@mycadet/gateway 0.12.7 → 0.12.9

package/src/risk/skill-risk-classifier.test.ts

@@ -19,10 +19,10 @@ describe("SkillLoadRiskClassifier", () => {
     expect(result.matchType).toBe("registry");
   });
 
-  test("scaffold_managed_skill is always High risk", async () => {
+  test("scaffold_cloud_skill is always High risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
+      toolName: "scaffold_cloud_skill",
     });
     expect(result.riskLevel).toBe("high");
     expect(result.reason).toBe(
@@ -32,10 +32,10 @@ describe("SkillLoadRiskClassifier", () => {
     expect(result.matchType).toBe("registry");
   });
 
-  test("delete_managed_skill is always High risk", async () => {
+  test("delete_cloud_skill is always High risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "delete_managed_skill",
+      toolName: "delete_cloud_skill",
     });
     expect(result.riskLevel).toBe("high");
     expect(result.reason).toBe(
@@ -55,19 +55,19 @@ describe("SkillLoadRiskClassifier", () => {
     expect(result.reason).toBe("Skill load (default)");
   });
 
-  test("scaffold_managed_skill with skillSelector is still High risk", async () => {
+  test("scaffold_cloud_skill with skillSelector is still High risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
+      toolName: "scaffold_cloud_skill",
       skillSelector: "new-skill",
     });
     expect(result.riskLevel).toBe("high");
   });
 
-  test("delete_managed_skill with skillSelector is still High risk", async () => {
+  test("delete_cloud_skill with skillSelector is still High risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "delete_managed_skill",
+      toolName: "delete_cloud_skill",
       skillSelector: "old-skill",
     });
     expect(result.riskLevel).toBe("high");
@@ -163,56 +163,56 @@ describe("allowlistOptions", () => {
     ]);
   });
 
-  test("scaffold_managed_skill produces skill-specific + wildcard options", async () => {
+  test("scaffold_cloud_skill produces skill-specific + wildcard options", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
+      toolName: "scaffold_cloud_skill",
       skillSelector: "new-skill",
     });
     expect(result.allowlistOptions).toEqual([
       {
         label: "new-skill",
         description: "This skill only",
-        pattern: "scaffold_managed_skill:new-skill",
+        pattern: "scaffold_cloud_skill:new-skill",
       },
       {
-        label: "scaffold_managed_skill:*",
+        label: "scaffold_cloud_skill:*",
         description: "All managed skill scaffolds",
-        pattern: "scaffold_managed_skill:*",
+        pattern: "scaffold_cloud_skill:*",
       },
     ]);
   });
 
-  test("delete_managed_skill produces skill-specific + wildcard options", async () => {
+  test("delete_cloud_skill produces skill-specific + wildcard options", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "delete_managed_skill",
+      toolName: "delete_cloud_skill",
       skillSelector: "old-skill",
     });
     expect(result.allowlistOptions).toEqual([
       {
         label: "old-skill",
         description: "This skill only",
-        pattern: "delete_managed_skill:old-skill",
+        pattern: "delete_cloud_skill:old-skill",
       },
       {
-        label: "delete_managed_skill:*",
+        label: "delete_cloud_skill:*",
         description: "All managed skill deletes",
-        pattern: "delete_managed_skill:*",
+        pattern: "delete_cloud_skill:*",
       },
     ]);
   });
 
-  test("scaffold_managed_skill without selector produces only wildcard", async () => {
+  test("scaffold_cloud_skill without selector produces only wildcard", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
+      toolName: "scaffold_cloud_skill",
     });
     expect(result.allowlistOptions).toEqual([
       {
-        label: "scaffold_managed_skill:*",
+        label: "scaffold_cloud_skill:*",
         description: "All managed skill scaffolds",
-        pattern: "scaffold_managed_skill:*",
+        pattern: "scaffold_cloud_skill:*",
       },
     ]);
   });
@@ -228,8 +228,8 @@ describe("singleton", () => {
   test("singleton produces same results as fresh instance", async () => {
     const inputs: SkillClassifierInput[] = [
       { toolName: "skill_load" },
-      { toolName: "scaffold_managed_skill" },
-      { toolName: "delete_managed_skill" },
+      { toolName: "scaffold_cloud_skill" },
+      { toolName: "delete_cloud_skill" },
     ];
 
