@mycadet/cli 0.12.7 → 0.12.9-dev.202610131452.9acab64

package/src/lib/{platform-client.ts → cloud-client.ts}

@@ -1,7 +1,7 @@
 import {
-  type PlatformCredentialVerificationStatus,
+  type CloudCredentialVerificationStatus,
   PlatformVerifyCredentialResponseSchema,
-} from "@mycadet/service-contracts/platform-credential";
+} from "@mycadet/service-contracts/cloud-credential";
 import {
   chmodSync,
   readFileSync,
@@ -18,7 +18,7 @@ import { getCurrentEnvironment } from "./environments/resolve.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
 import { z } from "zod";
 
-const PlatformErrorDetailSchema = z.object({
+const CloudErrorDetailSchema = z.object({
   detail: z.string().optional(),
 });
 
@@ -26,13 +26,18 @@ const InProgressResponseSchema = z.object({
   in_progress: z.boolean().optional(),
 });
 
-function getPlatformTokenPath(): string {
+function getCloudTokenPath(): string {
+  return join(getConfigDir(getCurrentEnvironment()), "cloud-token");
+}
+
+/** The pre-rename token filename, read as a fallback for existing installs. */
+function getLegacyCloudTokenPath(): string {
   return join(getConfigDir(getCurrentEnvironment()), "platform-token");
 }
 
 /**
- * Resolve the platform API base URL. Resolution order:
- *   1. `platformBaseUrl` persisted on the lockfile by
+ * Resolve the cloud API base URL. Resolution order:
+ *   1. `cloudBaseUrl` persisted on the lockfile by
  *      {@link syncConfigToLockfile} when the active assistant was last
  *      hatched/waked. This is the source of truth for "what URL does the
  *      currently-active assistant target" — reading the workspace
@@ -40,17 +45,17 @@ function getPlatformTokenPath(): string {
  *      non-production XDG layouts because the CLI process has no way to
  *      know which instance to read from without first consulting the
  *      lockfile anyway.
- *   2. `CADET_PLATFORM_URL` env var (explicit override, e.g. in CI).
+ *   2. `CADET_CLOUD_URL` env var (explicit override, e.g. in CI).
  *   3. The current environment's seed URL (e.g. `https://dev-cloud.mycadet.ai`
  *      for `CADET_ENVIRONMENT=dev`, `https://cloud.mycadet.ai` for prod).
  *      This makes the CLI environment-aware when no lockfile entry exists yet.
  */
-export function getPlatformUrl(): string {
+export function getCloudUrl(): string {
   const lockfileUrl = getLockfilePlatformBaseUrl();
   return (
     lockfileUrl ||
-    process.env.CADET_PLATFORM_URL?.trim() ||
-    getCurrentEnvironment().platformUrl
+    process.env.CADET_CLOUD_URL?.trim() ||
+    getCurrentEnvironment().cloudUrl
   );
 }
 
@@ -67,19 +72,21 @@ export function getWebUrl(): string {
   return process.env.CADET_WEB_URL?.trim() || getCurrentEnvironment().webUrl;
 }
 
-export function readPlatformToken(): string | null {
+export function readCloudToken(): string | null {
   for (const dir of getConfigDirs(getCurrentEnvironment())) {
-    try {
-      return readFileSync(join(dir, "platform-token"), "utf-8").trim();
-    } catch {
-      // Try the next compatible location.
+    for (const name of ["cloud-token", "platform-token"]) {
+      try {
+        return readFileSync(join(dir, name), "utf-8").trim();
+      } catch {
+        // Try the next compatible location, then the legacy name.
+      }
     }
   }
   return null;
 }
 
-export function savePlatformToken(token: string): void {
-  const tokenPath = getPlatformTokenPath();
+export function saveCloudToken(token: string): void {
+  const tokenPath = getCloudTokenPath();
   const dir = dirname(tokenPath);
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -88,11 +95,13 @@ export function savePlatformToken(token: string): void {
   chmodSync(tokenPath, 0o600);
 }
 
-export function clearPlatformToken(): void {
-  try {
-    unlinkSync(getPlatformTokenPath());
-  } catch {
-    // already doesn't exist
+export function clearCloudToken(): void {
+  for (const path of [getCloudTokenPath(), getLegacyCloudTokenPath()]) {
+    try {
+      unlinkSync(path);
+    } catch {
+      // already doesn't exist
+    }
   }
 }
 
