@mycadet/gateway 0.12.7-dev.202610111049.d2b52a8 → 0.12.8

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/gateway",
-  "version": "0.12.7-dev.202610111049.d2b52a8",
+  "version": "0.12.8",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/actor-token-revocation.test.ts

@@ -251,7 +251,6 @@ describe("runtime proxy enforcement", () => {
       routingEntries: [],
       port: 7830,
       runtimeProxyRequireAuth: true,
-      shutdownDrainMs: 5000,
       runtimeTimeoutMs: 30000,
       runtimeMaxRetries: 2,
       runtimeInitialBackoffMs: 500,

package/src/__tests__/channel-verification-session-proxy.test.ts

@@ -26,7 +26,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/config.test.ts

@@ -7,30 +7,6 @@ import { testWorkspaceDir } from "./test-preload.js";
 import { loadConfig } from "../config.js";
 
 describe("config: hardcoded defaults", () => {
-  test("returns expected hardcoded values", () => {
-    const config = loadConfig();
-    expect(config.shutdownDrainMs).toBe(5000);
-    expect(config.runtimeTimeoutMs).toBe(30000);
-    expect(config.runtimeMaxRetries).toBe(2);
-    expect(config.runtimeInitialBackoffMs).toBe(500);
-    expect(config.maxWebhookPayloadBytes).toBe(1024 * 1024);
-    expect(config.maxEmailWebhookPayloadBytes).toBe(350 * 1024 * 1024);
-    expect(config.maxAttachmentBytes).toEqual({
-      telegram: 20 * 1024 * 1024,
-      slack: 100 * 1024 * 1024,
-      whatsapp: 16 * 1024 * 1024,
-      discord: 100 * 1024 * 1024,
-      email: 25 * 1024 * 1024,
-      default: 100 * 1024 * 1024,
-    });
-    expect(config.maxAttachmentConcurrency).toBe(3);
-    expect(config.runtimeProxyRequireAuth).toBe(true);
-    expect(config.trustProxy).toBe(false);
-    expect(config.routingEntries).toEqual([]);
-    expect(config.logFile.dir).toMatch(/logs$/);
-    expect(config.logFile.retentionDays).toBe(30);
-  });
-
   test("GATEWAY_PORT defaults to 7830", () => {
     const saved = process.env.GATEWAY_PORT;
     delete process.env.GATEWAY_PORT;

package/src/__tests__/contacts-control-plane-proxy.test.ts

@@ -425,7 +425,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/guardian-init-lockfile.test.ts

@@ -158,7 +158,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/handle-inbound-admission.test.ts

@@ -90,7 +90,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
     ...overrides,
   } as GatewayConfig;

package/src/__tests__/handle-inbound-app-context.test.ts

@@ -86,7 +86,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as unknown as GatewayConfig;
 }

package/src/__tests__/handle-inbound-invite-intercept.test.ts

@@ -180,7 +180,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as unknown as GatewayConfig;
 }

package/src/__tests__/handle-inbound-trust-verdict.test.ts

@@ -155,7 +155,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as unknown as GatewayConfig;
 }

package/src/__tests__/load-guards.test.ts

@@ -21,7 +21,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/migration-teleport-gcs-proxy.test.ts

@@ -29,7 +29,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/oauth-callback.test.ts

@@ -33,7 +33,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/resolve-assistant.test.ts

@@ -9,7 +9,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/route-schema-guard.test.ts

@@ -227,6 +227,9 @@ const EXCLUDED_FROM_SCHEMA = new Set([
   "/v1/speech/stt/stream",
   "/v2/speech/stt/stream",
   "/v1/speech/tts/stream",
+  // Loopback-only ingress domain recording — the local CLI reports its
+  // tunnel's public URL (bearer-authed); not part of the public gateway API
+  "/v1/ingress/domains",
   // Plugin-declared webhooks — which paths exist is decided at runtime by the
   // installed plugins and the guardian's approvals, so there is no fixed set
   // to document. The declaration schema is the contract, not this path.

package/src/__tests__/runtime-client.test.ts

@@ -42,7 +42,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/runtime-health-proxy.test.ts

