@mycadet/gateway 0.12.7 → 0.12.9

package/src/backup/backup-worker.ts

@@ -25,7 +25,7 @@ import { pipeline } from "node:stream/promises";
 import { mintServiceToken } from "../auth/token-exchange.js";
 import { readConfigFileOrEmpty } from "../config-file-utils.js";
 import { fetchImpl } from "../fetch.js";
-import { isPlatformMode } from "../feature-flag-resolver.js";
+import { isCloudServedBuild } from "../feature-flag-resolver.js";
 import { getLogger } from "../logger.js";
 import { getGatewaySecurityDir } from "../paths.js";
 import { ensureBackupKey } from "./backup-key.js";
@@ -398,7 +398,7 @@ function createDisabledBackupWorkerHandle(): BackupWorkerHandle {
  * runOnce() methods.
  */
 export function startBackupWorker(deps: BackupDeps): BackupWorkerHandle {
-  if (isPlatformMode()) {
+  if (isCloudServedBuild()) {
     log.info("Backup worker disabled in platform mode");
     return createDisabledBackupWorkerHandle();
   }

package/src/channels/inbound-event.ts

@@ -114,7 +114,7 @@ interface InboundEventBase<C extends InboundChannelId> {
     isDirectMessage?: boolean;
     /**
      * Whether the message addresses the assistant by name, an @-mention on
-     * the platforms that have one. Stated only where the channel proved it,
+     * the clouds that have one. Stated only where the channel proved it,
      * in whichever direction it can prove; absent means "not established".
      * Slack states it for an `app_mention`; Discord reads its own id out of
      * the mentions array. The runtime reads it to decide whether a reply is
@@ -122,11 +122,11 @@ interface InboundEventBase<C extends InboundChannelId> {
      */
     botMentioned?: boolean;
     /**
-     * True when the platform names no actor for this event: the synthetic
+     * True when the cloud names no actor for this event: the synthetic
      * actorExternalId identifies the channel's system, not a person, so
      * nothing downstream may treat it as an identity claim. A delete on a
      * platform whose dispatch carries no author is the canonical case, and so
-     * is a delete of the assistant's own post on a platform that names the
+     * is a delete of the assistant's own post on a cloud that names the
      * author but never the deleter. The daemon then applies the event only to
      * a row it already holds for that chat: one it ingested from an author
      * who cleared the ACL on arrival, or one the assistant posted itself.

package/src/channels/ingress-inbound-vendors.test.ts

@@ -121,7 +121,7 @@ describe("a Comms declaration", () => {
  *
  * The two things a single path could not express are both here. The
  * conversation falls back from `message.space.id` to `space.id`, which in code
- * is `message.space ?? event.space`, and the platform is mapped to the two
+ * is `message.space ?? event.space`, and the cloud is mapped to the two
  * values admission acts on. The vendor\'s own casing is used for the map key,
  * because a declaration should be able to quote what the wire says.
  */
@@ -187,7 +187,7 @@ describe("a Photon declaration", () => {
     );
   });
 
-  it("maps the platform case-insensitively", () => {
+  it("maps the cloud case-insensitively", () => {
     // Photon spells it `iMessage`. A map that missed on capitalisation would
     // silently downgrade every blue bubble to the spoofable-sender treatment.
     const result = read("imessage", photonDelivery(), PHOTON);

package/src/channels/ingress-inbound.ts

@@ -198,7 +198,7 @@ const INBOUND_FIELD_NAMES = Object.keys(
 /**
  * What the sender's id is, so it can be compared with the ones already stored.
  *
- * `opaque` (the default) is right for a platform-stable id and is the only
+ * `opaque` (the default) is right for a cloud-stable id and is the only
  * safe guess, because rewriting an id that was already canonical is how a
  * returning sender stops matching their own contact record.
  */

package/src/channels/ingress-verification.test.ts

@@ -664,9 +664,9 @@ describe("HMAC URL and form payloads", () => {
     expect(result).toEqual({ ok: true });
   });
 
