@mycadet/gateway 0.12.7 → 0.12.8

package/src/http/routes/{platform-push-proxy.test.ts → cloud-push-proxy.test.ts}

@@ -24,13 +24,13 @@ mock.module("../../fetch.js", () => ({
   fetchImpl: (...args: Parameters<FetchFn>) => fetchMock(...args),
 }));
 
-const { createPlatformPushProxyHandler } =
-  await import("./platform-push-proxy.js");
-const { applyPlatformIdentityIds, _resetPlatformIdentityForTests } =
-  await import("../../platform-identity.js");
+const { createCloudPushProxyHandler } =
+  await import("./cloud-push-proxy.js");
+const { applyCloudIdentityIds, _resetCloudIdentityForTests } =
+  await import("../../cloud-identity.js");
 
 const PLATFORM_ASSISTANT_ID = "11111111-1111-4111-8111-111111111111";
-const PLATFORM_BASE_URL = "https://platform.example.com";
+const PLATFORM_BASE_URL = "https://test-cloud.mycadet.ai";
 const ASSISTANT_API_KEY = "assistant-api-key-123";
 
 function makeKeyedCredentials(
@@ -42,15 +42,14 @@ function makeKeyedCredentials(
 }
 
 function registeredCredentials(): CredentialCache {
-  applyPlatformIdentityIds({
+  applyCloudIdentityIds({
     assistantId: PLATFORM_ASSISTANT_ID,
     organizationId: "",
     userId: "",
   });
+  process.env.CADET_CLOUD_URL = PLATFORM_BASE_URL;
   return makeKeyedCredentials({
-    [credentialKey("cadet", "platform_base_url")]: PLATFORM_BASE_URL,
     [credentialKey("cadet", "assistant_api_key")]: ASSISTANT_API_KEY,
-    [credentialKey("cadet", "platform_assistant_id")]: PLATFORM_ASSISTANT_ID,
   });
 }
 
@@ -84,27 +83,27 @@ function capturedFetch(): {
 }
 
 describe("platform push proxy", () => {
-  const savedPlatformUrl = process.env.CADET_PLATFORM_URL;
+  const savedCloudUrl = process.env.CADET_CLOUD_URL;
 
   beforeAll(() => {
-    delete process.env.CADET_PLATFORM_URL;
+    delete process.env.CADET_CLOUD_URL;
   });
 
   afterAll(() => {
-    if (savedPlatformUrl !== undefined) {
-      process.env.CADET_PLATFORM_URL = savedPlatformUrl;
+    if (savedCloudUrl !== undefined) {
+      process.env.CADET_CLOUD_URL = savedCloudUrl;
     } else {
-      delete process.env.CADET_PLATFORM_URL;
+      delete process.env.CADET_CLOUD_URL;
     }
   });
 
   afterEach(() => {
     fetchMock = mock(async () => new Response());
-    _resetPlatformIdentityForTests();
+    _resetCloudIdentityForTests();
   });
 
   test("returns 503 and does not fetch when platform credentials are missing", async () => {
-    const handler = createPlatformPushProxyHandler(makeKeyedCredentials({}));
+    const handler = createCloudPushProxyHandler(makeKeyedCredentials({}));
 
     const res = await handler.handleUpsertPushToken(
       new Request("http://localhost:7830/v1/assistants/self/push-tokens/", {
@@ -131,7 +130,7 @@ describe("platform push proxy", () => {
           headers: { "content-type": "application/json" },
         }),
     );
-    const handler = createPlatformPushProxyHandler(registeredCredentials());
+    const handler = createCloudPushProxyHandler(registeredCredentials());
     const payload = {
       token: "device-token",
       platform: "ios",
@@ -166,7 +165,7 @@ describe("platform push proxy", () => {
 
   test("preserves bundle_id on push-token delete and ignores the URL assistant id", async () => {
     fetchMock = mock(async () => new Response(null, { status: 204 }));
-    const handler = createPlatformPushProxyHandler(registeredCredentials());
+    const handler = createCloudPushProxyHandler(registeredCredentials());
 
     const res = await handler.handleDeletePushToken(
       new Request(
@@ -195,7 +194,7 @@ describe("platform push proxy", () => {
           headers: { "content-type": "application/json" },
         }),
     );
-    const handler = createPlatformPushProxyHandler(registeredCredentials());
+    const handler = createCloudPushProxyHandler(registeredCredentials());
 
     const res = await handler.handleUpsertLiveActivityToken(
       new Request(
@@ -217,7 +216,7 @@ describe("platform push proxy", () => {
 