@@ -26,7 +26,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/runtime-proxy-auth.test.ts

@@ -45,7 +45,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,
@@ -412,7 +411,9 @@ describe("runtime proxy OAuth grant path rewrite", () => {
       },
     );
 
-    expect(url).toBe("http://localhost:7821/v1/oauth/proxy/stripe_link/v1/charges");
+    expect(url).toBe(
+      "http://localhost:7821/v1/oauth/proxy/stripe_link/v1/charges",
+    );
   });
 
   test("does not rewrite a host-absolute path without a proxy grant", async () => {

package/src/__tests__/runtime-proxy-device-stamp.test.ts

@@ -161,7 +161,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/runtime-proxy-error-body.test.ts

@@ -75,7 +75,6 @@ function makeConfig(): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/runtime-proxy.test.ts

@@ -26,7 +26,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: false,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/runtime-stream-test-utils.ts

@@ -50,7 +50,6 @@ export function makeConfig(
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/slack-control-plane-proxy.test.ts

@@ -26,7 +26,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/slack-display-name.test.ts

@@ -77,7 +77,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
     ...overrides,
   } as GatewayConfig;

package/src/__tests__/slack-normalize.test.ts

@@ -33,7 +33,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
     ...overrides,
   } as GatewayConfig;

package/src/__tests__/slack-reaction-normalize.test.ts

@@ -22,7 +22,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
     ...overrides,
   } as GatewayConfig;

package/src/__tests__/slack-socket-mode-catchup.test.ts

@@ -62,7 +62,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   };
 }

package/src/__tests__/slack-socket-mode-group-dm.test.ts

@@ -121,7 +121,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   };
 }

package/src/__tests__/slack-socket-mode-liveness.test.ts

@@ -178,7 +178,6 @@ function makeGatewayConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as unknown as GatewayConfig;
 }

package/src/__tests__/slack-socket-mode-outbound-root.test.ts

@@ -134,7 +134,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   };
 }

package/src/__tests__/slack-socket-mode-thread-tracking.test.ts

@@ -121,7 +121,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   };
 }

package/src/__tests__/telegram-control-plane-proxy.test.ts

@@ -26,7 +26,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/telegram-webhook-drop-visibility.test.ts

@@ -79,7 +79,6 @@ function makeConfig(): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: false,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/telegram-webhook-handler.test.ts

@@ -33,7 +33,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: false,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/twilio-media-websocket.test.ts

@@ -61,7 +61,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/twilio-webhooks.test.ts

@@ -135,7 +135,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/whatsapp-download.test.ts

@@ -25,7 +25,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/whatsapp-webhook.test.ts

@@ -52,7 +52,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/attachments/ingest.test.ts

@@ -29,7 +29,6 @@ function config(overrides?: Partial<GatewayConfig>): GatewayConfig {
     runtimeMaxRetries: 0,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 1000,
-    shutdownDrainMs: 1000,
     trustProxy: false,
   };
   return { ...base, ...overrides };

package/src/config.ts

@@ -36,7 +36,6 @@ export type GatewayConfig = {
   runtimeMaxRetries: number;
   runtimeProxyRequireAuth: boolean;
   runtimeTimeoutMs: number;
-  shutdownDrainMs: number;
   /** When true, trust X-Forwarded-For for client IP resolution (set when behind a reverse proxy). */
   trustProxy: boolean;
 };
@@ -226,7 +225,6 @@ export function loadConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth,
     runtimeTimeoutMs,
-    shutdownDrainMs: 5000,
     trustProxy,
   };
 }

package/src/http/edge-forwarded-header.ts

@@ -13,7 +13,7 @@
  * Loopback-only endpoints (`/v1/guardian/init`, `/v1/pair`) treat its presence
  * as proof that the request did NOT arrive directly from a local loopback
  * client: it was forwarded by the edge proxy, possibly from a remote browser
- * over a tunnel (e.g. ngrok). Because every hop in that chain is loopback
+ * over a tunnel (e.g. a third-party tunnel). Because every hop in that chain is loopback
  * (browser → tunnel agent → nginx@127.0.0.1 → gateway@127.0.0.1), the raw TCP
  * peer is 127.0.0.1 and a peer-IP loopback check alone would misclassify the
  * caller as local. This marker is the reliable signal instead — and crucially

package/src/http/loopback-guard.ts

@@ -91,7 +91,7 @@ export function enforceLoopbackOnly(
     return errorResponse("FORBIDDEN", "endpoint is local-only", 403);
   }
 