-  it("verifies against the platform-injected URL first", () => {
+  it("verifies against the cloud-injected URL first", () => {
     const injected =
-      "https://platform.example.test/v1/gateway/callbacks/abc123";
+      "https://test-cloud.mycadet.ai.test/v1/gateway/callbacks/abc123";
     const result = verify(
       URL_AND_FORM_HMAC,
       {

package/src/channels/ingress-verification.ts

@@ -1,7 +1,7 @@
 /**
  * Declared signature verification for plugin ingress routes.
  *
- * A plugin route that receives third-party webhooks cannot use the platform
+ * A plugin route that receives third-party webhooks cannot use the cloud
  * scheme (`Cadet-Signature`, see `../http/cadet-signature.ts`): the caller is
  * Comms, or Photon, or Stripe, and it signs the way it signs. Before this,
  * such a route could be declared, approved, registered with the vendor, and
@@ -22,10 +22,10 @@
  * - **The credential's service.** A descriptor names a *field*; the service is
  *   composed from the plugin's own directory name by the caller. A manifest
  *   that could name the service could point a route at another plugin's secret,
- *   or at the platform's.
+ *   or at the cloud's.
  * - **Fail-closed parsing.** Anything unrecognized — an unknown `kind`,
  *   algorithm, encoding, or an extra key — fails the manifest rather than
- *   falling back to the platform scheme. A route the plugin believes is
+ *   falling back to the cloud scheme. A route the plugin believes is
  *   verified one way and the gateway verifies another is worse than no route.
  * - **Canonical payload parts.** `body` is the bytes as received. Other
  *   payload parts declare their own canonicalization, so a manifest cannot
@@ -192,7 +192,7 @@ export type VerificationResult =
 /**
  * The public URLs a caller might have signed.
  *
- * The platform callback proxy can preserve the original URL explicitly, while
+ * The cloud callback proxy can preserve the original URL explicitly, while
  * a reverse proxy can expose it through forwarding headers. A configured
  * public base and the raw request URL cover direct deployments. Each distinct
  * candidate is tried because only the caller knows which public spelling it

package/src/channels/plugin-ingress-approvals.test.ts

@@ -404,7 +404,7 @@ describe("findServableRoute", () => {
   });
 
   it("serves a cadet-signed route without approval", () => {
-    // Only a caller holding the platform secret can open it, and that trust
+    // Only a caller holding the cloud secret can open it, and that trust
     // was already given when the account was connected.
     const res = resolution({
       pending: [

package/src/channels/plugin-ingress-approvals.ts

@@ -177,7 +177,7 @@ function resolveDiscoveredPluginIngress(
  *
  * Approval is the general gate, with one exception: a route declaring
  * `signer: "cadet"` is served without it. Such a route only opens to a
- * caller holding the platform's own webhook secret, which is to say us, and
+ * caller holding the cloud's own webhook secret, which is to say us, and
  * the user extended that trust when they connected their account, so asking
  * them to approve it again buys nothing. A route signed by anyone else still
  * needs a guardian decision, because approval is what establishes who that

package/src/channels/plugin-ingress.test.ts

@@ -112,7 +112,7 @@ describe("parsePluginIngressManifest", () => {
   });
 
   it("defaults an undeclared signer to the plugin's own secret", () => {
-    // The safe default: a plugin gets no reach against the platform's key
+    // The safe default: a plugin gets no reach against the cloud's key
     // unless it asks for it and a guardian approves that declaration.
     const manifest = parsePluginIngressManifest(JSON.parse(VALID));
     expect(manifest.routes[0]!.signer).toBe("plugin");
@@ -238,7 +238,7 @@ describe("parsePluginIngressManifest", () => {
   });
 
   it("leaves verification undeclared when the manifest omits it", () => {
-    // Absent means the platform scheme, exactly as before the field existed.
+    // Absent means the cloud scheme, exactly as before the field existed.
     const manifest = parsePluginIngressManifest(JSON.parse(VALID));
     expect(manifest.routes[0]!.verification).toBeUndefined();
   });
@@ -339,7 +339,7 @@ describe("parsePluginIngressManifest", () => {
   });
 
   it("rejects a verification descriptor the gateway cannot run", () => {
-    // Fail the manifest rather than falling back to the platform scheme: a
+    // Fail the manifest rather than falling back to the cloud scheme: a
     // route verified differently than declared is worse than no route.
     expect(() =>
       parsePluginIngressManifest({

