@mycadet/gateway 0.12.7 → 0.12.9

package/src/email/register-callback.test.ts

@@ -8,9 +8,9 @@ import {
   resetMockFetch,
 } from "../__tests__/mock-fetch.js";
 import {
-  applyPlatformIdentityIds,
-  _resetPlatformIdentityForTests,
-} from "../platform-identity.js";
+  applyCloudIdentityIds,
+  _resetCloudIdentityForTests,
+} from "../cloud-identity.js";
 import {
   registerEmailCallbackRoute,
   EMAIL_CALLBACK_PATH,
@@ -18,9 +18,9 @@ import {
 
 afterEach(() => {
   resetMockFetch();
-  delete process.env.CADET_PLATFORM_URL;
+  delete process.env.CADET_CLOUD_URL;
   delete process.env.ASSISTANT_API_KEY;
-  _resetPlatformIdentityForTests();
+  _resetCloudIdentityForTests();
 });
 
 function makeConfigFile(
@@ -34,29 +34,22 @@ function makeConfigFile(
 }
 
 function makeCaches(opts: {
-  platformBaseUrl?: string;
+  cloudBaseUrl?: string;
   assistantApiKey?: string;
-  platformAssistantId?: string;
+  cloudAssistantId?: string;
   ingressUrl?: string;
 }): { credentials: CredentialCache; configFile?: ConfigFileCache } {
   const store = new Map<string, string>();
-  if (opts.platformBaseUrl)
-    store.set(
-      credentialKey("cadet", "platform_base_url"),
-      opts.platformBaseUrl,
-    );
+  if (opts.cloudBaseUrl)
+    process.env.CADET_CLOUD_URL = opts.cloudBaseUrl;
   if (opts.assistantApiKey)
     store.set(
       credentialKey("cadet", "assistant_api_key"),
       opts.assistantApiKey,
     );
-  if (opts.platformAssistantId) {
-    store.set(
-      credentialKey("cadet", "platform_assistant_id"),
-      opts.platformAssistantId,
-    );
-    applyPlatformIdentityIds({
-      assistantId: opts.platformAssistantId,
+  if (opts.cloudAssistantId) {
+    applyCloudIdentityIds({
+      assistantId: opts.cloudAssistantId,
       organizationId: "org-abc",
       userId: "user-123",
     });
@@ -95,13 +88,13 @@ describe("registerEmailCallbackRoute", () => {
 
   test("registers callback route with platform via credential cache", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "test-api-key",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     const callbackUrl =
-      "https://platform.example.com/v1/gateway/callbacks/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/webhooks/email/";
+      "https://test-cloud.mycadet.ai/v1/gateway/callbacks/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/webhooks/email/";
 
     mockFetch(
       "callback-routes/register",
@@ -130,7 +123,7 @@ describe("registerEmailCallbackRoute", () => {
   });
 
   test("uses env assistant key with credential cache for assistant ID", async () => {
-    process.env.CADET_PLATFORM_URL = "https://env-platform.example.com";
+    process.env.CADET_CLOUD_URL = "https://env-platform.example.com";
     process.env.ASSISTANT_API_KEY = "env-key";
 
     const callbackUrl =
@@ -146,7 +139,7 @@ describe("registerEmailCallbackRoute", () => {
     );
 
     const caches = makeCaches({
-      platformAssistantId: "11111111-2222-3333-4444-555555555555",
+      cloudAssistantId: "11111111-2222-3333-4444-555555555555",
     });
 
     const result = await registerEmailCallbackRoute(caches);
@@ -161,9 +154,9 @@ describe("registerEmailCallbackRoute", () => {
 
   test("throws on non-ok response", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "test-api-key",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     mockFetch(
@@ -179,9 +172,9 @@ describe("registerEmailCallbackRoute", () => {
 
   test("throws when response has no callback_url", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "test-api-key",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     mockFetch(
@@ -200,9 +193,9 @@ describe("registerEmailCallbackRoute", () => {
 
   test("sends callback_base_url when ingress URL is configured (self-hosted)", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "vak_selfhosted",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
       ingressUrl: "https://my-assistant.example.com",
     });
 
@@ -233,15 +226,15 @@ describe("registerEmailCallbackRoute", () => {
     });
   });
 
