@mycadet/gateway 0.12.7 → 0.12.9

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/rpc.ts

@@ -34,7 +34,7 @@ import { RpcErrorSchema } from "./error.js";
 
 export const CesRpcMethod = {
   /** Push an updated assistant credential to CES after post-hatch provisioning. */
-  UpdateManagedCredential: "update_managed_credential",
+  UpdateCloudCredential: "update_managed_credential",
   /** Retrieve a single credential by account name. */
   GetCredential: "get_credential",
   /** Store or update a credential by account name. */
@@ -63,7 +63,7 @@ export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
 // update_managed_credential
 // ---------------------------------------------------------------------------
 
-export const UpdateManagedCredentialSchema = z.object({
+export const UpdateCloudCredentialSchema = z.object({
   /** The assistant API key to push to CES for platform credential materialization. */
   assistantApiKey: z.string(), // nosemgrep: not-a-secret
   /**
@@ -72,16 +72,16 @@ export const UpdateManagedCredentialSchema = z.object({
    */
   assistantId: z.string().optional(),
 });
-export type UpdateManagedCredential = z.infer<
-  typeof UpdateManagedCredentialSchema
+export type UpdateCloudCredential = z.infer<
+  typeof UpdateCloudCredentialSchema
 >;
 
-export const UpdateManagedCredentialResponseSchema = z.object({
-  /** Whether the managed credential was successfully updated. */
+export const UpdateCloudCredentialResponseSchema = z.object({
+  /** Whether the cloud credential was successfully updated. */
   updated: z.boolean(),
 });
-export type UpdateManagedCredentialResponse = z.infer<
-  typeof UpdateManagedCredentialResponseSchema
+export type UpdateCloudCredentialResponse = z.infer<
+  typeof UpdateCloudCredentialResponseSchema
 >;
 
 // ---------------------------------------------------------------------------
@@ -311,9 +311,9 @@ export type BulkSetCredentialRecordsResponse = z.infer<
  * schemas. Useful for building type-safe RPC dispatch layers.
  */
 export interface CesRpcContract {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredential;
-    response: UpdateManagedCredentialResponse;
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredential;
+    response: UpdateCloudCredentialResponse;
   };
   [CesRpcMethod.GetCredential]: {
     request: GetCredential;
@@ -361,9 +361,9 @@ export interface CesRpcContract {
  * Schema lookup map for runtime validation of RPC payloads.
  */
 export const CesRpcSchemas = {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredentialSchema,
-    response: UpdateManagedCredentialResponseSchema,
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredentialSchema,
+    response: UpdateCloudCredentialResponseSchema,
   },
   [CesRpcMethod.GetCredential]: {
     request: GetCredentialSchema,

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/trust-rules.ts

@@ -15,7 +15,7 @@
  * - **URL**: tools whose candidates include a URL (`web_fetch`,
  *   `network_request`).
  * - **Managed skill**: tools that manage first-party skill packages
- *   (`scaffold_managed_skill`, `delete_managed_skill`).
+ *   (`scaffold_cloud_skill`, `delete_cloud_skill`).
  * - **Skill load**: the `skill_load` tool, which uses a distinct candidate
  *   namespace (`skill_load:selector` or `skill_load_dynamic:selector`).
  * - **Generic**: everything else (computer-use tools, UI surface tools,
@@ -58,8 +58,8 @@ export const URL_TOOLS = ["web_fetch", "network_request"] as const;
  * Tools that manage first-party skill packages (scaffold/delete).
  */
 export const MANAGED_SKILL_TOOLS = [
-  "scaffold_managed_skill",
-  "delete_managed_skill",
+  "scaffold_cloud_skill",
+  "delete_cloud_skill",
 ] as const;
 
 /**
@@ -89,8 +89,8 @@ export function isUrlRule(rule: { tool: string }): boolean {
   return URL_TOOLS_SET.has(rule.tool);
 }
 
