@mycadet/gateway 0.12.7 → 0.12.8

package/src/__tests__/telegram-webhook-manager.test.ts

@@ -44,8 +44,8 @@ mock.module("../feature-flag-resolver.js", () => ({
 
 const { reconcileTelegramWebhook } =
   await import("../telegram/webhook-manager.js");
-const { applyPlatformIdentityIds, _resetPlatformIdentityForTests } =
-  await import("../platform-identity.js");
+const { applyCloudIdentityIds, _resetCloudIdentityForTests } =
+  await import("../cloud-identity.js");
 
 afterEach(() => {
   fetchMock = mock(async () => new Response());
@@ -53,10 +53,10 @@ afterEach(() => {
   claimedRoutes = [];
   claimError = undefined;
   delete process.env.IS_CONTAINERIZED;
-  delete process.env.IS_PLATFORM;
-  delete process.env.CADET_PLATFORM_URL;
+  delete process.env.IS_CLOUD;
+  delete process.env.CADET_CLOUD_URL;
   delete process.env.ASSISTANT_API_KEY;
-  _resetPlatformIdentityForTests();
+  _resetCloudIdentityForTests();
 });
 
 function makeTelegramResponse(result: unknown) {
@@ -74,9 +74,9 @@ function makeCaches(
     webhookSecret?: string | null;
     ingressUrl?: string | null;
     ingressEnabled?: boolean;
-    platformBaseUrl?: string | null;
+    cloudBaseUrl?: string | null;
     assistantApiKey?: string | null;
-    platformAssistantId?: string | null;
+    cloudAssistantId?: string | null;
   } = {},
 ) {
   const botToken =
@@ -89,28 +89,28 @@ function makeCaches(
     "ingressUrl" in opts
       ? (opts.ingressUrl ?? undefined)
       : "https://example.ngrok.io";
-  const platformBaseUrl =
-    "platformBaseUrl" in opts ? (opts.platformBaseUrl ?? undefined) : undefined;
+  const cloudBaseUrl =
+    "cloudBaseUrl" in opts ? (opts.cloudBaseUrl ?? undefined) : undefined;
   const assistantApiKey =
     "assistantApiKey" in opts ? (opts.assistantApiKey ?? undefined) : undefined;
-  const platformAssistantId =
-    "platformAssistantId" in opts
-      ? (opts.platformAssistantId ?? undefined)
+  const cloudAssistantId =
+    "cloudAssistantId" in opts
+      ? (opts.cloudAssistantId ?? undefined)
       : undefined;
+  if (cloudBaseUrl) process.env.CADET_CLOUD_URL = cloudBaseUrl;
   const credentialMap: Record<string, string | undefined> = {
     [credentialKey("telegram", "bot_token")]: botToken,
     [credentialKey("telegram", "webhook_secret")]: webhookSecret,
-    [credentialKey("cadet", "platform_base_url")]: platformBaseUrl,
     [credentialKey("cadet", "assistant_api_key")]: assistantApiKey,
-    [credentialKey("cadet", "platform_assistant_id")]: platformAssistantId,
+    [credentialKey("cadet", "platform_assistant_id")]: cloudAssistantId,
   };
   const credentials = {
     get: async (key: string) => credentialMap[key],
     invalidate: () => {},
   } as unknown as CredentialCache;
-  if (platformAssistantId) {
-    applyPlatformIdentityIds({
-      assistantId: platformAssistantId,
+  if (cloudAssistantId) {
+    applyCloudIdentityIds({
+      assistantId: cloudAssistantId,
       organizationId: "",
       userId: "",
     });
@@ -134,15 +134,15 @@ function makeCaches(
 }
 
 const PLATFORM_ASSISTANT_ID = "11111111-2222-4333-8444-555555555555";
-const MANAGED_CALLBACK_URL = `https://platform.example.com/v1/gateway/callbacks/${PLATFORM_ASSISTANT_ID}/webhooks/telegram/`;
+const MANAGED_CALLBACK_URL = `https://test-cloud.mycadet.ai/v1/gateway/callbacks/${PLATFORM_ASSISTANT_ID}/webhooks/telegram/`;
 
