@mycadet/assistant 0.12.7 → 0.12.9

package/src/providers/inference/adapter-factory.ts

@@ -35,10 +35,10 @@ import { AtlasCloudProvider } from "../atlascloud/client.js";
 import { BasetenProvider } from "../baseten/client.js";
 import { CadetProvider } from "../cadet/client.js";
 import {
-  CADET_MANAGED_PROVIDER,
-  getManagedUpstream,
-  isCadetManagedConnection,
-  MANAGED_ROUTABLE_PROVIDERS,
+  CADET_CLOUD_PROVIDER,
+  CLOUD_ROUTABLE_PROVIDERS,
+  getCloudUpstream,
+  isCadetCloudConnection,
 } from "../cadet-model-routing.js";
 import { FireworksProvider } from "../fireworks/client.js";
 import { GeminiProvider } from "../gemini/client.js";
@@ -70,7 +70,7 @@ export interface AdapterCreateOpts {
   apiKey: string;
   model: string;
   streamTimeoutMs: number;
-  /** Set when an explicit base URL override or managed proxy is in play. */
+  /** Set when an explicit base URL override or cloud proxy is in play. */
   baseURL?: string;
   /** Forwarded to providers that wire native provider-side web search. */
   useNativeWebSearch: boolean;
@@ -126,8 +126,8 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
   gemini: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
     new GeminiProvider(apiKey, model, {
       streamTimeoutMs,
-      // Gemini routes managed proxies through `managedBaseUrl`, not `baseURL`.
-      ...(baseURL ? { managedBaseUrl: baseURL } : {}),
+      // Gemini routes managed proxies through `cloudBaseUrl`, not `baseURL`.
+      ...(baseURL ? { cloudBaseUrl: baseURL } : {}),
     }),
   ollama: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
     new OllamaProvider(model, {
@@ -280,7 +280,7 @@ export function createAdapterFromConnection(
     useNativeWebSearch?: boolean;
     /**
      * Effective upstream provider to build the adapter for. Defaults to
-     * `connection.provider`. The provider-agnostic Cadet-managed connection
+     * `connection.provider`. The provider-agnostic Cadet Cloud connection
      * passes the resolved profile's provider here, since its own row carries
      * only the `cadet` sentinel.
      */
@@ -294,7 +294,7 @@ export function createAdapterFromConnection(
   }
 