     const fresh = new SkillLoadRiskClassifier();

package/src/risk/skill-risk-classifier.ts

@@ -4,8 +4,8 @@
  * Implements RiskClassifier<SkillClassifierInput> with constant risk levels
  * for each skill tool type:
  * - skill_load: Low (read-only skill loading)
- * - scaffold_managed_skill: High (writes persistent skill source code)
- * - delete_managed_skill: High (removes persistent skill source code)
+ * - scaffold_cloud_skill: High (writes persistent skill source code)
+ * - delete_cloud_skill: High (removes persistent skill source code)
  *
  * Gateway adaptation: accepts pre-resolved skill metadata via
  * SkillClassifierInput.resolvedMetadata instead of importing the assistant's
@@ -50,7 +50,7 @@ export interface ResolvedSkillMetadata {
 /** Input to the skill risk classifier. */
 export interface SkillClassifierInput {
   /** Which skill tool is being invoked. */
-  toolName: "skill_load" | "scaffold_managed_skill" | "delete_managed_skill";
+  toolName: "skill_load" | "scaffold_cloud_skill" | "delete_cloud_skill";
   /** Optional skill selector (e.g. skill name or path). */
   skillSelector?: string;
   /**
@@ -134,12 +134,12 @@ function buildSkillLoadAllowlistOptions(
 /**
  * Build allowlist options for scaffold/delete managed skill tools.
  */
-function buildManagedSkillAllowlistOptions(
+function buildCloudSkillAllowlistOptions(
   toolName: string,
   skillId?: string,
 ): AllowlistOption[] {
   const toolLabel =
-    toolName === "scaffold_managed_skill" ? "scaffold" : "delete";
+    toolName === "scaffold_cloud_skill" ? "scaffold" : "delete";
   const options: AllowlistOption[] = [];
   if (skillId) {
     options.push({
@@ -200,25 +200,25 @@ export class SkillLoadRiskClassifier implements RiskClassifier<SkillClassifierIn
         };
         break;
       }
-      case "scaffold_managed_skill":
+      case "scaffold_cloud_skill":
         assessment = {
           riskLevel: "high",
           reason: "Skill scaffold — writes persistent skill source code",
           scopeOptions: [],
           matchType: "registry",
-          allowlistOptions: buildManagedSkillAllowlistOptions(
+          allowlistOptions: buildCloudSkillAllowlistOptions(
             toolName,
             skillSelector,
           ),
         };
         break;
-      case "delete_managed_skill":
+      case "delete_cloud_skill":
         assessment = {
           riskLevel: "high",
           reason: "Skill delete — removes persistent skill source code",
           scopeOptions: [],
           matchType: "registry",
-          allowlistOptions: buildManagedSkillAllowlistOptions(
+          allowlistOptions: buildCloudSkillAllowlistOptions(
             toolName,
             skillSelector,
           ),
@@ -227,7 +227,7 @@ export class SkillLoadRiskClassifier implements RiskClassifier<SkillClassifierIn
     }
 
     // User override is applied after normal classification. This means a user-defined
-    // rule CAN lower a security-escalated risk (e.g., scaffold_managed_skill).
+    // rule CAN lower a security-escalated risk (e.g., scaffold_cloud_skill).
     // This is intentional — user overrides are authoritative for users who explicitly
     // created them. Uses resolved skillId from metadata (when available), and
     // skill_load_dynamic as the tool key for dynamic skills.