 /** Caches for a pod holding platform credentials, with the published URL varied. */
 function makePlatformCaches(ingressUrl: string | undefined) {
   return makeCaches({
     ingressUrl,
-    platformBaseUrl: "https://platform.example.com",
+    cloudBaseUrl: "https://test-cloud.mycadet.ai",
     assistantApiKey: "ast-managed-key",
-    platformAssistantId: PLATFORM_ASSISTANT_ID,
+    cloudAssistantId: PLATFORM_ASSISTANT_ID,
   });
 }
 
@@ -348,14 +348,14 @@ describe("reconcileTelegramWebhook", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  test("registers a managed callback route when ingress URL is not configured", async () => {
+  test("registers a cloud callback route when ingress URL is not configured", async () => {
     const calls: { method: string; body: unknown }[] = [];
     process.env.IS_CONTAINERIZED = "true";
     const caches = makeCaches({
       ingressUrl: undefined,
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "ast-managed-key",
-      platformAssistantId: "11111111-2222-4333-8444-555555555555",
+      cloudAssistantId: "11111111-2222-4333-8444-555555555555",
     });
 
     fetchMock = mock(
@@ -368,14 +368,14 @@ describe("reconcileTelegramWebhook", () => {
               : input.url;
         if (
           url ===
-          "https://platform.example.com/v1/internal/gateway/callback-routes/register/"
+          "https://test-cloud.mycadet.ai/v1/internal/gateway/callback-routes/register/"
         ) {
           const body = init?.body ? JSON.parse(init.body as string) : null;
           calls.push({ method: "registerCallbackRoute", body });
           return new Response(
             JSON.stringify({
               callback_url:
-                "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+                "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
             }),
             {
               status: 201,
@@ -412,21 +412,21 @@ describe("reconcileTelegramWebhook", () => {
     expect(calls[1].method).toBe("getWebhookInfo");
     expect(calls[2].method).toBe("setWebhook");
     expect((calls[2].body as any).url).toBe(
-      "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+      "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
     );
     expect((calls[2].body as any).secret_token).toBe("test-webhook-secret");
   });
 
-  test("registers a managed callback route without IS_CONTAINERIZED when platform credentials are present (LUM-2899)", async () => {
+  test("registers a cloud callback route without IS_CONTAINERIZED when platform credentials are present (LUM-2899)", async () => {
     const calls: { method: string; body: unknown }[] = [];
-    // IS_CONTAINERIZED deliberately unset: a platform-connected local
-    // assistant must complete the setWebhook handshake for the managed
+    // IS_CONTAINERIZED deliberately unset: a cloud-connected local
+    // assistant must complete the setWebhook handshake for the cloud
     // callback mode that `hasWebhookRoutingConfigured` reports as configured.
     const caches = makeCaches({
       ingressUrl: undefined,
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "ast-managed-key",
-      platformAssistantId: "11111111-2222-4333-8444-555555555555",
+      cloudAssistantId: "11111111-2222-4333-8444-555555555555",
     });
 
     fetchMock = mock(
@@ -439,14 +439,14 @@ describe("reconcileTelegramWebhook", () => {
               : input.url;
         if (
           url ===
-          "https://platform.example.com/v1/internal/gateway/callback-routes/register/"
+          "https://test-cloud.mycadet.ai/v1/internal/gateway/callback-routes/register/"
         ) {
           const body = init?.body ? JSON.parse(init.body as string) : null;
           calls.push({ method: "registerCallbackRoute", body });
           return new Response(
             JSON.stringify({
               callback_url:
-                "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+                "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
             }),
             {
               status: 201,
@@ -478,20 +478,20 @@ describe("reconcileTelegramWebhook", () => {
     expect(calls[1].method).toBe("getWebhookInfo");
     expect(calls[2].method).toBe("setWebhook");
     expect((calls[2].body as any).url).toBe(
-      "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+      "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
     );
     expect((calls[2].body as any).secret_token).toBe("test-webhook-secret");
   });
 