   test("forwards a Live Activity token delete to Django", async () => {
     fetchMock = mock(async () => new Response(null, { status: 204 }));
-    const handler = createPlatformPushProxyHandler(registeredCredentials());
+    const handler = createCloudPushProxyHandler(registeredCredentials());
 
     const res = await handler.handleDeleteLiveActivityToken(
       new Request(
@@ -242,7 +241,7 @@ describe("platform push proxy", () => {
           headers: { "content-type": "application/json" },
         }),
     );
-    const handler = createPlatformPushProxyHandler(registeredCredentials());
+    const handler = createCloudPushProxyHandler(registeredCredentials());
 
     const res = await handler.handleDeletePushToken(
       new Request(
@@ -256,11 +255,11 @@ describe("platform push proxy", () => {
     expect(await res.json()).toEqual({ detail: "bundle_id is required." });
   });
 
-  test("returns 502 when the platform request fails", async () => {
+  test("returns 502 when the cloud request fails", async () => {
     fetchMock = mock(async () => {
       throw new Error("network down");
     });
-    const handler = createPlatformPushProxyHandler(registeredCredentials());
+    const handler = createCloudPushProxyHandler(registeredCredentials());
 
     const res = await handler.handleUpsertPushToken(
       new Request("http://localhost:7830/v1/assistants/self/push-tokens/", {

package/src/http/routes/{platform-push-proxy.ts → cloud-push-proxy.ts}

@@ -16,32 +16,31 @@ import type { CredentialCache } from "../../credential-cache.js";
 import { credentialKey } from "../../credential-key.js";
 import { fetchImpl } from "../../fetch.js";
 import { getLogger } from "../../logger.js";
-import { resolvePlatformAssistantIdOrUndefined } from "../../platform-identity.js";
-import { getPlatformBaseUrl } from "../../platform-url.js";
+import { resolveCloudAssistantIdOrUndefined } from "../../cloud-identity.js";
+import { getCloudBaseUrl } from "../../cloud-url.js";
 import { errorResponse } from "../loopback-guard.js";
 
-const log = getLogger("platform-push-proxy");
+const log = getLogger("cloud-push-proxy");
 
 const UPSTREAM_TIMEOUT_MS = 10_000;
 
 interface PlatformTarget {
-  platformBaseUrl: string;
+  cloudBaseUrl: string;
   assistantApiKey: string;
   assistantId: string;
 }
 
-export function createPlatformPushProxyHandler(credentials: CredentialCache) {
+export function createCloudPushProxyHandler(credentials: CredentialCache) {
   async function resolvePlatformTarget(): Promise<PlatformTarget | Response> {
-    const [platformBaseUrl, assistantApiKeyRaw, assistantId] =
-      await Promise.all([
-        getPlatformBaseUrl(credentials),
-        credentials.get(credentialKey("cadet", "assistant_api_key")),
-        resolvePlatformAssistantIdOrUndefined(),
-      ]);
+    const [assistantApiKeyRaw, assistantId] = await Promise.all([
+      credentials.get(credentialKey("cadet", "assistant_api_key")),
+      resolveCloudAssistantIdOrUndefined(),
+    ]);
 
+    const cloudBaseUrl = getCloudBaseUrl();
     const assistantApiKey = assistantApiKeyRaw?.trim() || undefined;
 
-    if (!platformBaseUrl || !assistantApiKey || !assistantId) {
+    if (!cloudBaseUrl || !assistantApiKey || !assistantId) {
       return errorResponse(
         "PLATFORM_UNAVAILABLE",
         "This assistant is not registered with Cadet Cloud, so push notifications are unavailable.",
@@ -49,7 +48,7 @@ export function createPlatformPushProxyHandler(credentials: CredentialCache) {
       );
     }
 
