@mycadet/assistant 0.12.7 → 0.12.8

package/src/runtime/routes/migration-routes.ts

@@ -23,8 +23,8 @@ import { PassThrough, Readable } from "node:stream";
 import { GatewayDebugExportIpcResponseSchema } from "@mycadet/gateway-client/gateway-ipc-contracts";
 import { z } from "zod";
 
+import { resolveCloudAssistantId } from "../../config/cloud-identity.js";
 import { invalidateConfigCache } from "../../config/loader.js";
-import { resolvePlatformAssistantId } from "../../config/platform-identity.js";
 import { trackDaemonActivity } from "../../daemon/activity-trail.js";
 import { getAssistantName } from "../../daemon/identity-helpers.js";
 import { ipcCallPersistent } from "../../ipc/gateway-client.js";
@@ -108,7 +108,7 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 import { RouteResponse } from "./types.js";
 
 /**
- * CES account prefix for platform-identity (`cadet:*`) credentials. Entries
+ * CES account prefix for cloud-identity (`cadet:*`) credentials. Entries
  * with an account that starts with this string are filtered out of any
  * imported bundle so they don't overwrite the target's own Django-provisioned
  * platform identity (most notably `assistant_api_key`).
@@ -119,23 +119,17 @@ import { RouteResponse } from "./types.js";
 const PLATFORM_CREDENTIAL_PREFIX = credentialKey("cadet", "");
 
 /**
- * Platform-identity fields that the managed runtime expects to see in CES.
- * On a managed assistant the platform provisions these after hatch (most via
- * `POST /v1/secrets`), including `platform_organization_id` and
- * `platform_user_id`, which it resolves from the hatching user and
- * organization. A signed-in client may additionally (re)assert some of them
- * on teleport / local→managed transfer. Either set of writes can race with
+ * Cadet credentials that the cloud runtime expects to see in CES.
+ * On a cloud assistant the cloud provisions these after hatch via
+ * `POST /v1/secrets`. A signed-in client may additionally (re)assert some of
+ * them on teleport / local→managed transfer. Either set of writes can race with
  * the import — the CES write survives (separate volume), but the metadata
  * upsert may be clobbered by the in-place clear / atomic swap. After every
  * import we reconcile metadata.json against CES so any field CES already holds
  * a value for gets a matching metadata entry.
  */
-const CADET_PLATFORM_IDENTITY_FIELDS = [
-  "platform_base_url",
+const CADET_CREDENTIAL_FIELDS = [
   "assistant_api_key",
-  "platform_assistant_id",
-  "platform_organization_id",
-  "platform_user_id",
   "webhook_secret",
 ] as const;
 