-  test("omits callback_base_url when no ingress URL is configured (platform-managed)", async () => {
+  test("omits callback_base_url when no ingress URL is configured (cloud-managed)", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "vak_managed",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     const callbackUrl =
-      "https://platform.example.com/v1/gateway/callbacks/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/webhooks/email/";
+      "https://test-cloud.mycadet.ai/v1/gateway/callbacks/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/webhooks/email/";
 
     mockFetch(
       "callback-routes/register",

package/src/email/register-callback.ts

@@ -2,14 +2,14 @@ import type { ConfigFileCache } from "../config-file-cache.js";
 import type { CredentialCache } from "../credential-cache.js";
 import { credentialKey } from "../credential-key.js";
 import { fetchImpl } from "../fetch.js";
-import { arePlatformFeaturesEnabled } from "../feature-flag-resolver.js";
+import { areCloudFeaturesEnabled } from "../feature-flag-resolver.js";
 import { getLogger } from "../logger.js";
-import { resolvePlatformAssistantIdOrUndefined } from "../platform-identity.js";
+import { resolveCloudAssistantIdOrUndefined } from "../cloud-identity.js";
 
 const log = getLogger("email-callback");
 
 /**
- * The callback path registered with the platform for inbound email webhooks.
+ * The callback path registered with the cloud for inbound email webhooks.
  * Must match the gateway route path in index.ts ("/webhooks/email").
  */
 export const EMAIL_CALLBACK_PATH = "webhooks/email";
@@ -26,39 +26,34 @@ interface PlatformCallbackRouteResponse {
  * Follows the same pattern as Telegram's managed callback route registration
  * in `telegram/webhook-manager.ts`. Requires cloud credentials (base URL,
  * assistant API key, assistant ID). The base URL can fall back to
- * `CADET_PLATFORM_URL`; the key can fall back to `ASSISTANT_API_KEY`.
+ * `CADET_CLOUD_URL`; the key can fall back to `ASSISTANT_API_KEY`.
  *
  * Self-hosted assistants with a configured ``ingress.publicBaseUrl`` send
  * their own base URL so the callback route points directly at the gateway
- * rather than through the platform proxy.
+ * rather than through the cloud proxy.
  *
- * Returns the platform-assigned callback URL on success, or `undefined` if
+ * Returns the cloud-assigned callback URL on success, or `undefined` if
  * credentials are not available.
  */
 export async function registerEmailCallbackRoute(caches?: {
   credentials?: CredentialCache;
   configFile?: ConfigFileCache;
 }): Promise<string | undefined> {
-  if (!arePlatformFeaturesEnabled()) {
+  if (!areCloudFeaturesEnabled()) {
     log.debug(
       "Platform features disabled — skipping email callback registration",
     );
     return undefined;
   }
 
-  const [platformBaseUrlRaw, assistantApiKeyRaw] = caches?.credentials
-    ? await Promise.all([
-        caches.credentials.get(credentialKey("cadet", "platform_base_url")),
-        caches.credentials.get(credentialKey("cadet", "assistant_api_key")),
-      ])
-    : [undefined, undefined];
-
-  // Fall back to env vars when managed pod credentials are not yet cached,
-  // matching the daemon's resolvePlatformCallbackRegistrationContext().
-  const platformBaseUrl = (
-    platformBaseUrlRaw?.trim() ||
-    process.env.CADET_PLATFORM_URL?.trim() ||
-    ""
+  const assistantApiKeyRaw = caches?.credentials
+    ? await caches.credentials.get(credentialKey("cadet", "assistant_api_key"))
+    : undefined;
+
+  // The base URL resolves from the environment only — the credential store
+  // never carries it.
+  const cloudBaseUrl = (
+    process.env.CADET_CLOUD_URL?.trim() || ""
   ).replace(/\/+$/, "");
 
   const assistantCredential =
@@ -66,12 +61,12 @@ export async function registerEmailCallbackRoute(caches?: {
     process.env.ASSISTANT_API_KEY?.trim() ||
     undefined;
 
-  const assistantId = await resolvePlatformAssistantIdOrUndefined();
+  const assistantId = await resolveCloudAssistantIdOrUndefined();
 