-/** Returns true when the rule's tool belongs to the managed-skill-tool family. */
-export function isManagedSkillRule(rule: { tool: string }): boolean {
+/** Returns true when the rule's tool belongs to the cloud-skill-tool family. */
+export function isCloudSkillRule(rule: { tool: string }): boolean {
   return MANAGED_SKILL_TOOLS_SET.has(rule.tool);
 }
 

package/node_modules/@mycadet/gateway-client/src/binding-strength-contract.ts

@@ -34,7 +34,7 @@ export const VERIFIED_VIA_CHALLENGE = "challenge";
 /** `verified_via` written when the guardian direct-trusts a workspace-vouched identity. */
 export const VERIFIED_VIA_MANUAL = "manual";
 
-/** `verified_via` written when the guardian trusts an identity the platform is not vouching for. */
+/** `verified_via` written when the guardian trusts an identity the cloud is not vouching for. */
 export const VERIFIED_VIA_CHANNEL_CLAIM = "manual_channel_claim";
 
 // ---------------------------------------------------------------------------
@@ -48,10 +48,10 @@ export const VERIFIED_VIA_CHANNEL_CLAIM = "manual_channel_claim";
  *
  * - `verified_handshake` — the contact proved control of the channel by
  *   returning a verification code (`verified_via: "challenge"`).
- * - `internal_workspace_match` — the platform authenticated the identity inside
+ * - `internal_workspace_match` — the cloud authenticated the identity inside
  *   the guardian's own workspace; the guardian vouches directly
  *   (`verified_via: "manual"`).
- * - `inbound_channel_claim` — the guardian trusts an identity the platform is
+ * - `inbound_channel_claim` — the guardian trusts an identity the cloud is
  *   NOT vouching for (`verified_via: "manual_channel_claim"`).
  */
 export type BindingStrength =
@@ -101,7 +101,7 @@ const PROVEN_VERIFIED_VIA: ReadonlySet<string> = new Set([
   "invite", // redeemed an invite code / token
   "voice", // returned a voice (DTMF) code
   "bootstrap", // guardian binding (also protected by the guardian-downgrade guard)
-  "platform_auto_register", // guardian binding auto-registered by the platform
+  "platform_auto_register", // guardian binding auto-registered by the cloud
   "webhook_registration", // guardian binding registered via a provider webhook
 ]);
 
@@ -112,7 +112,7 @@ const PROVEN_VERIFIED_VIA: ReadonlySet<string> = new Set([
  * PRD (D4) may land on:
  *
  *   3  proven / possession — {@link PROVEN_VERIFIED_VIA}.
- *   2  workspace-vouched — the platform authenticated the identity but the
+ *   2  workspace-vouched — the cloud authenticated the identity but the
  *      actor did not actively prove control here (`manual`).
  *   1  inbound channel claim — nobody vouches; the guardian trusted an
  *      unproven claim (`manual_channel_claim`).

package/node_modules/@mycadet/gateway-client/src/gateway-ipc-contracts.ts

@@ -483,7 +483,7 @@ export type RegisterWebhookRouteIpcParams = z.infer<
 /**
  * A refusal is a normal result rather than an error: the daemon reads
  * `disabled` as "this assistant is not serving its own webhooks" and falls
- * back to the platform's callback routes.
+ * back to the cloud's callback routes.
  */
 export const RegisterWebhookRouteIpcResponseSchema = z.union([
   z.object({ disabled: z.literal(true) }),

package/node_modules/@mycadet/gateway-client/src/inbound-contract.ts

@@ -85,7 +85,7 @@ export const SourceMetadataSchema = z
     commandIntent: CommandIntentSchema.optional(),
     /**
      * Whether the message addresses the assistant by name, an @-mention on
-     * the platforms that have one. Stated by the channel's normalizer only
+     * the clouds that have one. Stated by the channel's normalizer only
      * where it proved the answer; absent means "not established". Read to
      * decide whether a reply is expected before any text exists, never to
      * admit or deny: admission is the gate's job, upstream of this.
@@ -154,7 +154,7 @@ export const SourceMetadataSchema = z
      */
     trustVerdict: TrustVerdictSchema.optional(),
     /**
-     * The platform named no actor for this event; the actor id is the
+     * The cloud named no actor for this event; the actor id is the
      * channel's synthetic system identity, never an identity claim.
      */
     actorUnattributed: z.boolean().optional(),