   /**
-   * Re-read the managed credential after an auth rejection and rebuild the
+   * Re-read the cloud credential after an auth rejection and rebuild the
    * adapter around it, so a key rotated out-of-band is picked up without a
    * restart. Returns `null` when the store hands back the same credential
    * that just failed — otherwise a proxy 401 from any other cause (platform
@@ -338,7 +338,7 @@ export function createAdapterFromConnection(
    * (call site consumed, wire params resolved from the backup profile, usage
    * attribution headers stamped). A second `RetryProvider` in between would
    * re-normalize that call-site-less config and strip those headers, leaving
-   * degraded traffic unattributed on the platform's billing events.
+   * degraded traffic unattributed on the cloud's billing events.
    *
    * Never throws: a broken backup lookup must surface the original provider
    * error, not a new one.
@@ -378,7 +378,7 @@ export function createAdapterFromConnection(
         }
         const overrideProfile = expectedFallback;
         // Resolved the provider-aware way the runtime resolver resolves every
-        // profile name: the backups are companions of the managed column and
+        // profile name: the backups are companions of the cloud column and
         // must not materialize under a BYOK or ChatGPT default provider.
         const backup = resolveDefaultProfileForProvider(
           llm.profiles,
@@ -412,21 +412,21 @@ export function createAdapterFromConnection(
         }
         // The model the adapter serves must be the model the fallback send
         // carries, so it comes from the same forced-profile resolution.
-        // This callback authenticates the backup with the managed connection
+        // This callback authenticates the backup with the cloud connection
         // it was built for, so it can only serve a backup that routes through
-        // the managed column. Refusing any other route keeps managed billing
+        // the cloud column. Refusing any other route keeps managed billing
         // and credentials from being applied to user-owned traffic.
         // Keyed on the connection, not the provider: a call-site fragment that
-        // pins a concrete upstream over a managed winner keeps the managed
+        // pins a concrete upstream over a cloud winner keeps the cloud
         // routing and is stamped with this connection's name by the resolver
         // (see `llm-resolver.ts`), so a concrete `provider` here is still
         // managed traffic. Only a profile that names a different connection,
-        // or a concrete provider carrying no managed connection at all (a BYOK
+        // or a concrete provider carrying no cloud connection at all (a BYOK
         // winner), routes somewhere this callback cannot authenticate.
         const backupConnection = resolvedBackup.provider_connection;
         const routesThroughThisConnection =
           backupConnection === undefined
-            ? resolvedBackup.provider === CADET_MANAGED_PROVIDER
+            ? resolvedBackup.provider === CADET_CLOUD_PROVIDER
             : backupConnection === connection.name;
         if (!routesThroughThisConnection) {
           log.warn(
@@ -436,7 +436,7 @@ export function createAdapterFromConnection(
               backupProvider: resolvedBackup.provider,
               backupConnection,
             },
-            "Backup profile routes outside the managed connection; keeping the original error",
+            "Backup profile routes outside the cloud connection; keeping the original error",
           );
           return null;
         }
@@ -448,15 +448,15 @@ export function createAdapterFromConnection(
         // and the `isCadet && !expectedProvider` branch). Deriving it from the
         // model here regardless would send a provider-pinned call-site fragment
         // to a different upstream than a primary send of the same resolution,
-        // and would refuse a managed model the catalog does not list yet even
-        // though normal dispatch serves it. A provider the managed proxy cannot
+        // and would refuse a cloud model the catalog does not list yet even
+        // though normal dispatch serves it. A provider the cloud proxy cannot
         // front (a non-routable id, or another routing identity such as
         // `chatgpt`) is refused rather than routed.
         const declaredProvider = resolvedBackup.provider;
         const upstream =
-          declaredProvider === CADET_MANAGED_PROVIDER
-            ? getManagedUpstream(resolvedBackup.model)
-            : MANAGED_ROUTABLE_PROVIDERS.has(declaredProvider)
+          declaredProvider === CADET_CLOUD_PROVIDER
+            ? getCloudUpstream(resolvedBackup.model)
+            : CLOUD_ROUTABLE_PROVIDERS.has(declaredProvider)
               ? declaredProvider
               : null;
         if (upstream === null) {
@@ -467,11 +467,11 @@ export function createAdapterFromConnection(
               backupProvider: declaredProvider,
               backupModel: resolvedBackup.model,
             },
-            "Backup profile does not resolve to a managed upstream; keeping the original error",
+            "Backup profile does not resolve to a cloud upstream; keeping the original error",
           );
           return null;
         }
-        // Re-resolve auth for the BACKUP upstream: the managed proxy's base URL
+        // Re-resolve auth for the BACKUP upstream: the cloud proxy's base URL
         // is per-upstream, so the primary's resolved auth cannot be reused.
         const backupAuth = await resolveAuth(
           effectiveConnectionAuth(connection),
@@ -495,7 +495,7 @@ export function createAdapterFromConnection(
         return {
           provider: backupAdapter,
           overrideProfile,
-          // Always true: this callback is wired only on the managed proxy, so
+          // Always true: this callback is wired only on the cloud proxy, so
           // the backup route runs through it too and its `X-Cadet-*` billing
           // metadata reaches our own backend, never a third party.
           forwardUsageAttributionHeaders: true,
@@ -511,17 +511,17 @@ export function createAdapterFromConnection(
   }
 