-  if (!platformBaseUrl || !assistantCredential || !assistantId) {
+  if (!cloudBaseUrl || !assistantCredential || !assistantId) {
     log.debug(
       {
-        hasPlatformBaseUrl: !!platformBaseUrl,
+        hasPlatformBaseUrl: !!cloudBaseUrl,
         hasApiKey: !!assistantCredential,
         hasAssistantId: !!assistantId,
       },
@@ -80,9 +75,9 @@ export async function registerEmailCallbackRoute(caches?: {
     return undefined;
   }
 
-  // Self-hosted assistants send their public ingress URL so the platform
+  // Self-hosted assistants send their public ingress URL so the cloud
   // registers a callback pointing directly at the gateway rather than
-  // routing through the platform proxy (matching Telegram's two-tier
+  // routing through the cloud proxy (matching Telegram's two-tier
   // pattern in telegram/webhook-manager.ts).
   const ingressUrl = caches?.configFile
     ?.getString("ingress", "publicBaseUrl")
@@ -106,7 +101,7 @@ export async function registerEmailCallbackRoute(caches?: {
   }
 
   const response = await fetchImpl(
-    `${platformBaseUrl}/v1/internal/gateway/callback-routes/register/`,
+    `${cloudBaseUrl}/v1/internal/gateway/callback-routes/register/`,
     {
       method: "POST",
       headers: {

package/src/feature-flag-registry.json

@@ -82,7 +82,7 @@
       "scope": "client",
       "key": "multi-platform-assistant",
       "label": "Multi-Platform Assistant Switcher",
-      "description": "Enable the menu-bar assistant switcher for managing multiple platform-hosted assistants (new/switch/retire)",
+      "description": "Enable the menu-bar assistant switcher for managing multiple cloud-hosted assistants (new/switch/retire)",
       "defaultEnabled": false
     },
     {
@@ -138,7 +138,7 @@
       "scope": "client",
       "key": "fork-from-message",
       "label": "Internal Thread Actions (legacy key)",
-      "description": "Legacy key for `internal-thread-actions`. The client grants the internal thread affordances when either key is enabled, so the platform may serve the gate under either name. Declared here so the flag mapper keeps the value instead of dropping it as undeclared.",
+      "description": "Legacy key for `internal-thread-actions`. The client grants the internal thread affordances when either key is enabled, so the cloud may serve the gate under either name. Declared here so the flag mapper keeps the value instead of dropping it as undeclared.",
       "defaultEnabled": false
     },
     {
@@ -378,7 +378,7 @@
       "scope": "client",
       "key": "push-avatar-sender",
       "label": "Push Avatar Sender",
-      "description": "Native notifications show the assistant's avatar as the icon with the assistant's name on line one. Same key the platform reads for APNs/FCM sender blocks.",
+      "description": "Native notifications show the assistant's avatar as the icon with the assistant's name on line one. Same key the cloud reads for APNs/FCM sender blocks.",
       "defaultEnabled": false
     },
     {
@@ -450,7 +450,7 @@
       "scope": "assistant",
       "key": "tunnel-webhooks",
       "label": "Tunnel Webhooks",
-      "description": "Platform pods resolve webhook callback URLs from the Tunnel-published ingress URL instead of registering platform callback routes. Falls back to platform callback registration while no tunnel URL is published.",
+      "description": "Cloud pods resolve webhook callback URLs from the Tunnel-published ingress URL instead of registering platform callback routes. Falls back to platform callback registration while no tunnel URL is published.",
       "defaultEnabled": false
     },
     {
@@ -483,7 +483,7 @@
       "scope": "assistant",
       "key": "assistant-desktop",
       "label": "Virtual desktop",
-      "description": "Streams an interactive virtual desktop from a platform-hosted, containerized assistant over /v1/desktop/stream. Requires platform hosting; self-hosted assistants are excluded. Off: the virtual desktop is hidden. On: the chat header offers its viewer and controls.",
+      "description": "Streams an interactive virtual desktop from a cloud-hosted, containerized assistant over /v1/desktop/stream. Requires platform hosting; self-hosted assistants are excluded. Off: the virtual desktop is hidden. On: the chat header offers its viewer and controls.",
       "defaultEnabled": false
     },
     {

