@mycadet/gateway 0.12.7 → 0.12.9

package/src/telegram/webhook-manager.ts

@@ -7,13 +7,13 @@ import { credentialKey } from "../credential-key.js";
 import { registerWebhookIngressRoute } from "../db/webhook-ingress-route-store.js";
 import { fetchImpl } from "../fetch.js";
 import {
-  arePlatformFeaturesEnabled,
+  areCloudFeaturesEnabled,
   isFeatureFlagEnabled,
-  isPlatformMode,
+  isCloudServedBuild,
 } from "../feature-flag-resolver.js";
 import { callTelegramApi } from "./api.js";
 import { getLogger } from "../logger.js";
-import { resolvePlatformAssistantIdOrUndefined } from "../platform-identity.js";
+import { resolveCloudAssistantIdOrUndefined } from "../cloud-identity.js";
 
 const log = getLogger("webhook-manager");
 const TELEGRAM_CALLBACK_PATH = "webhooks/telegram";
@@ -46,26 +46,21 @@ interface PlatformCallbackRouteResponse {
 async function registerManagedTelegramCallbackRoute(
   caches?: WebhookManagerCaches,
 ): Promise<string | undefined> {
-  if (!arePlatformFeaturesEnabled()) {
+  if (!areCloudFeaturesEnabled()) {
     log.debug(
       "Platform features disabled — skipping managed Telegram callback registration",
     );
     return undefined;
   }
 
-  const [platformBaseUrlRaw, assistantApiKeyRaw] = caches?.credentials
-    ? await Promise.all([
-        caches.credentials.get(credentialKey("cadet", "platform_base_url")),
-        caches.credentials.get(credentialKey("cadet", "assistant_api_key")),
-      ])
-    : [undefined, undefined];
-
-  // Fall back to env vars when managed pod credentials are not yet cached,
-  // matching the daemon's resolvePlatformCallbackRegistrationContext().
-  const platformBaseUrl = (
-    platformBaseUrlRaw?.trim() ||
-    process.env.CADET_PLATFORM_URL?.trim() ||
-    ""
+  const assistantApiKeyRaw = caches?.credentials
+    ? await caches.credentials.get(credentialKey("cadet", "assistant_api_key"))
+    : undefined;
+
+  // The base URL resolves from the environment only — the credential store
+  // never carries it.
+  const cloudBaseUrl = (
+    process.env.CADET_CLOUD_URL?.trim() || ""
   ).replace(/\/+$/, "");
 
   const assistantCredential =
@@ -73,12 +68,12 @@ async function registerManagedTelegramCallbackRoute(
     process.env.ASSISTANT_API_KEY?.trim() ||
     undefined;
 
-  const assistantId = await resolvePlatformAssistantIdOrUndefined();
+  const assistantId = await resolveCloudAssistantIdOrUndefined();
 
-  if (!platformBaseUrl || !assistantCredential || !assistantId) {
+  if (!cloudBaseUrl || !assistantCredential || !assistantId) {
     log.debug(
       {
-        hasPlatformBaseUrl: !!platformBaseUrl,
+        hasPlatformBaseUrl: !!cloudBaseUrl,
         hasApiKey: !!assistantCredential,
         hasAssistantId: !!assistantId,
       },
@@ -104,8 +99,8 @@ async function registerManagedTelegramCallbackRoute(
     log.debug("Could not resolve Telegram bot username for source_identifier");
   }
 
-  // Self-hosted assistants send their public ingress URL so the platform
-  // can register a callback that points at this gateway. Platform pods may
+  // Self-hosted assistants send their public ingress URL so the cloud
+  // can register a callback that points at this gateway. Cloud pods may
   // also include it; Django ignores a client-provided base for those.
   const ingressUrl = readIngressBaseUrl(caches);
 
