@mycadet/gateway 0.12.7 → 0.12.8

package/src/__tests__/{platform-identity.test.ts → cloud-identity.test.ts}

@@ -37,30 +37,23 @@ mock.module("../fetch.js", () => ({
 }));
 
 const {
-  _resetPlatformIdentityForTests,
-  applyPlatformIdentityIds,
-  fetchPlatformIdentityIds,
-  PLATFORM_IDENTITY_VALIDATE_PATH,
-  readStoredPlatformUserId,
-  resolvePlatformAssistantId,
-} = await import("../platform-identity.js");
+  _resetCloudIdentityForTests,
+  applyCloudIdentityIds,
+  fetchCloudIdentityIds,
+  CLOUD_IDENTITY_VALIDATE_PATH,
+  readStoredCloudUserId,
+  resolveCloudAssistantId,
+} = await import("../cloud-identity.js");
 const { credentialKey } = await import("../credential-key.js");
 
-const BASE_URL = "https://platform.example.com";
+const BASE_URL = "https://test-cloud.mycadet.ai";
 const ASSISTANT_ID = "11111111-2222-4333-8444-555555555555";
 const ORG_ID = "22222222-3333-4444-8555-666666666666";
 const USER_ID = "33333333-4444-4555-8666-777777777777";
 const API_KEY_ACCOUNT = credentialKey("cadet", "assistant_api_key");
-const BASE_URL_ACCOUNT = credentialKey("cadet", "platform_base_url");
-const USER_ID_ACCOUNT = credentialKey("cadet", "platform_user_id");
-const ASSISTANT_ID_ACCOUNT = credentialKey("cadet", "platform_assistant_id");
-const ORG_ID_ACCOUNT = credentialKey("cadet", "platform_organization_id");
 
 const originalAssistantApiKey = process.env.ASSISTANT_API_KEY;
-const originalPlatformUrl = process.env.CADET_PLATFORM_URL;
-const originalPlatformAssistantId = process.env.PLATFORM_ASSISTANT_ID;
-const originalPlatformOrgId = process.env.PLATFORM_ORGANIZATION_ID;
-const originalPlatformUserId = process.env.PLATFORM_USER_ID;
+const originalCloudUrl = process.env.CADET_CLOUD_URL;
 
 function restoreEnv(name: string, value: string | undefined): void {
   if (value === undefined) {
@@ -91,35 +84,29 @@ beforeEach(() => {
   fetchCalls.length = 0;
   fetchImplFn = async () => new Response("not found", { status: 404 });
   delete process.env.ASSISTANT_API_KEY;
-  delete process.env.CADET_PLATFORM_URL;
-  delete process.env.PLATFORM_ASSISTANT_ID;
-  delete process.env.PLATFORM_ORGANIZATION_ID;
-  delete process.env.PLATFORM_USER_ID;
-  _resetPlatformIdentityForTests();
+  delete process.env.CADET_CLOUD_URL;
+  _resetCloudIdentityForTests();
 });
 
 afterEach(() => {
   restoreEnv("ASSISTANT_API_KEY", originalAssistantApiKey);
-  restoreEnv("CADET_PLATFORM_URL", originalPlatformUrl);
-  restoreEnv("PLATFORM_ASSISTANT_ID", originalPlatformAssistantId);
-  restoreEnv("PLATFORM_ORGANIZATION_ID", originalPlatformOrgId);
-  restoreEnv("PLATFORM_USER_ID", originalPlatformUserId);
-  _resetPlatformIdentityForTests();
+  restoreEnv("CADET_CLOUD_URL", originalCloudUrl);
+  _resetCloudIdentityForTests();
 });
 