package/src/feature-flag-remote-store.ts

@@ -1,13 +1,13 @@
 /**
  * Gateway-side remote feature flag store — file-backed persistence of
- * feature flag values pushed from the platform.
+ * feature flag values pushed from the cloud.
  *
  * Mirrors the feature-flag-store.ts pattern: file path resolution via
  * getGatewaySecurityDir(), atomic writes (temp file + rename), 0o600
  * permissions, and module-level caching with manual invalidation.
  *
  * Unlike the local override store, writes replace the *entire* value map at
- * once (the platform pushes a complete snapshot) and immediately update the
+ * once (the cloud pushes a complete snapshot) and immediately update the
  * in-memory cache so no file watcher is needed.
  */
 

package/src/feature-flag-resolver.ts

@@ -40,13 +40,13 @@ export function isFeatureFlagEnabled(key: string): boolean {
   return !!getFeatureFlagValue(key);
 }
 
-export function isPlatformMode(): boolean {
-  const v = process.env.IS_PLATFORM?.trim().toLowerCase();
+export function isCloudServedBuild(): boolean {
+  const v = process.env.IS_CLOUD?.trim().toLowerCase();
   return v === "true" || v === "1";
 }
 
-export function arePlatformFeaturesEnabled(): boolean {
-  if (isPlatformMode()) return true;
-  const v = process.env.CADET_DISABLE_PLATFORM?.trim().toLowerCase();
+export function areCloudFeaturesEnabled(): boolean {
+  if (isCloudServedBuild()) return true;
+  const v = process.env.CADET_DISABLE_CLOUD?.trim().toLowerCase();
   return !(v === "true" || v === "1");
 }

package/src/http/cadet-signature.ts

@@ -2,7 +2,7 @@
  * Verification for the `Cadet-Signature` header.
  *
  * The signer computes `HMAC-SHA256(secret, rawBody)` and sends it as
- * `Cadet-Signature: sha256=<hex-digest>`. The scheme is the platform's, but
+ * `Cadet-Signature: sha256=<hex-digest>`. The scheme is the cloud's, but
  * nothing about it is platform-specific — plugin webhook routes verify the
  * same header against the plugin's own secret.
  */

package/src/http/edge-forwarded-header.ts

@@ -13,7 +13,7 @@
  * Loopback-only endpoints (`/v1/guardian/init`, `/v1/pair`) treat its presence
  * as proof that the request did NOT arrive directly from a local loopback
  * client: it was forwarded by the edge proxy, possibly from a remote browser
- * over a tunnel (e.g. ngrok). Because every hop in that chain is loopback
+ * over a tunnel (e.g. a third-party tunnel). Because every hop in that chain is loopback
  * (browser → tunnel agent → nginx@127.0.0.1 → gateway@127.0.0.1), the raw TCP
  * peer is 127.0.0.1 and a peer-IP loopback check alone would misclassify the
  * caller as local. This marker is the reliable signal instead — and crucially

package/src/http/loopback-guard.ts

@@ -91,7 +91,7 @@ export function enforceLoopbackOnly(
     return errorResponse("FORBIDDEN", "endpoint is local-only", 403);
   }
 
-  // The self-hosted nginx edge (e.g. the SPA over an ngrok tunnel) sets this
+  // The self-hosted nginx edge (e.g. the SPA over a tunnel) sets this
   // marker unconditionally; it cannot be spoofed or stripped by the client.
   if (requestArrivedViaEdgeProxy(req)) {
     auditDeny(req, clientIp, auditTag, "edge_proxy_forwarded");

package/src/http/middleware/auth.ts

@@ -13,7 +13,7 @@ import { AuthFallbackCountTracker } from "../../auth-fallback-count-tracker.js";
 import { AuthFallbackLogThrottle } from "../../auth-fallback-log-throttle.js";
 import type { AuthRateLimiter } from "../../auth-rate-limiter.js";
 import { getLogger } from "../../logger.js";
-import { readStoredPlatformUserId } from "../../platform-user-id.js";
+import { readStoredCloudUserId } from "../../cloud-user-id.js";
 import { isLoopbackPeer } from "../../util/is-loopback-address.js";
 import { requestArrivedViaEdgeProxy } from "../edge-forwarded-header.js";
 