@@ -122,7 +117,7 @@ async function registerManagedTelegramCallbackRoute(
   }
 
   const response = await fetchImpl(
-    `${platformBaseUrl}/v1/internal/gateway/callback-routes/register/`,
+    `${cloudBaseUrl}/v1/internal/gateway/callback-routes/register/`,
     {
       method: "POST",
       headers: {
@@ -177,7 +172,7 @@ function readIngressBaseUrl(caches?: WebhookManagerCaches): string | undefined {
  * path is unclaimed would register a webhook that every delivery bounces off.
  *
  * Returns undefined when the tunnel has published no URL yet or the claim
- * fails, which leaves the caller on the managed callback route.
+ * fails, which leaves the caller on the cloud callback route.
  */
 function resolveTunnelTelegramWebhookUrl(
   caches?: WebhookManagerCaches,
@@ -195,7 +190,7 @@ function resolveTunnelTelegramWebhookUrl(
   } catch (err) {
     log.error(
       { err },
-      "Could not claim the Telegram webhook path in the ingress registry; falling back to the managed callback route",
+      "Could not claim the Telegram webhook path in the ingress registry; falling back to the cloud callback route",
     );
     return undefined;
   }
@@ -213,33 +208,33 @@ async function resolveExpectedTelegramWebhookUrl(
   // resolver declines makes setup report success while setWebhook never runs
   // (LUM-2899).
   //
-  //   1. Platform pods (`IS_PLATFORM`) with `tunnel-webhooks` off always use
-  //      the managed callback route and never consult ingress at all. A pod's
+  //   1. Cloud pods (`IS_CLOUD`) with `tunnel-webhooks` off always use
+  //      the cloud callback route and never consult ingress at all. A pod's
   //      `ingress.publicBaseUrl` is written by the Tunnel client, not by
   //      a user, and that address is only live while the tunnel is:
   //      `clearManagedPublicBaseUrl` wipes the key when the tunnel drops, but
   //      Telegram keeps delivering to whatever was last registered, so a pod
   //      that resolved through the address alone would be pointed at a dead
-  //      one. The platform callback route is the pod's stable inbound address.
+  //      one. The cloud callback route is the pod's stable inbound address.
   //   2. With the flag on, a pod points Telegram at its published Tunnel URL
   //      and claims that path in the ingress registry first, so the tunnel
   //      edge and the bridge both admit it. A pod with no published URL, or a
-  //      claim that fails, still falls back to the managed callback route.
+  //      claim that fails, still falls back to the cloud callback route.
   //      Both the tunnel publishing a URL and the flag flipping re-run this
   //      reconciliation, so a pod moves between the two addresses in either
   //      direction without a restart.
   //   3. An explicit `ingress.enabled: false` is a decision not to accept
   //      inbound webhooks at all; it precedes both tiers below and actively
   //      deregisters, so `reconcileTelegramWebhook` handles it before calling
-  //      this resolver. Platform pods are exempt (see the comment there).
+  //      this resolver. Cloud pods are exempt (see the comment there).
   //   4. A configured public ingress URL wins (a self-hosted tunnel, or the
   //      Tunnel-published URL while the tunnel is registered).
   //   5. Platform-connected local assistants holding cadet credentials fall
-  //      back to a managed platform callback route.
+  //      back to a cloud platform callback route.
   //      `registerManagedTelegramCallbackRoute` self-gates on platform
   //      features and credential presence, so a gateway with no platform
   //      context resolves to undefined and reconciliation skips.
-  if (isPlatformMode()) {
+  if (isCloudServedBuild()) {
     if (isFeatureFlagEnabled("tunnel-webhooks")) {
       const tunnelUrl = resolveTunnelTelegramWebhookUrl(caches);
       if (tunnelUrl) {
@@ -269,7 +264,7 @@ let reconcileDrain: Promise<void> | undefined;
  * resolves depends on config that moves underneath it. A Tunnel rules refresh
  * clears `ingress.publicBaseUrl` and republishes it moments later, and each
  * write fires a config change. Run concurrently, the clear-time reconciliation
- * resolves the managed callback route while the republish-time one resolves
+ * resolves the cloud callback route while the republish-time one resolves
  * Tunnel, and whichever setWebhook lands last decides where Telegram delivers.
  * A stale winner leaves the pod on the fallback address until some later
  * trigger happens to correct it.
@@ -375,13 +370,13 @@ async function reconcileTelegramWebhookNow(
   // idempotent, and pending updates are deliberately kept so re-enabling
   // ingress does not lose queued messages.
   //
-  // Platform pods are exempt: `hasWebhookRoutingConfigured` resolves the
-  // IS_PLATFORM tier ahead of the explicit-disable check because a pod has no
+  // Cloud pods are exempt: `hasWebhookRoutingConfigured` resolves the
+  // IS_CLOUD tier ahead of the explicit-disable check because a pod has no
   // self-owned ingress to disable, so honoring a stray flag here would delete
   // the pod's only delivery path while the daemon still reports the channel
   // as configured (the LUM-2899 divergence in mirror image).
   if (
-    !isPlatformMode() &&
+    !isCloudServedBuild() &&
     caches?.configFile?.getBoolean("ingress", "enabled") === false
   ) {
     await callTelegramApi("deleteWebhook", {}, apiOpts);
@@ -399,8 +394,8 @@ async function reconcileTelegramWebhookNow(
   try {
     expectedUrl = await resolveExpectedTelegramWebhookUrl(caches);
   } catch (err) {
-    // Managed callback route registration failed — this is a platform-side
-    // issue. Do not suggest ngrok or other tunnel options; they are not
+    // Managed callback route registration failed — this is a cloud-side
+    // issue. Do not suggest third-party tunnel options; they are not
     // usable in containerized deployments.
     const detail = err instanceof Error ? err.message : String(err);
     log.error(