-  // The self-hosted nginx edge (e.g. the SPA over an ngrok tunnel) sets this
+  // The self-hosted nginx edge (e.g. the SPA over a tunnel) sets this
   // marker unconditionally; it cannot be spoofed or stripped by the client.
   if (requestArrivedViaEdgeProxy(req)) {
     auditDeny(req, clientIp, auditTag, "edge_proxy_forwarded");

package/src/http/routes/channel-verification-session-proxy.ts

@@ -166,7 +166,7 @@ export function createChannelVerificationSessionProxyHandler(
       }
 
       // Defense-in-depth: reject requests forwarded by the self-hosted nginx
-      // edge (e.g. the SPA reached over an ngrok tunnel). Every hop in that
+      // edge (e.g. the SPA reached over a tunnel). Every hop in that
       // chain is loopback, so the raw peer IP would otherwise misclassify a
       // remote caller as local. The edge sets this marker unconditionally and
       // it cannot be spoofed or stripped by the client. Only the self-hosted
@@ -221,7 +221,7 @@ export function createChannelVerificationSessionProxyHandler(
 
       // Bare-metal mode: restrict to loopback callers only. Without a
       // bootstrap secret the lockfile is the sole guard, so a remote
-      // client that can reach the gateway (e.g. via ngrok) must not be
+      // client that can reach the gateway (e.g. via a tunnel) must not be
       // able to race the legitimate local user.
       if (!isCloud && expectedSecrets.length === 0) {
         // A genuine local bootstrap caller connects directly over loopback and

package/src/http/routes/email-webhook.test.ts

@@ -71,7 +71,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/http/routes/ingress-domains.test.ts

@@ -0,0 +1,129 @@
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { z } from "zod";
+
+import { ConfigFileCache } from "../../config-file-cache.js";
+import { handleSaveIngressDomain } from "./ingress-domains.js";
+
+// The handler's write path resolves the workspace config through
+// getWorkspaceDir; the mock redirects it into a per-test temp dir.
+let workspaceDir = "";
+
+mock.module("../../credential-reader.js", () => ({
+  getWorkspaceDir: () => workspaceDir,
+}));
+
+const SavedIngressSchema = z.looseObject({
+  ingress: z
+    .looseObject({
+      publicBaseUrl: z.string().optional(),
+      publicBaseUrlManagedBy: z.string().optional(),
+    })
+    .optional(),
+});
+
+let testDir = "";
+
+beforeEach(() => {
+  testDir = mkdtempSync(join(tmpdir(), "gateway-ingress-domains-test-"));
+  workspaceDir = testDir;
+});
+
+afterEach(() => {
+  rmSync(testDir, { recursive: true, force: true });
+});
+
+function request(body?: unknown): Request {
+  return new Request("http://127.0.0.1/v1/ingress/domains", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+}
+
+function readSavedIngress(): z.infer<typeof SavedIngressSchema>["ingress"] {
+  const raw = SavedIngressSchema.parse(
+    JSON.parse(readFileSync(join(workspaceDir, "config.json"), "utf-8")),
+  );
+  return raw.ingress;
+}
+
+describe("POST /v1/ingress/domains", () => {
+  test("records the tunnel URL as tunnel-managed in the gateway config", async () => {
+    const res = await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app" }),
+      "127.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(res.status).toBe(200);
+    expect(readSavedIngress()).toMatchObject({
+      publicBaseUrl: "https://foo.ngrok.app",
+      publicBaseUrlManagedBy: "tunnel",
+    });
+  });
+
+  test("normalizes the URL the same way every other public base URL is", async () => {
+    await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app/" }),
+      "127.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(readSavedIngress()?.publicBaseUrl).toBe("https://foo.ngrok.app");
+  });
+
+  test("is a no-op write when the URL is already recorded as tunnel-managed", async () => {
+    const configFile = new ConfigFileCache();
+    await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app" }),
+      "127.0.0.1",
+      configFile,
+    );
+    const afterFirst = readFileSync(join(workspaceDir, "config.json"), "utf-8");
+
+    await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app" }),
+      "127.0.0.1",
+      configFile,
+    );
+    const afterSecond = readFileSync(
+      join(workspaceDir, "config.json"),
+      "utf-8",
+    );
+
+    expect(afterSecond).toBe(afterFirst);
+  });
+
+  test("rejects non-loopback callers", async () => {
+    const res = await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app" }),
+      "10.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(res.status).toBe(403);
+  });
+
+  test("rejects a body without a usable public URL", async () => {
+    const res = await handleSaveIngressDomain(
+      request({}),
+      "127.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(res.status).toBe(400);
+  });
+
+  test("rejects non-POST methods", async () => {
+    const res = await handleSaveIngressDomain(
+      new Request("http://127.0.0.1/v1/ingress/domains", { method: "GET" }),
+      "127.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(res.status).toBe(405);
+  });
+});