-describe("fetchPlatformIdentityIds", () => {
+describe("fetchCloudIdentityIds", () => {
   test("returns the three ids from a successful validate response", async () => {
     fetchImplFn = async () => validateResponse();
 
     await expect(
-      fetchPlatformIdentityIds(BASE_URL, "assistant-key"),
+      fetchCloudIdentityIds(BASE_URL, "assistant-key"),
     ).resolves.toEqual({
       assistantId: ASSISTANT_ID,
       organizationId: ORG_ID,
       userId: USER_ID,
     });
     expect(fetchCalls[0]?.url).toBe(
-      `${BASE_URL}${PLATFORM_IDENTITY_VALIDATE_PATH}`,
+      `${BASE_URL}${CLOUD_IDENTITY_VALIDATE_PATH}`,
     );
     expect(fetchCalls[0]?.init?.method).toBe("POST");
     const headers = new Headers(fetchCalls[0]?.init?.headers);
@@ -128,16 +115,16 @@ describe("fetchPlatformIdentityIds", () => {
 
   test("strips a trailing slash from the base URL", async () => {
     fetchImplFn = async () => validateResponse();
-    await fetchPlatformIdentityIds(`${BASE_URL}/`, "assistant-key");
+    await fetchCloudIdentityIds(`${BASE_URL}/`, "assistant-key");
     expect(fetchCalls[0]?.url).toBe(
-      `${BASE_URL}${PLATFORM_IDENTITY_VALIDATE_PATH}`,
+      `${BASE_URL}${CLOUD_IDENTITY_VALIDATE_PATH}`,
     );
   });
 
   test("returns null on 401 without throwing", async () => {
     fetchImplFn = async () => new Response("no", { status: 401 });
     await expect(
-      fetchPlatformIdentityIds(BASE_URL, "assistant-key"),
+      fetchCloudIdentityIds(BASE_URL, "assistant-key"),
     ).resolves.toBeNull();
   });
 
@@ -146,66 +133,66 @@ describe("fetchPlatformIdentityIds", () => {
       throw new Error("network down");
     };
     await expect(
-      fetchPlatformIdentityIds(BASE_URL, "assistant-key"),
+      fetchCloudIdentityIds(BASE_URL, "assistant-key"),
     ).resolves.toBeNull();
   });
 });
 
-describe("resolvePlatformAssistantId", () => {
+describe("resolveCloudAssistantId", () => {
   test("returns the in-memory override without calling validate", async () => {
-    applyPlatformIdentityIds({
+    applyCloudIdentityIds({
       assistantId: ASSISTANT_ID,
       organizationId: ORG_ID,
       userId: USER_ID,
     });
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    await expect(resolvePlatformAssistantId()).resolves.toBe(ASSISTANT_ID);
+    await expect(resolveCloudAssistantId()).resolves.toBe(ASSISTANT_ID);
     expect(fetchCalls).toHaveLength(0);
   });
 
   test("returns empty when the in-memory override is unset and there is no API key", async () => {
-    await expect(resolvePlatformAssistantId()).resolves.toBe("");
+    await expect(resolveCloudAssistantId()).resolves.toBe("");
     expect(fetchCalls).toHaveLength(0);
   });
 
   test("loads ids from validate when the in-memory override is empty", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     fetchImplFn = async () => validateResponse();
 
-    await expect(resolvePlatformAssistantId()).resolves.toBe(ASSISTANT_ID);
+    await expect(resolveCloudAssistantId()).resolves.toBe(ASSISTANT_ID);
     expect(fetchCalls).toHaveLength(1);
     expect(fetchCalls[0]?.url).toBe(
-      `${BASE_URL}${PLATFORM_IDENTITY_VALIDATE_PATH}`,
+      `${BASE_URL}${CLOUD_IDENTITY_VALIDATE_PATH}`,
     );
   });
 
   test("does not retry validate during the cooldown after a failure", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     fetchImplFn = async () => new Response("down", { status: 503 });
 
-    await expect(resolvePlatformAssistantId()).resolves.toBe("");
-    await expect(resolvePlatformAssistantId()).resolves.toBe("");
+    await expect(resolveCloudAssistantId()).resolves.toBe("");
+    await expect(resolveCloudAssistantId()).resolves.toBe("");
     expect(fetchCalls).toHaveLength(1);
   });
 
   test("retries validate after a failed attempt once the cooldown is cleared", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     fetchImplFn = async () => new Response("down", { status: 503 });
 