package/node_modules/@mycadet/gateway-client/src/outbound-contract.ts

@@ -6,7 +6,7 @@
  * them to the channel transport its callback URL names
  * (`messaging/providers`). `/deliver/{channel}` is only that callback URL's
  * addressing form: no service serves it. A callback URL no
- * transport owns (a managed callback carrying a `callback_token`) is POSTed
+ * transport owns (a cloud callback carrying a `callback_token`) is POSTed
  * over HTTP by `http-delivery.ts` instead.
  *
  * The gateway sends through the same transports, never to a provider itself:

package/node_modules/@mycadet/service-contracts/package.json

@@ -26,7 +26,7 @@
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
-    "./platform-credential": "./src/platform-credential.ts",
+    "./cloud-credential": "./src/cloud-credential.ts",
     "./plan-credit": "./src/plan-credit.ts",
     "./integration-categories": "./src/integration-categories.ts",
     "./mcp-oauth": "./src/mcp-oauth.ts"
@@ -40,6 +40,6 @@
   },
   "devDependencies": {
     "@types/bun": "1.2.4",
-    "typescript": "5.7.3"
+    "typescript": "5.9.3"
   }
 }

package/node_modules/@mycadet/service-contracts/src/{platform-credential.ts → cloud-credential.ts}

@@ -1,10 +1,10 @@
 /**
- * Wire contract for asking an assistant whether its stored platform-managed
+ * Wire contract for asking an assistant whether its stored cloud-managed
  * credential still authenticates.
  *
  * The daemon route is the authoritative serving side:
  *   - `POST /v1/platform/verify-credential`
- *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *       (`assistant/src/runtime/routes/cloud-routes.ts`)
  *
  * The daemon's platform client produces the verdict, the route reports it,
  * and the `cadet` CLI reads it before deciding whether a stored key can be
@@ -15,26 +15,26 @@
 import { z } from "zod";
 
 /**
- * What the platform said about the stored credential, right now.
+ * What the cloud said about the stored credential, right now.
  *
- *   - `valid`: the platform accepted it.
- *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *   - `valid`: the cloud accepted it.
+ *   - `rejected`: the cloud refused it (unauthorized or forbidden); the
  *     credential needs replacing.
  *   - `unknown`: the check itself could not run (no credential stored, the
  *     platform unreachable, a server error). Not evidence either way.
  */
-export const PlatformCredentialVerificationStatusSchema = z.enum([
+export const CloudCredentialVerificationStatusSchema = z.enum([
   "valid",
   "rejected",
   "unknown",
 ]);
-export type PlatformCredentialVerificationStatus = z.infer<
-  typeof PlatformCredentialVerificationStatusSchema
+export type CloudCredentialVerificationStatus = z.infer<
+  typeof CloudCredentialVerificationStatusSchema
 >;
 
 /** `POST /v1/platform/verify-credential` response body. */
 export const PlatformVerifyCredentialResponseSchema = z.object({
-  status: PlatformCredentialVerificationStatusSchema,
+  status: CloudCredentialVerificationStatusSchema,
 });
 export type PlatformVerifyCredentialResponse = z.infer<
   typeof PlatformVerifyCredentialResponseSchema

package/node_modules/@mycadet/service-contracts/src/handles.ts

@@ -15,9 +15,9 @@
  *    Format: `local_oauth:<providerKey>/<connectionId>` where providerKey
  *    is the bare provider name (e.g. `google`).
  *
- * 3. **Managed OAuth** — references an OAuth connection managed by the
+ * 3. **Cloud OAuth** — references an OAuth connection managed by the
  *    platform. Format: `platform_oauth:<connectionId>` where connectionId
- *    is the platform-assigned connection identifier.
+ *    is the cloud-assigned connection identifier.
  */
 
