@mycadet/gateway 0.12.10 → 0.13.0

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
+      "staging-tunnel.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
+      "dev-tunnel.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,17 +1,17 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/node_modules/@mycadet/ces-client/src/http-credentials.ts

@@ -143,6 +143,19 @@ export interface CesHttpCredentialClient {
 // Factory
 // ---------------------------------------------------------------------------
 
+function listErrorContext(
+  response: Response,
+  path: string,
+): Record<string, unknown> {
+  const requestId = response.headers.get("x-ces-error-id");
+  return {
+    status: response.status,
+    method: "GET",
+    path,
+    ...(requestId && /^[a-f0-9-]{36}$/i.test(requestId) ? { requestId } : {}),
+  };
+}
+
 export function createCesHttpCredentialClient(
   config: CesHttpCredentialConfig,
   logger: CesHttpLogger,
@@ -298,7 +311,7 @@ export function createCesHttpCredentialClient(
         if (!res) return { accounts: [], unreachable: true };
         if (!res.ok) {
           logger.warn(
-            { status: res.status },
+            listErrorContext(res, "/v1/credentials"),
             "CES credential list returned non-OK status",
           );
           return { accounts: [], unreachable: true };
@@ -399,6 +412,10 @@ export function createCesHttpCredentialClient(
           return { records: [], unreachable: true };
         }
         if (!res.ok) {
+          logger.warn(
+            listErrorContext(res, "/v1/metadata"),
+            "CES metadata list returned non-OK status",
+          );
           return { records: [], unreachable: true };
         }
         const data = (await res.json()) as {

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
+      "staging-tunnel.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
+      "dev-tunnel.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,17 +1,17 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/node_modules/@mycadet/gateway-client/src/gateway-ipc-contracts.ts

@@ -68,26 +68,6 @@ export type GatewayLogsTailRouteParams = z.infer<
   typeof GatewayLogsTailRouteParamsSchema
 >;
 
-/**
- * `gateway_debug_export`: a consistent copy of the gateway database plus its
- * recent log files, as one gzipped tar, for a debug bundle. No params.
- */
-export const GatewayDebugExportIpcParamsSchema = z
-  .object({})
-  .strict()
-  .default({});
-
-export const GatewayDebugExportIpcResponseSchema = z.object({
-  ok: z.literal(true),
-  /** `tar.gz` bytes, base64. Contains gateway.sqlite and gateway-logs/. */
-  archive_base64: z.string(),
-  size_bytes: z.number().int().nonnegative(),
-});
-
-export type GatewayDebugExportIpcResponse = z.infer<
-  typeof GatewayDebugExportIpcResponseSchema
->;
-
 export const GatewayLogsTailIpcResponseSchema = z.object({
   lines: z.array(z.record(z.string(), z.unknown())),
   truncated: z.boolean(),

package/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
+      "staging-tunnel.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
+      "dev-tunnel.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,17 +1,17 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Cadet Gateway API",
-    "version": "0.12.8",
+    "version": "0.12.9",
     "description": "Auto-generated OpenAPI specification for the Cadet Gateway HTTP endpoints."
   },
   "servers": [{ "url": "", "description": "Same-origin — the gateway" }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/gateway",
-  "version": "0.12.10",
+  "version": "0.13.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/actor-token-revocation.test.ts

@@ -30,10 +30,6 @@ const { createRuntimeProxyHandler } =
   await import("../http/routes/runtime-proxy.js");
 const { bustGuardianIntegrityCache } =
   await import("../auth/guardian-integrity.js");
-const {
-  resetGuardianIntegrityReporterForTesting,
-  setGuardianIntegrityReporterOverridesForTesting,
-} = await import("../guardian-integrity-reporter.js");
 
 const ACTOR_SUB = "actor:self:guardian-001";
 const actorClaims = { sub: ACTOR_SUB } as TokenClaims;
@@ -128,20 +124,12 @@ beforeEach(async () => {
   await initGatewayDb();
   __resetLastUsedDebounceForTests();
   // The integrity state is module-cached across tests; token rows seeded here
-  // are integrity evidence, so keep the reporter silenced and the cache cold.
+  // are integrity evidence, so keep the cache cold.
   bustGuardianIntegrityCache();
-  resetGuardianIntegrityReporterForTesting();
-  setGuardianIntegrityReporterOverridesForTesting({
-    fetchImpl: async () => new Response("{}"),
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: { error: () => {}, warn: () => {} },
-  });
 });
 