package/src/runtime/client.ts

@@ -397,12 +397,12 @@ function extractPlatformCallbackAssistantId(
 
 function resolveTunnelBaseWssUrl(
   config: GatewayConfig,
-  platformAssistantId?: string,
+  cloudAssistantId?: string,
 ): string | undefined {
-  if (!config.tunnelBaseUrl || !platformAssistantId) return undefined;
+  if (!config.tunnelBaseUrl || !cloudAssistantId) return undefined;
 
   const withPath =
-    config.tunnelBaseUrl.replace(/\/+$/, "") + "/" + platformAssistantId;
+    config.tunnelBaseUrl.replace(/\/+$/, "") + "/" + cloudAssistantId;
   const normalizedTunnelUrl = normalizePublicBaseUrl(withPath);
   return normalizedTunnelUrl
     ? toWebSocketBaseUrl(normalizedTunnelUrl)
@@ -418,7 +418,7 @@ function resolveTunnelBaseWssUrl(
  * 2. `ingress.publicBaseUrl` from the config file when it is a real public
  *    gateway base URL — written by Tunnel after tunnel registration, or set
  *    manually for self-hosted.
- * 3. `TUNNEL_BASE_URL` + the platform assistant ID from a configured callback
+ * 3. `TUNNEL_BASE_URL` + the cloud assistant ID from a configured callback
  *    URL or credential cache.
  *
  * Returns `undefined` when no source provides a value — the placeholder
@@ -428,7 +428,7 @@ function resolveTunnelBaseWssUrl(
 export function resolvePublicBaseWssUrl(
   config: GatewayConfig,
   configFile?: ConfigFileCache,
-  platformAssistantId?: string,
+  cloudAssistantId?: string,
   validatedPublicUrl?: string,
 ): string | undefined {
   const raw = configFile?.getString("ingress", "publicBaseUrl");
@@ -450,7 +450,7 @@ export function resolvePublicBaseWssUrl(
 
   return resolveTunnelBaseWssUrl(
     config,
-    configuredCallbackAssistantId ?? platformAssistantId,
+    configuredCallbackAssistantId ?? cloudAssistantId,
   );
 }
 
@@ -462,12 +462,12 @@ export function resolvePublicBaseWssUrl(
  * Sources (in priority order):
  * 1. `ingress.publicBaseUrl` from the config file — written by Tunnel after
  *    tunnel registration, or set manually for self-hosted.
- * 2. `TUNNEL_BASE_URL` + the platform assistant ID. This mirrors the Twilio
+ * 2. `TUNNEL_BASE_URL` + the cloud assistant ID. This mirrors the Twilio
  *    resolver's fallback and stays valid even while the tunnel is briefly
  *    disconnected (Tunnel clears the config value on every reconnect), so
  *    these links no longer break on a tunnel flap.
  *
- * The platform assistant ID is read through a lazy getter so callers that
+ * The cloud assistant ID is read through a lazy getter so callers that
  * resolve from the config value (self-hosted / manual URL) never load
  * identity. A transient credential-store outage must not fail those callers.
  *
@@ -476,14 +476,14 @@ export function resolvePublicBaseWssUrl(
 export async function resolvePublicHttpBaseUrl(
   config: GatewayConfig,
   configFile?: ConfigFileCache,
-  getPlatformAssistantId?: () => Promise<string | undefined>,
+  getCloudAssistantId?: () => Promise<string | undefined>,
 ): Promise<string | undefined> {
   const resolved =
     normalizeHttpPublicBaseUrl(
       configFile?.getString("ingress", "publicBaseUrl"),
     ) ??
     normalizeHttpPublicBaseUrl(
-      await resolveTunnelHttpFallback(config, getPlatformAssistantId),
+      await resolveTunnelHttpFallback(config, getCloudAssistantId),
     );
 
   // Drop a root-path trailing slash so callers can append `/…` without
@@ -492,18 +492,18 @@ export async function resolvePublicHttpBaseUrl(
 }
 