package/src/channels/plugin-ingress.ts

@@ -106,7 +106,7 @@ export const IngressRouteSchema = z.object({
    * `webhook_secret`, so a plugin can receive third-party callbacks it has
    * arranged itself, and a guardian decides whether that route is served.
    *
-   * `cadet` verifies against the platform's `webhook_secret`, for routes
+   * `cadet` verifies against the cloud's `webhook_secret`, for routes
    * only Cadet calls, which would otherwise need a per-plugin secret
    * provisioned for a caller we already authenticate. Such a route is
    * served without a guardian approval: the trust it relies on was given
@@ -120,7 +120,7 @@ export const IngressRouteSchema = z.object({
   /**
    * How the caller proves it holds the signing secret.
    *
-   * `signed-headers` (the default) is the platform's scheme: the signature
+   * `signed-headers` (the default) is the cloud's scheme: the signature
    * travels in `Cadet-Signature`, over the body for HTTP and over
    * `<timestamp>.<pathname>` for a WebSocket upgrade.
    *
@@ -142,7 +142,7 @@ export const IngressRouteSchema = z.object({
   /**
    * How a third-party caller's signature is checked, when it is not ours.
    *
-   * Absent (the default) means the platform scheme: `Cadet-Signature` over
+   * Absent (the default) means the cloud scheme: `Cadet-Signature` over
    * the body, keyed by whichever `webhook_secret` {@link signer} selects.
    * That is right for a caller Cadet controls and wrong for every other one
    * — Comms signs `X-Osis-Signature`, Photon signs `X-Spectrum-Signature` over

package/src/channels/room-admission.ts

@@ -14,11 +14,11 @@
  * admits is a chat, not a person: who may be answered there is the
  * trust-class admission floor's decision downstream.
  *
- * The candidate is neutral on purpose. How a platform proves "direct" (Discord
+ * The candidate is neutral on purpose. How a cloud proves "direct" (Discord
  * by the absence of a guild, Telegram by `chat.type`) and "addressed" (a
  * mentions array, text entities, a reply to the bot's post) is the adapter's
  * side of the seam, built in `discord/admit.ts` and `telegram/admit.ts`. This
- * module never reads a platform field.
+ * module never reads a cloud field.
  */
 
 import type { AdmissionDropLogLevel } from "./admission-drop-log.js";

package/src/cli/contacts.ts

@@ -204,7 +204,9 @@ export async function executeContactsCommand(
       );
     }
     console.log("");
-    console.log(`${contacts.length} contact(s)`);
+    console.log(
+      `${contacts.length} ${contacts.length === 1 ? "contact" : "contacts"}`,
+    );
     return 0;
   }
 

package/src/cli/index.ts

@@ -15,7 +15,7 @@ function printUsage(): void {
   console.log("Operator commands for gateway-owned state.");
   console.log("");
   console.log("Commands:");
-  console.log("  contacts    Manage contact ACL (list, get, set-risk-threshold)");
+  console.log("  contacts    Manage the contact ACL with list, get, set-risk-threshold");
 }
 
 const args = process.argv.slice(2);

package/src/{platform-identity.ts → cloud-identity.ts}

@@ -2,9 +2,9 @@
  * Bound platform identity (assistant, organization, user).
  *
  * Django maps an assistant API key to these ids via
- * `POST /v1/internal/assistants/validate/`. Resolution reads in-memory
- * overrides (and `PLATFORM_ASSISTANT_ID` / `PLATFORM_ORGANIZATION_ID` /
- * `PLATFORM_USER_ID` when set). When the bound ids are empty, or the
+ * `POST /v1/internal/assistants/validate/`. Resolution reads the in-memory
+ * overrides the validate response populates — nothing else. When the bound
+ * ids are empty, or the
  * API key / platform base URL that produced them has changed, the next
  * resolve retries validate (single-flight, with a cooldown after a failed
  * validate attempt for the same credentials).
@@ -21,30 +21,28 @@ import { readCredentialResult } from "./credential-reader.js";
 import { fetchImpl } from "./fetch.js";
 import { getLogger } from "./logger.js";
 
-const log = getLogger("platform-identity");
+const log = getLogger("cloud-identity");
 