-    return { platformBaseUrl, assistantApiKey, assistantId };
+    return { cloudBaseUrl, assistantApiKey, assistantId };
   }
 
   async function forward(
@@ -62,7 +61,7 @@ export function createPlatformPushProxyHandler(credentials: CredentialCache) {
     }
 
     const search = new URL(req.url).search;
-    const upstreamUrl = `${target.platformBaseUrl}/v1/assistants/${target.assistantId}${resourcePath}${search}`;
+    const upstreamUrl = `${target.cloudBaseUrl}/v1/assistants/${target.assistantId}${resourcePath}${search}`;
 
     const headers = new Headers();
     headers.set("Authorization", `Api-Key ${target.assistantApiKey}`);

package/src/http/routes/contacts-control-plane-proxy.ts

@@ -286,11 +286,11 @@ function sharedInviteRegistrationError(
  * daemon-owned and layered on by each create transport exactly once: the
  * daemon's create relay composes in-process; the gateway HTTP handler
  * composes via the `invites_compose_presentation` daemon IPC.
- * A `cadet-shared` invite is registered with the platform before the row is
+ * A `cadet-shared` invite is registered with the cloud before the row is
  * written (see `registerSharedInvite`).
  *
  * Throws InviteNativeError(404) when the contact is unknown, (400) on invalid
- * voice parameters, (409 / 429 / 502 / 503) when the platform registration
+ * voice parameters, (409 / 429 / 502 / 503) when the cloud registration
  * does not succeed, and (500) when the gateway write fails.
  */
 export async function createInviteNative(

package/src/http/routes/email-webhook.test.ts

@@ -71,7 +71,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 
@@ -381,7 +380,7 @@ describe("email-webhook", () => {
     expect(status).toBe(false);
   });
 
-  // Intercept response-shape pins. The platform email relay
+  // Intercept response-shape pins. The cloud email relay
   // (mycadet-platform django/app/email/views.py) gates only on
   // `denied` in the gateway body and returns everything else verbatim — it
   // reads neither intercept flag nor `replyText`. The flags name which
@@ -571,7 +570,7 @@ describe("email-webhook", () => {
     const res = await handler(postRequest(body));
     expect(res.status).toBe(500);
     expect(handleInboundMock).not.toHaveBeenCalled();
-    // Unreserved so the platform's retry delivery can be processed.
+    // Unreserved so the cloud's retry delivery can be processed.
     expect(dedupCache.reserve("<transient-upload-fail@example.com>")).toBe(
       true,
     );

package/src/http/routes/email-webhook.ts

@@ -154,7 +154,7 @@ export function createEmailWebhookHandler(
 
     // Ingest inline base64 attachments into the assistant's attachment store
     // (which stores them in the conversation workspace) and forward the ids.
-    // A transient upload failure surfaces as 500 so the platform retries.
+    // A transient upload failure surfaces as 500 so the cloud retries.
     let attachmentIds: string[] | undefined;
     try {
       const ingested = await ingestEmailAttachments(config, attachments, tlog);
@@ -222,7 +222,7 @@ export function createEmailWebhookHandler(
           "Gateway intercept — returning reply text to platform",
         );
         // replyText contract: the gateway cannot send email on this path — the
-        // reply rides the HTTP response for the platform (vembda) to deliver,
+        // reply rides the HTTP response for the cloud (vembda) to deliver,
         // and delivery is tracked platform-side.
         return Response.json({
           ok: true,
@@ -269,9 +269,9 @@ export function createEmailWebhookHandler(
       }
 
       // Propagate the runtime's full response (including denied/reason/replyText)
-      // so the platform can decide whether to persist the email and how to respond
+      // so the cloud can decide whether to persist the email and how to respond
       // to the sender. Same replyText contract as above: the gateway cannot send
-      // email here — the platform (vembda) delivers any reply and tracks delivery.
+      // email here — the cloud (vembda) delivers any reply and tracks delivery.
       const runtimeBody = result.runtimeResponse ?? {};
       return Response.json({ ok: true, ...runtimeBody });
     } catch (err) {

package/src/http/routes/guardian-channel-create.ts

@@ -1,8 +1,8 @@
 /**
  * POST /v1/contacts/guardian/channel — create a guardian channel binding
- * via platform auto-verify.
+ * via cloud auto-verify.
  *
- * This route is called by the platform's `assistant email register` flow
+ * This route is called by the cloud's `assistant email register` flow
  * to auto-verify the owner's email channel. It creates a guardian email
  * channel binding directly in both the assistant and gateway databases.
  *
@@ -138,7 +138,7 @@ export function createGuardianChannelHandler() {
 
     log.info(
       { channel: body.type, address: body.address },
-      "Auto-verified guardian channel via platform auto-register",
+      "Auto-verified guardian channel via cloud auto-register",
     );
 