 /**
- * Build the `TUNNEL_BASE_URL/<platform-assistant-id>` fallback base URL. Only
- * reads the platform assistant ID (via the getter) when `tunnelBaseUrl` is
+ * Build the `TUNNEL_BASE_URL/<cloud-assistant-id>` fallback base URL. Only
+ * reads the cloud assistant ID (via the getter) when `tunnelBaseUrl` is
  * configured, so it's skipped entirely on self-hosted deployments.
  */
 async function resolveTunnelHttpFallback(
   config: GatewayConfig,
-  getPlatformAssistantId?: () => Promise<string | undefined>,
+  getCloudAssistantId?: () => Promise<string | undefined>,
 ): Promise<string | undefined> {
-  if (!config.tunnelBaseUrl || !getPlatformAssistantId) return undefined;
-  const platformAssistantId = await getPlatformAssistantId();
-  if (!platformAssistantId) return undefined;
-  return config.tunnelBaseUrl.replace(/\/+$/, "") + "/" + platformAssistantId;
+  if (!config.tunnelBaseUrl || !getCloudAssistantId) return undefined;
+  const cloudAssistantId = await getCloudAssistantId();
+  if (!cloudAssistantId) return undefined;
+  return config.tunnelBaseUrl.replace(/\/+$/, "") + "/" + cloudAssistantId;
 }
 