-  test("includes callback_base_url when a platform pod has an ingress URL in config", async () => {
+  test("includes callback_base_url when a cloud pod has an ingress URL in config", async () => {
     const calls: { method: string; body: unknown }[] = [];
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
     process.env.IS_CONTAINERIZED = "true";
     const caches = makeCaches({
       ingressUrl: "https://tunnel.example.com",
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "ast-managed-key",
-      platformAssistantId: "11111111-2222-4333-8444-555555555555",
+      cloudAssistantId: "11111111-2222-4333-8444-555555555555",
     });
 
     fetchMock = mock(
@@ -504,14 +504,14 @@ describe("reconcileTelegramWebhook", () => {
               : input.url;
         if (
           url ===
-          "https://platform.example.com/v1/internal/gateway/callback-routes/register/"
+          "https://test-cloud.mycadet.ai/v1/internal/gateway/callback-routes/register/"
         ) {
           const body = init?.body ? JSON.parse(init.body as string) : null;
           calls.push({ method: "registerCallbackRoute", body });
           return new Response(
             JSON.stringify({
               callback_url:
-                "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+                "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
             }),
             {
               status: 201,
@@ -546,18 +546,18 @@ describe("reconcileTelegramWebhook", () => {
       callback_base_url: "https://tunnel.example.com",
     });
     expect((calls[2].body as { url: string }).url).toBe(
-      "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+      "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
     );
   });
 
-  test("deregisters the webhook instead of using the managed callback fallback when ingress is explicitly disabled", async () => {
+  test("deregisters the webhook instead of using the cloud callback fallback when ingress is explicitly disabled", async () => {
     const calls: string[] = [];
     const caches = makeCaches({
       ingressUrl: undefined,
       ingressEnabled: false,
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "ast-managed-key",
-      platformAssistantId: "11111111-2222-4333-8444-555555555555",
+      cloudAssistantId: "11111111-2222-4333-8444-555555555555",
     });
 
     fetchMock = mock(async (input: string | URL | Request) => {
@@ -607,15 +607,15 @@ describe("reconcileTelegramWebhook", () => {
     expect(calls).toEqual(["deleteWebhook"]);
   });
 
-  test("ignores ingress.enabled false on platform pods and registers the managed callback route", async () => {
+  test("ignores ingress.enabled false on cloud pods and registers the cloud callback route", async () => {
     const calls: string[] = [];
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
     const caches = makeCaches({
       ingressUrl: undefined,
       ingressEnabled: false,
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "ast-managed-key",
-      platformAssistantId: "11111111-2222-4333-8444-555555555555",
+      cloudAssistantId: "11111111-2222-4333-8444-555555555555",
     });
 
     fetchMock = mock(async (input: string | URL | Request) => {
@@ -630,7 +630,7 @@ describe("reconcileTelegramWebhook", () => {
         return new Response(
           JSON.stringify({
             callback_url:
-              "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+              "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
           }),
           { status: 201, headers: { "content-type": "application/json" } },
         );
@@ -663,20 +663,20 @@ describe("reconcileTelegramWebhook", () => {
     ]);
   });
 
-  test("prefers the managed callback route over the Tunnel ingress URL on platform pods", async () => {
+  test("prefers the cloud callback route over the Tunnel ingress URL on cloud pods", async () => {
     const calls: string[] = [];
     let registeredUrl: string | undefined;
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
     // A platform pod always has an `ingress.publicBaseUrl`: the Tunnel
-    // client publishes one at boot. It must not win over the managed callback
+    // client publishes one at boot. It must not win over the cloud callback
     // route — the Tunnel address dies with the tunnel, and the daemon's
     // `hasWebhookRoutingConfigured` reports this pod as managed-callback mode.
     const caches = makeCaches({
       ingressUrl:
         "https://tunnel.mycadet.ai/11111111-2222-4333-8444-555555555555",
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "ast-managed-key",
-      platformAssistantId: "11111111-2222-4333-8444-555555555555",
+      cloudAssistantId: "11111111-2222-4333-8444-555555555555",
     });
 