@@ -131,20 +140,20 @@ const orgIdCache = new Map<string, { orgId: string; expiresAt: number }>();
 const ORG_ID_CACHE_TTL_MS = 60_000; // 60 seconds
 
 /**
- * Drop the cached org ID for a given (token, platformUrl) pair. Used by the
+ * Drop the cached org ID for a given (token, cloudUrl) pair. Used by the
  * one-shot 401-retry path: a 401 on a session-token request frequently means
  * the cached `Cadet-Organization-Id` header is stale (e.g. user switched
  * orgs in another tab). Clearing the entry forces the next `authHeaders`
- * call to refetch the org ID from the platform.
+ * call to refetch the org ID from the cloud.
  *
  * Exported so other modules (e.g. local-runtime-client) can implement the
  * same retry pattern without needing direct access to the cache map.
  */
 export function invalidateOrgIdCache(
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): void {
-  orgIdCache.delete(`${token}::${platformUrl ?? ""}`);
+  orgIdCache.delete(`${token}::${cloudUrl ?? ""}`);
 }
 
 /**
@@ -154,10 +163,10 @@ export function invalidateOrgIdCache(
  * - `Content-Type: application/json`
  * - The appropriate auth header (`Authorization: Bearer` for `vak_`
  *   API keys, `X-Session-Token` for session tokens).
- * - `Cadet-Organization-Id` – fetched from the platform.  Only
+ * - `Cadet-Organization-Id` – fetched from the cloud.  Only
  *   included for session-token callers; API keys are already org-scoped.
  *
- * The org ID is cached per (token, platformUrl) for 60 seconds to avoid
+ * The org ID is cached per (token, cloudUrl) for 60 seconds to avoid
  * redundant HTTP requests in tight polling loops.
  *
  * Auth errors (401 / 403) from the org-ID fetch are wrapped in a
@@ -169,7 +178,7 @@ export function invalidateOrgIdCache(
  */
 export async function authHeaders(
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<Record<string, string>> {
   const base: Record<string, string> = {
     "Content-Type": "application/json",
@@ -181,14 +190,14 @@ export async function authHeaders(
     return base;
   }
 
-  const cacheKey = `${token}::${platformUrl ?? ""}`;
+  const cacheKey = `${token}::${cloudUrl ?? ""}`;
   const cached = orgIdCache.get(cacheKey);
   if (cached && Date.now() < cached.expiresAt) {
     return { ...base, "Cadet-Organization-Id": cached.orgId };
   }
 
   try {
-    const orgId = await fetchOrganizationId(token, platformUrl);
+    const orgId = await fetchOrganizationId(token, cloudUrl);
     orgIdCache.set(cacheKey, {
       orgId,
       expiresAt: Date.now() + ORG_ID_CACHE_TTL_MS,
@@ -300,7 +309,7 @@ const RawUnifiedJobStatusSchema = z.object({
 
 export interface HatchAssistantResult {
   assistant: HatchedAssistant;
-  /** true when the platform returned an existing assistant (HTTP 200) */
+  /** true when the cloud returned an existing assistant (HTTP 200) */
   reusedExisting: boolean;
 }
 
@@ -320,7 +329,7 @@ export interface EnsureRegistrationResponse {
 }
 
 /**
- * Register (or re-confirm) a self-hosted local assistant with the platform.
+ * Register (or re-confirm) a self-hosted local assistant with the cloud.
  *
  * Calls `POST /v1/assistants/self-hosted-local/ensure-registration/`.
  * The endpoint is idempotent: the first call provisions an API key;
@@ -333,10 +342,10 @@ export async function ensureSelfHostedLocalRegistration(
   runtimeAssistantId: string,
   clientPlatform: string,
   assistantVersion?: string,
-  platformUrl?: string,
+  cloudUrl?: string,
   publicBaseUrl?: string,
 ): Promise<EnsureRegistrationResponse> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const body: Record<string, string> = {
     client_installation_id: clientInstallationId,
     runtime_assistant_id: runtimeAssistantId,
@@ -391,7 +400,7 @@ export interface ReprovisionApiKeyResponse {
  * Reprovision (rotate) the API key for a self-hosted local assistant.
  *
  * Calls `POST /v1/assistants/self-hosted-local/reprovision-api-key/`.
- * Returns a fresh API key. The platform keeps the previous key valid for a
+ * Returns a fresh API key. The cloud keeps the previous key valid for a
  * grace period rather than revoking it on the spot, so a rotation whose
  * replacement never gets stored leaves the assistant on a key that still
  * works until that window closes.
@@ -403,9 +412,9 @@ export async function reprovisionAssistantApiKey(
   runtimeAssistantId: string,
   clientPlatform: string,
   assistantVersion?: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<ReprovisionApiKeyResponse> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const body: Record<string, string> = {
     client_installation_id: clientInstallationId,
     runtime_assistant_id: runtimeAssistantId,
@@ -455,20 +464,20 @@ export interface GatewayCredentialResult {
 }
 