 import { z } from "zod";
@@ -96,7 +96,7 @@ export function localOAuthHandle(
 }
 
 /**
- * Build a managed (platform) OAuth credential handle from a connection ID.
+ * Build a cloud (platform) OAuth credential handle from a connection ID.
  */
 export function platformOAuthHandle(connectionId: string): string {
   return `${HandleType.PlatformOAuth}:${connectionId}`;

package/node_modules/@mycadet/service-contracts/src/index.ts

@@ -31,7 +31,7 @@ export * from "./no-response.js";
 export * from "./plan-credit.js";
 export * from "./integration-categories.js";
 export * from "./mcp-oauth.js";
-export * from "./platform-credential.js";
+export * from "./cloud-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -4,7 +4,7 @@
  * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
- * managed-speech transport can't drift.
+ * cloud-speech transport can't drift.
  */
 export function tunnelHostForPlatformHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/service-contracts/src/remote-web-pairing.ts

@@ -152,7 +152,7 @@ export const DEFAULT_REMOTE_WEB_PAIRING_PLATFORM: RemoteWebPairingPlatform =
 
 /**
  * A requested platform coerced to a known value. The pairing-token route is
- * publicly reachable and the platform renders verbatim in the host's
+ * publicly reachable and the cloud renders verbatim in the host's
  * paired-devices list, so an unrecognized value never reaches the DB.
  */
 export function resolveRemoteWebPairingPlatform(

package/node_modules/@mycadet/service-contracts/src/rpc.ts

@@ -34,7 +34,7 @@ import { RpcErrorSchema } from "./error.js";
 
 export const CesRpcMethod = {
   /** Push an updated assistant credential to CES after post-hatch provisioning. */
-  UpdateManagedCredential: "update_managed_credential",
+  UpdateCloudCredential: "update_managed_credential",
   /** Retrieve a single credential by account name. */
   GetCredential: "get_credential",
   /** Store or update a credential by account name. */
@@ -63,7 +63,7 @@ export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
 // update_managed_credential
 // ---------------------------------------------------------------------------
 
-export const UpdateManagedCredentialSchema = z.object({
+export const UpdateCloudCredentialSchema = z.object({
   /** The assistant API key to push to CES for platform credential materialization. */
   assistantApiKey: z.string(), // nosemgrep: not-a-secret
   /**
@@ -72,16 +72,16 @@ export const UpdateManagedCredentialSchema = z.object({
    */
   assistantId: z.string().optional(),
 });
-export type UpdateManagedCredential = z.infer<
-  typeof UpdateManagedCredentialSchema
+export type UpdateCloudCredential = z.infer<
+  typeof UpdateCloudCredentialSchema
 >;
 
-export const UpdateManagedCredentialResponseSchema = z.object({
-  /** Whether the managed credential was successfully updated. */
+export const UpdateCloudCredentialResponseSchema = z.object({
+  /** Whether the cloud credential was successfully updated. */
   updated: z.boolean(),
 });
-export type UpdateManagedCredentialResponse = z.infer<
-  typeof UpdateManagedCredentialResponseSchema
+export type UpdateCloudCredentialResponse = z.infer<
+  typeof UpdateCloudCredentialResponseSchema
 >;
 
 // ---------------------------------------------------------------------------
@@ -311,9 +311,9 @@ export type BulkSetCredentialRecordsResponse = z.infer<
  * schemas. Useful for building type-safe RPC dispatch layers.
  */
 export interface CesRpcContract {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredential;
-    response: UpdateManagedCredentialResponse;
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredential;
+    response: UpdateCloudCredentialResponse;
   };
   [CesRpcMethod.GetCredential]: {
     request: GetCredential;
@@ -361,9 +361,9 @@ export interface CesRpcContract {
  * Schema lookup map for runtime validation of RPC payloads.
  */
 export const CesRpcSchemas = {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredentialSchema,
-    response: UpdateManagedCredentialResponseSchema,
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredentialSchema,
+    response: UpdateCloudCredentialResponseSchema,
   },
   [CesRpcMethod.GetCredential]: {
     request: GetCredentialSchema,