     fetchMock = mock(
@@ -692,7 +692,7 @@ describe("reconcileTelegramWebhook", () => {
           return new Response(
             JSON.stringify({
               callback_url:
-                "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+                "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
             }),
             { status: 201, headers: { "content-type": "application/json" } },
           );
@@ -725,13 +725,13 @@ describe("reconcileTelegramWebhook", () => {
       "setWebhook",
     ]);
     expect(registeredUrl).toBe(
-      "https://platform.example.com/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
+      "https://test-cloud.mycadet.ai/v1/gateway/callbacks/11111111-2222-4333-8444-555555555555/webhooks/telegram/",
     );
     expect(claimedRoutes).toEqual([]);
   });
 
   test("points a pod at its published Tunnel URL and claims the path first when the flag is on", async () => {
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
     tunnelWebhooksEnabled = true;
     const { calls, result } = mockReconcileFetch();
 
@@ -752,8 +752,8 @@ describe("reconcileTelegramWebhook", () => {
     );
   });
 
-  test("falls back to the managed callback route when the path claim fails", async () => {
-    process.env.IS_PLATFORM = "true";
+  test("falls back to the cloud callback route when the path claim fails", async () => {
+    process.env.IS_CLOUD = "true";
     tunnelWebhooksEnabled = true;
     claimError = new Error("database disk image is malformed");
     const { calls, result } = mockReconcileFetch({
@@ -774,8 +774,8 @@ describe("reconcileTelegramWebhook", () => {
     expect(result.registeredUrl).toBe(MANAGED_CALLBACK_URL);
   });
 
-  test("falls back to the managed callback route when the flag is on but no URL is published", async () => {
-    process.env.IS_PLATFORM = "true";
+  test("falls back to the cloud callback route when the flag is on but no URL is published", async () => {
+    process.env.IS_CLOUD = "true";
     tunnelWebhooksEnabled = true;
     const { calls, result } = mockReconcileFetch({
       callbackUrl: MANAGED_CALLBACK_URL,
@@ -820,14 +820,14 @@ describe("reconcileTelegramWebhook", () => {
       headers?: Record<string, string>;
     }[] = [];
     process.env.IS_CONTAINERIZED = "true";
-    process.env.CADET_PLATFORM_URL = "https://env-platform.example.com";
+    process.env.CADET_CLOUD_URL = "https://env-platform.example.com";
     process.env.ASSISTANT_API_KEY = "env-key";
 
     const caches = makeCaches({
       ingressUrl: undefined,
-      platformBaseUrl: undefined,
+      cloudBaseUrl: undefined,
       assistantApiKey: undefined,
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     fetchMock = mock(
@@ -886,20 +886,19 @@ describe("reconcileTelegramWebhook", () => {
     );
   });
 
-  test("credential cache for assistant ID, base URL, and auth key", async () => {
+  test("credential cache for assistant ID and auth key; base URL rides the env", async () => {
     const calls: {
       method: string;
       body: unknown;
       headers?: Record<string, string>;
     }[] = [];
     process.env.IS_CONTAINERIZED = "true";
-    process.env.CADET_PLATFORM_URL = "https://env-platform.example.com";
+    process.env.CADET_CLOUD_URL = "https://env-platform.example.com";
 
     const caches = makeCaches({
       ingressUrl: undefined,
-      platformBaseUrl: "https://cache-platform.example.com",
       assistantApiKey: "cache-api-key",
-      platformAssistantId: "cache-assistant-id",
+      cloudAssistantId: "cache-assistant-id",
     });
 
     fetchMock = mock(
@@ -917,7 +916,7 @@ describe("reconcileTelegramWebhook", () => {
           return new Response(
             JSON.stringify({
               callback_url:
-                "https://cache-platform.example.com/v1/gateway/callbacks/cache-assistant-id/webhooks/telegram/",
+                "https://env-platform.example.com/v1/gateway/callbacks/cache-assistant-id/webhooks/telegram/",
             }),
             {
               status: 201,
@@ -946,16 +945,17 @@ describe("reconcileTelegramWebhook", () => {
 