   // Usage-attribution headers (`X-Cadet-*`) are only meaningful when the
-  // request is routed through the Cadet-managed proxy. They carry billing
+  // request is routed through the Cadet Cloud proxy. They carry billing
   // metadata for our own backend. Forwarding them to a third-party endpoint
-  // would leak internal Cadet metadata, so gate on the managed connection
+  // would leak internal Cadet metadata, so gate on the cloud connection
   // identity, the only route that flows through our proxy.
-  const isManagedProxy = isCadetManagedConnection(connection);
+  const isCloudProxy = isCadetCloudConnection(connection);
   const effectiveAuth = effectiveConnectionAuth(connection);
   const tracked = new UsageTrackingProvider(
     new RetryProvider(adapter, {
-      forwardUsageAttributionHeaders: isManagedProxy,
-      credentialSource: isManagedProxy
-        ? "cadet-managed"
+      forwardUsageAttributionHeaders: isCloudProxy,
+      credentialSource: isCloudProxy
+        ? "cadet-cloud"
         : effectiveAuth.type === "api_key"
           ? "byok"
           : effectiveAuth.type === "oauth_subscription"
@@ -530,11 +530,11 @@ export function createAdapterFromConnection(
               ? "no-auth"
               : undefined,
       connectionName: connection.name,
-      // Both escalations are managed-route only. A BYOK, oauth-subscription,
+      // Both escalations are cloud-route only. A BYOK, oauth-subscription,
       // or no-auth connection must never fall back: the install may hold no
-      // credential for the backup profile's provider, and only the managed
+      // credential for the backup profile's provider, and only the cloud
       // column carries `fallbackProfile` pointers in the first place.
-      ...(isManagedProxy
+      ...(isCloudProxy
         ? {
             refreshCredentialProvider: makeCredentialRefresher(),
             resolveFallbackRoute: makeFallbackRouteResolver(),
@@ -569,7 +569,7 @@ function buildConnectionAdapter(
   // only when the caller names an upstream, including Cadet-hosted GPU
   // models whose catalog id is also `cadet`.
   if (
-    connection.provider === CADET_MANAGED_PROVIDER &&
+    connection.provider === CADET_CLOUD_PROVIDER &&
     opts.provider === undefined
   ) {
     return null;

package/src/providers/inference/auth.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { CADET_MANAGED_PROVIDER } from "../cadet-model-routing.js";
+import { CADET_CLOUD_PROVIDER } from "../cadet-model-routing.js";
 import { PROVIDER_CATALOG } from "../model-catalog.js";
 