package/node_modules/@mycadet/service-contracts/src/trust-rules.ts

@@ -15,7 +15,7 @@
  * - **URL**: tools whose candidates include a URL (`web_fetch`,
  *   `network_request`).
  * - **Managed skill**: tools that manage first-party skill packages
- *   (`scaffold_managed_skill`, `delete_managed_skill`).
+ *   (`scaffold_cloud_skill`, `delete_cloud_skill`).
  * - **Skill load**: the `skill_load` tool, which uses a distinct candidate
  *   namespace (`skill_load:selector` or `skill_load_dynamic:selector`).
  * - **Generic**: everything else (computer-use tools, UI surface tools,
@@ -58,8 +58,8 @@ export const URL_TOOLS = ["web_fetch", "network_request"] as const;
  * Tools that manage first-party skill packages (scaffold/delete).
  */
 export const MANAGED_SKILL_TOOLS = [
-  "scaffold_managed_skill",
-  "delete_managed_skill",
+  "scaffold_cloud_skill",
+  "delete_cloud_skill",
 ] as const;
 
 /**
@@ -89,8 +89,8 @@ export function isUrlRule(rule: { tool: string }): boolean {
   return URL_TOOLS_SET.has(rule.tool);
 }
 
-/** Returns true when the rule's tool belongs to the managed-skill-tool family. */
-export function isManagedSkillRule(rule: { tool: string }): boolean {
+/** Returns true when the rule's tool belongs to the cloud-skill-tool family. */
+export function isCloudSkillRule(rule: { tool: string }): boolean {
   return MANAGED_SKILL_TOOLS_SET.has(rule.tool);
 }
 