-    await expect(resolvePlatformAssistantId()).resolves.toBe("");
-    _resetPlatformIdentityForTests();
+    await expect(resolveCloudAssistantId()).resolves.toBe("");
+    _resetCloudIdentityForTests();
     fetchImplFn = async () => validateResponse();
 
-    await expect(resolvePlatformAssistantId()).resolves.toBe(ASSISTANT_ID);
+    await expect(resolveCloudAssistantId()).resolves.toBe(ASSISTANT_ID);
     expect(fetchCalls).toHaveLength(2);
   });
 
   test("concurrent resolves share one in-flight validate", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     let release!: (value: Response) => void;
     let notifyFetchStarted!: () => void;
     const fetchStarted = new Promise<void>((resolve) => {
@@ -218,8 +205,8 @@ describe("resolvePlatformAssistantId", () => {
       });
     };
 
-    const first = resolvePlatformAssistantId();
-    const second = resolvePlatformAssistantId();
+    const first = resolveCloudAssistantId();
+    const second = resolveCloudAssistantId();
     await fetchStarted;
     expect(fetchCalls).toHaveLength(1);
     release(validateResponse());
@@ -229,14 +216,14 @@ describe("resolvePlatformAssistantId", () => {
   });
 });
 
-describe("readStoredPlatformUserId", () => {
+describe("readStoredCloudUserId", () => {
   test("returns a live owner id from in-memory identity", async () => {
-    applyPlatformIdentityIds({
+    applyCloudIdentityIds({
       assistantId: ASSISTANT_ID,
       organizationId: ORG_ID,
       userId: USER_ID,
     });
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: USER_ID,
       unreachable: false,
     });
@@ -245,16 +232,16 @@ describe("readStoredPlatformUserId", () => {
 
   test("loads the owner id from validate and keeps it when validate later fails", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     fetchImplFn = async () => validateResponse();
 
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: USER_ID,
       unreachable: false,
     });
 
     fetchImplFn = async () => new Response("down", { status: 503 });
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: USER_ID,
       unreachable: false,
     });
@@ -266,7 +253,7 @@ describe("readStoredPlatformUserId", () => {
       value: undefined,
       unreachable: true,
     });
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: undefined,
       unreachable: true,
     });
@@ -278,25 +265,21 @@ describe("readStoredPlatformUserId", () => {
       value: "assistant-key",
       unreachable: false,
     });
-    credentialResults.set(BASE_URL_ACCOUNT, {
-      value: BASE_URL,
-      unreachable: false,
-    });
     fetchImplFn = async () => new Response("no", { status: 401 });
 
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: undefined,
       unreachable: false,
     });
   });
 
-  test("reports unreachable when the API key is present but the base URL vault is down", async () => {
-    process.env.ASSISTANT_API_KEY = "assistant-key";
-    credentialResults.set(BASE_URL_ACCOUNT, {
+  test("reports unreachable when the API key vault is down", async () => {
+    delete process.env.ASSISTANT_API_KEY;
+    credentialResults.set(API_KEY_ACCOUNT, {
       value: undefined,
       unreachable: true,
     });
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: undefined,
       unreachable: true,
     });
@@ -305,11 +288,8 @@ describe("readStoredPlatformUserId", () => {
 
   test("reports a miss when the API key is present and the base URL is unset", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    credentialResults.set(BASE_URL_ACCOUNT, {
-      value: undefined,
-      unreachable: false,
-    });
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    delete process.env.CADET_CLOUD_URL;
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: undefined,
       unreachable: false,
     });
@@ -320,10 +300,10 @@ describe("readStoredPlatformUserId", () => {
     const nextAssistantId = "44444444-5555-4666-8777-888888888888";
     const nextUserId = "55555555-6666-4777-8888-999999999999";
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     fetchImplFn = async () => validateResponse();
 
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: USER_ID,
       unreachable: false,
     });
@@ -336,11 +316,11 @@ describe("readStoredPlatformUserId", () => {
         userId: nextUserId,
       });
 