package/src/http/routes/ingress-domains.ts

@@ -0,0 +1,73 @@
+/**
+ * Loopback-guarded recording of a tunnel's public URL.
+ *
+ *   POST /v1/ingress/domains — the CLI (its ngrok agent, today) tells the
+ *   gateway the public URL its tunnel published; the gateway writes
+ *   `ingress.publicBaseUrl` + `publicBaseUrlManagedBy: "tunnel"` in its own
+ *   config via the same machinery its own tunnel uses, so both publishers
+ *   record through one path and the gateway's existing loss handling clears
+ *   it uniformly. Write-only: reads keep flowing through the config the
+ *   gateway already serves. While we ship one bundle the gateway still hosts
+ *   the ngrok-related logic; once the bundle splits, the gateway manages its
+ *   own tunnel (mycadet.ai vs <assistant>.mycadet.bot) and this route is what
+ *   the CLI-side publishers migrate onto.
+ */
+
+import { z } from "zod";
+
+import { normalizeHttpPublicBaseUrlWithoutTrailingSlash } from "@mycadet/service-contracts/ingress";
+
+import type { ConfigFileCache } from "../../config-file-cache.js";
+import { writeManagedPublicBaseUrl } from "../../tunnel/client.js";
+import {
+  enforceLoopbackOnly,
+  errorResponse,
+  rejectBrowserOrigin,
+} from "../loopback-guard.js";
+
+const SaveIngressDomainRequestSchema = z.object({
+  publicBaseUrl: z.string(),
+});
+
+export async function handleSaveIngressDomain(
+  req: Request,
+  clientIp: string,
+  configFile: ConfigFileCache,
+): Promise<Response> {
+  if (req.method !== "POST") {
+    return new Response("method not allowed", {
+      status: 405,
+      headers: { Allow: "POST" },
+    });
+  }
+
+  const guardError = enforceLoopbackOnly(req, clientIp, "ingress-domains");
+  if (guardError) return guardError;
+  const originError = rejectBrowserOrigin(req, clientIp, "ingress-domains");
+  if (originError) return originError;
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    body = {};
+  }
+  const parsed = SaveIngressDomainRequestSchema.safeParse(body);
+  if (!parsed.success) {
+    return errorResponse("BAD_REQUEST", "publicBaseUrl is required", 400);
+  }
+  const publicUrl = normalizeHttpPublicBaseUrlWithoutTrailingSlash(
+    parsed.data.publicBaseUrl,
+  );
+  if (!publicUrl) {
+    return errorResponse(
+      "BAD_REQUEST",
+      "publicBaseUrl must be an absolute http(s) URL",
+      400,
+    );
+  }
+
+  // No-op (no write) when the URL is already recorded as tunnel-managed.
+  await writeManagedPublicBaseUrl(publicUrl, configFile);
+  return Response.json({ ok: true });
+}

package/src/http/routes/log-export.test.ts

@@ -112,7 +112,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/http/routes/log-tail.test.ts