     return Response.json({

package/src/http/routes/guardian-pin.ts

@@ -21,7 +21,7 @@
  *   user who traversed tunnel, so it is cross-checked against the bound
  *   platform user id by {@link requireManagedGuardian}. A gateway takes
  *   this path when {@link acceptsTunnelAttestation} says it has a tunnel
- *   at all: a managed pod, or a locally hosted assistant whose gateway dialed
+ *   at all: a cloud pod, or a locally hosted assistant whose gateway dialed
  *   tunnel so the mobile app can reach it.
  * - **Everything else.** The caller presents an actor edge JWT and its
  *   principal is compared against the binding by {@link requireBoundGuardian}.
@@ -39,7 +39,7 @@ import { authorizeRuntimeAudioStream } from "./runtime-audio-stream.js";
 import { findCadetGuardian } from "../../auth/guardian-bootstrap.js";
 import type { GatewayConfig } from "../../config.js";
 import { requestHasTunnelBridgeAuth } from "../../tunnel/bridge-auth.js";
-import { readStoredPlatformUserId } from "../../platform-user-id.js";
+import { readStoredCloudUserId } from "../../cloud-user-id.js";
 
 const TUNNEL_USER_ID_HEADER = "x-tunnel-user-id";
 const TUNNEL_ORG_ID_HEADER = "x-tunnel-org-id";
@@ -47,16 +47,16 @@ const TUNNEL_ACTOR_HEADER = "x-tunnel-actor";
 
 /**
  * True when the gateway runs in managed/cloud mode (vembda + tunnel ingress).
- * Mirrors the `IS_PLATFORM` check used by the gateway's HTTP edge auth
+ * Mirrors the `IS_CLOUD` check used by the gateway's HTTP edge auth
  * (`src/http/middleware/auth.ts`) and feature-flag resolver.
  */
 export function isPlatformManaged(): boolean {
-  const v = process.env.IS_PLATFORM?.trim().toLowerCase();
+  const v = process.env.IS_CLOUD?.trim().toLowerCase();
   return v === "1" || v === "true";
 }
 
 /**
- * True when a tunnel-attested caller can reach this gateway at all: a managed
+ * True when a tunnel-attested caller can reach this gateway at all: a cloud
  * pod, or any gateway started with a tunnel (`TUNNEL_BASE_URL`), which is
  * how a locally hosted assistant is reachable from the mobile app.
  *
@@ -101,7 +101,7 @@ export function extractTunnelAttestedContext(
 /**
  * Managed-mode guardian check: cross-check a tunnel-attested caller's platform
  * user id against the bound platform user id, the same guard the
- * edge-auth middleware applies to guardian routes under the platform bypass.
+ * edge-auth middleware applies to guardian routes under the cloud bypass.
  *
  * Returns null when the caller is the guardian, else a 403/503 Response.
  */
@@ -112,7 +112,7 @@ export async function requireManagedGuardian(
   let storedUserId: string | undefined;
   let unreachable = false;
   try {
-    const result = await readStoredPlatformUserId();
+    const result = await readStoredCloudUserId();
     storedUserId = result.userId;
     unreachable = result.unreachable;
   } catch (err) {
@@ -172,8 +172,8 @@ export async function authorizeGuardianStream(
   config: GatewayConfig,
   log: Logger,
 ): Promise<Response | null> {
-  // Checked here as well as in the shared gate, because the managed path
-  // below skips that gate entirely: without this, a managed caller sending a
+  // Checked here as well as in the shared gate, because the cloud path
+  // below skips that gate entirely: without this, a cloud caller sending a
   // plain request would fall through to `server.upgrade` and get a 500.
   if (req.headers.get("upgrade")?.toLowerCase() !== "websocket") {
     return new Response("Upgrade Required", { status: 426 });

package/src/http/routes/inbound-register.ts

@@ -2,11 +2,11 @@
  * POST /inbound/register — auto-verify the guardian's email channel when
  * an email provider is registered.
  *
- * The platform provides `guardian_email` in the request body. For BYO
+ * The cloud provides `guardian_email` in the request body. For BYO
  * providers with an identity API (Mailgun), the gateway cross-verifies
  * the email against the API response. For BYO providers without one
  * (Resend), it validates that the stored API key is functional (proving
- * account ownership) and trusts the provided email. For platform-managed
+ * account ownership) and trusts the provided email. For cloud-managed
  * email (type "cadet"), the route's edge-scoped auth is sufficient.
  *
  * On success, creates a guardian email channel binding directly in both