     expect(calls).toHaveLength(3);
     expect(calls[0].method).toBe("registerCallbackRoute");
-    // platform_base_url: credential cache takes precedence over env var
+    // The base URL resolves from the environment only; ids and the API key
+    // come from the credential cache.
     expect(calls[0].body).toEqual({
       assistant_id: "cache-assistant-id",
       callback_path: "webhooks/telegram",
       type: "telegram",
     });
     expect(calls[0].headers?.Authorization).toBe("Api-Key cache-api-key");
-    // Registration URL should use cache platform URL
+    // Registration URL should use the env platform URL
     expect((calls[2].body as any).url).toBe(
-      "https://cache-platform.example.com/v1/gateway/callbacks/cache-assistant-id/webhooks/telegram/",
+      "https://env-platform.example.com/v1/gateway/callbacks/cache-assistant-id/webhooks/telegram/",
     );
   });
 
@@ -964,9 +964,9 @@ describe("reconcileTelegramWebhook", () => {
 
     const caches = makeCaches({
       ingressUrl: undefined,
-      platformBaseUrl: undefined,
+      cloudBaseUrl: undefined,
       assistantApiKey: undefined,
-      platformAssistantId: undefined,
+      cloudAssistantId: undefined,
     });
 
     fetchMock = mock(async () => new Response("", { status: 200 }));
@@ -1017,15 +1017,14 @@ const TUNNEL_WEBHOOK_URL = `${TUNNEL_BASE_URL}/webhooks/telegram`;
  * rather than the value that was current when it was queued.
  */
 function makeLivePlatformCaches(readIngressUrl: () => string | undefined) {
+  process.env.CADET_CLOUD_URL = "https://test-cloud.mycadet.ai";
   const credentialMap: Record<string, string | undefined> = {
     [credentialKey("telegram", "bot_token")]: "test-bot-token",
     [credentialKey("telegram", "webhook_secret")]: "test-webhook-secret",
-    [credentialKey("cadet", "platform_base_url")]:
-      "https://platform.example.com",
     [credentialKey("cadet", "assistant_api_key")]: "ast-managed-key",
     [credentialKey("cadet", "platform_assistant_id")]: PLATFORM_ASSISTANT_ID,
   };
-  applyPlatformIdentityIds({
+  applyCloudIdentityIds({
     assistantId: PLATFORM_ASSISTANT_ID,
     organizationId: "",
     userId: "",
@@ -1064,11 +1063,11 @@ async function waitFor(condition: () => boolean): Promise<void> {
 
 describe("reconcileTelegramWebhook serialization", () => {
   test("a reconcile latched behind a slow one settles on the newer address", async () => {
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
     tunnelWebhooksEnabled = true;
 
     // The tunnel clears its published URL and republishes it moments later.
-    // The first reconcile sees the cleared state and resolves the managed
+    // The first reconcile sees the cleared state and resolves the cloud
     // callback route; the second must win with the Tunnel URL.
     const published: { ingressUrl?: string } = {};
     const { caches, refreshes } = makeLivePlatformCaches(
@@ -1127,7 +1126,7 @@ describe("reconcileTelegramWebhook serialization", () => {
     releaseFirstSetWebhook();
     await Promise.all([first, second]);
 
-    // The managed registration is the stale one, so it must not be what
+    // The cloud registration is the stale one, so it must not be what
     // Telegram is left pointed at.
     expect(registeredUrls).toEqual([MANAGED_CALLBACK_URL, TUNNEL_WEBHOOK_URL]);
     expect(claimedRoutes).toEqual([

package/src/__tests__/twilio-media-websocket.test.ts

@@ -61,7 +61,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/twilio-webhooks.test.ts

@@ -135,7 +135,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,
@@ -780,16 +779,16 @@ describe("Twilio webhook signature with canonical ingress base URL", () => {
 
     const handler = createTwilioVoiceWebhookHandler(makeConfig(), makeCaches());
 