 // ---------------------------------------------------------------------------
@@ -12,7 +12,7 @@ import { PROVIDER_CATALOG } from "../model-catalog.js";
  *
  * Runtime-supported variants:
  *   - api_key: look up `credential` in vault, inject as bearer/provider header.
- *   - platform: route via Cadet managed proxy; no client-side credential.
+ *   - platform: route via Cadet Cloud proxy; no client-side credential.
  *   - none: no auth (e.g. Ollama running locally).
  *   - oauth_subscription: OAuth-based subscription auth (e.g. ChatGPT Codex).
  *   - service_account: Google service-account JSON key (Vertex AI); signs a
@@ -46,8 +46,8 @@ export type Auth = z.infer<typeof AuthSchema>;
 /**
  * Derive the auth configuration a provider implies when a client omits an
  * explicit `auth` object: keyless catalog providers (`setupMode: "keyless"`,
- * e.g. ollama) need none, the Cadet-managed sentinel routes via the
- * platform proxy, and every other provider authenticates by API key. Returns
+ * e.g. ollama) need none, the Cadet Cloud sentinel routes via the
+ * cloud proxy, and every other provider authenticates by API key. Returns
  * null when an API key is required but no credential was supplied, so route
  * handlers can reject with a 400. `oauth_subscription` is never derived —
  * the ChatGPT PKCE routes own that connection.
@@ -56,7 +56,7 @@ export function deriveAuthForProvider(
   provider: string,
   credential?: string,
 ): Auth | null {
-  if (provider === CADET_MANAGED_PROVIDER) {
+  if (provider === CADET_CLOUD_PROVIDER) {
     return { type: "platform" };
   }
   const entry = PROVIDER_CATALOG.find((p) => p.id === provider);
@@ -75,14 +75,14 @@ export function deriveAuthForProvider(
  * The auth a connection dispatches with. The stored auth object is
  * authoritative only where it carries a payload (an api_key credential ref,
  * the oauth_subscription marker, a deliberately keyed keyless provider);
- * the cadet provider IS the managed route, so its auth derives from the
+ * the cadet provider IS the cloud route, so its auth derives from the
  * provider and the stored value can never mislead dispatch.
  */
 export function effectiveConnectionAuth(connection: {
   provider: string;
   auth: Auth;
 }): Auth {
-  return connection.provider === CADET_MANAGED_PROVIDER
+  return connection.provider === CADET_CLOUD_PROVIDER
     ? { type: "platform" }
     : connection.auth;
 }
@@ -119,11 +119,11 @@ export type ResolvedAuth =
 export const VALID_CONNECTION_PROVIDERS: readonly string[] = [
   ...new Set([
     ...PROVIDER_CATALOG.map((p) => p.id),
-    // The provider-agnostic Cadet-managed connection stores this sentinel in
+    // The provider-agnostic Cadet Cloud connection stores this sentinel in
     // its `provider` column. The same id owns Cadet-hosted GPU models in the
     // catalog. Keep it allowlisted explicitly so a future catalog rename
     // cannot drop persisted `cadet` rows from the DB loaders.
-    CADET_MANAGED_PROVIDER,
+    CADET_CLOUD_PROVIDER,
     // The ChatGPT-subscription row stores the "chatgpt" routing identity in
     // its `provider` column: the row IS the subscription route (auth
     // modality = provider identity), and dispatch derives the openai
@@ -233,7 +233,7 @@ export const ProviderConnectionSchema = z
     createdAt: z.number().int(),
     updatedAt: z.number().int(),
     /**
-     * Whether this row is the Cadet-managed connection (`cadet`). Derived from
+     * Whether this row is the Cadet Cloud connection (`cadet`). Derived from
      * `MANAGED_CONNECTION_NAMES` in `connections.ts` at serialize time; the
      * DB column does not exist. Clients use this to render the read-only
      * "Cadet" badge + view-only editor and to disable the delete affordance

package/src/providers/inference/backfill.ts

@@ -18,18 +18,19 @@
  */
 
 import { MANAGED_PROFILE_NAMES } from "../../config/default-profile-catalog.js";
+import { getIsCloud } from "../../config/env-registry.js";
 import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
 import type { DrizzleDb } from "../../persistence/db-connection.js";
 import { credentialKey } from "../../security/credential-key.js";
 import { getLogger } from "../../util/logger.js";
-import { MANAGED_ROUTABLE_PROVIDERS } from "../cadet-model-routing.js";
+import { CLOUD_ROUTABLE_PROVIDERS } from "../cadet-model-routing.js";
 import { isConnectionCompatibleWithModel } from "../connection-model-compat.js";
 import {
   PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
   ROUTING_IDENTITY_PROVIDERS,
 } from "./auth.js";
 import {
-  CADET_MANAGED_CONNECTION_NAME,
+  CADET_CLOUD_CONNECTION_NAME,
   createConnection,
   getConnection,
   listConnections,
@@ -73,9 +74,8 @@ function backfillConfigProfiles(db: DrizzleDb): void {
     return;
   }
 
-  const isPlatform =
-    process.env.IS_PLATFORM === "true" || process.env.IS_PLATFORM === "1";
-  const globalMode = isPlatform ? "managed" : "your-own";
+  const isCloud = getIsCloud();
+  const globalMode = isCloud ? "managed" : "your-own";
 
   let changed = false;
 