package/src/http/routes/ingress-domains.test.ts

@@ -0,0 +1,129 @@
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { z } from "zod";
+
+import { ConfigFileCache } from "../../config-file-cache.js";
+import { handleSaveIngressDomain } from "./ingress-domains.js";
+
+// The handler's write path resolves the workspace config through
+// getWorkspaceDir; the mock redirects it into a per-test temp dir.
+let workspaceDir = "";
+
+mock.module("../../credential-reader.js", () => ({
+  getWorkspaceDir: () => workspaceDir,
+}));
+
+const SavedIngressSchema = z.looseObject({
+  ingress: z
+    .looseObject({
+      publicBaseUrl: z.string().optional(),
+      publicBaseUrlManagedBy: z.string().optional(),
+    })
+    .optional(),
+});
+
+let testDir = "";
+
+beforeEach(() => {
+  testDir = mkdtempSync(join(tmpdir(), "gateway-ingress-domains-test-"));
+  workspaceDir = testDir;
+});
+
+afterEach(() => {
+  rmSync(testDir, { recursive: true, force: true });
+});
+
+function request(body?: unknown): Request {
+  return new Request("http://127.0.0.1/v1/ingress/domains", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+}
+
+function readSavedIngress(): z.infer<typeof SavedIngressSchema>["ingress"] {
+  const raw = SavedIngressSchema.parse(
+    JSON.parse(readFileSync(join(workspaceDir, "config.json"), "utf-8")),
+  );
+  return raw.ingress;
+}
+
+describe("POST /v1/ingress/domains", () => {
+  test("records the tunnel URL as tunnel-managed in the gateway config", async () => {
+    const res = await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app" }),
+      "127.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(res.status).toBe(200);
+    expect(readSavedIngress()).toMatchObject({
+      publicBaseUrl: "https://foo.ngrok.app",
+      publicBaseUrlManagedBy: "tunnel",
+    });
+  });
+
+  test("normalizes the URL the same way every other public base URL is", async () => {
+    await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app/" }),
+      "127.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(readSavedIngress()?.publicBaseUrl).toBe("https://foo.ngrok.app");
+  });
+
+  test("is a no-op write when the URL is already recorded as tunnel-managed", async () => {
+    const configFile = new ConfigFileCache();
+    await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app" }),
+      "127.0.0.1",
+      configFile,
+    );
+    const afterFirst = readFileSync(join(workspaceDir, "config.json"), "utf-8");
+
+    await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app" }),
+      "127.0.0.1",
+      configFile,
+    );
+    const afterSecond = readFileSync(
+      join(workspaceDir, "config.json"),
+      "utf-8",
+    );
+
+    expect(afterSecond).toBe(afterFirst);
+  });
+
+  test("rejects non-loopback callers", async () => {
+    const res = await handleSaveIngressDomain(
+      request({ publicBaseUrl: "https://foo.ngrok.app" }),
+      "10.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(res.status).toBe(403);
+  });
+
+  test("rejects a body without a usable public URL", async () => {
+    const res = await handleSaveIngressDomain(
+      request({}),
+      "127.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(res.status).toBe(400);
+  });
+
+  test("rejects non-POST methods", async () => {
+    const res = await handleSaveIngressDomain(
+      new Request("http://127.0.0.1/v1/ingress/domains", { method: "GET" }),
+      "127.0.0.1",
+      new ConfigFileCache(),
+    );
+
+    expect(res.status).toBe(405);
+  });
+});