-    // The platform callback URL is what Twilio signs against — it includes
+    // The cloud callback URL is what Twilio signs against — it includes
     // the /v1/gateway/callbacks/{assistantId}/ prefix that the gateway
     // never sees in the request path.
     const platformCallbackUrl =
       "https://cloud.mycadet.ai/v1/gateway/callbacks/abc123/webhooks/twilio/voice";
     const localUrl =
-      "http://localhost:7830/webhooks/twilio/voice?callSessionId=platform-proxy-test";
-    const params = { CallSid: "CA-platform-proxy" };
+      "http://localhost:7830/webhooks/twilio/voice?callSessionId=cloud-proxy-test";
+    const params = { CallSid: "CA-cloud-proxy" };
 
-    // Sign against the platform callback URL (as Twilio would)
+    // Sign against the cloud callback URL (as Twilio would)
     const signature = computeSignature(platformCallbackUrl, params, AUTH_TOKEN);
     const req = new Request(localUrl, {
       method: "POST",
@@ -863,7 +862,7 @@ describe("Twilio webhook signature with canonical ingress base URL", () => {
     expect(body).not.toContain("staging-cloud.mycadet.ai");
   });
 
-  test("platform proxy URL takes priority over configured ingress", async () => {
+  test("cloud proxy URL takes priority over configured ingress", async () => {
     fetchMock = mock(
       async () =>
         new Response('<?xml version="1.0" encoding="UTF-8"?><Response/>', {
@@ -884,7 +883,7 @@ describe("Twilio webhook signature with canonical ingress base URL", () => {
       "http://localhost:7830/webhooks/twilio/voice?callSessionId=priority-test";
     const params = { CallSid: "CA-priority" };
 
-    // Sign against the platform callback URL
+    // Sign against the cloud callback URL
     const signature = computeSignature(platformCallbackUrl, params, AUTH_TOKEN);
     const req = new Request(localUrl, {
       method: "POST",

package/src/__tests__/whatsapp-download.test.ts

@@ -25,7 +25,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/__tests__/whatsapp-webhook.test.ts

@@ -52,7 +52,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,

package/src/attachments/ingest.test.ts

@@ -29,7 +29,6 @@ function config(overrides?: Partial<GatewayConfig>): GatewayConfig {
     runtimeMaxRetries: 0,
     runtimeProxyRequireAuth: false,
     runtimeTimeoutMs: 1000,
-    shutdownDrainMs: 1000,
     trustProxy: false,
   };
   return { ...base, ...overrides };

package/src/auth/guardian-bootstrap.ts

@@ -21,7 +21,7 @@ import {
 } from "../db/schema.js";
 import { readCredential } from "../credential-reader.js";
 import { credentialKey } from "../credential-key.js";
-import { arePlatformFeaturesEnabled } from "../feature-flag-resolver.js";
+import { areCloudFeaturesEnabled } from "../feature-flag-resolver.js";
 import { reportGuardianMintRefused } from "../guardian-integrity-reporter.js";
 import { ipcCallAssistant } from "../ipc/assistant-client.js";
 import { getLogger } from "../logger.js";
@@ -1030,38 +1030,40 @@ export function mintAndRecordBrowserTokenPair(params: {
 // ---------------------------------------------------------------------------
 
 /**
- * Attempt to fetch the assistant owner's display name from the platform.
+ * Attempt to fetch the assistant owner's display name from the cloud.
  *
- * Only runs when IS_PLATFORM=true. Reads platform_base_url and
- * assistant_api_key from the credential store, then calls
+ * Only runs when IS_CLOUD=true. Reads the assistant API key from the
+ * credential store, resolves the base URL from CADET_CLOUD_URL, then calls
  * GET /v1/internal/gateway/guardian/ with a 5-second timeout.
  * Returns null on any missing credential, timeout, or network/parse failure —
  * callers fall back to a generated principal ID in that case.
  */
 async function fetchPlatformOwnerDisplayName(): Promise<string | null> {
-  if (!arePlatformFeaturesEnabled()) {
+  if (!areCloudFeaturesEnabled()) {
     log.debug(
       "Platform features disabled — skipping platform owner display name fetch",
     );
     return null;
   }
 