 /**
- * Ask a running assistant to check its stored managed credential against the
+ * Ask a running assistant to check its stored cloud credential against the
  * platform, via the gateway-proxied `POST /v1/platform/verify-credential`.
  *
- * Returns `"rejected"` only when the platform settled that answer. Every other
+ * Returns `"rejected"` only when the cloud settled that answer. Every other
  * case, including a daemon too old to serve the route and any failure to reach
  * one, returns null: the answer decides whether a key is rotated, so an absent
  * answer must never read as a rejection.
  *
  * Never throws.
  */
-export async function verifyGatewayManagedCredential(
+export async function verifyGatewayCloudCredential(
   gatewayUrl: string,
   bearerToken?: string,
-): Promise<PlatformCredentialVerificationStatus | null> {
+): Promise<CloudCredentialVerificationStatus | null> {
   try {
     const headers: Record<string, string> = { Accept: "application/json" };
     if (bearerToken) {
@@ -506,7 +515,7 @@ export async function verifyGatewayManagedCredential(
  * Returns a result distinguishing "key not found" (`value: null,
  * unreachable: false`) from "gateway unreachable" (`value: null,
  * unreachable: true`). Callers should only reprovision when the gateway
- * is reachable: the platform keeps the outgoing key valid for a grace
+ * is reachable: the cloud keeps the outgoing key valid for a grace
  * period, so reprovisioning while the gateway is down does not break the
  * assistant immediately, but it starts a clock on a key the caller cannot
  * yet replace.
@@ -594,8 +603,7 @@ export interface CredentialInjectionParams {
   gatewayUrl: string;
   bearerToken?: string;
   assistantApiKey?: string | null;
-  platformAssistantId: string;
-  platformBaseUrl: string;
+  cloudAssistantId: string;
   organizationId: string;
   userId?: string;
   webhookSecret?: string | null;
@@ -622,8 +630,6 @@ export async function injectCredentialsIntoAssistant(
     promises.push(inject("cadet:assistant_api_key", params.assistantApiKey));
   }
 
-  promises.push(inject("cadet:platform_base_url", params.platformBaseUrl));
-
   if (params.webhookSecret) {
     promises.push(inject("cadet:webhook_secret", params.webhookSecret));
   }
@@ -634,14 +640,14 @@ export async function injectCredentialsIntoAssistant(
 
 export async function hatchAssistant(
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<HatchAssistantResult> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const url = `${resolvedUrl}/v1/assistants/hatch/`;
 
   const response = await loopbackSafeFetch(url, {
     method: "POST",
-    headers: await authHeaders(token, platformUrl),
+    headers: await authHeaders(token, cloudUrl),
     body: JSON.stringify({}),
     signal: AbortSignal.timeout(300_000),
   });
@@ -652,7 +658,7 @@ export async function hatchAssistant(
   }
 
   if (response.status === 401 || response.status === 403) {
-    const detail = PlatformErrorDetailSchema
+    const detail = CloudErrorDetailSchema
       .catch({})
       .parse(await response.json().catch(() => ({})));
     throw new Error(
@@ -665,7 +671,7 @@ export async function hatchAssistant(
     throw new Error("Insufficient balance to hatch a new assistant.");
   }
 
-  const errorBody = PlatformErrorDetailSchema
+  const errorBody = CloudErrorDetailSchema
     .catch({})
     .parse(await response.json().catch(() => ({})));
   throw new Error(
@@ -677,18 +683,18 @@ export async function hatchAssistant(
 const PLATFORM_FETCH_TIMEOUT_MS = 10_000;
 
 /**
- * Lightweight pre-check: returns the first active managed assistant for the
+ * Lightweight pre-check: returns the first active cloud assistant for the
  * authenticated user, or `null` if none exists. Calls `GET /v1/assistants/`
  * and looks for any assistant with status "active".
  *
  * Used by the teleport flow to block BEFORE the expensive GCS upload when
- * the user already has a platform assistant.
+ * the user already has a cloud assistant.
  */
-export async function checkExistingPlatformAssistant(
+export async function checkExistingCloudAssistant(
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<HatchedAssistant | null> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const url = `${resolvedUrl}/v1/assistants/`;
 
   const controller = new AbortController();
@@ -700,7 +706,7 @@ export async function checkExistingPlatformAssistant(
   try {
     const response = await loopbackSafeFetch(url, {
       signal: controller.signal,
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
     });
 
     if (!response.ok) {
@@ -717,14 +723,14 @@ export async function checkExistingPlatformAssistant(
 }
 