package/src/tunnel/allowed-paths.test.ts

@@ -28,7 +28,7 @@ beforeEach(() => {
 });
 
 describe("TUNNEL_ALLOWED_PATHS", () => {
-  it("matches the platform-side header name (must stay in sync with mycadet-platform RegistrationAllowedPathsHeader)", () => {
+  it("matches the cloud-side header name (must stay in sync with mycadet-platform RegistrationAllowedPathsHeader)", () => {
     expect(TUNNEL_ALLOWED_PATHS_HEADER).toBe("X-Cadet-Tunnel-Allowed-Paths");
   });
 
@@ -57,7 +57,7 @@ describe("TUNNEL_ALLOWED_PATHS", () => {
     for (const pattern of patterns) {
       expect(() => new RegExp(pattern)).not.toThrow();
       // RE2-incompatible features that should never appear: lookahead,
-      // lookbehind, backreferences. A simple guard is enough — the platform
+      // lookbehind, backreferences. A simple guard is enough — the cloud
       // side will reject anything Go's regexp.Compile can't parse.
       expect(pattern).not.toMatch(/\(\?[=!<]/); // lookaround
       expect(pattern).not.toMatch(/\\[1-9]/); // backreferences
@@ -85,7 +85,7 @@ describe("TUNNEL_ALLOWED_PATHS", () => {
       "/v1/audio/some-uuid.mp3": true,
       "/v1/live-voice": true,
       "/v1/stt/stream": true,
-      // Watch sessions on a managed assistant ride the tunnel, the same shape
+      // Watch sessions on a cloud assistant ride the tunnel, the same shape
       // as live voice: tunnel validates the browser's minted token on this path
       // and injects the attested caller, and the gateway's handler admits only
       // the guardian on it. Self-hosted assistants bypass tunnel entirely.