 /**

package/src/schema.ts

@@ -302,7 +302,7 @@ export function buildSchema(): Record<string, unknown> {
               },
             },
             "405": {
-              description: "Method not allowed (only POST accepted)",
+              description: "Method not allowed, only POST accepted",
               content: {
                 "application/json": {
                   schema: { $ref: "#/components/schemas/ErrorResponse" },
@@ -368,7 +368,7 @@ export function buildSchema(): Record<string, unknown> {
               },
             },
             "405": {
-              description: "Method not allowed (only POST accepted)",
+              description: "Method not allowed, only POST accepted",
               content: {
                 "application/json": {
                   schema: { $ref: "#/components/schemas/ErrorResponse" },
@@ -822,7 +822,7 @@ export function buildSchema(): Record<string, unknown> {
               "application/json": {
                 schema: {
                   type: "object",
-                  description: "Mailgun webhook payload (JSON).",
+                  description: "Mailgun webhook payload as JSON.",
                 },
               },
             },
@@ -945,7 +945,7 @@ export function buildSchema(): Record<string, unknown> {
         get: {
           summary: "Twilio Media Stream WebSocket",
           description:
-            "Accepts a WebSocket upgrade from Twilio Media Streams and bidirectionally proxies frames to the assistant runtime's /v1/calls/media-stream endpoint. Handshake metadata (callSessionId and auth token) is carried in URL path segments (e.g. /webhooks/twilio/media-stream/<callSessionId>/<token>) because Twilio Media Streams does not reliably preserve query parameters across the WebSocket upgrade. Legacy query-parameter-based handshake is still supported as a fallback.",
+            "Accepts a WebSocket upgrade from Twilio Media Streams and bidirectionally proxies frames to the assistant runtime's /v1/calls/media-stream endpoint. Handshake metadata, the callSessionId and auth token, is carried in URL path segments, e.g. /webhooks/twilio/media-stream/<callSessionId>/<token>, because Twilio Media Streams does not reliably preserve query parameters across the WebSocket upgrade. Legacy query-parameter-based handshake is still supported as a fallback.",
           operationId: "twilioMediaStreamWebsocket",
           parameters: [
             {
@@ -1003,7 +1003,7 @@ export function buildSchema(): Record<string, unknown> {
               required: false,
               schema: { type: "string" },
               description:
-                "Optional STT provider identifier (e.g. 'deepgram', 'google-gemini'). Forwarded as compatibility metadata: the runtime resolves the transcriber from config (`services.stt.roles.dictation`, else `services.stt.provider`), not from this parameter. When supplied and it disagrees with the provider that resolves to, the runtime logs a mismatch warning.",
+                "Optional STT provider identifier, e.g. 'deepgram' or 'google-gemini'. Forwarded as compatibility metadata: the runtime resolves the transcriber from config (`services.stt.roles.dictation`, else `services.stt.provider`), not from this parameter. When supplied and it disagrees with the provider that resolves to, the runtime logs a mismatch warning.",
             },
             {
               name: "mimeType",
@@ -1011,7 +1011,7 @@ export function buildSchema(): Record<string, unknown> {
               required: true,
               schema: { type: "string" },
               description:
-                "MIME type of the audio being streamed (e.g. 'audio/webm;codecs=opus').",
+                "MIME type of the audio being streamed, e.g. 'audio/webm;codecs=opus'.",
             },
             {
               name: "sampleRate",
@@ -1035,7 +1035,7 @@ export function buildSchema(): Record<string, unknown> {
                 "WebSocket upgrade successful — bidirectional STT audio/transcription frame proxying begins.",
             },
             "400": {
-              description: "Missing required query parameter (mimeType)",
+              description: "Missing required query parameter: mimeType",
               content: {
                 "text/plain": {
                   schema: { type: "string" },
@@ -1084,7 +1084,7 @@ export function buildSchema(): Record<string, unknown> {
               required: true,
               schema: { type: "string" },
               description:
-                "MIME type of the narration audio being streamed (e.g. 'audio/pcm').",
+                "MIME type of the narration audio being streamed, e.g. 'audio/pcm'.",
             },
             {
               name: "sampleRate",
@@ -1124,7 +1124,7 @@ export function buildSchema(): Record<string, unknown> {
                 "WebSocket upgrade successful - bidirectional watch stream frame proxying begins.",
             },
             "400": {
-              description: "Missing required query parameter (mimeType)",
+              description: "Missing required query parameter: mimeType",
               content: {
                 "text/plain": {
                   schema: { type: "string" },
@@ -1739,7 +1739,7 @@ export function buildSchema(): Record<string, unknown> {
             "404": { description: "Channel not found" },
             "409": {
               description:
-                "Invalid state transition (e.g. revoking a blocked channel)",
+                "Invalid state transition, e.g. revoking a blocked channel",
             },
             "503": { description: "Bearer token not configured" },
             "502": { description: "Failed to reach assistant runtime" },
@@ -1751,7 +1751,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Mark a contact channel as verified by guardian attestation",
           description:
-            "Guardian-only endpoint that attests a contact channel as verified without exchanging a challenge code. The caller must be the bound guardian — verified either by JWT actor principal (laptop / docker) or by `X-Cadet-User-Id` matching the stored platform user id (platform-managed). Idempotent: an already-verified channel returns 200 without re-writing. Mutation is gateway-DB primary with a best-effort dual-write to the assistant daemon DB for sync during the gateway-security-migration transition.",