 /**
- * Fetch all active assistants for the authenticated user from the platform.
+ * Fetch all active assistants for the authenticated user from the cloud.
  * Returns an empty array on failure (non-fatal).
  */
-export async function fetchPlatformAssistants(
+export async function fetchCloudAssistants(
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<HatchedAssistant[]> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const url = `${resolvedUrl}/v1/assistants/`;
 
   const controller = new AbortController();
@@ -736,7 +742,7 @@ export async function fetchPlatformAssistants(
   try {
     const response = await loopbackSafeFetch(url, {
       signal: controller.signal,
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
     });
 
     if (!response.ok) return [];
@@ -750,7 +756,7 @@ export async function fetchPlatformAssistants(
   }
 }
 
-export interface PlatformAssistantDetail {
+export interface CloudAssistantDetail {
   currentReleaseVersion: string | null;
   releaseChannel: "stable" | "preview";
 }
@@ -763,15 +769,15 @@ export interface PlatformAssistantDetail {
 export async function fetchAssistantDetail(
   token: string,
   assistantId: string,
-  platformUrl?: string,
-): Promise<PlatformAssistantDetail | null> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  cloudUrl?: string,
+): Promise<CloudAssistantDetail | null> {
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const url = `${resolvedUrl}/v1/assistants/${encodeURIComponent(assistantId)}/`;
 
   try {
     const response = await loopbackSafeFetch(url, {
       signal: AbortSignal.timeout(PLATFORM_FETCH_TIMEOUT_MS),
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
     });
 
     if (!response.ok) return null;
@@ -790,7 +796,7 @@ export async function fetchAssistantDetail(
 }
 
 /**
- * Check whether the platform reports an upgrade in progress for the
+ * Check whether the cloud reports an upgrade in progress for the
  * assistant via `GET /v1/assistants/{id}/upgrade-status/`. Returns null
  * when the endpoint is unavailable (404 on older platforms, network
  * error) so callers can skip the check. Never throws.
@@ -798,15 +804,15 @@ export async function fetchAssistantDetail(
 export async function fetchUpgradeInProgress(
   token: string,
   assistantId: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<boolean | null> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const url = `${resolvedUrl}/v1/assistants/${encodeURIComponent(assistantId)}/upgrade-status/`;
 
   try {
     const response = await loopbackSafeFetch(url, {
       signal: AbortSignal.timeout(PLATFORM_FETCH_TIMEOUT_MS),
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
     });
 
     if (!response.ok) return null;
@@ -828,9 +834,9 @@ export interface PlatformUser {
 
 export async function fetchOrganizationId(
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<string> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const url = `${resolvedUrl}/v1/organizations/`;
 
   const controller = new AbortController();
@@ -866,9 +872,9 @@ export async function fetchOrganizationId(
 
 export async function fetchCurrentUser(
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<PlatformUser> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const url = `${resolvedUrl}/_allauth/app/v1/auth/session`;
 
   const controller = new AbortController();
@@ -907,18 +913,18 @@ export async function fetchCurrentUser(
 // Rollback
 // ---------------------------------------------------------------------------
 
-export async function rollbackPlatformAssistant(
+export async function rollbackCloudAssistant(
   token: string,
   assistantId: string,
   version?: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<{ detail: string; version: string | null }> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const response = await loopbackSafeFetch(
     `${resolvedUrl}/v1/assistants/${encodeURIComponent(assistantId)}/rollback/`,
     {
       method: "POST",
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
       body: JSON.stringify(version ? { version } : {}),
     },
   );
@@ -973,14 +979,14 @@ export async function platformUploadToSignedUrl(
 export async function platformImportPreflightFromGcs(
   bundleKey: string,
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<{ statusCode: number; body: Record<string, unknown> }> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const response = await loopbackSafeFetch(
     `${resolvedUrl}/v1/migrations/import-preflight-from-gcs/`,
     {
       method: "POST",
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
       signal: AbortSignal.timeout(120_000),
       body: JSON.stringify({ bundle_key: bundleKey }),
     },
@@ -995,14 +1001,14 @@ export async function platformImportPreflightFromGcs(
 export async function platformImportBundleFromGcs(
   bundleKey: string,
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<{ statusCode: number; body: Record<string, unknown> }> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const response = await loopbackSafeFetch(
     `${resolvedUrl}/v1/migrations/import-from-gcs/`,
     {
       method: "POST",
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
       body: JSON.stringify({ bundle_key: bundleKey }),
       signal: AbortSignal.timeout(60_000),
     },
@@ -1024,7 +1030,7 @@ export async function platformImportBundleFromGcs(
 