@@ -34,34 +34,34 @@ export const loopbackFallbackCountTracker = new AuthFallbackCountTracker();
 type GetClientIp = () => string;
 
 // ---------------------------------------------------------------------------
-// Platform-managed auth bypass — DISABLE_HTTP_AUTH + IS_PLATFORM
+// Platform-managed auth bypass — DISABLE_HTTP_AUTH + IS_CLOUD
 // ---------------------------------------------------------------------------
 //
 // Both flags must be set together to disable JWT validation. DISABLE_HTTP_AUTH
 // alone is insufficient — it closes the accidental misconfig case where the
-// flag gets set on a non-platform deployment (e.g. a leaked dev env var on a
-// public host). When the bypass IS active, the platform vembda sidecar is
+// flag gets set on a non-cloud deployment (e.g. a leaked dev env var on a
+// public host). When the bypass IS active, the cloud vembda sidecar is
 // expected to forward `X-Cadet-User-Id`; the gateway cross-checks that
 // against the bound platform user id. This means reaching the gateway
 // sidecar's port directly (without going through vembda) still requires
-// knowing the bound user id. The platform header alone is not a free-pass.
+// knowing the bound user id. The cloud header alone is not a free-pass.
 
 /** True when DISABLE_HTTP_AUTH=true. */
 export function isHttpAuthDisabled(): boolean {
   return process.env.DISABLE_HTTP_AUTH?.trim().toLowerCase() === "true";
 }
 
-/** True when IS_PLATFORM is set (vembda-managed deployment). */
+/** True when IS_CLOUD is set (vembda-managed deployment). */
 function isPlatformManaged(): boolean {
-  const v = process.env.IS_PLATFORM?.trim();
+  const v = process.env.IS_CLOUD?.trim();
   return v === "1" || v?.toLowerCase() === "true";
 }
 
 /**
- * True when the platform-managed auth bypass is in effect — both flags set.
+ * True when the cloud-managed auth bypass is in effect — both flags set.
  * Either alone leaves JWT validation in place.
  */
-function isPlatformAuthBypassActive(): boolean {
+function isCloudAuthBypassActive(): boolean {
   return isHttpAuthDisabled() && isPlatformManaged();
 }
 