package/src/tunnel/allowed-paths.ts

@@ -1,7 +1,7 @@
 /**
  * Tunnel path allowlist sent to Tunnel on the WS upgrade request via the
  * {@link TUNNEL_ALLOWED_PATHS_HEADER} HTTP header. Tunnel parses the JSON-encoded
- * regex array on the platform side
+ * regex array on the cloud side
  * ({@link
  *   https://github.com/vargasjr-dev/mycadet-platform/blob/main/tunnel/internal/tunnel/protocol.go
  *   `RegistrationAllowedPathsHeader`})

package/src/tunnel/client.test.ts

@@ -81,8 +81,8 @@ const {
 } = await import("./allowed-paths.js");
 const { TunnelClient, createTunnelClient, enablePublicIngress } =
   await import("./client.js");
-const { applyPlatformIdentityIds, _resetPlatformIdentityForTests } =
-  await import("../platform-identity.js");
+const { applyCloudIdentityIds, _resetCloudIdentityForTests } =
+  await import("../cloud-identity.js");
 
 const WS_OPEN = WebSocket.OPEN;
 const WS_CLOSED = WebSocket.CLOSED;
@@ -91,7 +91,7 @@ function makeCredentials(values: Record<string, string | undefined>) {
   const assistantId =
     values[credentialKey("cadet", "platform_assistant_id")]?.trim();
   if (assistantId) {
-    applyPlatformIdentityIds({
+    applyCloudIdentityIds({
       assistantId,
       organizationId: "",
       userId: "",
@@ -178,7 +178,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     runtimeMaxRetries: 0,
     runtimeProxyRequireAuth: true,
     runtimeTimeoutMs: 1,
-    shutdownDrainMs: 1,
     trustProxy: false,
     ...overrides,
   };
@@ -270,10 +269,10 @@ async function flushPromises(): Promise<void> {
 }
 
 const originalAssistantApiKey = process.env.ASSISTANT_API_KEY;
-const originalPlatformUrl = process.env.CADET_PLATFORM_URL;
-const originalPlatformAssistantId = process.env.PLATFORM_ASSISTANT_ID;
-const originalPlatformOrgId = process.env.PLATFORM_ORGANIZATION_ID;
-const originalPlatformUserId = process.env.PLATFORM_USER_ID;
+const originalCloudUrl = process.env.CADET_CLOUD_URL;
+const originalCloudAssistantId = process.env.CLOUD_ASSISTANT_ID;
+const originalCloudOrgId = process.env.CLOUD_ORGANIZATION_ID;
+const originalCloudUserId = process.env.CLOUD_USER_ID;
 
 function restoreEnv(name: string, value: string | undefined): void {
   if (value === undefined) {
@@ -291,21 +290,21 @@ beforeEach(() => {
   webhookRouteReads = 0;
   fetchImplFn = async () => new Response("not found", { status: 404 });
   delete process.env.ASSISTANT_API_KEY;
-  delete process.env.CADET_PLATFORM_URL;
-  delete process.env.PLATFORM_ASSISTANT_ID;
-  delete process.env.PLATFORM_ORGANIZATION_ID;
-  delete process.env.PLATFORM_USER_ID;
-  _resetPlatformIdentityForTests();
+  delete process.env.CADET_CLOUD_URL;
+  delete process.env.CLOUD_ASSISTANT_ID;
+  delete process.env.CLOUD_ORGANIZATION_ID;
+  delete process.env.CLOUD_USER_ID;
+  _resetCloudIdentityForTests();
 });
 
 afterEach(() => {
   rmSync(workspaceDir, { recursive: true, force: true });
   restoreEnv("ASSISTANT_API_KEY", originalAssistantApiKey);
-  restoreEnv("CADET_PLATFORM_URL", originalPlatformUrl);
-  restoreEnv("PLATFORM_ASSISTANT_ID", originalPlatformAssistantId);
-  restoreEnv("PLATFORM_ORGANIZATION_ID", originalPlatformOrgId);
-  restoreEnv("PLATFORM_USER_ID", originalPlatformUserId);
-  _resetPlatformIdentityForTests();
+  restoreEnv("CADET_CLOUD_URL", originalCloudUrl);
+  restoreEnv("CLOUD_ASSISTANT_ID", originalCloudAssistantId);
+  restoreEnv("CLOUD_ORGANIZATION_ID", originalCloudOrgId);
+  restoreEnv("CLOUD_USER_ID", originalCloudUserId);
+  _resetCloudIdentityForTests();
 });
 
 describe("enablePublicIngress", () => {
@@ -368,7 +367,7 @@ describe("TunnelClient", () => {
     await client.stop();
   });
 