@@ -150,7 +144,7 @@ const CADET_PLATFORM_IDENTITY_FIELDS = [
 export async function reconcileCadetMetadataFromCes(warningSink: {
   warnings: string[];
 }): Promise<void> {
-  for (const field of CADET_PLATFORM_IDENTITY_FIELDS) {
+  for (const field of CADET_CREDENTIAL_FIELDS) {
     try {
       const value = await getSecureKeyAsync(credentialKey("cadet", field));
       if (!value) {
@@ -244,7 +238,7 @@ interface ExportManifestInputs {
  * `DAEMON_INTERNAL_ASSISTANT_ID` rather than the empty string.
  */
 async function resolveAssistantId(): Promise<string> {
-  const resolved = await resolvePlatformAssistantId();
+  const resolved = await resolveCloudAssistantId();
   if (resolved) {
     return resolved;
   }
@@ -272,9 +266,9 @@ async function resolveAssistantId(): Promise<string> {
  *
  * Managed-mode exports never reach this with credentials: both export
  * handlers skip credential collection entirely when `origin.mode` is
- * "managed" (the validator's cross-field refine rejects a managed bundle
+ * "managed" (the validator's cross-field refine rejects a cloud bundle
  * with `secrets_redacted: false`, and teleport clients re-provision
- * platform identity after a platform→local import).
+ * platform identity after a cloud→local import).
  */
 export function computeSecretsRedacted(
   credentialCount: number,
@@ -383,7 +377,7 @@ export async function handleMigrationExport(
     // Managed deployments never ship credentials in bundles — the manifest
     // schema forbids it (`secrets_redacted` must be true when `origin.mode`
     // is "managed"), and teleport clients re-provision platform identity
-    // after a platform→local import. Redact instead of emitting a bundle
+    // after a cloud→local import. Redact instead of emitting a bundle
     // the importer is guaranteed to reject.
     let credentials: Array<{ account: string; value: string }> = [];
     let secretsRedacted = true;
@@ -642,7 +636,7 @@ export async function handleMigrationExportToGcs({ body }: RouteHandlerArgs) {
   // deployments never ship credentials in bundles — the manifest schema
   // forbids it (`secrets_redacted` must be true when `origin.mode` is
   // "managed"), and teleport clients re-provision platform identity after
-  // a platform→local import — so redact instead of emitting a bundle the
+  // a cloud→local import — so redact instead of emitting a bundle the
   // importer is guaranteed to reject.
   //
   // A debug bundle goes to Cadet staff, so it never carries credentials
@@ -729,7 +723,7 @@ export async function handleMigrationExportToGcs({ body }: RouteHandlerArgs) {
             method: "PUT",
             body: webBody,
             // `duplex: "half"` is required when sending a streaming body
-            // via fetch in Node/Bun — without it the platform rejects the
+            // via fetch in Node/Bun — without it the cloud rejects the
             // request as "duplex option is required when body is a
             // ReadableStream".
             duplex: "half",
@@ -1143,7 +1137,7 @@ function wasFetchBodyTornDown(stream: PassThrough): boolean {
  * assistant is willing to PUT a bundle (SSRF). Widening the export path is
  * its own explicit operator opt-in via the separate
  * `CADET_MIGRATION_EXPORT_ALLOWED_HOSTS` env var (local/minikube only,
- * where the platform serves plain-http SigV4 URLs from SeaweedFS) — see
+ * where the cloud serves plain-http SigV4 URLs from SeaweedFS) — see
  * `exportValidatorOptions`.
  */
 let urlValidatorOptions: ValidateGcsSignedUrlOptions | undefined;
@@ -1174,7 +1168,7 @@ export function parseMigrationImportAllowedHostsEnv(
  *
  * Precedence: an explicit test override (when set) wins; otherwise the
  * env-derived import allowlist from `CADET_MIGRATION_IMPORT_ALLOWED_HOSTS`.
- * The platform injects that env var only where the bundle is served over
+ * The cloud injects that env var only where the bundle is served over
  * plain http from a non-GCS host — e.g. local/minikube, where the signed
  * bundle URL points at `http://host.docker.internal/...`. Supplying a
  * non-default allowlist intentionally relaxes the validator's scheme check
@@ -1211,7 +1205,7 @@ function importValidatorOptions(): ValidateGcsSignedUrlOptions | undefined {
  * Deliberately a separate env var from the import allowlist: the export
  * path controls where the assistant will PUT a full workspace bundle, so
  * widening it must be its own operator decision, never a side effect of
- * relaxing imports. The platform injects it only where the signed upload
+ * relaxing imports. The cloud injects it only where the signed upload
  * URL is served over plain http from a non-GCS host (local/minikube
  * SeaweedFS); it is unset in staging/prod, keeping the strict GCS-only
  * default there.
@@ -1265,7 +1259,7 @@ interface GcsImportErrorInit {
   reason?: string;
   errors?: Array<{ code: string; message: string; path?: string }>;
   partial_report?: ImportCommitReport;
-  /** Populated for `version_incompatible` — mirrors the platform's PR #5470
+  /** Populated for `version_incompatible` — mirrors the cloud's PR #5470
    *  response shape so the URL-body endpoint can return the same body. */
   bundle_compat?: RuntimeCompatibility;
   /** Populated for `version_incompatible`. */
@@ -1607,7 +1601,7 @@ async function runGcsImport(
     }
     if (result.reason === "version_incompatible") {
       // Returned by commitImport / streamCommitImport when the runtime falls
-      // outside the bundle's compat range. The platform-side gate is the
+      // outside the bundle's compat range. The cloud-side gate is the
       // primary check; this catches legacy bundles whose ExportJob row
       // predates PR #5470 (compat columns NULL → platform gate skipped).
       throw new GcsImportError({
@@ -1890,7 +1884,7 @@ function throwGcsImportError(err: unknown): never {
     }
     if (err.code === "version_incompatible") {
       // 422 (not 500) — the bundle is structurally valid but cannot be
-      // imported on this runtime. Body mirrors the platform's PR #5470
+      // imported on this runtime. Body mirrors the cloud's PR #5470
       // response shape.
       throw new UnprocessableEntityError(err.message, {
         reason: "version_incompatible" as const,
@@ -2094,7 +2088,7 @@ interface CredentialImportSummary {
   succeeded: number;
   failed: number;
   failedAccounts: string[];
-  skippedPlatform: number;
+  skippedCloud: number;
 }
 
 /**
@@ -2108,7 +2102,7 @@ interface CredentialWarningSink {
 }
 
 /**
- * Filter platform-identity (cadet:*) credentials out of the bundle, push
+ * Filter cloud-identity (cadet:*) credentials out of the bundle, push
  * user credentials into CES via `bulkSetSecureKeysAsync`, and return a
  * structured summary. Never throws — CES failures become report warnings.
  */
@@ -2116,18 +2110,18 @@ async function importBundleCredentialsIntoCes(
   bundleCredentials: Array<{ account: string; value: string }>,
   warningSink: CredentialWarningSink,
 ): Promise<CredentialImportSummary | undefined> {
-  // Filter out platform-identity credentials (cadet:*) — these are
+  // Filter out cloud-identity credentials (cadet:*) — these are
   // environment-specific and must not overwrite the target's own identity.
   const userCredentials = bundleCredentials.filter(
     (c) => !c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
   );
-  const skippedPlatform = bundleCredentials.length - userCredentials.length;
-  if (skippedPlatform > 0) {
-    log.info(`Skipped ${skippedPlatform} cloud credential(s) from import`);
+  const skippedCloud = bundleCredentials.length - userCredentials.length;
+  if (skippedCloud > 0) {
+    log.info(`Skipped ${skippedCloud} cloud credential(s) from import`);
   }
 
   if (userCredentials.length === 0) {
-    if (skippedPlatform > 0) {
+    if (skippedCloud > 0) {
       // All credentials in the bundle were cloud credentials — report
       // the skip count even though nothing was sent to CES.
       return {
@@ -2135,7 +2129,7 @@ async function importBundleCredentialsIntoCes(
         succeeded: 0,
         failed: 0,
         failedAccounts: [],
-        skippedPlatform,
+        skippedCloud,
       };
     }
     return undefined;
@@ -2165,7 +2159,7 @@ async function importBundleCredentialsIntoCes(
       succeeded,
       failed: failedResults.length,
       failedAccounts: failedResults.map((f) => f.account),
-      skippedPlatform,
+      skippedCloud,
     };
   } catch (err) {
     log.warn({ err }, "Credential import failed entirely");
@@ -2177,7 +2171,7 @@ async function importBundleCredentialsIntoCes(
       succeeded: 0,
       failed: userCredentials.length,
       failedAccounts: userCredentials.map((c) => c.account),
-      skippedPlatform,
+      skippedCloud,
     };
   }
 }
@@ -2248,13 +2242,13 @@ function throwImportCommitFailure(
 
   if (result.reason === "version_incompatible") {
     // Returned by commitImport / streamCommitImport when the runtime falls
-    // outside the bundle's compat range. The platform-side gate is the
+    // outside the bundle's compat range. The cloud-side gate is the
     // primary check; this catches legacy bundles whose ExportJob row
     // predates PR #5470 (compat columns NULL → platform gate skipped).
     //
     // 422 (not 500) — the bundle is structurally valid but cannot be
     // imported on this runtime; the caller can act on it (upgrade the
-    // runtime, choose a different bundle). Body mirrors the platform's
+    // runtime, choose a different bundle). Body mirrors the cloud's
     // PR #5470 response shape.
     throw new UnprocessableEntityError(
       formatRuntimeCompatibilityMessage(
@@ -2286,7 +2280,7 @@ function throwImportCommitFailure(
  *
  *   - `{ job_id, type, status: "processing" }`
  *     Covers both the internal `pending` and `running` states — collapsed
- *     into a single wire value to match the platform's transport shape used
+ *     into a single wire value to match the cloud's transport shape used
  *     by `ExportStatusProcessingSerializer` / `ImportStatusProcessingSerializer`.
  *   - `{ job_id, type, status: "complete", result }`
  *   - `{ job_id, type, status: "failed", error, error_code, upstream_status? }`
@@ -2330,7 +2324,7 @@ export async function handleMigrationJobStatus({
     return result;
   }
 
-  // pending or running — collapse to the platform's "processing" wire value.
+  // pending or running — collapse to the cloud's "processing" wire value.
   return {
     job_id: job.id,
     type: job.type,

package/src/runtime/routes/oauth-commands-routes.ts

@@ -9,6 +9,7 @@ import { readFileSync } from "node:fs";
 
 import { channelForBotProvider } from "@mycadet/service-contracts/channels";
 
+import { CadetCloudClient } from "../../cloud/client.js";
 import {
   getConfig,
   loadRawConfig,
@@ -46,7 +47,6 @@ import {
   type OAuthProviderRow,
 } from "../../oauth/oauth-store.js";
 import { missingScopesForStoredToken } from "../../oauth/scope-utils.js";
-import { CadetPlatformClient } from "../../platform/client.js";
 import { withValidToken } from "../../security/token-manager.js";
 import { matchHostPattern } from "../../tools/credentials/host-pattern-match.js";
 import { parseJsonSafe } from "../../util/json.js";
@@ -77,14 +77,14 @@ interface PlatformConnectionEntry {
 
 function getManagedServiceConfigKey(provider: string): string | null {
   const providerRow = getProvider(provider);
-  const managedKey = providerRow?.managedServiceConfigKey;
+  const managedKey = providerRow?.cloudServiceConfigKey;
   if (!managedKey || !(managedKey in ServicesSchema.shape)) {
     return null;
   }
   return managedKey;
 }
 
-function isManagedMode(provider: string): boolean {
+function isCloudMode(provider: string): boolean {
   const managedKey = getManagedServiceConfigKey(provider);
   if (!managedKey) {
     return false;
@@ -97,30 +97,30 @@ function isManagedMode(provider: string): boolean {
   }
 }
 
-async function requirePlatformClient(): Promise<CadetPlatformClient> {
-  const client = await CadetPlatformClient.create();
+async function requireCloudClient(): Promise<CadetCloudClient> {
+  const client = await CadetCloudClient.create();
   if (!client) {
     throw new BadRequestError(
       "Not connected to Cadet Cloud. Run `cadet cloud connect` to connect first.",
     );
   }
-  if (!client.platformAssistantId) {
+  if (!client.cloudAssistantId) {
     throw new BadRequestError(
-      "Connected to Cadet Cloud but no assistant ID is configured. Ensure the assistant is registered on the platform.",
+      "Connected to Cadet Cloud but no assistant ID is configured. Ensure the assistant is registered on the cloud.",
     );
   }
   return client;
 }
 
 async function fetchActiveConnections(
-  client: CadetPlatformClient,
+  client: CadetCloudClient,
   provider: string,
 ): Promise<PlatformConnectionEntry[]> {
   const params = new URLSearchParams();
   params.set("provider", provider);
   params.set("status", "ACTIVE");
 
-  const path = `/v1/assistants/${encodeURIComponent(client.platformAssistantId)}/oauth/connections/?${params.toString()}`;
+  const path = `/v1/assistants/${encodeURIComponent(client.cloudAssistantId)}/oauth/connections/?${params.toString()}`;
   const response = await client.fetch(path);
 
   if (!response.ok) {
@@ -141,12 +141,12 @@ async function fetchActiveConnections(
 
 /**
  * Best-effort helper to count active cloud connections for a provider.
- * Returns 0 if the platform client cannot be created or the fetch fails.
+ * Returns 0 if the cloud client cannot be created or the fetch fails.
  */
 async function countManagedConnections(provider: string): Promise<number> {
   try {
-    const client = await CadetPlatformClient.create();
-    if (!client || !client.platformAssistantId) {
+    const client = await CadetCloudClient.create();
+    if (!client || !client.cloudAssistantId) {
       return 0;
     }
     const entries = await fetchActiveConnections(client, provider);
@@ -264,7 +264,7 @@ function judgeProviderResponse(
  * health measures the same thing on the heartbeat; measuring it on the
  * request names the gap at the moment a call may depend on it, since a
  * connection made before a scope was required keeps working for every call
- * that does not need it. A managed connection has no local row and reports
+ * that does not need it. A cloud connection has no local row and reports
  * nothing.
  */
 function missingScopesForConnection(
@@ -312,10 +312,10 @@ async function handleDisconnect({ body = {} }: RouteHandlerArgs) {
     );
   }
 
-  const managed = isManagedMode(b.provider);
+  const managed = isCloudMode(b.provider);
 
   if (managed) {
-    const client = await requirePlatformClient();
+    const client = await requireCloudClient();
     const entries = await fetchActiveConnections(client, b.provider);
 
     let connectionId: string | undefined;
@@ -355,7 +355,7 @@ async function handleDisconnect({ body = {} }: RouteHandlerArgs) {
       accountLabel = entries[0].account_label;
     }
 
-    const disconnectPath = `/v1/assistants/${encodeURIComponent(client.platformAssistantId)}/oauth/connections/${encodeURIComponent(connectionId!)}/disconnect/`;
+    const disconnectPath = `/v1/assistants/${encodeURIComponent(client.cloudAssistantId)}/oauth/connections/${encodeURIComponent(connectionId!)}/disconnect/`;
     const disconnectResponse = await client.fetch(disconnectPath, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -513,13 +513,13 @@ async function handleModeSet({ body = {} }: RouteHandlerArgs) {
       };
     }
     throw new BadRequestError(
-      `Managed mode is not available for ${b.provider}. Only providers with platform-managed OAuth support can be switched to managed mode.`,
+      `Managed mode is not available for ${b.provider}. Only providers with cloud OAuth support can be switched to managed mode.`,
     );
   }
 
   // Require cloud connection when switching to managed mode
   if (b.mode === "managed") {
-    const client = await CadetPlatformClient.create();
+    const client = await CadetCloudClient.create();
     if (!client) {
       throw new BadRequestError(
         "Not connected to Cadet Cloud. Run `cadet cloud connect` to connect first.",
@@ -590,10 +590,10 @@ async function handleStatus({ queryParams = {} }: RouteHandlerArgs) {
     );
   }
 
-  const managed = isManagedMode(provider);
+  const managed = isCloudMode(provider);
 
   if (managed) {
-    const client = await requirePlatformClient();
+    const client = await requireCloudClient();
     const rawEntries = await fetchActiveConnections(client, provider);
 
     const connections = rawEntries.map((c) => ({
@@ -762,9 +762,9 @@ async function handleToken({ body = {} }: RouteHandlerArgs) {
     throw new BadRequestError("provider is required");
   }
 
-  if (isManagedMode(b.provider)) {
+  if (isCloudMode(b.provider)) {
     throw new BadRequestError(
-      "Token retrieval is not supported for platform-managed providers. " +
+      "Token retrieval is not supported for cloud providers. " +
         "When a provider is in managed mode, Cadet handles OAuth tokens on your behalf — " +
         "they are not exposed directly.\n\n" +
         `To verify your connection is working, run 'assistant oauth ping ${b.provider}'.\n` +
@@ -858,11 +858,11 @@ export async function handleRequest({ body = {} }: RouteHandlerArgs) {
     );
   }
 
-  const managed = isManagedMode(b.provider);
+  const managed = isCloudMode(b.provider);
 
   if (b.client_id) {
     if (managed) {
-      log.info("--client-id is ignored for platform-managed providers");
+      log.info("--client-id is ignored for cloud providers");
     } else {
       const app = getAppByProviderAndClientId(b.provider, b.client_id);
       if (!app) {
@@ -1075,9 +1075,9 @@ async function handleManagedConnect({ body = {} }: RouteHandlerArgs) {
     throw new BadRequestError("provider is required");
   }
 
-  const client = await requirePlatformClient();
+  const client = await requireCloudClient();
 
-  const startPath = `/v1/assistants/${encodeURIComponent(client.platformAssistantId)}/oauth/${encodeURIComponent(b.provider)}/start/`;
+  const startPath = `/v1/assistants/${encodeURIComponent(client.cloudAssistantId)}/oauth/${encodeURIComponent(b.provider)}/start/`;
 
   const reqBody: Record<string, unknown> = {};
   if (b.scopes && b.scopes.length > 0) {
@@ -1085,7 +1085,7 @@ async function handleManagedConnect({ body = {} }: RouteHandlerArgs) {
   }
   reqBody.redirect_after_connect =
     b.redirect_after_connect ?? "/account/oauth/complete";
-  // Only forwarded when present: the platform validates it against the
+  // Only forwarded when present: the cloud validates it against the
   // provider's pattern and rejects per-tenant providers that omit it.
   const tenantHost =
     typeof b.tenant_host === "string" ? b.tenant_host.trim() : "";
@@ -1129,7 +1129,7 @@ async function handleManagedConnectPoll({
     throw new BadRequestError("provider query param is required");
   }
 
-  const client = await requirePlatformClient();
+  const client = await requireCloudClient();
   const entries = await fetchActiveConnections(client, provider);
 
   return {
@@ -1268,9 +1268,9 @@ export const ROUTES: RouteDefinition[] = [
       requiredScopes: ["settings.write"],
       allowedPrincipalTypes: LOCAL_PRINCIPALS,
     },
-    summary: "Start managed OAuth connect",
+    summary: "Start cloud OAuth connect",
     description:
-      "Start a managed (platform) OAuth connect flow and return the connect URL.",
+      "Start a cloud (platform) OAuth connect flow and return the connect URL.",
     tags: ["oauth"],
     handler: handleManagedConnect,
   },
@@ -1282,7 +1282,7 @@ export const ROUTES: RouteDefinition[] = [
       requiredScopes: ["settings.read"],
       allowedPrincipalTypes: LOCAL_PRINCIPALS,
     },
-    summary: "Poll managed OAuth connections",
+    summary: "Poll cloud OAuth connections",
     description:
       "Fetch active cloud connections for a provider (used to detect new connections after managed connect).",
     tags: ["oauth"],

package/src/runtime/routes/oauth-providers.ts

@@ -72,11 +72,11 @@ function handleListProviders({ queryParams = {} }: RouteHandlerArgs) {
     .map((row) => serializeProviderSummary(row))
     .filter((s): s is NonNullable<typeof s> => s !== null);
 
-  const supportsManagedMode = queryParams.supports_managed_mode;
+  const supportsManagedMode = queryParams.supports_cloud_mode;
   if (supportsManagedMode === "true") {
-    serialized = serialized.filter((p) => p.supports_managed_mode);
+    serialized = serialized.filter((p) => p.supports_cloud_mode);
   } else if (supportsManagedMode === "false") {
-    serialized = serialized.filter((p) => !p.supports_managed_mode);
+    serialized = serialized.filter((p) => !p.supports_cloud_mode);
   }
 
   return { providers: serialized };
@@ -399,7 +399,7 @@ export const oauthProviderSummarySchema = z.object({
   client_id_placeholder: z.string().nullable(),
   requires_client_secret: z.boolean(),
   logo_url: z.string().nullable(),
-  supports_managed_mode: z.boolean(),
+  supports_cloud_mode: z.boolean(),
   managed_service_is_paid: z.boolean(),
   feature_flag: z.string().nullable(),
   category: z
@@ -446,7 +446,7 @@ export const ROUTES: RouteDefinition[] = [
     handler: handleListProviders,
     queryParams: [
       {
-        name: "supports_managed_mode",
+        name: "supports_cloud_mode",
         schema: { type: "string" },
         description: "Filter by managed mode support (true/false)",
       },

package/src/runtime/routes/oauth-proxy-passthrough.test.ts

@@ -4,7 +4,7 @@ import {
   CredentialRequiredError,
   InsufficientBalanceError,
   ProviderUnreachableError,
-} from "../../oauth/platform-connection.js";
+} from "../../oauth/cloud-connection.js";
 import { BackendError } from "../../util/errors.js";
 import { BadRequestError, ForbiddenError, RouteError } from "./errors.js";
 import {

package/src/runtime/routes/oauth-proxy-passthrough.ts

@@ -7,14 +7,14 @@
  * fidelity, header stripping, error mapping) testable in isolation.
  */
 
+import {
+  CredentialRequiredError,
+  InsufficientBalanceError,
+} from "../../oauth/cloud-connection.js";
 import {
   isBinaryOAuthBody,
   type OAuthConnectionResponse,
 } from "../../oauth/connection.js";
-import {
-  CredentialRequiredError,
-  InsufficientBalanceError,
-} from "../../oauth/platform-connection.js";
 import type { TokenExpiredError } from "../../security/token-manager.js";
 import { findContentTypeHeader } from "../../util/oauth-request-body.js";
 import {
@@ -69,7 +69,7 @@ const TEXT_ENCODER = new TextEncoder();
 /**
  * Statuses the `Response` constructor refuses a body on, limited to the ones
  * this route can emit. The interim 1xx statuses are absent: a BYO `fetch`
- * never surfaces one as a final response and the platform envelope refuses a
+ * never surfaces one as a final response and the cloud envelope refuses a
  * status outside 200 to 599, so a `RouteResponse` carrying one would only make
  * the adapter's `Response` constructor throw.
  */
@@ -409,9 +409,9 @@ export function mapProxyResolveError(
  *
  * Upstream text arrives here verbatim: a BYO refresh failure carries the
  * provider token endpoint's own response and the refresh breaker's state, and
- * a managed provider that could not be reached carries the platform proxy's
+ * a cloud provider that could not be reached carries the cloud proxy's
  * body. The grant holder learns which dependency failed and what repairs it,
- * and nothing the provider or the platform wrote; the route logs the verbatim
+ * and nothing the provider or the cloud wrote; the route logs the verbatim
  * text so the operator still has it.
  *
  * `InsufficientBalanceError` is the exception: it is raised on a bare status
@@ -506,7 +506,7 @@ function pinningProviderSegment(
  * A BYO connection reports a dead credential either as `TokenExpiredError`
  * (no token, or a refresh that cannot succeed) or, when a refreshed request
  * still comes back 401, as an error carrying `status: 401`. Both mean the same
- * thing the platform's `CredentialRequiredError` does: reconnect.
+ * thing the cloud's `CredentialRequiredError` does: reconnect.
  */
 function isBYOCredentialFailure(err: unknown): boolean {
   return isTokenExpiredError(err) || hasUnauthorizedStatus(err);

package/src/runtime/routes/oauth-proxy-routes.ts

@@ -11,7 +11,11 @@
  * `oauth-proxy-passthrough.ts`; this module is the wiring around them.
  */
 
-import { isPlatformAuthBypassActive } from "../../config/env.js";
+import { isCloudAuthBypassActive } from "../../config/env.js";
+import {
+  CloudOAuthConnection,
+  prepareCloudProxyHeaders,
+} from "../../oauth/cloud-connection.js";
 import {
   isIdempotentHttpMethod,
   type OAuthConnectionResponse,
@@ -19,10 +23,6 @@ import {
 import type { OAuthConnectionResolution } from "../../oauth/connection-resolver.js";
 import { resolveOAuthConnectionWithMeta } from "../../oauth/connection-resolver.js";
 import { getProvider } from "../../oauth/oauth-store.js";
-import {
-  PlatformOAuthConnection,
-  prepareManagedProxyHeaders,
-} from "../../oauth/platform-connection.js";
 import { getLogger } from "../../util/logger.js";
 import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import {
@@ -76,11 +76,11 @@ export async function handleOAuthProxy(
   // A grant names one provider and, when it pinned one, one account. The
   // subject is re-derived from this request's own segment, so rewriting or
   // dropping `@account` cannot match the grant's subject. Only a
-  // platform-managed pod skips the comparison: there the daemon discards the
+  // cloud-managed pod skips the comparison: there the daemon discards the
   // token and builds a synthetic context that carries no grant subject to
   // compare against.
   if (
-    !isPlatformAuthBypassActive() &&
+    !isCloudAuthBypassActive() &&
     args.headers?.["x-cadet-subject"] !== proxyGrantSubject(provider, account)
   ) {
     throw new ForbiddenError(
@@ -118,13 +118,11 @@ export async function handleOAuthProxy(
   }
 
   const { connection } = resolution;
-  if (connection instanceof PlatformOAuthConnection) {
+  if (connection instanceof CloudOAuthConnection) {
     if (method === "HEAD") {
-      throw new MethodNotAllowedError(
-        "Managed connections do not support HEAD",
-      );
+      throw new MethodNotAllowedError("Cloud connections do not support HEAD");
     }
-    const managedHeaders = prepareManagedProxyHeaders(headers);
+    const managedHeaders = prepareCloudProxyHeaders(headers);
     const { unsupportedHeaders } = managedHeaders;
     if (unsupportedHeaders.length > 0) {
       throw new BadRequestError(
@@ -134,7 +132,7 @@ export async function handleOAuthProxy(
     headers = managedHeaders.headers;
   }
 
-  // A Buffer travels as raw bytes on BYO and as base64 on the platform, in
+  // A Buffer travels as raw bytes on BYO and as base64 on the cloud, in
   // both cases under the caller's own Content-Type.
   const body =
     carriesBody(method) && args.rawBody?.byteLength
@@ -152,7 +150,7 @@ export async function handleOAuthProxy(
       headers,
       body,
       signal: args.abortSignal,
-      // Byte-exact passthrough. Honored by BYO connections; a managed
+      // Byte-exact passthrough. Honored by BYO connections; a cloud
       // connection is parsed platform-side and cannot offer it.
       rawResponseBody: true,
       // The caller's own HTTP client decides what to do with a 3xx; the
@@ -163,7 +161,7 @@ export async function handleOAuthProxy(
       // the other idempotent methods keep their retries.
       singleAttempt: !isIdempotentHttpMethod(method),
       // The provider signing this query sees the bytes the caller wrote: key
-      // order, `%20`, and valueless flags all survive. Managed connections
+      // order, `%20`, and valueless flags all survive. Cloud connections
       // have no raw mode and send `query` instead.
       rawQuery: args.rawUrl.search,
     });
@@ -202,9 +200,9 @@ const BINARY_BODY = {
 const ERROR_RESPONSES: Record<string, { description: string }> = {
   "400": {
     description:
-      "Malformed provider segment or proxied path, or request headers unsupported by a managed connection",
+      "Malformed provider segment or proxied path, or request headers unsupported by a cloud connection",
   },
-  "402": { description: "The managed account is out of balance" },
+  "402": { description: "The cloud account is out of balance" },
   "403": {
     description: "The grant was minted for a different provider or account",
   },