-  const isPlatform =
-    process.env.IS_PLATFORM?.trim().toLowerCase() === "true" ||
-    process.env.IS_PLATFORM?.trim() === "1";
-  if (!isPlatform) return null;
+  const isCloud =
+    process.env.IS_CLOUD?.trim().toLowerCase() === "true" ||
+    process.env.IS_CLOUD?.trim() === "1";
+  if (!isCloud) return null;
 
-  const [platformBaseUrl, assistantApiKey] = await Promise.all([
-    readCredential(credentialKey("cadet", "platform_base_url")),
-    readCredential(credentialKey("cadet", "assistant_api_key")),
-  ]);
+  const assistantApiKey = await readCredential(
+    credentialKey("cadet", "assistant_api_key"),
+  );
+  const cloudBaseUrl = (
+    process.env.CADET_CLOUD_URL?.trim() || ""
+  ).replace(/\/+$/, "");
 
-  if (!platformBaseUrl || !assistantApiKey) {
+  if (!cloudBaseUrl || !assistantApiKey) {
     return null;
   }
 
   try {
-    const url = `${platformBaseUrl.replace(/\/+$/, "")}/v1/internal/gateway/guardian/`;
+    const url = `${cloudBaseUrl.replace(/\/+$/, "")}/v1/internal/gateway/guardian/`;
     const response = await fetch(url, {
       headers: { Authorization: `Api-Key ${assistantApiKey}` },
       signal: AbortSignal.timeout(5_000),

package/src/auth/scopes.ts

@@ -54,7 +54,7 @@ const PROFILE_SCOPES: Record<ScopeProfile, ReadonlySet<Scope>> = {
   // Mirrors the daemon profile a short-lived OAuth passthrough grant is
   // minted with; the gateway resolves it on the IPC fast path.
   oauth_proxy_v1: new Set<Scope>(["oauth.proxy"]),
-  // Managed speech relay only (ATL-1033): the daemon's relay-dial token must
+  // Cloud speech relay only (ATL-1033): the daemon's relay-dial token must
   // not open any other edge-scoped route.
   speech_relay_v1: new Set<Scope>(["speech.relay"]),
   ui_page_v1: new Set<Scope>(["settings.read"]),

package/src/auth-fallback-reporter.ts

@@ -1,6 +1,6 @@
 // Periodically drains AuthFallbackCountTracker and ships the accumulated counts
 // to the daemon's internal telemetry route, which persists them and forwards
-// them to the platform. Best-effort background work: failures are logged and the
+// them to the cloud. Best-effort background work: failures are logged and the
 // drained counts are merged back so a transient daemon blip doesn't lose a
 // window. Deliberately does NOT touch the runtime circuit breaker — this is
 // non-critical traffic and must never affect chat routing.

package/src/backup/backup-worker.ts

@@ -25,7 +25,7 @@ import { pipeline } from "node:stream/promises";
 import { mintServiceToken } from "../auth/token-exchange.js";
 import { readConfigFileOrEmpty } from "../config-file-utils.js";
 import { fetchImpl } from "../fetch.js";
-import { isPlatformMode } from "../feature-flag-resolver.js";
+import { isCloudServedBuild } from "../feature-flag-resolver.js";
 import { getLogger } from "../logger.js";
 import { getGatewaySecurityDir } from "../paths.js";
 import { ensureBackupKey } from "./backup-key.js";
@@ -398,7 +398,7 @@ function createDisabledBackupWorkerHandle(): BackupWorkerHandle {
  * runOnce() methods.
  */
 export function startBackupWorker(deps: BackupDeps): BackupWorkerHandle {
-  if (isPlatformMode()) {
+  if (isCloudServedBuild()) {
     log.info("Backup worker disabled in platform mode");
     return createDisabledBackupWorkerHandle();
   }