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: nextUserId,
       unreachable: false,
     });
-    await expect(resolvePlatformAssistantId()).resolves.toBe(nextAssistantId);
+    await expect(resolveCloudAssistantId()).resolves.toBe(nextAssistantId);
     expect(fetchCalls).toHaveLength(2);
     const headers = new Headers(fetchCalls[1]?.init?.headers);
     expect(headers.get("Authorization")).toBe("Api-Key next-assistant-key");
@@ -348,10 +328,10 @@ describe("readStoredPlatformUserId", () => {
 
   test("drops bound identity when credentials change and validate fails", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     fetchImplFn = async () => validateResponse();
 
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: USER_ID,
       unreachable: false,
     });
@@ -359,7 +339,7 @@ describe("readStoredPlatformUserId", () => {
     process.env.ASSISTANT_API_KEY = "next-assistant-key";
     fetchImplFn = async () => new Response("no", { status: 401 });
 
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: undefined,
       unreachable: false,
     });
@@ -368,10 +348,10 @@ describe("readStoredPlatformUserId", () => {
 
   test("keeps bound identity when the vault is down and the new API key cannot be read", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     fetchImplFn = async () => validateResponse();
 
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: USER_ID,
       unreachable: false,
     });
@@ -383,7 +363,7 @@ describe("readStoredPlatformUserId", () => {
     });
     fetchImplFn = async () => new Response("down", { status: 503 });
 
-    await expect(readStoredPlatformUserId()).resolves.toEqual({
+    await expect(readStoredCloudUserId()).resolves.toEqual({
       userId: USER_ID,
       unreachable: false,
     });
@@ -392,13 +372,19 @@ describe("readStoredPlatformUserId", () => {
 
   test("does not read platform identity ids from the credential store", async () => {
     process.env.ASSISTANT_API_KEY = "assistant-key";
-    process.env.CADET_PLATFORM_URL = BASE_URL;
+    process.env.CADET_CLOUD_URL = BASE_URL;
     fetchImplFn = async () => validateResponse();
 
-    await readStoredPlatformUserId();
+    await readStoredCloudUserId();
 
-    expect(credentialReads).not.toContain(USER_ID_ACCOUNT);
-    expect(credentialReads).not.toContain(ASSISTANT_ID_ACCOUNT);
-    expect(credentialReads).not.toContain(ORG_ID_ACCOUNT);
+    expect(credentialReads).not.toContain(
+      credentialKey("cadet", "platform_user_id"),
+    );
+    expect(credentialReads).not.toContain(
+      credentialKey("cadet", "platform_assistant_id"),
+    );
+    expect(credentialReads).not.toContain(
+      credentialKey("cadet", "platform_organization_id"),
+    );
   });
 });

package/src/__tests__/config.test.ts

@@ -7,30 +7,6 @@ import { testWorkspaceDir } from "./test-preload.js";
 import { loadConfig } from "../config.js";
 
 describe("config: hardcoded defaults", () => {
-  test("returns expected hardcoded values", () => {
-    const config = loadConfig();
-    expect(config.shutdownDrainMs).toBe(5000);
-    expect(config.runtimeTimeoutMs).toBe(30000);
-    expect(config.runtimeMaxRetries).toBe(2);
-    expect(config.runtimeInitialBackoffMs).toBe(500);
-    expect(config.maxWebhookPayloadBytes).toBe(1024 * 1024);
-    expect(config.maxEmailWebhookPayloadBytes).toBe(350 * 1024 * 1024);
-    expect(config.maxAttachmentBytes).toEqual({
-      telegram: 20 * 1024 * 1024,
-      slack: 100 * 1024 * 1024,
-      whatsapp: 16 * 1024 * 1024,
-      discord: 100 * 1024 * 1024,
-      email: 25 * 1024 * 1024,
-      default: 100 * 1024 * 1024,
-    });
-    expect(config.maxAttachmentConcurrency).toBe(3);
-    expect(config.runtimeProxyRequireAuth).toBe(true);
-    expect(config.trustProxy).toBe(false);
-    expect(config.routingEntries).toEqual([]);
-    expect(config.logFile.dir).toMatch(/logs$/);
-    expect(config.logFile.retentionDays).toBe(30);
-  });
-
   test("GATEWAY_PORT defaults to 7830", () => {
     const saved = process.env.GATEWAY_PORT;
     delete process.env.GATEWAY_PORT;

package/src/__tests__/contacts-control-plane-proxy.test.ts

@@ -425,7 +425,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/credential-requests.test.ts