 afterEach(() => {
   resetGatewayDb();
-  resetGuardianIntegrityReporterForTesting();
   bustGuardianIntegrityCache();
   if (savedSecurityDir === undefined) {
     delete process.env.GATEWAY_SECURITY_DIR;
@@ -158,28 +146,41 @@ afterEach(() => {
 describe("admitActorToken: revocation verdict", () => {
   test("rejects an actor token whose record is revoked", () => {
     insertTokenRecord("token-revoked", "revoked");
-    expect(admitActorToken("token-revoked", actorClaims)).toBe(false);
+    expect(admitActorToken("token-revoked", actorClaims).admitted).toBe(false);
   });
 
   test("admits an actor token whose record is active", () => {
     insertTokenRecord("token-active", "active");
-    expect(admitActorToken("token-active", actorClaims)).toBe(true);
+    expect(admitActorToken("token-active", actorClaims).admitted).toBe(true);
+  });
+
+  test("hands the loaded record back for route reuse", () => {
+    insertTokenRecord("token-recorded", "active");
+    const { record } = admitActorToken("token-recorded", actorClaims);
+    expect(record).toMatchObject({
+      status: "active",
+      guardianPrincipalId: "guardian-001",
+      hashedDeviceId: hashToken("device-A"),
+      platform: "web",
+    });
+    expect(record?.issuedAt).toBeNumber();
+    expect(record?.expiresAt).toBeNumber();
   });
 
   test("admits (fail-open) an actor token with no record", () => {
-    expect(admitActorToken("token-unknown", actorClaims)).toBe(true);
+    expect(admitActorToken("token-unknown", actorClaims).admitted).toBe(true);
   });
 
   test("never checks non-actor tokens (svc)", () => {
     // Even if a row with this hash were revoked, a svc sub must be ignored.
     insertTokenRecord("svc-token", "revoked");
     const svcClaims = { sub: "svc:gateway:self" } as TokenClaims;
-    expect(admitActorToken("svc-token", svcClaims)).toBe(true);
+    expect(admitActorToken("svc-token", svcClaims).admitted).toBe(true);
   });
 
   test("admits (fail-open) when the gateway DB is unavailable", () => {
     resetGatewayDb();
-    expect(admitActorToken("token-anything", actorClaims)).toBe(true);
+    expect(admitActorToken("token-anything", actorClaims).admitted).toBe(true);
   });
 
   test("still detects revocation when the token has surrounding whitespace", () => {
@@ -187,8 +188,10 @@ describe("admitActorToken: revocation verdict", () => {
     // supplied with trailing whitespace (e.g. a `?token=<jwt>%20` WS param)
     // must still resolve to the revoked record.
     insertTokenRecord("token-revoked", "revoked");
-    expect(admitActorToken("token-revoked ", actorClaims)).toBe(false);
-    expect(admitActorToken(" token-revoked\n", actorClaims)).toBe(false);
+    expect(admitActorToken("token-revoked ", actorClaims).admitted).toBe(false);
+    expect(admitActorToken(" token-revoked\n", actorClaims).admitted).toBe(
+      false,
+    );
   });
 
   test("a revoked token is rejected without stamping any row", () => {
@@ -197,7 +200,7 @@ describe("admitActorToken: revocation verdict", () => {
     insertTokenRecord("token-stale", "revoked");
     insertTokenRecord("token-fresh", "active");
 
-    expect(admitActorToken("token-stale", actorClaims)).toBe(false);
+    expect(admitActorToken("token-stale", actorClaims).admitted).toBe(false);
 
     expect(readRow("token-stale")?.lastUsedAt).toBeNull();
     expect(readRow("token-fresh")?.lastUsedAt).toBeNull();
@@ -228,19 +231,19 @@ describe("signature-encoding canonicalization (revocation bypass)", () => {
     insertTokenRecord(jwt, "revoked"); // stored under the canonical token hash
 
     // Baseline: the canonical token is detected as revoked.
-    expect(admitActorToken(jwt, actorClaims)).toBe(false);
+    expect(admitActorToken(jwt, actorClaims).admitted).toBe(false);
 
     // Bypass attempt: same token, signature re-encoded (different string, same
     // bytes). Must still resolve to the revoked record.
     const padded = padSignature(jwt);
     expect(padded).not.toBe(jwt);
-    expect(admitActorToken(padded, actorClaims)).toBe(false);
+    expect(admitActorToken(padded, actorClaims).admitted).toBe(false);
   });
 
   test("does not falsely revoke an active token re-encoded with padding", () => {
     const jwt = mintActorJwt();
     insertTokenRecord(jwt, "active");
-    expect(admitActorToken(padSignature(jwt), actorClaims)).toBe(true);
+    expect(admitActorToken(padSignature(jwt), actorClaims).admitted).toBe(true);
   });
 });
 