@@ -79,7 +79,6 @@ function makeConfig(dir: string | undefined): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: true,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as GatewayConfig;
 }

package/src/http/routes/telegram-webhook.test.ts

@@ -72,7 +72,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/http/routes/twilio-voice-webhook.test.ts

@@ -112,7 +112,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/http/routes/whatsapp-webhook.test.ts

@@ -91,7 +91,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/index.ts

@@ -104,6 +104,7 @@ import {
   handleListDevices,
   handleRevokeDevice,
 } from "./http/routes/devices.js";
+import { handleSaveIngressDomain } from "./http/routes/ingress-domains.js";
 import { handlePair } from "./http/routes/pair.js";
 import { handleCredentialEntryPage } from "./http/routes/credential-entry-page.js";
 import {
@@ -888,6 +889,15 @@ async function main() {
       handler: () => psHandler.handlePs(),
     },
 
+    // ── Ingress domain recording (localhost CLI only, bearer-authed) ──
+    {
+      path: "/v1/ingress/domains",
+      method: "POST",
+      auth: "edge",
+      handler: (req, _params, getClientIp) =>
+        handleSaveIngressDomain(req, getClientIp(), configFileCache),
+    },
+
     // ── Tunnel status ──
     {
       path: "/v1/tunnel/status",
@@ -3171,7 +3181,7 @@ async function main() {
     // Force-reconnect Slack WebSocket (may be half-open after sleep)
     slackSocketClient?.forceReconnect();
 
-    // Invalidate caches so next read picks up any config changes (e.g. new ngrok URL)
+    // Invalidate caches so next read picks up any config changes (e.g. a new tunnel URL)
     configFileCache.invalidate();
     credentialCache.invalidate();
 
@@ -3190,8 +3200,6 @@ async function main() {
   });
   sleepWakeDetector.start();
 
-  const drainMs = config.shutdownDrainMs;
-
   process.on("SIGTERM", () => {
     log.info("SIGTERM received, starting graceful shutdown");
     draining = true;
@@ -3225,7 +3233,7 @@ async function main() {
         server.stop(true);
         process.exit(0);
       });
-    }, drainMs);
+    }, 5_000);
   });
 }
 

package/src/ipc/debug-export-handlers.test.ts

@@ -40,7 +40,6 @@ function makeConfig(logDir: string | undefined): GatewayConfig {
     runtimeMaxRetries: 0,
     runtimeProxyRequireAuth: true,
     runtimeTimeoutMs: 1000,
-    shutdownDrainMs: 1,
     trustProxy: false,
   } as GatewayConfig;
 }

package/src/ipc/log-tail-handlers.test.ts

@@ -43,7 +43,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: true,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as GatewayConfig;
 }

package/src/telegram/send.test.ts

@@ -39,7 +39,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/telegram/webhook-manager.ts

@@ -395,7 +395,7 @@ async function reconcileTelegramWebhookNow(
     expectedUrl = await resolveExpectedTelegramWebhookUrl(caches);
   } catch (err) {
     // Managed callback route registration failed — this is a cloud-side
-    // issue. Do not suggest ngrok or other tunnel options; they are not
+    // issue. Do not suggest third-party tunnel options; they are not
     // usable in containerized deployments.
     const detail = err instanceof Error ? err.message : String(err);
     log.error(

package/src/tunnel/client.test.ts

@@ -178,7 +178,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     runtimeMaxRetries: 0,
     runtimeProxyRequireAuth: true,
     runtimeTimeoutMs: 1,
-    shutdownDrainMs: 1,
     trustProxy: false,
     ...overrides,
   };

package/src/tunnel/client.ts

@@ -845,7 +845,7 @@ async function mutateGatewayConfigFile(
 
 const TUNNEL_MANAGED_BY = "tunnel";
 
-async function writeManagedPublicBaseUrl(
+export async function writeManagedPublicBaseUrl(
   publicUrl: string,
   configFile: ConfigFileCache,
 ): Promise<void> {