package/openapi.json

@@ -2,10 +2,10 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Cadet Gateway API",
-    "version": "0.12.6",
+    "version": "0.12.8",
     "description": "Auto-generated OpenAPI specification for the Cadet Gateway HTTP endpoints."
   },
-  "servers": [{ "url": "", "description": "Same-origin (gateway)" }],
+  "servers": [{ "url": "", "description": "Same-origin — the gateway" }],
   "paths": {
     "/v1/permissions/thresholds": {
       "get": {
@@ -105,7 +105,7 @@
         "operationId": "conversationThresholdGet",
         "summary": "Get a conversation's threshold override",
         "tags": ["permissions"],
-        "description": "Returns { threshold: null } when no override exists. (Gateways predating that behavior returned 404 for the same condition; clients tolerate both during rollout.)",
+        "description": "Returns { threshold: null } when no override exists. Gateways predating that behavior returned 404 for the same condition; clients tolerate both during rollout.",
         "parameters": [
           {
             "name": "conversation_id",
@@ -209,7 +209,7 @@
         "operationId": "channelAdmissionPolicyList",
         "summary": "List per-channel admission floors",
         "tags": ["channel-admission-policy"],
-        "description": "Returns one entry per enforced channel (exempt and hidden channels are omitted), seeded with defaults for channels without a stored row.",
+        "description": "Returns one entry per enforced channel, excluding exempt and hidden channels, seeded with defaults for channels without a stored row.",
         "responses": {
           "200": {
             "description": "Successful response",
@@ -272,7 +272,7 @@
             "in": "path",
             "required": true,
             "schema": { "type": "string" },
-            "description": "The channel type (e.g. slack)"
+            "description": "The channel type, e.g. slack"
           }
         ],
         "requestBody": {
@@ -452,7 +452,7 @@
             "in": "path",
             "required": true,
             "schema": { "type": "string" },
-            "description": "The declaring ingress source (today, a plugin name)"
+            "description": "The declaring ingress source, today a plugin name"
           }
         ],
         "requestBody": {
@@ -502,7 +502,7 @@
             "in": "path",
             "required": true,
             "schema": { "type": "string" },
-            "description": "The declaring ingress source (today, a plugin name)"
+            "description": "The declaring ingress source, today a plugin name"
           }
         ],
         "responses": {
@@ -530,7 +530,7 @@
         "operationId": "channelPermissionOverridesList",
         "summary": "List channel-permission matrix cells",
         "tags": ["channel-permission-overrides"],
-        "description": "Returns every persisted cell (cascade selector × contact-type → RiskThreshold). Unset cells fall through the cascade; the list contains only explicit overrides.",
+        "description": "Returns every persisted cell in the cascade selector × contact-type → RiskThreshold map. Unset cells fall through the cascade; the list contains only explicit overrides.",
         "responses": {
           "200": {
             "description": "Successful response",
@@ -854,7 +854,7 @@
         "operationId": "channelPermissionResolve",
         "summary": "Resolve the effective channel-permission threshold",
         "tags": ["channel-permission-overrides"],
-        "description": "Read-only cascade resolution for one coordinate: walks channel → channel_type → adapter → workspace for the given selector keys and contact-type, returning the winning cell's threshold and scope, or null when no cell matches (the caller then falls through to the global thresholds). Same resolver the runtime evaluator uses over IPC.",
+        "description": "Read-only cascade resolution for one coordinate: walks channel → channel_type → adapter → workspace for the given selector keys and contact-type, returning the winning cell's threshold and scope, or null when no cell matches, in which case the caller falls through to the global thresholds. Same resolver the runtime evaluator uses over IPC.",
         "requestBody": {
           "required": true,
           "content": {
@@ -931,7 +931,7 @@
         "operationId": "channelPermissionOverrideDelete",
         "summary": "Delete a channel-permission matrix cell",
         "tags": ["channel-permission-overrides"],
-        "description": "Removes one cell by its composite key (selector × contact-type), letting the next cascade tier up win. Returns whether a cell was removed.",
+        "description": "Removes one cell by its composite key, selector × contact-type, letting the next cascade tier up win. Returns whether a cell was removed.",
         "requestBody": {
           "required": true,
           "content": {
@@ -1027,7 +1027,7 @@
         "operationId": "contactsUpsert",
         "summary": "Create or update a contact",
         "tags": ["contacts"],
-        "description": "Gateway-native contact upsert (dual-writes the gateway ACL store and the assistant info mirror). Matches by id, then by any provided (type, address) channel, else creates.",
+        "description": "Gateway-native contact upsert that dual-writes the gateway ACL store and the assistant info mirror. Matches by id, then by the provided type and address channel, else creates.",
         "requestBody": {
           "required": true,
           "content": {
@@ -1085,7 +1085,7 @@
                         "address": { "type": "string" },
                         "isPrimary": { "type": "boolean" },
                         "externalChatId": {
-                          "description": "Delivery chat id. Omit to preserve the stored value. A legacy explicit null is accepted for compatibility and treated as omitted; clearing is not supported (a stored null is indistinguishable from never-learned, so no consumer could tell a clear from a gap).",
+                          "description": "Delivery chat id. Omit to preserve the stored value. A legacy explicit null is accepted for compatibility and treated as omitted; clearing is not supported: a stored null is indistinguishable from never-learned, so no consumer could tell a clear from a gap.",
                           "type": "string"
                         },
                         "status": { "type": "string" },
@@ -1141,7 +1141,7 @@
                             },
                             { "type": "null" }
                           ],
-                          "description": "Per-contact auto-approve ceiling. Null means unset (inherit cascade)."
+                          "description": "Per-contact auto-approve ceiling. Null means unset, inheriting the cascade."
                         },
                         "assistantMetadata": {
                           "anyOf": [
@@ -1184,7 +1184,7 @@
                               },
                               "externalUserId": {
                                 "type": "string",
-                                "description": "Compat alias for address (older macOS clients)"
+                                "description": "Compat alias for address, for older macOS clients"
                               },
                               "status": {
                                 "anyOf": [
@@ -1479,7 +1479,7 @@
         "operationId": "contactChannelVerify",
         "summary": "Manually verify a contact channel",
         "tags": ["contacts"],
-        "description": "Guardian-only manual attestation: marks the channel active/verified in the gateway store (source of truth) with a best-effort assistant mirror. Idempotent.",
+        "description": "Guardian-only manual attestation: marks the channel active/verified in the gateway store, the source of truth, with a best-effort assistant mirror. Idempotent.",
         "parameters": [
           {
             "name": "channel_id",
@@ -1828,7 +1828,7 @@
             "in": "query",
             "required": false,
             "schema": { "type": "string" },
-            "description": "Filter by origin (default | user_defined)"
+            "description": "Filter by origin: default or user_defined"
           },
           {
             "name": "tool",
@@ -1929,7 +1929,7 @@
                   },
                   "description": { "type": "string", "minLength": 1 },
                   "scope": {
-                    "description": "Compatibility field. Trust rules apply workspace-wide: the engine matches on (tool, pattern) only, so a narrower scope cannot be honored and any value other than \"everywhere\" is rejected rather than stored broader than the consent it records.",
+                    "description": "Compatibility field. Trust rules apply workspace-wide: the engine matches on tool and pattern only, so a narrower scope cannot be honored and any value other than \"everywhere\" is rejected rather than stored broader than the consent it records.",
                     "type": "string",
                     "const": "everywhere"
                   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/gateway",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "license": "MIT",
   "type": "module",
   "exports": {