 /**
  * Discriminated union representing the unified migration job status shape
- * returned by `GET /v1/migrations/jobs/{job_id}/` on both the platform and
+ * returned by `GET /v1/migrations/jobs/{job_id}/` on both the cloud and
  * the local runtime.
  */
 export type UnifiedJobStatus =
@@ -1090,7 +1096,7 @@ export interface BundleCompatibility {
 }
 
 /**
- * Thrown by platformRequestSignedUrl when the platform rejects a download
+ * Thrown by cloudRequestSignedUrl when the cloud rejects a download
  * signed-URL request because the target runtime version is outside the
  * ExportJob's [min_runtime_version, max_runtime_version] band. Terminal
  * — callers must NOT retry; surface to the user and abort the
@@ -1124,7 +1130,7 @@ export class VersionMismatchError extends Error {
 }
 
 /**
- * Request a signed URL from the platform for either uploading a new bundle
+ * Request a signed URL from the cloud for either uploading a new bundle
  * or downloading an existing one. Calls `POST /v1/migrations/signed-url/`.
  *
  * - `operation: "upload"` (optionally with `contentType` / `contentLength`)
@@ -1138,7 +1144,7 @@ export class VersionMismatchError extends Error {
  * Throws {@link VersionMismatchError} on a 422 `version_mismatch` response,
  * which is terminal — callers must NOT retry.
  */
-export async function platformRequestSignedUrl(
+export async function cloudRequestSignedUrl(
   params: {
     operation: "upload" | "download";
     bundleKey?: string;
@@ -1150,21 +1156,21 @@ export async function platformRequestSignedUrl(
     // Target-side, download only: runtime version that will import.
     targetRuntimeVersion?: string;
     // Upload only: who will PUT to the URL. "runtime" signs against the
-    // runtime-reachable storage endpoint so a managed assistant pod can
+    // runtime-reachable storage endpoint so a cloud assistant pod can
     // upload its export bundle (platform→local teleport); defaults to
     // "client" server-side. No effect in production, where both endpoints
     // are the same.
     consumer?: "client" | "runtime";
   },
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<{
   url: string;
   bundleKey: string;
   expiresAt: string;
   maxContentLength?: number;
 }> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const body: Record<string, unknown> = { operation: params.operation };
   if (params.bundleKey !== undefined) body.bundle_key = params.bundleKey;
   if (params.contentType !== undefined) body.content_type = params.contentType;
@@ -1189,7 +1195,7 @@ export async function platformRequestSignedUrl(
   const doRequest = async (): Promise<Response> =>
     loopbackSafeFetch(`${resolvedUrl}/v1/migrations/signed-url/`, {
       method: "POST",
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
       body: JSON.stringify(body),
     });
 
@@ -1200,7 +1206,7 @@ export async function platformRequestSignedUrl(
     // lookup. For session-token callers, a 401 frequently means the
     // cached org ID is stale — calling doRequest() again without clearing
     // the cache would just send the same stale header and fail again.
-    invalidateOrgIdCache(token, platformUrl);
+    invalidateOrgIdCache(token, cloudUrl);
     response = await doRequest();
   }
 
@@ -1240,19 +1246,19 @@ export async function platformRequestSignedUrl(
 }
 
 /**
- * Poll the unified job-status endpoint on the platform. Calls
+ * Poll the unified job-status endpoint on the cloud. Calls
  * `GET /v1/migrations/jobs/{jobId}/` and parses into {@link UnifiedJobStatus}.
  */
 export async function platformPollJobStatus(
   jobId: string,
   token: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<UnifiedJobStatus> {
-  const resolvedUrl = platformUrl || getPlatformUrl();
+  const resolvedUrl = cloudUrl || getCloudUrl();
   const response = await loopbackSafeFetch(
     `${resolvedUrl}/v1/migrations/jobs/${jobId}/`,
     {
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
     },
   );