@@ -200,14 +200,14 @@ function ensureProviderConnection(
   // For user-owned entries, an existing connection for the entry's provider
   // wins over the mode-derived default. Only user-brought connections can
   // match — the canonical `cadet` row carries the `cadet` sentinel
-  // provider, never a concrete upstream. Without this, the managed branch
+  // provider, never a concrete upstream. Without this, the cloud branch
   // would silently switch a connection-less BYOK-intent profile onto the
-  // billed managed connection, and the your-own branch would create a
+  // billed cloud connection, and the your-own branch would create a
   // parallel `-personal` row (pointing at an empty credential slot) when a
   // custom-named connection already exists.
   //
-  // Managed-owned entries are excluded: a managed preset must stay on the
-  // platform-managed route, not start dispatching against a key the user
+  // Managed-owned entries are excluded: a cloud preset must stay on the
+  // cloud route, not start dispatching against a key the user
   // brought for their own profiles. Managed-owned means `source: "managed"`
   // or a canonical managed name without an explicit `source: "user"` —
   // legacy seeders wrote canonical entries source-less, and only an explicit
@@ -228,12 +228,12 @@ function ensureProviderConnection(
     connectionName = existingForProvider.name;
   } else if (
     globalMode === "managed" &&
-    MANAGED_ROUTABLE_PROVIDERS.has(provider)
+    CLOUD_ROUTABLE_PROVIDERS.has(provider)
   ) {
     // All managed-routable providers share the single provider-agnostic
     // `cadet` connection; the upstream is recovered per-request from the
     // profile's `provider` field.
-    connectionName = CADET_MANAGED_CONNECTION_NAME;
+    connectionName = CADET_CLOUD_CONNECTION_NAME;
   } else {
     // "your-own" path (or provider not managed-supported): ensure a
     // personal connection exists. Ollama is keyless, so it gets

package/src/providers/inference/connection-availability.ts

@@ -20,11 +20,12 @@ import { getDb } from "../../persistence/db-connection.js";
 import { credentialKey } from "../../security/credential-key.js";
 import { getSecureKeyResultAsync } from "../../security/secure-keys.js";
 import {
-  CADET_MANAGED_CONNECTION_NAME,
-  CADET_MANAGED_PROVIDER,
-  isCadetManagedConnection,
-  MANAGED_ROUTABLE_PROVIDERS,
+  CADET_CLOUD_CONNECTION_NAME,
+  CADET_CLOUD_PROVIDER,
+  CLOUD_ROUTABLE_PROVIDERS,
+  isCadetCloudConnection,
 } from "../cadet-model-routing.js";
+import { resolveCloudProxyContext } from "../cloud-proxy/context.js";
 import {
   describeSubscriptionModelIncompatibility,
   isConnectionCompatibleWithModel,
@@ -34,7 +35,6 @@ import {
   resolveEntryConnectionName,
 } from "../connection-resolution.js";
 import { PROVIDER_CATALOG } from "../model-catalog.js";
-import { resolveManagedProxyContext } from "../platform-proxy/context.js";
 import {
   ConnectionResolutionError,
   resolveRoutingIdentity,
@@ -70,17 +70,17 @@ export interface ConnectionAvailability {
 const SETTINGS_HINT = "in Settings → Models & Services";
 
 /**
- * Availability of the Cadet-managed platform proxy: signed in and reachable.
+ * Availability of the Cadet Cloud cloud proxy: signed in and reachable.
  */
 export async function cadetConnectionAvailability(): Promise<ConnectionAvailability> {
-  const ctx = await resolveManagedProxyContext();
+  const ctx = await resolveCloudProxyContext();
   if (ctx.enabled) {
     return { status: "ok" };
   }
-  if (!ctx.platformBaseUrl) {
+  if (!ctx.cloudBaseUrl) {
     return {
       status: "cadet_unauthenticated",
-      message: "Not signed in to Cadet — the platform URL is not configured.",
+      message: "Not signed in to Cadet — the cloud URL is not configured.",
     };
   }
   // The context collapses an unreachable credential read into "no key";
@@ -101,17 +101,17 @@ export async function cadetConnectionAvailability(): Promise<ConnectionAvailabil
   return {
     status: "cadet_unauthenticated",
     message:
-      "Not signed in to Cadet — no assistant API key is stored. Log in to use Cadet-managed inference.",
+      "Not signed in to Cadet — no assistant API key is stored. Log in to use Cadet Cloud inference.",
   };
 }
 