@@ -365,12 +368,12 @@ describe("/auth/token revocation", () => {
       .get();
 
     expect(derivedRecord?.status).toBe("derived");
-    expect(admitActorToken(derivedJwt, actorClaims)).toBe(true);
+    expect(admitActorToken(derivedJwt, actorClaims).admitted).toBe(true);
 
     revokeActorTokensByDevice("guardian-001", hashToken("device-A"));
 
-    expect(admitActorToken(sourceJwt, actorClaims)).toBe(false);
-    expect(admitActorToken(derivedJwt, actorClaims)).toBe(false);
+    expect(admitActorToken(sourceJwt, actorClaims).admitted).toBe(false);
+    expect(admitActorToken(derivedJwt, actorClaims).admitted).toBe(false);
   });
 
   test("fails closed with a repairable 401 when guardian rows are lost over evidence (no divergent mint)", async () => {
@@ -528,7 +531,7 @@ describe("admitActorToken: device last-used stamping", () => {
     const before = readRow("token-used");
     expect(before?.lastUsedAt).toBeNull();
 
-    expect(admitActorToken("token-used", actorClaims)).toBe(true);
+    expect(admitActorToken("token-used", actorClaims).admitted).toBe(true);
 
     const after = readRow("token-used");
     expect(after?.lastUsedAt).toBeGreaterThan(0);
@@ -540,7 +543,7 @@ describe("admitActorToken: device last-used stamping", () => {
     insertTokenRecord("token-counted", "active");
 
     const sql = captureSql(() => {
-      expect(admitActorToken("token-counted", actorClaims)).toBe(true);
+      expect(admitActorToken("token-counted", actorClaims).admitted).toBe(true);
     });
 
     // The verdict and the stamp share one SELECT; the stamp adds the UPDATE.
@@ -560,7 +563,9 @@ describe("admitActorToken: device last-used stamping", () => {
       .run();
 
     const sql = captureSql(() => {
-      expect(admitActorToken("token-debounced", actorClaims)).toBe(true);
+      expect(admitActorToken("token-debounced", actorClaims).admitted).toBe(
+        true,
+      );
     });
 
     expect(readRow("token-debounced")?.lastUsedAt).toBe(sentinel);
@@ -593,7 +598,7 @@ describe("admitActorToken: device last-used stamping", () => {
     const svcClaims = { sub: "svc:gateway:self" } as TokenClaims;
 
     const sql = captureSql(() => {
-      expect(admitActorToken("svc-token", svcClaims)).toBe(true);
+      expect(admitActorToken("svc-token", svcClaims).admitted).toBe(true);
     });
 
     expect(readRow("svc-token")?.lastUsedAt).toBeNull();
@@ -604,7 +609,9 @@ describe("admitActorToken: device last-used stamping", () => {
   test("is a no-op for an unrecorded token hash", () => {
     insertTokenRecord("token-recorded", "active");
 
-    expect(admitActorToken("token-unrecorded", actorClaims)).toBe(true);
+    expect(admitActorToken("token-unrecorded", actorClaims).admitted).toBe(
+      true,
+    );
     expect(readRow("token-recorded")?.lastUsedAt).toBeNull();
   });
 
@@ -623,7 +630,7 @@ describe("admitActorToken: device last-used stamping", () => {
       "CREATE TRIGGER fail_last_used BEFORE UPDATE ON actor_token_records BEGIN SELECT RAISE(ABORT, 'stamp failed'); END",
     );
 
-    expect(admitActorToken("token-retry", actorClaims)).toBe(true);
+    expect(admitActorToken("token-retry", actorClaims).admitted).toBe(true);
     expect(readRow("token-retry")?.lastUsedAt).toBeNull();
 
     rawDb.exec("DROP TRIGGER fail_last_used");
@@ -657,7 +664,7 @@ describe("admitActorToken: device last-used stamping", () => {
     ).$client;
     rawDb.exec("ALTER TABLE actor_token_records RENAME TO actor_token_stash");
 
-    expect(admitActorToken("token-transient", actorClaims)).toBe(true);
+    expect(admitActorToken("token-transient", actorClaims).admitted).toBe(true);
 
     rawDb.exec("ALTER TABLE actor_token_stash RENAME TO actor_token_records");
     insertTokenRecord("token-transient", "active");