-export const PLATFORM_IDENTITY_VALIDATE_PATH =
-  "/v1/internal/assistants/validate/";
+export const CLOUD_IDENTITY_VALIDATE_PATH = "/v1/internal/assistants/validate/";
 
 const VALIDATE_TIMEOUT_MS = 5_000;
 const ENSURE_COOLDOWN_MS = 10_000;
 
 const ASSISTANT_API_KEY_ACCOUNT = credentialKey("cadet", "assistant_api_key");
-const PLATFORM_BASE_URL_ACCOUNT = credentialKey("cadet", "platform_base_url");
 
-export type PlatformIdentityIds = {
+export type CloudIdentityIds = {
   assistantId: string;
   organizationId: string;
   userId: string;
 };
 
-export type StoredPlatformUserId = {
+export type StoredCloudUserId = {
   userId: string | undefined;
   unreachable: boolean;
 };
 
-let platformAssistantIdOverride: string | undefined;
-let platformOrganizationIdOverride: string | undefined;
+let cloudAssistantIdOverride: string | undefined;
+let cloudOrganizationIdOverride: string | undefined;
 let platformUserIdOverride: string | undefined;
 let identityBoundToFingerprint: string | undefined;
 let lastAttemptFingerprint: string | undefined;
@@ -65,42 +63,38 @@ function envTrim(name: string): string {
   return process.env[name]?.trim() ?? "";
 }
 
-function getPlatformAssistantId(): string {
-  return (
-    platformAssistantIdOverride || envTrim("PLATFORM_ASSISTANT_ID")
-  ).trim();
+function getCloudAssistantId(): string {
+  return (cloudAssistantIdOverride ?? "").trim();
 }
 
-function getPlatformOrganizationId(): string {
-  return (
-    platformOrganizationIdOverride || envTrim("PLATFORM_ORGANIZATION_ID")
-  ).trim();
+function getCloudOrganizationId(): string {
+  return (cloudOrganizationIdOverride ?? "").trim();
 }
 
-function getPlatformUserId(): string {
-  return (platformUserIdOverride || envTrim("PLATFORM_USER_ID")).trim();
+function getCloudUserId(): string {
+  return (platformUserIdOverride ?? "").trim();
 }
 
 function hasBoundIdentity(): boolean {
-  return Boolean(getPlatformAssistantId() && getPlatformUserId());
+  return Boolean(getCloudAssistantId() && getCloudUserId());
 }
 
 function identityFingerprint(apiKey: string, baseUrl: string): string {
   return `${baseUrl}\0${apiKey}`;
 }
 
-function clearPlatformIdentityOverrides(): void {
-  platformAssistantIdOverride = undefined;
-  platformOrganizationIdOverride = undefined;
+function clearCloudIdentityOverrides(): void {
+  cloudAssistantIdOverride = undefined;
+  cloudOrganizationIdOverride = undefined;
   platformUserIdOverride = undefined;
 }
 
-export function applyPlatformIdentityIds(ids: PlatformIdentityIds): void {
+export function applyCloudIdentityIds(ids: CloudIdentityIds): void {
   if (ids.assistantId) {
-    platformAssistantIdOverride = ids.assistantId;
+    cloudAssistantIdOverride = ids.assistantId;
   }
   if (ids.organizationId) {
-    platformOrganizationIdOverride = ids.organizationId;
+    cloudOrganizationIdOverride = ids.organizationId;
   }
   if (ids.userId) {
     platformUserIdOverride = ids.userId;
@@ -111,16 +105,16 @@ export function applyPlatformIdentityIds(ids: PlatformIdentityIds): void {
  * Use the gateway credential cache for API key / base URL lookups so a
  * vault outage can still retry validate with last-good secrets.
  */
-export function bindPlatformIdentityCredentialCache(
+export function bindCloudIdentityCredentialCache(
   cache: CredentialCache | undefined,
 ): void {
   credentialCache = cache;
 }
 
 /** @internal Test-only: drop in-memory identity and in-flight ensure state. */
-export function _resetPlatformIdentityForTests(): void {
-  platformAssistantIdOverride = undefined;
-  platformOrganizationIdOverride = undefined;
+export function _resetCloudIdentityForTests(): void {
+  cloudAssistantIdOverride = undefined;
+  cloudOrganizationIdOverride = undefined;
   platformUserIdOverride = undefined;
   identityBoundToFingerprint = undefined;
   lastAttemptFingerprint = undefined;
@@ -132,20 +126,20 @@ export function _resetPlatformIdentityForTests(): void {
 