-function cadetManagedMismatch(
+function cadetCloudMismatch(
   resolvedConnectionName: string,
   provider: string,
 ): ConnectionAvailability {
   return {
     status: "provider_mismatch",
-    message: `Connection "${resolvedConnectionName}" is the Cadet-managed connection, which cannot serve provider "${provider}". Pick a connection for "${provider}" ${SETTINGS_HINT}.`,
+    message: `Connection "${resolvedConnectionName}" is the Cadet Cloud connection, which cannot serve provider "${provider}". Pick a connection for "${provider}" ${SETTINGS_HINT}.`,
   };
 }
 
@@ -146,23 +146,23 @@ export async function computeConnectionAvailability(
   }
 
   // Mirror the dispatch-time provider check (`tryResolveProviderForConnectionName`):
-  // the provider-agnostic Cadet-managed connection routes managed-routable
-  // providers via platform auth; any other provider mismatch fails there, so
+  // the provider-agnostic Cadet Cloud connection routes managed-routable
+  // providers via cloud auth; any other provider mismatch fails there, so
   // usable credentials must not read as ok.
-  if (isCadetManagedConnection(connection)) {
+  if (isCadetCloudConnection(connection)) {
     if (
-      provider === CADET_MANAGED_PROVIDER ||
-      MANAGED_ROUTABLE_PROVIDERS.has(provider)
+      provider === CADET_CLOUD_PROVIDER ||
+      CLOUD_ROUTABLE_PROVIDERS.has(provider)
     ) {
       return cadetConnectionAvailability();
     }
-    return cadetManagedMismatch(resolvedConnectionName, provider);
+    return cadetCloudMismatch(resolvedConnectionName, provider);
   }
   // Everything routed through the canonical name dispatches on platform auth,
-  // never on a claiming row's credentials, so the platform's own status is the
-  // answer. Scoped to that name: a managed default explicitly pinned to some
+  // never on a claiming row's credentials, so the cloud's own status is the
+  // answer. Scoped to that name: a cloud default explicitly pinned to some
   // other row is a real misconfiguration and still reads as a mismatch below.
-  if (resolvedConnectionName === CADET_MANAGED_CONNECTION_NAME) {
+  if (resolvedConnectionName === CADET_CLOUD_CONNECTION_NAME) {
     return cadetConnectionAvailability();
   }
   // The ChatGPT-subscription row stores the "chatgpt" identity while its
@@ -228,10 +228,10 @@ export async function computeConnectionAvailability(
       };
     }
     case "platform":
-      // The managed proxy only serves managed-routable upstreams
-      // (`resolveAuth` → `buildManagedBaseUrl` has no proxy path for the
+      // The cloud proxy only serves managed-routable upstreams
+      // (`resolveAuth` → `buildCloudBaseUrl` has no proxy path for the
       // rest), so platform auth on e.g. openrouter can never dispatch.
-      if (MANAGED_ROUTABLE_PROVIDERS.has(provider)) {
+      if (CLOUD_ROUTABLE_PROVIDERS.has(provider)) {
         return cadetConnectionAvailability();
       }
       return {

package/src/providers/inference/connections.ts

@@ -6,13 +6,13 @@ import { providerConnections } from "../../persistence/schema/inference.js";
 import { normalizeCredentialRef } from "../../security/credential-key.js";
 import { getLogger } from "../../util/logger.js";
 import {
-  CADET_MANAGED_CONNECTION_NAME,
-  CADET_MANAGED_PROVIDER,
-  isCadetManagedConnection,
+  CADET_CLOUD_CONNECTION_NAME,
+  CADET_CLOUD_PROVIDER,
+  isCadetCloudConnection,
 } from "../cadet-model-routing.js";
 import { clearConnectionProviderCache } from "../registry.js";
 
-export { CADET_MANAGED_CONNECTION_NAME };
+export { CADET_CLOUD_CONNECTION_NAME };
 import {
   type Auth,
   AuthSchema,
@@ -28,20 +28,18 @@ import {
 const log = getLogger("providers/inference/connections");
 