package/scripts/generate-openapi.ts

@@ -126,7 +126,7 @@ function buildSpec(version: string) {
       description:
         "Auto-generated OpenAPI specification for the Cadet Gateway HTTP endpoints.",
     },
-    servers: [{ url: "", description: "Same-origin (gateway)" }],
+    servers: [{ url: "", description: "Same-origin — the gateway" }],
     paths,
   });
 }

package/src/__tests__/actor-token-revocation.test.ts

@@ -251,7 +251,6 @@ describe("runtime proxy enforcement", () => {
       routingEntries: [],
       port: 7830,
       runtimeProxyRequireAuth: true,
-      shutdownDrainMs: 5000,
       runtimeTimeoutMs: 30000,
       runtimeMaxRetries: 2,
       runtimeInitialBackoffMs: 500,

package/src/__tests__/{backup-worker-platform-mode.test.ts → backup-worker-cloud-mode.test.ts}

@@ -1,7 +1,7 @@
 import { afterEach, expect, mock, test } from "bun:test";
 
 let exportRequested = false;
-const originalIsPlatform = process.env.IS_PLATFORM;
+const originalIsPlatform = process.env.IS_CLOUD;
 
 mock.module("../config-file-utils.js", () => ({
   readConfigFileOrEmpty: () => ({
@@ -23,15 +23,15 @@ mock.module("../fetch.js", () => ({
 
 afterEach(() => {
   if (originalIsPlatform === undefined) {
-    delete process.env.IS_PLATFORM;
+    delete process.env.IS_CLOUD;
   } else {
-    process.env.IS_PLATFORM = originalIsPlatform;
+    process.env.IS_CLOUD = originalIsPlatform;
   }
   mock.restore();
 });
 
 test("platform mode disables the backup worker", async () => {
-  process.env.IS_PLATFORM = "true";
+  process.env.IS_CLOUD = "true";
   const { startBackupWorker } = await import("../backup/backup-worker.js");
 
   const worker = startBackupWorker({

package/src/__tests__/channel-verification-session-proxy.test.ts

@@ -26,7 +26,6 @@ function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
     routingEntries: [],
     port: 7830,
     runtimeProxyRequireAuth: true,
-    shutdownDrainMs: 5000,
     runtimeTimeoutMs: 30000,
     runtimeMaxRetries: 2,
     runtimeInitialBackoffMs: 500,