 /** @internal Alias so existing auth tests can reset the bound owner id. */
 export function _resetLastKnownPlatformUserIdForTest(): void {
-  _resetPlatformIdentityForTests();
+  _resetCloudIdentityForTests();
 }
 
 /**
  * Trade an assistant API key for the bound platform ids.
  *
- * Returns null when the platform is unreachable, refuses the key, or the
+ * Returns null when the cloud is unreachable, refuses the key, or the
  * body has no ids. Never throws.
  */
-export async function fetchPlatformIdentityIds(
+export async function fetchCloudIdentityIds(
   baseUrl: string,
   apiKey: string,
-): Promise<PlatformIdentityIds | null> {
-  const url = `${baseUrl.replace(/\/+$/, "")}${PLATFORM_IDENTITY_VALIDATE_PATH}`;
+): Promise<CloudIdentityIds | null> {
+  const url = `${baseUrl.replace(/\/+$/, "")}${CLOUD_IDENTITY_VALIDATE_PATH}`;
   try {
     const res = await fetchImpl(url, {
       method: "POST",
@@ -211,20 +205,18 @@ async function readAuthPrerequisites(): Promise<{
   unreachable: boolean;
 }> {
   const envKey = envTrim("ASSISTANT_API_KEY");
-  const envUrl = envTrim("CADET_PLATFORM_URL").replace(/\/+$/, "");
-
-  const [apiKeyRead, baseUrlRead] = await Promise.all([
-    readCredentialOrEnv(ASSISTANT_API_KEY_ACCOUNT, envKey),
-    readCredentialOrEnv(PLATFORM_BASE_URL_ACCOUNT, envUrl),
-  ]);
-
-  const apiKey = apiKeyRead.value;
-  const baseUrl = baseUrlRead.value.replace(/\/+$/, "");
-  const unreachable =
-    (!apiKey && apiKeyRead.unreachable) ||
-    (!baseUrl && baseUrlRead.unreachable);
-
-  return { apiKey, baseUrl, unreachable };
+  const envUrl = envTrim("CADET_CLOUD_URL").replace(/\/+$/, "");
+
+  const apiKeyRead = await readCredentialOrEnv(
+    ASSISTANT_API_KEY_ACCOUNT,
+    envKey,
+  );
+
+  return {
+    apiKey: apiKeyRead.value,
+    baseUrl: envUrl,
+    unreachable: !apiKeyRead.value && apiKeyRead.unreachable,
+  };
 }
 
 /**
@@ -236,7 +228,7 @@ async function readAuthPrerequisites(): Promise<{
  * validate for the same credentials is still inside the cooldown window.
  * Concurrent callers share one in-flight request.
  */
-export async function ensurePlatformIdentityIds(): Promise<void> {
+export async function ensureCloudIdentityIds(): Promise<void> {
   if (!ensureInFlight) {
     ensureInFlight = (async () => {
       try {
@@ -258,7 +250,7 @@ export async function ensurePlatformIdentityIds(): Promise<void> {
           identityBoundToFingerprint !== undefined &&
           identityBoundToFingerprint !== fingerprint
         ) {
-          clearPlatformIdentityOverrides();
+          clearCloudIdentityOverrides();
           identityBoundToFingerprint = undefined;
         }
         if (
@@ -268,19 +260,19 @@ export async function ensurePlatformIdentityIds(): Promise<void> {
           return;
         }
         lastAttemptFingerprint = fingerprint;
-        const ids = await fetchPlatformIdentityIds(baseUrl, apiKey);
+        const ids = await fetchCloudIdentityIds(baseUrl, apiKey);
         if (!ids) {
           nextEnsureAttemptAt = Date.now() + ENSURE_COOLDOWN_MS;
           return;
         }
-        applyPlatformIdentityIds(ids);
+        applyCloudIdentityIds(ids);
         identityBoundToFingerprint = fingerprint;
         nextEnsureAttemptAt = 0;
         log.info(
           {
-            hasAssistantId: Boolean(getPlatformAssistantId()),
-            hasOrganizationId: Boolean(getPlatformOrganizationId()),
-            hasUserId: Boolean(getPlatformUserId()),
+            hasAssistantId: Boolean(getCloudAssistantId()),
+            hasOrganizationId: Boolean(getCloudOrganizationId()),
+            hasUserId: Boolean(getCloudUserId()),
           },
           "Loaded platform identity from platform validate",
         );
@@ -292,26 +284,26 @@ export async function ensurePlatformIdentityIds(): Promise<void> {
   await ensureInFlight;
 }
 