 /**
- * Whether a row is one of the managed connections, judged by the row and not
+ * Whether a row is one of the cloud connections, judged by the row and not
  * by its name alone. Boot seeding leaves a user-owned row claiming a canonical
  * name in place, and that row is an ordinary connection: routing ignores it,
  * the route layer lets it be edited and deleted, and clients must render it
  * that way or the collision becomes unrecoverable from the UI.
  */
-function isManagedRow(row: {
+function isCloudRow(row: {
   name: string;
   provider: string;
   auth: { type: string };
 }): boolean {
-  return (
-    MANAGED_CONNECTION_NAMES.has(row.name) && isCadetManagedConnection(row)
-  );
+  return MANAGED_CONNECTION_NAMES.has(row.name) && isCadetCloudConnection(row);
 }
 
 // ---------------------------------------------------------------------------
@@ -110,7 +108,7 @@ export function listConnections(
         label: row.label ?? null,
         baseUrl: row.baseUrl ?? null,
         models: parseModelsColumn(row.models),
-        isManaged: isManagedRow({ ...row, provider: provider.data, auth }),
+        isManaged: isCloudRow({ ...row, provider: provider.data, auth }),
       },
     ];
   });
@@ -144,7 +142,7 @@ export function getConnection(
     label: row.label ?? null,
     baseUrl: row.baseUrl ?? null,
     models: parseModelsColumn(row.models),
-    isManaged: isManagedRow({ ...row, provider: provider.data, auth }),
+    isManaged: isCloudRow({ ...row, provider: provider.data, auth }),
   };
 }
 
@@ -265,7 +263,7 @@ export function createConnection(
       models,
       createdAt: now,
       updatedAt: now,
-      isManaged: isManagedRow({ name: input.name, provider, auth }),
+      isManaged: isCloudRow({ name: input.name, provider, auth }),
     },
   };
 }
@@ -353,7 +351,7 @@ export function updateConnection(
       baseUrl: nextBaseUrl,
       models: nextModels,
       updatedAt: now,
-      isManaged: isManagedRow({ name, provider: nextProvider, auth }),
+      isManaged: isCloudRow({ name, provider: nextProvider, auth }),
     },
   };
 }
@@ -427,15 +425,15 @@ const CANONICAL_CONNECTIONS: Array<{
   label: string;
 }> = [
   {
-    name: CADET_MANAGED_CONNECTION_NAME,
-    provider: CADET_MANAGED_PROVIDER,
+    name: CADET_CLOUD_CONNECTION_NAME,
+    provider: CADET_CLOUD_PROVIDER,
     auth: { type: "platform" },
     label: "Cadet",
   },
 ];
 
 /**
- * The Cadet-managed connection as boot seeding defines it, built without a DB
+ * The Cadet Cloud connection as boot seeding defines it, built without a DB
  * read. Dispatch uses this when the `cadet` name is occupied by a user-owned
  * row: seeding refuses to overwrite such a row, so the canonical row can be
  * absent from the DB while managed routing still has to work. Platform auth
@@ -458,15 +456,15 @@ export function canonicalCadetConnection(): ProviderConnection {
 }
 
 /**
- * Names of the canonical Cadet-managed connections. Seeded on every daemon
- * boot via `seedCanonicalConnections` and representing the platform-managed
+ * Names of the canonical Cadet Cloud connections. Seeded on every daemon
+ * boot via `seedCanonicalConnections` and representing the cloud-managed
  * inference route. They are write-protected at the route layer:
  *   - DELETE is blocked outright (would resurrect on next boot anyway, but
  *     blocking prevents a confusing delete → re-appear loop).
  *   - PATCH that changes `auth` is blocked (auth is locked to `{type:"platform"}`
  *     so any other value would be reverted on the next boot upsert).
  *   - PATCH that changes `label` is allowed — users may legitimately relabel the
- *     managed connection. `label` is seeded on initial INSERT and backfilled when
+ *     cloud connection. `label` is seeded on initial INSERT and backfilled when
  *     null on subsequent boots so pre-seed installs pick up the default; a non-null
  *     user-customized label is preserved (see `seedCanonicalConnections`).
  *
@@ -495,7 +493,7 @@ export function seedCanonicalConnections(db: DrizzleDb): void {
     // canonical name. `cadet` was not a reserved name before consolidation, so
     // an install may already have a BYOK connection keyed `cadet` (with a real
     // provider + api_key auth). Upserting it here would silently rewrite it to
-    // the platform-auth sentinel and make it managed/write-protected, breaking
+    // the cloud-auth sentinel and make it managed/write-protected, breaking
     // any profile that references the user's connection. Only seed/refresh when
     // the row is absent or already our sentinel (same provider).
     const existing = db