-  test("opens a socket and registers when the platform assistant ID is missing", async () => {
+  test("opens a socket and registers when the cloud assistant ID is missing", async () => {
     const sockets: FakeWebSocket[] = [];
     const reconnectDelays: number[] = [];
     writeConfig({
@@ -629,7 +628,7 @@ describe("TunnelClient", () => {
   test("awaits validate before rejecting a mismatched registration", async () => {
     const sockets: FakeWebSocket[] = [];
     process.env.ASSISTANT_API_KEY = "api-key-123";
-    process.env.CADET_PLATFORM_URL = "https://platform.example.com";
+    process.env.CADET_CLOUD_URL = "https://test-cloud.mycadet.ai";
     fetchImplFn = async () =>
       new Response(
         JSON.stringify({
@@ -785,7 +784,7 @@ describe("TunnelClient", () => {
       resolveFirstApiKeyRead = resolve;
     });
     let useFreshCredentials = false;
-    applyPlatformIdentityIds({
+    applyCloudIdentityIds({
       assistantId: "asst-123",
       organizationId: "",
       userId: "",

package/src/tunnel/client.ts

@@ -9,9 +9,9 @@ import { credentialKey } from "../credential-key.js";
 import { mutateConfigFile } from "../config-file-utils.js";
 import { getLogger } from "../logger.js";
 import {
-  ensurePlatformIdentityIds,
-  peekPlatformAssistantId,
-} from "../platform-identity.js";
+  ensureCloudIdentityIds,
+  peekCloudAssistantId,
+} from "../cloud-identity.js";
 import { ExponentialBackoff } from "../util/exponential-backoff.js";
 import { listWebhookIngressRoutes } from "../db/webhook-ingress-route-store.js";
 import {
@@ -33,6 +33,7 @@ import {
   TUNNEL_BINARY_WEBSOCKET_HEADER,
 } from "./binary-websocket.js";
 import { TunnelWebSocketBridge } from "./websocket-bridge.js";
+import { getIsCloud } from "../cloud-url.js";
 
 const log = getLogger("tunnel-client");
 
@@ -335,8 +336,8 @@ export class TunnelClient {
       this.scheduleReconnect();
       return;
     }
-    await ensurePlatformIdentityIds();
-    const expectedAssistantId = peekPlatformAssistantId();
+    await ensureCloudIdentityIds();
+    const expectedAssistantId = peekCloudAssistantId();
 
     let registerUrl: string;
     try {
@@ -360,7 +361,7 @@ export class TunnelClient {
           // Declares the path allowlist Tunnel enforces for inbound proxied
           // traffic on this tunnel. Read per attempt so a reconnect picks up
           // webhook routes registered since the last one. See
-          // ./allowed-paths.ts for the route inventory and the platform-side
+          // ./allowed-paths.ts for the route inventory and the cloud-side
           // enforcement (ATL-402).
           [TUNNEL_ALLOWED_PATHS_HEADER]: buildTunnelAllowedPathsHeaderValue(
             () => this.readRegisteredWebhookPaths(),
@@ -435,7 +436,7 @@ export class TunnelClient {
   private async handleMessage(
     data: unknown,
     originWs: WebSocket,
-    platformAssistantId: string | undefined,
+    cloudAssistantId: string | undefined,
   ): Promise<void> {
     if (this.ws !== originWs || !this.running) return;
 