@@ -125,7 +125,7 @@ describe("credential-request mint (IPC)", () => {
       fakeConfigFile(undefined),
       { service: "github", field: "api_token" },
       {
-        getPlatformAssistantId: async () => "assistant-123",
+        getCloudAssistantId: async () => "assistant-123",
         ensurePublicIngressLive,
       },
     );
@@ -149,16 +149,16 @@ describe("credential-request mint (IPC)", () => {
     expect(ensurePublicIngressLive).not.toHaveBeenCalled();
   });
 
-  test("does not read the platform assistant id when the config URL resolves", async () => {
-    const getPlatformAssistantId = mock(async () => "assistant-123");
+  test("does not read the cloud assistant id when the config URL resolves", async () => {
+    const getCloudAssistantId = mock(async () => "assistant-123");
     const result = await createCredentialRequest(
       fakeGatewayConfig("https://tunnel-dev.mycadet.ai"),
       fakeConfigFile("https://assistant.example.com"),
       { service: "github", field: "api_token" },
-      { getPlatformAssistantId },
+      { getCloudAssistantId },
     );
     expect(result.ok).toBe(true);
-    expect(getPlatformAssistantId).not.toHaveBeenCalled();
+    expect(getCloudAssistantId).not.toHaveBeenCalled();
   });
 
   test("falls back to TUNNEL_BASE_URL + platform assistant id when the config URL is empty", async () => {
@@ -168,7 +168,7 @@ describe("credential-request mint (IPC)", () => {
       fakeGatewayConfig("https://tunnel-dev.mycadet.ai"),
       fakeConfigFile(undefined),
       { service: "github", field: "api_token" },
-      { getPlatformAssistantId: async () => "assistant-123" },
+      { getCloudAssistantId: async () => "assistant-123" },
     );
 
     if (!result.ok) throw new Error(`mint failed: ${result.error}`);

package/src/__tests__/{credential-watcher-managed-bootstrap.test.ts → credential-watcher-cloud-bootstrap.test.ts}

@@ -216,7 +216,7 @@ afterEach(async () => {
   rmSync(testDir, { recursive: true, force: true });
 });
 
-describe("gateway managed credential bootstrap retry", () => {
+describe("gateway cloud credential bootstrap retry", () => {
   test("reloads Telegram after CES becomes reachable without a metadata rewrite", async () => {
     mkdirSync(testDir, { recursive: true });
 

package/src/__tests__/edge-auth.test.ts

@@ -4,14 +4,14 @@
  *
  * Two auth modes (mirrors `requireEdgeGuardianAuth`):
  *
- *  1. Platform-managed (DISABLE_HTTP_AUTH=true + IS_PLATFORM=true): identity
+ *  1. Platform-managed (DISABLE_HTTP_AUTH=true + IS_CLOUD=true): identity
  *     asserted via `X-Cadet-User-Id` header cross-referenced against the
  *     stored `cadet:platform_user_id` credential. Scope authorization is
- *     delegated to the upstream platform proxy.
+ *     delegated to the upstream cloud proxy.
  *  2. Default: edge JWT validated; scoped guard additionally checks the
  *     scope_profile claim.
  *
- * Importantly, DISABLE_HTTP_AUTH alone (without IS_PLATFORM) does NOT
+ * Importantly, DISABLE_HTTP_AUTH alone (without IS_CLOUD) does NOT
  * bypass JWT validation — protects against accidental misconfig.
  */
 
@@ -37,8 +37,8 @@ mock.module("../credential-reader.js", () => ({
   ...actualCredentialReader,
   readCredential: (key: string) => mockReadCredential(key),
 }));
-mock.module("../platform-user-id.js", () => ({
-  readStoredPlatformUserId: async () => {
+mock.module("../cloud-user-id.js", () => ({
+  readStoredCloudUserId: async () => {
     if (mockPlatformUserIdUnreachable) {
       return { userId: undefined, unreachable: true };
     }
@@ -101,17 +101,17 @@ beforeEach(() => {
 
 afterEach(() => {
   delete process.env.DISABLE_HTTP_AUTH;
-  delete process.env.IS_PLATFORM;
+  delete process.env.IS_CLOUD;
 });
 