package/src/providers/inference/profile-probe.ts

@@ -119,7 +119,7 @@ function checkMessage(check: {
 /**
  * Probe a saved profile with one minimal request. Returns `null` when there
  * is no verdict to give: the profile does not exist or is disabled, it rides
- * a managed or routing-identity route (probing would bill managed credits),
+ * a cloud or routing-identity route (probing would bill managed credits),
  * or the probe timed out without an answer.
  */
 export async function probeInferenceProfile(
@@ -164,7 +164,7 @@ export async function probeInferenceProfile(
   // Billing guards run on the fully resolved call-site config — the same
   // composition dispatch consumes (mix arm expanded, call-site overrides
   // applied) — so neither a mix nor an `llm.callSites.inference` provider
-  // tweak can route the probe onto a managed or platform-billed path the
+  // tweak can route the probe onto a cloud or platform-billed path the
   // stored entry hid. Same seed as the dispatch below, so the judged arm is
   // the dispatched arm.
   const resolved = resolveCallSiteConfig("inference", llm, {
@@ -184,7 +184,7 @@ export async function probeInferenceProfile(
     return null;
   }
   // A legacy profile can declare a concrete provider while staying bound to
-  // a platform-billed connection row; the row's auth is the billing fact, so
+  // a cloud-billed connection row; the row's auth is the billing fact, so
   // it gates the probe too.
   const boundRow = connection ? getConnection(getDb(), connection) : null;
   if (boundRow?.auth.type === "platform") {
@@ -213,7 +213,7 @@ export async function probeInferenceProfile(
     // getConfiguredProvider, so only the stamped attribution names the row
     // this request would sign with.
     const route = providerInstance.routeAttribution;
-    if (route?.isManagedRoute) {
+    if (route?.isCloudRoute) {
       return null;
     }
     const routedRow = route?.connectionName

package/src/providers/inference/resolve-auth.ts

@@ -3,7 +3,7 @@
  *
  * Resolution rules:
  *   - api_key              → fetch credential from vault → inject as bearer header
- *   - platform             → build managed proxy URL and fetch the platform API key
+ *   - platform             → build cloud proxy URL and fetch the cloud API key
  *   - none                 → pass through with no auth headers
  *   - oauth_subscription   → fetch OAuth token from vault (with auto-refresh) → inject as bearer header
  *   - service_account      → sign JWT and exchange for bearer token at token_uri (Google Vertex AI)
@@ -12,9 +12,9 @@
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
 import {
-  buildManagedBaseUrl,
-  resolveManagedProxyContext,
-} from "../platform-proxy/context.js";
+  buildCloudBaseUrl,
+  resolveCloudProxyContext,
+} from "../cloud-proxy/context.js";
 import {
   type Auth,
   PROVIDERS_ALLOWING_CUSTOM_BASE_URL,
@@ -68,17 +68,17 @@ export async function resolveAuth(
     }
 
     case "platform": {
-      const managedBaseUrl = await buildManagedBaseUrl(provider);
-      if (!managedBaseUrl) {
+      const cloudBaseUrl = await buildCloudBaseUrl(provider);
+      if (!cloudBaseUrl) {
         return { ok: false, error: { code: "platform_unavailable" } };
       }
-      const ctx = await resolveManagedProxyContext();
+      const ctx = await resolveCloudProxyContext();
       return {
         ok: true,
         resolved: {
           kind: "header",
           headers: { Authorization: `Bearer ${ctx.assistantApiKey}` },
-          baseUrl: managedBaseUrl,
+          baseUrl: cloudBaseUrl,
         },
       };
     }