@@ -75,14 +75,14 @@ export function logAuthBypassState(): void {
   }
   if (isPlatformManaged()) {
     log.info(
-      "DISABLE_HTTP_AUTH + IS_PLATFORM both set: JWT validation bypassed; " +
+      "DISABLE_HTTP_AUTH + IS_CLOUD both set: JWT validation bypassed; " +
         "X-Cadet-User-Id is cross-checked against the bound platform user id",
     );
   } else {
     log.warn(
-      "DISABLE_HTTP_AUTH is set but IS_PLATFORM is NOT — bypass is INACTIVE. " +
-        "JWT validation runs as normal. Set IS_PLATFORM=true to opt into the " +
-        "platform-managed auth model.",
+      "DISABLE_HTTP_AUTH is set but IS_CLOUD is NOT — bypass is INACTIVE. " +
+        "JWT validation runs as normal. Set IS_CLOUD=true to opt into the " +
+        "cloud-managed auth model.",
     );
   }
 }
@@ -94,14 +94,14 @@ export function logAuthBypassState(): void {
  * clients. Each fallback endpoint and failure kind logs once per cooldown
  * window (see `loopbackFallbackLogThrottle`) so callers still missing or
  * failing auth are visible during rollout without per-request log noise. The
- * platform-managed bypass is checked first, so this fallback only applies in
+ * cloud-managed bypass is checked first, so this fallback only applies in
  * default mode.
  *
  *   - `requireEdgeAuth` — validates a JWT bearer token (aud=cadet-gateway)
  *     OR (when bypass is active) cross-checks X-Cadet-User-Id against the
  *     bound platform user id.
  *   - `requireEdgeAuthWithScope` — same, plus a scope-profile check on the
- *     decoded JWT. Under the platform bypass, scope is enforced upstream by
+ *     decoded JWT. Under the cloud bypass, scope is enforced upstream by
  *     vembda; the gateway only verifies the cross-checked user id.
  *   - `requireEdgeGuardianAuth` — same pattern, additionally requires the
  *     authenticated principal to match the bound guardian.
@@ -117,7 +117,7 @@ export function createAuthMiddleware(
 ) {
   /**
    * Cross-check `X-Cadet-User-Id` against the bound platform user id.
-   * Used by all three guards under the platform-managed bypass. Returns
+   * Used by all three guards under the cloud-managed bypass. Returns
    * null on success, or a 4xx/5xx Response.
    */
   async function requirePlatformUserHeader(
@@ -134,7 +134,7 @@ export function createAuthMiddleware(
     let storedUserId: string | undefined;
     let unreachable = false;
     try {
-      const result = await readStoredPlatformUserId();
+      const result = await readStoredCloudUserId();
       storedUserId = result.userId;
       unreachable = result.unreachable;
     } catch (err) {
@@ -177,7 +177,7 @@ export function createAuthMiddleware(
     req: Request,
     server?: Server<unknown>,
   ): Promise<Response | null> {
-    if (isPlatformAuthBypassActive()) {
+    if (isCloudAuthBypassActive()) {
       return requirePlatformUserHeader(req);
     }
     const hasAuthHeader = hasAuthorizationHeader(req);
@@ -194,7 +194,7 @@ export function createAuthMiddleware(
   /**
    * Validate a JWT bearer token and check that its scope profile includes the
    * required scope. Loopback peers fall back when auth is missing, malformed,
-   * invalid, or under-scoped. Under the platform bypass, scope is enforced
+   * invalid, or under-scoped. Under the cloud bypass, scope is enforced
    * upstream by vembda — the gateway only confirms the user id.
    */
   async function requireEdgeAuthWithScope(
@@ -202,7 +202,7 @@ export function createAuthMiddleware(
     scope: Scope,
     server?: Server<unknown>,
   ): Promise<Response | null> {
-    if (isPlatformAuthBypassActive()) {
+    if (isCloudAuthBypassActive()) {
       return requirePlatformUserHeader(req);
     }
     const hasAuthHeader = hasAuthorizationHeader(req);
@@ -233,7 +233,7 @@ export function createAuthMiddleware(
    *
    * Two auth modes:
    *
-   *   1. Platform-managed (DISABLE_HTTP_AUTH + IS_PLATFORM): caller's identity
+   *   1. Platform-managed (DISABLE_HTTP_AUTH + IS_CLOUD): caller's identity
    *      is asserted via X-Cadet-User-Id cross-checked against the bound
    *      platform user id.
    *   2. Default: validate the edge JWT, require an actor principal, assert it
@@ -246,7 +246,7 @@ export function createAuthMiddleware(
     req: Request,
     server?: Server<unknown>,
   ): Promise<Response | null> {
-    if (isPlatformAuthBypassActive()) {
+    if (isCloudAuthBypassActive()) {
       return requirePlatformUserHeader(req);
     }
     return requireEdgeGuardianAuthByActorPrincipal(req, server);

package/src/http/router.ts

@@ -22,7 +22,7 @@ export type GetRawPeerIp = () => string;
  * - "edge-guardian" — caller must be the bound cadet guardian. In the default
  *                      path, edge JWT is validated and the caller's actor
  *                      principal must match the guardian's principal id.
- *                      When DISABLE_HTTP_AUTH=true (platform-managed), the
+ *                      When DISABLE_HTTP_AUTH=true (cloud-managed), the
  *                      caller is asserted via X-Cadet-User-Id forwarded by
  *                      vembda, cross-referenced with the bound platform
  *                      user id.