 // =========================================================================
 // requireEdgeAuth — platform bypass active
 // =========================================================================
 
-describe("requireEdgeAuth — DISABLE_HTTP_AUTH + IS_PLATFORM", () => {
+describe("requireEdgeAuth — DISABLE_HTTP_AUTH + IS_CLOUD", () => {
   beforeEach(() => {
     process.env.DISABLE_HTTP_AUTH = "true";
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
   });
 
   test("401 when X-Cadet-User-Id header is missing", async () => {
@@ -175,7 +175,7 @@ describe("requireEdgeAuth — DISABLE_HTTP_AUTH + IS_PLATFORM", () => {
     expect(mockValidateEdgeToken).not.toHaveBeenCalled();
   });
 
-  test("uses platform header check when a platform bearer is also forwarded", async () => {
+  test("uses platform header check when a cloud bearer is also forwarded", async () => {
     mockReadCredential = mock(async () => PLATFORM_USER_ID);
     const { requireEdgeAuth } = makeMiddleware();
     const res = await requireEdgeAuth(
@@ -194,17 +194,17 @@ describe("requireEdgeAuth — DISABLE_HTTP_AUTH + IS_PLATFORM", () => {
 // =========================================================================
 
 describe("requireEdgeAuth — DISABLE_HTTP_AUTH alone is insufficient", () => {
-  test("DISABLE_HTTP_AUTH=true without IS_PLATFORM still runs JWT validation", async () => {
+  test("DISABLE_HTTP_AUTH=true without IS_CLOUD still runs JWT validation", async () => {
     process.env.DISABLE_HTTP_AUTH = "true";
-    // IS_PLATFORM intentionally NOT set
+    // IS_CLOUD intentionally NOT set
     const { requireEdgeAuth } = makeMiddleware();
     const res = await requireEdgeAuth(makeReq());
     // No bearer token + no bypass → 401, NOT a free pass
     expect(res?.status).toBe(401);
   });
 
-  test("IS_PLATFORM=true without DISABLE_HTTP_AUTH still runs JWT validation", async () => {
-    process.env.IS_PLATFORM = "true";
+  test("IS_CLOUD=true without DISABLE_HTTP_AUTH still runs JWT validation", async () => {
+    process.env.IS_CLOUD = "true";
     // DISABLE_HTTP_AUTH intentionally NOT set
     const { requireEdgeAuth } = makeMiddleware();
     const res = await requireEdgeAuth(makeReq());
@@ -315,16 +315,16 @@ describe("requireEdgeAuth — JWT mode", () => {
 // requireEdgeAuthWithScope — same bypass model + scope check on JWT path
 // =========================================================================
 
-describe("requireEdgeAuthWithScope — DISABLE_HTTP_AUTH + IS_PLATFORM", () => {
+describe("requireEdgeAuthWithScope — DISABLE_HTTP_AUTH + IS_CLOUD", () => {
   beforeEach(() => {
     process.env.DISABLE_HTTP_AUTH = "true";
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
   });
 
   test("uses platform header check; no scope check on bypass path", async () => {
     // Even with a scope profile that wouldn't grant the required scope under
     // JWT mode, the bypass path only cross-checks the user header. Scope is
-    // enforced upstream by the platform proxy.
+    // enforced upstream by the cloud proxy.
     mockReadCredential = mock(async () => PLATFORM_USER_ID);
     const { requireEdgeAuthWithScope } = makeMiddleware();
     const res = await requireEdgeAuthWithScope(
@@ -335,7 +335,7 @@ describe("requireEdgeAuthWithScope — DISABLE_HTTP_AUTH + IS_PLATFORM", () => {
     expect(res).toBeNull();
   });
 