@@ -458,7 +459,7 @@ export class TunnelClient {
 
     switch (frame.type) {
       case TUNNEL_FRAME_TYPES.registered:
-        await this.handleRegisteredFrame(frame, originWs, platformAssistantId);
+        await this.handleRegisteredFrame(frame, originWs, cloudAssistantId);
         return;
       case TUNNEL_FRAME_TYPES.httpRequest:
         await this.handleHttpRequestFrame(frame, originWs);
@@ -479,12 +480,12 @@ export class TunnelClient {
   private async handleRegisteredFrame(
     frame: TunnelRegisteredFrame,
     originWs: WebSocket,
-    platformAssistantId: string | undefined,
+    cloudAssistantId: string | undefined,
   ): Promise<void> {
-    if (platformAssistantId && frame.assistant_id !== platformAssistantId) {
+    if (cloudAssistantId && frame.assistant_id !== cloudAssistantId) {
       log.error(
         {
-          expectedAssistantId: platformAssistantId,
+          expectedAssistantId: cloudAssistantId,
           receivedAssistantId: frame.assistant_id,
         },
         "Tunnel registered assistant ID mismatch",
@@ -793,12 +794,10 @@ export function createTunnelClient(
   },
 ): TunnelClient | undefined {
   if (!config.tunnelBaseUrl) {
-    const isPlatform =
-      process.env.IS_PLATFORM?.trim().toLowerCase() === "true" ||
-      process.env.IS_PLATFORM?.trim() === "1";
-    if (isPlatform) {
+    const isCloud = getIsCloud();
+    if (isCloud) {
       log.warn(
-        "TUNNEL_BASE_URL is not configured on a platform pod — the assistant tunnel will not be established and inbound webhook delivery will fail",
+        "TUNNEL_BASE_URL is not configured on a cloud pod — the assistant tunnel will not be established and inbound webhook delivery will fail",
       );
     }
     void clearManagedPublicBaseUrl(deps.configFile).catch((err) => {
@@ -845,7 +844,7 @@ async function mutateGatewayConfigFile(
 
 const TUNNEL_MANAGED_BY = "tunnel";
 
-async function writeManagedPublicBaseUrl(
+export async function writeManagedPublicBaseUrl(
   publicUrl: string,
   configFile: ConfigFileCache,
 ): Promise<void> {

package/src/verification/shared-invite-registration.ts

@@ -1,6 +1,6 @@
 /**
- * Registers a `cadet-shared` invite with the platform, which routes the
- * invitee's redemption back to this assistant. The platform receives only the
+ * Registers a `cadet-shared` invite with the cloud, which routes the
+ * invitee's redemption back to this assistant. The cloud receives only the
  * link-token hash and the invite's expiry, never the token itself.
  */
 
@@ -10,7 +10,7 @@ import { credentialKey } from "../credential-key.js";
 import { readCredentialResult } from "../credential-reader.js";
 import { fetchImpl } from "../fetch.js";
 import {
-  arePlatformFeaturesEnabled,
+  areCloudFeaturesEnabled,
   isFeatureFlagEnabled,
 } from "../feature-flag-resolver.js";
 import { getLogger } from "../logger.js";
@@ -26,9 +26,9 @@ const REGISTRATION_TIMEOUT_MS = 10_000;
 export type SharedInviteRegistrationResult =
   /** Registered, or nothing to register for this invite or gateway. */
   | { status: "registered" | "skipped" }
-  /** The platform already holds this hash. */
+  /** The cloud already holds this hash. */
   | { status: "duplicate" }
-  /** The platform refused another outstanding invite. */
+  /** The cloud refused another outstanding invite. */
   | { status: "limit_reached" }
   /** The credential store could not be read. */
   | { status: "unavailable" }
@@ -39,8 +39,8 @@ export type SharedInviteRegistrationResult =
  * Store value when present, else the environment fallback. `unreachable` is
  * set only when the store could not be read and no fallback exists.
  */
-async function readPlatformCredential(
-  field: "platform_base_url" | "assistant_api_key",
+async function readCloudCredential(
+  field: "assistant_api_key",
   envName: string,
 ): Promise<{ value: string; unreachable: boolean }> {
   const stored = await readCredentialResult(credentialKey("cadet", field));
@@ -49,7 +49,7 @@ async function readPlatformCredential(
 }
 