package/src/http/routes/auto-approve-thresholds-routes.ts

@@ -55,7 +55,7 @@ export const ROUTES: GatewayRouteDefinition[] = [
     operationId: "conversationThresholdGet",
     summary: "Get a conversation's threshold override",
     description:
-      "Returns { threshold: null } when no override exists. (Gateways predating that behavior returned 404 for the same condition; clients tolerate both during rollout.)",
+      "Returns { threshold: null } when no override exists. Gateways predating that behavior returned 404 for the same condition; clients tolerate both during rollout.",
     tags: ["permissions"],
     pathParameters: [
       { name: "conversation_id", description: "The conversation id" },

package/src/http/routes/cadet-identity.ts

@@ -1,7 +1,7 @@
 /**
- * Cadet identity validation — platform-managed email.
+ * Cadet identity validation — cloud-managed email.
  *
- * The route's edge-scoped auth already authenticates the platform,
+ * The route's edge-scoped auth already authenticates the cloud,
  * so no external API key validation is needed.
  */
 

package/src/http/routes/channel-admission-policy-routes.ts

@@ -44,7 +44,7 @@ export const ROUTES: GatewayRouteDefinition[] = [
     operationId: "channelAdmissionPolicyList",
     summary: "List per-channel admission floors",
     description:
-      "Returns one entry per enforced channel (exempt and hidden channels are omitted), seeded with defaults for channels without a stored row.",
+      "Returns one entry per enforced channel, excluding exempt and hidden channels, seeded with defaults for channels without a stored row.",
     tags: ["channel-admission-policy"],
     responseBody: z.object({
       policies: z.array(ChannelPolicyViewSchema),
@@ -59,7 +59,7 @@ export const ROUTES: GatewayRouteDefinition[] = [
       "Upserts the channel's admission policy. Exempt and hidden channels return 403.",
     tags: ["channel-admission-policy"],
     pathParameters: [
-      { name: "channel_type", description: "The channel type (e.g. slack)" },
+      { name: "channel_type", description: "The channel type, e.g. slack" },
     ],
     requestBody: SetChannelPolicyRequestSchema,
     responseBody: z.object({ policy: ChannelPolicyViewSchema }),

package/src/http/routes/channel-ingress-routes.ts

@@ -9,7 +9,7 @@ import type { GatewayRouteDefinition } from "./types.js";
  * scripts/generate-openapi.ts). Unlike the neighbouring channel APIs there
  * are no assistant-scoped `/v1/assistants/{assistant_id}/...` variants: the
  * guardian reaches these flat paths directly rather than through the
- * platform proxy.
+ * cloud proxy.
  *
  * The handlers live in `channel-ingress.ts`; that module imports
  * `ApproveChannelIngressRequestSchema` so wire validation and the published
@@ -110,7 +110,7 @@ export const ROUTES: GatewayRouteDefinition[] = [
     pathParameters: [
       {
         name: "source",
-        description: "The declaring ingress source (today, a plugin name)",
+        description: "The declaring ingress source, today a plugin name",
       },
     ],
     requestBody: ApproveChannelIngressRequestSchema,
@@ -127,7 +127,7 @@ export const ROUTES: GatewayRouteDefinition[] = [
     pathParameters: [
       {
         name: "source",
-        description: "The declaring ingress source (today, a plugin name)",
+        description: "The declaring ingress source, today a plugin name",
       },
     ],
     responseBody: z.object({ source: z.string(), revoked: z.boolean() }),

package/src/http/routes/channel-ingress.test.ts

@@ -273,7 +273,18 @@ describe("approve", () => {
       refresh: () => {},
       pollIntervalMs: 10,
     });
-    await new Promise((done) => setTimeout(done, 40));
+    // The watcher polls every 10ms, so the retry normally lands in tens of
+    // milliseconds — but a fixed sleep races the poll under CI contention
+    // and starves it. Wait on a deadline instead: exit as soon as the routes
+    // appear, and let the assertion below name the failure if the watcher
+    // genuinely never reclaims them.
+    const retryDeadline = Date.now() + 5_000;
+    while (
+      listWebhookIngressRoutes().length === 0 &&
+      Date.now() < retryDeadline
+    ) {
+      await new Promise((done) => setTimeout(done, 5));
+    }
     unwatch();
 
     expect(
@@ -596,7 +607,7 @@ describe("list", () => {
 
   it("reports a cadet-signed route as served while its source waits", async () => {
     // Approval is the general gate, and a cadet-signed route is the
-    // exception: only a caller holding the platform secret can open it. A
+    // exception: only a caller holding the cloud secret can open it. A
     // listing that read servability off the source's state would call a live
     // route dormant, and say nothing about which half of a mixed declaration
     // is already reachable.