-  test("uses platform header check when a platform bearer is also forwarded", async () => {
+  test("uses platform header check when a cloud bearer is also forwarded", async () => {
     mockReadCredential = mock(async () => PLATFORM_USER_ID);
     const { requireEdgeAuthWithScope } = makeMiddleware();
     const res = await requireEdgeAuthWithScope(
@@ -665,7 +665,7 @@ describe("requireEdgeAuth — trustProxy loopback fallback", () => {
 
   test("platform bypass short-circuits before the fallback regardless of trustProxy", async () => {
     process.env.DISABLE_HTTP_AUTH = "true";
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
     const { requireEdgeAuth } = makeMiddleware(true);
     // Missing X-Cadet-User-Id, loopback socket, trustProxy on: still the
     // platform 401 (missing user header), NOT a loopback free pass.

package/src/__tests__/edge-guardian-auth.test.ts

@@ -1,7 +1,7 @@
 /**
  * Tests for the `requireEdgeGuardianAuth` middleware — both modes:
  *
- *  1. Platform-managed (DISABLE_HTTP_AUTH=true + IS_PLATFORM=true): identity
+ *  1. Platform-managed (DISABLE_HTTP_AUTH=true + IS_CLOUD=true): identity
  *     asserted via `X-Cadet-User-Id` header cross-referenced against the
  *     stored `cadet:platform_user_id` credential.
  *  2. Default (laptop / docker / bare-metal): edge JWT validated, then
@@ -21,8 +21,8 @@ let mockPlatformUserIdUnreachable = false;
 mock.module("../credential-reader.js", () => ({
   readCredential: (key: string) => mockReadCredential(key),
 }));
-mock.module("../platform-user-id.js", () => ({
-  readStoredPlatformUserId: async () => {
+mock.module("../cloud-user-id.js", () => ({
+  readStoredCloudUserId: async () => {
     if (mockPlatformUserIdUnreachable) {
       return { userId: undefined, unreachable: true };
     }
@@ -87,17 +87,17 @@ beforeEach(() => {
 
 afterEach(() => {
   delete process.env.DISABLE_HTTP_AUTH;
-  delete process.env.IS_PLATFORM;
+  delete process.env.IS_CLOUD;
 });
 
 // =========================================================================
-// Platform-managed mode (DISABLE_HTTP_AUTH=true + IS_PLATFORM=true)
+// Platform-managed mode (DISABLE_HTTP_AUTH=true + IS_CLOUD=true)
 // =========================================================================
 
 describe("requireEdgeGuardianAuth — platform header mode", () => {
   beforeEach(() => {
     process.env.DISABLE_HTTP_AUTH = "true";
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
   });
 
   test("returns 401 when X-Cadet-User-Id header is missing", async () => {
@@ -162,7 +162,7 @@ describe("requireEdgeGuardianAuth — platform header mode", () => {
     expect(mockFindCadetGuardian).not.toHaveBeenCalled();
   });
 
-  test("uses platform header check when a platform bearer is also forwarded", async () => {
+  test("uses platform header check when a cloud bearer is also forwarded", async () => {
     mockReadCredential = mock(async () => PLATFORM_USER_ID);
     const { requireEdgeGuardianAuth } = makeMiddleware();
     const res = await requireEdgeGuardianAuth(
@@ -176,10 +176,10 @@ describe("requireEdgeGuardianAuth — platform header mode", () => {
     expect(mockFindCadetGuardian).not.toHaveBeenCalled();
   });
 
-  test("falls through to JWT mode when IS_PLATFORM is false (rejects missing bearer token)", async () => {
-    // DISABLE_HTTP_AUTH=true but IS_PLATFORM=false → should use JWT path, not
+  test("falls through to JWT mode when IS_CLOUD is false (rejects missing bearer token)", async () => {
+    // DISABLE_HTTP_AUTH=true but IS_CLOUD=false → should use JWT path, not
     // platform header path. No JWT provided, so expect 401.
-    process.env.IS_PLATFORM = "false";
+    process.env.IS_CLOUD = "false";
     const { requireEdgeGuardianAuth } = makeMiddleware();
     const res = await requireEdgeGuardianAuth(
       makeReq({ "x-cadet-user-id": PLATFORM_USER_ID }),