+            "Guardian-only endpoint that attests a contact channel as verified without exchanging a challenge code. The caller must be the bound guardian — verified either by JWT actor principal (laptop / docker) or by `X-Cadet-User-Id` matching the stored platform user id (cloud-managed). Idempotent: an already-verified channel returns 200 without re-writing. Mutation is gateway-DB primary with a best-effort dual-write to the assistant daemon DB for sync during the gateway-security-migration transition.",
           operationId: "contactsChannelVerify",
           security: [{ BearerAuth: [] }],
           parameters: [
@@ -1983,7 +1983,7 @@ export function buildSchema(): Record<string, unknown> {
               required: false,
               schema: { type: "string" },
               description:
-                "Optional verification purpose (e.g. guardian, trusted-contact).",
+                "Optional verification purpose, e.g. guardian or trusted-contact.",
             },
             {
               name: "contactChannelId",
@@ -2126,7 +2126,7 @@ export function buildSchema(): Record<string, unknown> {
             "Loopback-only endpoint that removes the guardian-init lock file so that /v1/guardian/init can be called again. When bootstrap secrets are configured, callers must provide a valid x-bootstrap-secret header. Used by the desktop app to recover from a lost actor token.",
           operationId: "guardianResetBootstrap",
           responses: {
-            "200": { description: "Lock file removed (or already absent)" },
+            "200": { description: "Lock file removed, or already absent" },
             "403": {
               description:
                 "Forbidden — non-loopback origin or invalid bootstrap secret",
@@ -2183,7 +2183,7 @@ export function buildSchema(): Record<string, unknown> {
           responses: {
             "200": { description: "New access token returned" },
             "400": {
-              description: "Missing required field (refreshToken or deviceId)",
+              description: "Missing required field: refreshToken or deviceId",
             },
             "401": { description: "Unauthorized — invalid token" },
             "403": {
@@ -2407,7 +2407,7 @@ export function buildSchema(): Record<string, unknown> {
           operationId: "oauthProvidersList",
           parameters: [
             {
-              name: "supports_managed_mode",
+              name: "supports_cloud_mode",
               in: "query",
               required: false,
               schema: { type: "boolean" },
@@ -2509,7 +2509,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Create OAuth app",
           description:
-            "Authenticated gateway endpoint that creates or updates a user-managed OAuth app by proxying to the assistant runtime.",
+            "Authenticated gateway endpoint that creates or updates a user-cloud OAuth app by proxying to the assistant runtime.",
           operationId: "oauthAppsCreate",
           security: [{ BearerAuth: [] }],
           requestBody: {
@@ -2546,7 +2546,7 @@ export function buildSchema(): Record<string, unknown> {
         delete: {
           summary: "Delete OAuth app",
           description:
-            "Authenticated gateway endpoint that deletes a user-managed OAuth app and disconnects its linked accounts by proxying to the assistant runtime.",
+            "Authenticated gateway endpoint that deletes a user-cloud OAuth app and disconnects its linked accounts by proxying to the assistant runtime.",
           operationId: "oauthAppsDelete",
           parameters: [
             {
@@ -3314,11 +3314,11 @@ export function buildSchema(): Record<string, unknown> {
                   properties: {
                     startTime: {
                       type: "number",
-                      description: "Start of time range (epoch ms)",
+                      description: "Start of time range, in epoch ms",
                     },
                     endTime: {
                       type: "number",
-                      description: "End of time range (epoch ms)",
+                      description: "End of time range, in epoch ms",
                     },
                     auditLimit: {
                       type: "number",
@@ -3381,7 +3381,7 @@ export function buildSchema(): Record<string, unknown> {
                 enum: ["trace", "debug", "info", "warn", "error", "fatal"],
                 default: "info",
               },
-              description: "Minimum pino level name (default: info)",
+              description: "Minimum pino level name, defaults to info",
             },
             {
               name: "module",
@@ -3427,7 +3427,7 @@ export function buildSchema(): Record<string, unknown> {
         get: {
           summary: "List trust rules",
           description:
-            "Authenticated gateway endpoint that lists trust rules from the SQLite-backed store. By default returns user-relevant rules (user_defined + user-modified defaults). Supports `origin`, `tool`, and `include_deleted` query filters.",
+            "Authenticated gateway endpoint that lists trust rules from the SQLite-backed store. By default returns user-relevant rules: user_defined + user-modified defaults. Supports `origin`, `tool`, and `include_deleted` query filters.",
           operationId: "trustRulesGet",
           security: [{ BearerAuth: [] }],
           parameters: [
@@ -3752,7 +3752,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Resolve the effective channel-permission threshold",
           description:
-            "Authenticated gateway endpoint that resolves the cascade for one coordinate (adapter, optional channelType/channelExternalId, contact-type) and returns the winning cell's threshold and scope, or null when no cell matches so the caller falls through to the global thresholds. Read-only; a POST verb path because the composite query travels in the body, same rationale as /delete.",