-export async function resolvePlatformAssistantId(): Promise<string> {
-  await ensurePlatformIdentityIds();
-  return getPlatformAssistantId();
+export async function resolveCloudAssistantId(): Promise<string> {
+  await ensureCloudIdentityIds();
+  return getCloudAssistantId();
 }
 
-export function peekPlatformAssistantId(): string | undefined {
-  const id = getPlatformAssistantId();
+export function peekCloudAssistantId(): string | undefined {
+  const id = getCloudAssistantId();
   return id || undefined;
 }
 
-export async function resolvePlatformAssistantIdOrUndefined(): Promise<
+export async function resolveCloudAssistantIdOrUndefined(): Promise<
   string | undefined
 > {
-  const id = await resolvePlatformAssistantId();
+  const id = await resolveCloudAssistantId();
   return id || undefined;
 }
 
 export async function resolvePlatformUserId(): Promise<string> {
-  await ensurePlatformIdentityIds();
-  return getPlatformUserId();
+  await ensureCloudIdentityIds();
+  return getCloudUserId();
 }
 
 /**
@@ -322,7 +314,7 @@ export async function resolvePlatformUserId(): Promise<string> {
  * prior successful resolve is cached. A cached owner is returned with
  * `unreachable: false` so callers keep treating the assistant as reachable.
  */
-export async function readStoredPlatformUserId(): Promise<StoredPlatformUserId> {
+export async function readStoredCloudUserId(): Promise<StoredCloudUserId> {
   const userId = await resolvePlatformUserId();
   if (userId) {
     return { userId, unreachable: false };

package/src/cloud-url.ts

@@ -0,0 +1,25 @@
+/**
+ * Resolve the cloud base URL from the `CADET_CLOUD_URL` environment
+ * variable, defaulting to `https://cloud.mycadet.ai`.
+ *
+ * The returned URL is trimmed and has any trailing slashes removed so callers
+ * can safely append path segments.
+ */
+export function getCloudBaseUrl(): string {
+  const url = (process.env.CADET_CLOUD_URL?.trim() || "").replace(/\/+$/, "");
+  return url || "https://cloud.mycadet.ai";
+}
+
+function str(name: string): string | undefined {
+  const v = process.env[name]?.trim();
+  return v || undefined;
+}
+
+function flag(name: string): boolean {
+  const raw = str(name)?.toLowerCase();
+  return raw === "true" || raw === "1";
+}
+
+export function getIsCloud(): boolean {
+  return flag("IS_CLOUD");
+}

package/src/{platform-user-id.ts → cloud-user-id.ts}

@@ -2,11 +2,11 @@
  * Bound platform owner id for managed-mode edge auth.
  *
  * Identity is resolved from platform validate and in-memory last-known
- * values. See {@link readStoredPlatformUserId} in `platform-identity.ts`.
+ * values. See {@link readStoredCloudUserId} in `cloud-identity.ts`.
  */
 
 export {
   _resetLastKnownPlatformUserIdForTest,
-  readStoredPlatformUserId,
-  type StoredPlatformUserId,
-} from "./platform-identity.js";
+  readStoredCloudUserId,
+  type StoredCloudUserId,
+} from "./cloud-identity.js";