package/src/http/routes/ingress-domains.ts

@@ -0,0 +1,73 @@
+/**
+ * Loopback-guarded recording of a tunnel's public URL.
+ *
+ *   POST /v1/ingress/domains — the CLI (its ngrok agent, today) tells the
+ *   gateway the public URL its tunnel published; the gateway writes
+ *   `ingress.publicBaseUrl` + `publicBaseUrlManagedBy: "tunnel"` in its own
+ *   config via the same machinery its own tunnel uses, so both publishers
+ *   record through one path and the gateway's existing loss handling clears
+ *   it uniformly. Write-only: reads keep flowing through the config the
+ *   gateway already serves. While we ship one bundle the gateway still hosts
+ *   the ngrok-related logic; once the bundle splits, the gateway manages its
+ *   own tunnel (mycadet.ai vs <assistant>.mycadet.bot) and this route is what
+ *   the CLI-side publishers migrate onto.
+ */
+
+import { z } from "zod";
+
+import { normalizeHttpPublicBaseUrlWithoutTrailingSlash } from "@mycadet/service-contracts/ingress";
+
+import type { ConfigFileCache } from "../../config-file-cache.js";
+import { writeManagedPublicBaseUrl } from "../../tunnel/client.js";
+import {
+  enforceLoopbackOnly,
+  errorResponse,
+  rejectBrowserOrigin,
+} from "../loopback-guard.js";
+
+const SaveIngressDomainRequestSchema = z.object({
+  publicBaseUrl: z.string(),
+});
+
+export async function handleSaveIngressDomain(
+  req: Request,
+  clientIp: string,
+  configFile: ConfigFileCache,
+): Promise<Response> {
+  if (req.method !== "POST") {
+    return new Response("method not allowed", {
+      status: 405,
+      headers: { Allow: "POST" },
+    });
+  }
+
+  const guardError = enforceLoopbackOnly(req, clientIp, "ingress-domains");
+  if (guardError) return guardError;
+  const originError = rejectBrowserOrigin(req, clientIp, "ingress-domains");
+  if (originError) return originError;
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    body = {};
+  }
+  const parsed = SaveIngressDomainRequestSchema.safeParse(body);
+  if (!parsed.success) {
+    return errorResponse("BAD_REQUEST", "publicBaseUrl is required", 400);
+  }
+  const publicUrl = normalizeHttpPublicBaseUrlWithoutTrailingSlash(
+    parsed.data.publicBaseUrl,
+  );
+  if (!publicUrl) {
+    return errorResponse(
+      "BAD_REQUEST",
+      "publicBaseUrl must be an absolute http(s) URL",
+      400,
+    );
+  }
+
+  // No-op (no write) when the URL is already recorded as tunnel-managed.
+  await writeManagedPublicBaseUrl(publicUrl, configFile);
+  return Response.json({ ok: true });
+}

package/src/http/routes/live-voice-websocket.ts

@@ -119,7 +119,7 @@ async function checkLiveVoiceAuth(
         // the caller is *a* platform user who traversed tunnel, not that they
         // are THIS assistant's guardian, so cross-check the tunnel user id
         // against the bound platform user id (the same guardian check the
-        // edge-auth middleware applies to guardian routes under the managed
+        // edge-auth middleware applies to guardian routes under the cloud
         // bypass). Without it, any tunnel-authorized org user reaching this
         // assistant would be stamped guardian downstream.
         const guardianError = await requireManagedGuardian(
@@ -127,7 +127,7 @@ async function checkLiveVoiceAuth(
           log,
         );
         if (guardianError) return { response: guardianError };
-        // Tunnel attests a platform user, not an actor principal, so the
+        // Tunnel attests a cloud user, not an actor principal, so the
         // principal comes from the gateway's own binding rather than from
         // anything the request carried.
         const guardian = await findCadetGuardian();

package/src/http/routes/log-export.test.ts

@@ -112,7 +112,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/http/routes/log-tail.test.ts

@@ -79,7 +79,6 @@ function makeConfig(dir: string | undefined): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: true,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as GatewayConfig;
 }

package/src/http/routes/migration-proxy.ts

@@ -452,7 +452,7 @@ async function handleSyncBytesImport(
  *
  * Returns the job's current status on 200, or 404 if the jobId is unknown
  * (never issued, or pruned after the TTL). The response shape deliberately
- * mirrors the platform's existing `/v1/migrations/import/:jobId/status/`
+ * mirrors the cloud's existing `/v1/migrations/import/:jobId/status/`
  * endpoint so `PlatformMigrationClient.pollImportStatus` works against
  * either surface with no changes.
  */

package/src/http/routes/plugin-webhook-websocket.test.ts

@@ -176,7 +176,7 @@ describe("upgrade gate", () => {
   });
 
   it("upgrades a cadet-signed declaration nobody approved", async () => {
-    // Only a caller holding the platform secret can open it, and the user
+    // Only a caller holding the cloud secret can open it, and the user
     // extended that trust when they connected their account.
     const handle = makeHandler({
       resolve: () =>
@@ -203,7 +203,7 @@ describe("upgrade gate", () => {
     expect(upgrades).toHaveLength(1);
   });
 
-  it("still demands the platform signature on an unapproved cadet route", async () => {
+  it("still demands the cloud signature on an unapproved cadet route", async () => {
     // Skipping approval did not skip authentication.
     const handle = makeHandler({
       resolve: () =>
@@ -378,7 +378,7 @@ describe("handshake signature", () => {
     expect(upgrades).toEqual([]);
   });
 
-  it("verifies a cadet-signed route against the platform secret", async () => {
+  it("verifies a cadet-signed route against the cloud secret", async () => {
     const handle = makeHandler({
       resolve: () => approvedWith([{ ...ROUTE, signer: "cadet" as const }]),
     });