+            "Authenticated gateway endpoint that resolves the cascade for one coordinate — adapter, optional channelType/channelExternalId, contact-type — and returns the winning cell's threshold and scope, or null when no cell matches so the caller falls through to the global thresholds. Read-only; a POST verb path because the composite query travels in the body, same rationale as /delete.",
           operationId: "channelPermissionResolve",
           security: [{ BearerAuth: [] }],
           requestBody: {
@@ -3764,7 +3764,7 @@ export function buildSchema(): Record<string, unknown> {
             },
           },
           responses: {
-            "200": { description: "Resolution returned (resolved or null)" },
+            "200": { description: "Resolution returned — resolved or null" },
             "400": { description: "Invalid request payload or adapter" },
             "401": {
               description: "Unauthorized — missing or invalid bearer token",
@@ -3777,7 +3777,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Delete a channel-permission matrix cell",
           description:
-            "Authenticated gateway endpoint that removes one channel-permission cell by its composite key (selector × contact-type), letting the next cascade tier up win. A POST verb path because cells have no row id and DELETE request bodies are unreliable through proxies.",
+            "Authenticated gateway endpoint that removes one channel-permission cell by its composite key, selector × contact-type, letting the next cascade tier up win. A POST verb path because cells have no row id and DELETE request bodies are unreliable through proxies.",
           operationId: "channelPermissionOverrideDelete",
           security: [{ BearerAuth: [] }],
           requestBody: {
@@ -4152,7 +4152,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Kick off an async export-to-GCS job",
           description:
-            "Transparent proxy to the assistant daemon's `POST /v1/migrations/export-to-gcs` endpoint. The daemon schedules a background export job that streams the workspace backup to the supplied signed GCS upload URL and returns `202 Accepted` with a `job_id`. Callers poll `GET /v1/migrations/jobs/{jobId}` for progress. Registered explicitly (not via the runtime-proxy catch-all) for dedicated auth and timeout handling.",
+            "Transparent proxy to the assistant daemon's `POST /v1/migrations/export-to-gcs` endpoint. The daemon schedules a background export job that streams the workspace backup to the supplied signed GCS upload URL and returns `202 Accepted` with a `job_id`. Callers poll `GET /v1/migrations/jobs/{jobId}` for progress. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
           operationId: "migrationExportToGcs",
           security: [{ BearerAuth: [] }],
           requestBody: {
@@ -4191,7 +4191,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Kick off an async import-from-GCS job",
           description:
-            "Transparent proxy to the assistant daemon's `POST /v1/migrations/import-from-gcs` endpoint. The daemon schedules a background import job that fetches a `.vbundle` archive at the supplied `bundle_url` and streams it through the importer, returning `202 Accepted` with a `job_id`. Callers poll `GET /v1/migrations/jobs/{jobId}` for progress. Registered explicitly (not via the runtime-proxy catch-all) for dedicated auth and timeout handling.",
+            "Transparent proxy to the assistant daemon's `POST /v1/migrations/import-from-gcs` endpoint. The daemon schedules a background import job that fetches a `.vbundle` archive at the supplied `bundle_url` and streams it through the importer, returning `202 Accepted` with a `job_id`. Callers poll `GET /v1/migrations/jobs/{jobId}` for progress. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
           operationId: "migrationImportFromGcs",
           security: [{ BearerAuth: [] }],
           requestBody: {
@@ -4241,7 +4241,7 @@ export function buildSchema(): Record<string, unknown> {
         get: {
           summary: "Poll unified migration job status",
           description:
-            "Transparent proxy to the assistant daemon's `GET /v1/migrations/jobs/{job_id}` endpoint. Returns the current status of an async export-to-GCS or import-from-GCS job tracked by the daemon's migration job registry. Registered explicitly (not via the runtime-proxy catch-all) for dedicated auth and timeout handling.",
+            "Transparent proxy to the assistant daemon's `GET /v1/migrations/jobs/{job_id}` endpoint. Returns the current status of an async export-to-GCS or import-from-GCS job tracked by the daemon's migration job registry. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
           operationId: "migrationJobStatus",
           security: [{ BearerAuth: [] }],
           parameters: [
@@ -4346,7 +4346,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Auto-verify guardian email",
           description:
-            "Called by the platform to auto-verify the guardian's email channel. For BYO providers (resend, mailgun), validates the provider API key. For platform-managed email (cadet), the route's auth is sufficient. Creates a guardian email channel binding.",
+            "Called by the cloud to auto-verify the guardian's email channel. For BYO providers (resend, mailgun), validates the provider API key. For cloud-managed email (cadet), the route's auth is sufficient. Creates a guardian email channel binding.",
           operationId: "inboundRegister",
           security: [{ BearerAuth: [] }],
           requestBody: {
@@ -4360,7 +4360,7 @@ export function buildSchema(): Record<string, unknown> {
                     type: {
                       type: "string",
                       description:
-                        "Email provider type (e.g. resend, mailgun, cadet)",
+                        "Email provider type, e.g. resend, mailgun, cadet",
                     },
                     guardian_email: {
                       type: "string",

package/src/telegram/send.test.ts

@@ -39,7 +39,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };