@mycadet/assistant 0.12.7 → 0.12.9

package/src/__tests__/{credential-execution-managed-contract.test.ts → credential-execution-cloud-contract.test.ts}

@@ -1,7 +1,7 @@
 /**
  * Managed CES contract and wiring tests.
  *
- * Validates the contract surface and behavioral invariants for the managed
+ * Validates the contract surface and behavioral invariants for the cloud
  * (three-container pod) CES sidecar integration:
  *
  * 1. Pod creation contract: well-known path constants match the
@@ -15,7 +15,7 @@
  *    behavioral contract per main.ts managed-mode handler builder).
  *
  * 4. RPC schema compatibility: managed-specific schemas
- *    (UpdateManagedCredential, MakeAuthenticatedRequest) validate expected
+ *    (UpdateCloudCredential, MakeAuthenticatedRequest) validate expected
  *    payloads and reject malformed ones at the contract level.
  *
  * All tests use contract schemas and handle parsers to verify behavioral
@@ -35,8 +35,8 @@ import {
   MANAGED_LOCAL_STATIC_REJECTION_ERROR,
   parseHandle,
   platformOAuthHandle,
-  UpdateManagedCredentialResponseSchema,
-  UpdateManagedCredentialSchema,
+  UpdateCloudCredentialResponseSchema,
+  UpdateCloudCredentialSchema,
 } from "@mycadet/service-contracts/credential-rpc";
 
 import {
@@ -78,7 +78,7 @@ describe("three-container pod contract", () => {
     // Verify actual string values, not just that they exist. These are
     // the method names on the wire — changing them is a breaking change
     // that would break the assistant-to-CES sidecar RPC contract.
-    expect(CesRpcMethod.UpdateManagedCredential).toBe(
+    expect(CesRpcMethod.UpdateCloudCredential).toBe(
       "update_managed_credential",
     );
     expect(CesRpcMethod.GetCredential).toBe("get_credential");
@@ -134,7 +134,7 @@ describe("local_static handle rejection in managed mode", () => {
 
   test("HandleType enum has exactly the three expected types", () => {
     // Managed mode explicitly switches on handle type. If a new type is
-    // added without a managed-mode handler, the default case in
+    // added without a cloud-mode handler, the default case in
     // main.ts will return an error. This test catches new types
     // that need managed-mode consideration.
     const types = Object.values(HandleType);
@@ -162,60 +162,60 @@ describe("local_static handle rejection in managed mode", () => {
 });
 
 // ---------------------------------------------------------------------------
-// RPC schema compatibility — UpdateManagedCredential
+// RPC schema compatibility — UpdateCloudCredential
 // ---------------------------------------------------------------------------
 
-describe("UpdateManagedCredential RPC schema contract", () => {
+describe("UpdateCloudCredential RPC schema contract", () => {
   test("request schema requires assistantApiKey field", () => {
-    // The UpdateManagedCredential RPC is managed-mode-specific: the
+    // The UpdateCloudCredential RPC is managed-mode-specific: the
     // assistant pushes its API key to CES after hatch provisioning.
-    expect(UpdateManagedCredentialSchema.shape.assistantApiKey).toBeDefined();
+    expect(UpdateCloudCredentialSchema.shape.assistantApiKey).toBeDefined();
   });
 
   test("request schema validates a well-formed payload", () => {
     const payload = { assistantApiKey: "cadet_key_test_123" };
-    const result = UpdateManagedCredentialSchema.safeParse(payload);
+    const result = UpdateCloudCredentialSchema.safeParse(payload);
     expect(result.success).toBe(true);
   });
 
   test("request schema rejects payload missing assistantApiKey", () => {
-    const result = UpdateManagedCredentialSchema.safeParse({});
+    const result = UpdateCloudCredentialSchema.safeParse({});
     expect(result.success).toBe(false);
   });
 
   test("request schema rejects non-string assistantApiKey", () => {
-    const result = UpdateManagedCredentialSchema.safeParse({
+    const result = UpdateCloudCredentialSchema.safeParse({
       assistantApiKey: 12345,
     });
     expect(result.success).toBe(false);
   });
 
   test("response schema requires updated boolean field", () => {
-    expect(UpdateManagedCredentialResponseSchema.shape.updated).toBeDefined();
+    expect(UpdateCloudCredentialResponseSchema.shape.updated).toBeDefined();
 
-    const successResult = UpdateManagedCredentialResponseSchema.safeParse({
+    const successResult = UpdateCloudCredentialResponseSchema.safeParse({
       updated: true,
     });
     expect(successResult.success).toBe(true);
 
-    const failResult = UpdateManagedCredentialResponseSchema.safeParse({
+    const failResult = UpdateCloudCredentialResponseSchema.safeParse({
       updated: false,
     });
     expect(failResult.success).toBe(true);
   });
 
   test("response schema rejects payload missing updated field", () => {
-    const result = UpdateManagedCredentialResponseSchema.safeParse({});
+    const result = UpdateCloudCredentialResponseSchema.safeParse({});
     expect(result.success).toBe(false);
   });
 
-  test("CesRpcSchemas entry for UpdateManagedCredential matches standalone schemas", () => {
+  test("CesRpcSchemas entry for UpdateCloudCredential matches standalone schemas", () => {
     // The schema lookup map must reference the same schemas. A mismatch
     // would mean the RPC dispatch layer validates against a different
     // schema than what callers expect.
-    const entry = CesRpcSchemas[CesRpcMethod.UpdateManagedCredential];
-    expect(entry.request).toBe(UpdateManagedCredentialSchema);
-    expect(entry.response).toBe(UpdateManagedCredentialResponseSchema);
+    const entry = CesRpcSchemas[CesRpcMethod.UpdateCloudCredential];
+    expect(entry.request).toBe(UpdateCloudCredentialSchema);
+    expect(entry.response).toBe(UpdateCloudCredentialResponseSchema);
   });
 });
 
@@ -226,7 +226,7 @@ describe("UpdateManagedCredential RPC schema contract", () => {
 describe("managed CES bootstrap handshake contract", () => {
   test("CES_PROTOCOL_VERSION is valid semver", () => {
     // The protocol version must be valid semver so version negotiation
-    // works correctly during the managed bootstrap handshake.
+    // works correctly during the cloud bootstrap handshake.
     expect(CES_PROTOCOL_VERSION).toMatch(/^\d+\.\d+\.\d+$/);
   });
 
@@ -236,7 +236,7 @@ describe("managed CES bootstrap handshake contract", () => {
   });
 
   test("handshake request schema requires protocolVersion and sessionId", () => {
-    // Both fields are mandatory for the managed bootstrap handshake.
+    // Both fields are mandatory for the cloud bootstrap handshake.
     // A handshake missing either must be rejected at parse time.
     const validHandshake = {
       type: "handshake_request" as const,
@@ -300,7 +300,7 @@ describe("managed CES bootstrap handshake contract", () => {
 // Managed OAuth handle parsing
 // ---------------------------------------------------------------------------
 
-describe("managed OAuth materialization through CES sidecar", () => {
+describe("cloud OAuth materialization through CES sidecar", () => {
   test("platform_oauth handle roundtrips through parse correctly", () => {
     const handle = platformOAuthHandle("conn_abc123");
     expect(handle).toBe("platform_oauth:conn_abc123");

package/src/__tests__/credential-health-service.test.ts

@@ -16,7 +16,7 @@ let mockProviders: Array<{
   pingBody: string | null;
   authorizeParams: string | null;
   scopeSeparator: string | null;
-  managedServiceConfigKey?: string;
+  cloudServiceConfigKey?: string;
 }> = [];
 
 let mockConnections: Map<
@@ -55,11 +55,11 @@ let managedPingOutcome:
   | { kind: "credential_required" }
   | { kind: "throw"; message: string } = { kind: "status", status: 200 };
 
-// Managed assistant-credential mock state. The verdict is what the platform
-// answers about the stored assistant API key; `platformClientAvailable` covers
+// Cloud assistant-credential mock state. The verdict is what the cloud
+// answers about the stored assistant API key; `cloudClientAvailable` covers
 // the case where the client cannot be built at all.
 let assistantKeyVerdict: "valid" | "rejected" | "unknown" = "valid";
-let platformClientAvailable = true;
+let cloudClientAvailable = true;
 
 // ── Module mocks ─────────────────────────────────────────────────────
 
@@ -112,18 +112,18 @@ mock.module("../security/token-manager.js", () => ({
   },
 }));
 
-// Managed-path mocks: platform client and PlatformOAuthConnection. The
+// Managed-path mocks: platform client and CloudOAuthConnection. The
 // managed code path uses dynamic imports for these so they only matter when
-// a managed test scenario is exercised. The managed/your-own service mode is
+// a cloud test scenario is exercised. The cloud/your-own service mode is
 // seeded into the real workspace config via `seedGoogleOAuthMode` below.
-mock.module("../platform/client.js", () => ({
-  CadetPlatformClient: {
+mock.module("../cloud/client.js", () => ({
+  CadetCloudClient: {
     create: async () => {
-      if (!platformClientAvailable) {
+      if (!cloudClientAvailable) {
         return null;
       }
       return {
-        platformAssistantId: "test-assistant",
+        cloudAssistantId: "test-assistant",
         fetch: async (_path: string) => ({
           ok: managedListResponse.ok,
           status: managedListResponse.status,
@@ -142,8 +142,8 @@ class MockCredentialRequiredError extends Error {
   }
 }
 
-mock.module("../oauth/platform-connection.js", () => ({
-  PlatformOAuthConnection: class {
+mock.module("../oauth/cloud-connection.js", () => ({
+  CloudOAuthConnection: class {
     constructor(_opts: unknown) {}
     async request(_req: unknown) {
       if (managedPingOutcome.kind === "credential_required") {
@@ -197,7 +197,7 @@ function addProvider(
     defaultScopes?: string[];
     pingUrl?: string | null;
     pingMethod?: string | null;
-    managedServiceConfigKey?: string;
+    cloudServiceConfigKey?: string;
     authorizeParams?: Record<string, string>;
   },
 ) {
@@ -212,10 +212,10 @@ function addProvider(
     pingMethod: opts?.pingMethod ?? null,
     pingHeaders: null,
     pingBody: null,
-    // checkManagedProvider reads this field via OAuthProviderRow; the
-    // health-check code branches to the managed path only when set AND
+    // checkCloudProvider reads this field via OAuthProviderRow; the
+    // health-check code branches to the cloud path only when set AND
     // when the corresponding config key's service mode is "managed".
-    managedServiceConfigKey: opts?.managedServiceConfigKey,
+    cloudServiceConfigKey: opts?.cloudServiceConfigKey,
   });
 }
 
@@ -265,7 +265,7 @@ describe("credential-health-service", () => {
     managedListResponse = { ok: true, status: 200, body: { results: [] } };
     managedPingOutcome = { kind: "status", status: 200 };
     assistantKeyVerdict = "valid";
-    platformClientAvailable = true;
+    cloudClientAvailable = true;
   });
 
   test("returns empty report when no providers exist", async () => {
@@ -660,8 +660,8 @@ describe("credential-health-service", () => {
   });
 
   describe("managed-provider path", () => {
-    // Distinguishing managed-path failure modes: a 424 from the platform
-    // proxy (CredentialRequiredError) means the platform tried and gave up
+    // Distinguishing managed-path failure modes: a 424 from the cloud
+    // proxy (CredentialRequiredError) means the cloud tried and gave up
     // on refresh — actionable, fire reconnect alert. A bare 401/403 from
     // the upstream provider could be a transient platform-side miss (proxy
     // didn't refresh-before-forward) and should NOT fire reconnect alerts
@@ -670,7 +670,7 @@ describe("credential-health-service", () => {
     function setupManagedGoogle(opts?: { hasActiveConnection?: boolean }) {
       addProvider("google", {
         pingUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
-        managedServiceConfigKey: "google-oauth",
+        cloudServiceConfigKey: "google-oauth",
       });
       seedGoogleOAuthMode("managed");
       if (opts?.hasActiveConnection !== false) {
@@ -714,7 +714,7 @@ describe("credential-health-service", () => {
       // This is the key change: previously this would fire a user-facing
       // reconnect alert (because "revoked" is in hardFailureStatuses). Now
       // we treat upstream 401 as potentially transient — only a 424 from
-      // the platform proxy is trusted enough to trigger the alert.
+      // the cloud proxy is trusted enough to trigger the alert.
       setupManagedGoogle();
       managedPingOutcome = { kind: "status", status: 401 };
 
@@ -771,38 +771,29 @@ describe("credential-health-service", () => {
     });
   });
 
-  describe("managed assistant credential", () => {
+  describe("cloud assistant credential", () => {
     const KEY = "credential/cadet/assistant_api_key";
-    const BASE_URL = "credential/cadet/platform_base_url";
 
-    // Checked directly rather than through `checkAllCredentials`: the managed
+    // Checked directly rather than through `checkAllCredentials`: the cloud
     // credential is not enrolled in the heartbeat pass yet, because the alert
     // that pass raises has nowhere to send the reader until the notification
     // carries the repair.
     const assistantKeyResult = checkAssistantApiKey;
 
-    test("is not reported when the workspace was never connected", async () => {
-      expect(await assistantKeyResult()).toBeNull();
-    });
-
-    test("is missing_token when a platform identity exists without a key", async () => {
-      secureKeyValues.set(BASE_URL, "https://platform.example");
-
+    test("is missing_token when no key is stored, connected or not", async () => {
       const result = await assistantKeyResult();
       expect(result!.status).toBe("missing_token");
       expect(result!.canAutoRecover).toBe(true);
     });
 
-    test("is healthy when the platform accepts the stored key", async () => {
-      secureKeyValues.set(BASE_URL, "https://platform.example");
+    test("is healthy when the cloud accepts the stored key", async () => {
       secureKeyValues.set(KEY, "stored-key");
       assistantKeyVerdict = "valid";
 
       expect((await assistantKeyResult())!.status).toBe("healthy");
     });
 
-    test("is revoked when the platform rejects the stored key", async () => {
-      secureKeyValues.set(BASE_URL, "https://platform.example");
+    test("is revoked when the cloud rejects the stored key", async () => {
       secureKeyValues.set(KEY, "stored-key");
       assistantKeyVerdict = "rejected";
 
@@ -818,7 +809,6 @@ describe("credential-health-service", () => {
     // error, transport failure) must degrade to `unreachable`, which the
     // heartbeat drops before notifying.
     test("an unsettled platform answer is unreachable, never revoked", async () => {
-      secureKeyValues.set(BASE_URL, "https://platform.example");
       secureKeyValues.set(KEY, "stored-key");
       assistantKeyVerdict = "unknown";
 
@@ -826,16 +816,14 @@ describe("credential-health-service", () => {
     });
 
     test("an unreadable credential store is unreachable, never revoked", async () => {
-      secureKeyValues.set(BASE_URL, "https://platform.example");
       markUnreachable(KEY);
 
       expect((await assistantKeyResult())!.status).toBe("unreachable");
     });
 
-    test("is unreachable when the platform client cannot be built", async () => {
-      secureKeyValues.set(BASE_URL, "https://platform.example");
+    test("is unreachable when the cloud client cannot be built", async () => {
       secureKeyValues.set(KEY, "stored-key");
-      platformClientAvailable = false;
+      cloudClientAvailable = false;
 
       expect((await assistantKeyResult())!.status).toBe("unreachable");
     });