 /**
- * Register the invite's link-token hash and expiry with the platform.
+ * Register the invite's link-token hash and expiry with the cloud.
  *
  * Skipped for any channel other than `cadet-shared`, while the
  * trusted-contacts flag is off, when platform features are disabled, and when
@@ -63,28 +63,33 @@ export async function registerSharedInvite(params: {
   if (
     params.sourceChannel !== SHARED_INVITE_CHANNEL ||
     !isFeatureFlagEnabled(TRUSTED_CONTACTS_FLAG) ||
-    !arePlatformFeaturesEnabled()
+    !areCloudFeaturesEnabled()
   ) {
     return { status: "skipped" };
   }
 
-  const [baseUrl, apiKey] = await Promise.all([
-    readPlatformCredential("platform_base_url", "CADET_PLATFORM_URL"),
-    readPlatformCredential("assistant_api_key", "ASSISTANT_API_KEY"),
+  const [cloudBaseUrl, apiKey] = await Promise.all([
+    Promise.resolve(
+      (process.env.CADET_CLOUD_URL?.trim() || "").replace(/\/+$/, ""),
+    ),
+    readCloudCredential("assistant_api_key", "ASSISTANT_API_KEY"),
   ]);
-  if (baseUrl.unreachable || apiKey.unreachable) {
+  if (apiKey.unreachable) {
     log.warn("Shared invite registration: credential store unreachable");
     return { status: "unavailable" };
   }
-  if (!baseUrl.value || !apiKey.value) {
+  if (!cloudBaseUrl || !apiKey.value) {
     log.debug(
-      { hasPlatformBaseUrl: !!baseUrl.value, hasApiKey: !!apiKey.value },
+      {
+        hasPlatformBaseUrl: !!cloudBaseUrl,
+        hasApiKey: !!apiKey.value,
+      },
       "Shared invite registration skipped: no cloud credentials",
     );
     return { status: "skipped" };
   }
 
-  const url = `${baseUrl.value.replace(/\/+$/, "")}${SHARED_INVITE_REGISTRATION_PATH}`;
+  const url = `${cloudBaseUrl}${SHARED_INVITE_REGISTRATION_PATH}`;
   let response: Response;
   try {
     response = await fetchImpl(url, {
@@ -109,7 +114,7 @@ export async function registerSharedInvite(params: {
   }
   log.warn(
     { status: response.status },
-    "Shared invite registration refused by the platform",
+    "Shared invite registration refused by the cloud",
   );
   if (response.status === 409) {
     return { status: "duplicate" };

package/src/version.ts

@@ -28,7 +28,7 @@ export const APP_VERSION: string = resolveVersion();
 
 /**
  * Header name for the assistant version returned in every gateway response.
- * Allows the platform to trace which build handled a request.
+ * Allows the cloud to trace which build handled a request.
  */
 export const VERSION_HEADER_NAME = "X-Cadet-Assistant-Version";
 

package/src/platform-url.ts

@@ -1,24 +0,0 @@
-import type { CredentialCache } from "./credential-cache.js";
-import { credentialKey } from "./credential-key.js";
-
-/**
- * Resolve the platform base URL from the credential cache, falling back to
- * the `CADET_PLATFORM_URL` environment variable. Returns `undefined` when
- * neither source provides a value.
- *
- * The returned URL is trimmed and has any trailing slashes removed so callers
- * can safely append path segments.
- */
-export async function getPlatformBaseUrl(
-  credentials: CredentialCache,
-): Promise<string | undefined> {
-  const raw = await credentials.get(
-    credentialKey("cadet", "platform_base_url"),
-  );
-  const url = (
-    raw?.trim() ||
-    process.env.CADET_PLATFORM_URL?.trim() ||
-    ""
-  ).replace(/\/+$/, "");
-  return url || undefined;
-}