package/src/config.ts

@@ -25,7 +25,7 @@ export type GatewayConfig = {
   /**
    * Body cap for the inbound email webhook (`/webhooks/email`). Email
    * attachments arrive inlined as base64 in the payload, so this ceiling is
-   * much larger than {@link maxWebhookPayloadBytes} to fit the platform's
+   * much larger than {@link maxWebhookPayloadBytes} to fit the cloud's
    * per-file / per-message attachment cap. Optional — callers fall back to
    * {@link maxWebhookPayloadBytes} when unset.
    */
@@ -36,7 +36,6 @@ export type GatewayConfig = {
   runtimeMaxRetries: number;
   runtimeProxyRequireAuth: boolean;
   runtimeTimeoutMs: number;
-  shutdownDrainMs: number;
   /** When true, trust X-Forwarded-For for client IP resolution (set when behind a reverse proxy). */
   trustProxy: boolean;
 };
@@ -217,7 +216,7 @@ export function loadConfig(): GatewayConfig {
     },
     maxAttachmentConcurrency: 3,
     maxWebhookPayloadBytes: 1024 * 1024,
-    // Fits the platform's inbound-attachment cap (25 MB/file × 10 files),
+    // Fits the cloud's inbound-attachment cap (25 MB/file × 10 files),
     // expanded by base64 (~4/3) plus body/JSON overhead.
     maxEmailWebhookPayloadBytes: 350 * 1024 * 1024,
     port,
@@ -226,7 +225,6 @@ export function loadConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth,
     runtimeTimeoutMs,
-    shutdownDrainMs: 5000,
     trustProxy,
   };
 }

package/src/credential-reader.ts

@@ -196,7 +196,7 @@ export function getCesHttpConfig():
 }
 
 /**
- * Try to read a credential from the CES managed service over HTTP.
+ * Try to read a credential from the CES cloud service over HTTP.
  *
  * Delegates to `@mycadet/ces-client/http-credentials` for the transport.
  * Activated when `CES_CREDENTIAL_URL` is set (e.g. `http://ces-host:8090`).
@@ -404,7 +404,7 @@ export const DISCORD_CHANNEL_CREDENTIAL_SPEC: ServiceCredentialSpec = {
 
 export const CADET_CREDENTIAL_SPEC: ServiceCredentialSpec = {
   service: "cadet",
-  requiredFields: ["platform_base_url", "assistant_api_key", "webhook_secret"],
+  requiredFields: ["assistant_api_key", "webhook_secret"],
 } as const;
 
 export const ALL_CREDENTIAL_SPECS: readonly ServiceCredentialSpec[] = [

package/src/db/assistant-db-proxy.ts

@@ -3,7 +3,7 @@
  * SQLite database via IPC. Gateway one-time data migrations (m0002, m0010,
  * m0014, et al.) need raw read/drop access to the assistant DB on first boot
  * of upgraded installs, and direct cross-container file access corrupts the
- * DB on platform pods (fcntl locks are not shared across mount namespaces +
+ * DB on cloud pods (fcntl locks are not shared across mount namespaces +
  * a SQLite WAL-reset bug in ≤3.51.2) — so migrations reach the assistant DB
  * only through this route.
  *

package/src/discord/forward.ts

@@ -24,7 +24,7 @@ export function createDiscordInboundEventHandler(options: {
   const { config, log, notifyRecordActivity, forwardQueue } = options;
 
   return (event, attachmentRefs) => {
-    // Reset the platform idle-sleep timer so inbound Discord activity keeps
+    // Reset the cloud idle-sleep timer so inbound Discord activity keeps
     // the assistant awake like any other channel.
     notifyRecordActivity();
 

package/src/email/normalize.ts

@@ -24,7 +24,7 @@ export interface EmailAttachment {
  * Shape of a normalized inbound email event as sent by the Cadet
  * platform (or any upstream caller).
  *
- * The platform is responsible for provider-specific parsing (e.g.
+ * The cloud is responsible for provider-specific parsing (e.g.
  * Mailgun multipart → JSON). By the time the payload reaches the
  * gateway it should already be in this canonical shape.
  */
@@ -47,15 +47,15 @@ export interface CadetEmailPayload {
   inReplyTo?: string;
   /** Space-separated chain of ancestor Message-IDs (References header). */
   references?: string;
-  /** Stable conversation/thread identifier derived by the platform. */
+  /** Stable conversation/thread identifier derived by the cloud. */
   conversationId: string;
   /** ISO 8601 timestamp of the original email. */
   timestamp?: string;
   /**
-   * Whether the platform authenticated the sender's `From:` address against
+   * Whether the cloud authenticated the sender's `From:` address against
    * the message's SPF/DKIM/DMARC results. `true` when authentication passed,
    * `false` when it was evaluated and failed (spoofable sender), omitted when
-   * the platform could not evaluate (no auth-results header). The gateway
+   * the cloud could not evaluate (no auth-results header). The gateway
    * downgrades an unauthenticated sender so a forged `From:` cannot inherit
    * guardian/trusted_contact trust.
    */