@mycadet/gateway 0.12.7 → 0.12.8

package/README.md

@@ -210,9 +210,9 @@ The assistant runtime uses this URL to construct all webhook and OAuth callback
 
 ### Tunnel for Twilio Testing
 
-Tunnel is a managed ingress transport for assistant-hosted HTTP and WebSocket traffic. The gateway starts the Tunnel only after Twilio setup has been started in the workspace, or when existing Twilio config shows it was set up before. When Tunnel registration succeeds, the gateway writes the registered public assistant URL to `ingress.publicBaseUrl` and marks it with `ingress.publicBaseUrlManagedBy: "tunnel"`. Twilio URL builders use that public base URL for voice, status, and media-stream endpoints.
+Tunnel is a cloud ingress transport for assistant-hosted HTTP and WebSocket traffic. The gateway starts the Tunnel only after Twilio setup has been started in the workspace, or when existing Twilio config shows it was set up before. When Tunnel registration succeeds, the gateway writes the registered public assistant URL to `ingress.publicBaseUrl` and marks it with `ingress.publicBaseUrlManagedBy: "tunnel"`. Twilio URL builders use that public base URL for voice, status, and media-stream endpoints.
 
-Use Tunnel when testing Twilio voice webhooks or Twilio WebSocket upgrades through the platform-managed tunnel:
+Use Tunnel when testing Twilio voice webhooks or Twilio WebSocket upgrades through the cloud-managed tunnel:
 
 1. In `mycadet-platform`, start the local Tunnel service:
 
@@ -248,7 +248,7 @@ bun -e 'const ws = new WebSocket(process.argv[1]); ws.onopen = () => { console.l
   "wss://<tunnel-host>/<assistant-id>/webhooks/twilio/media-stream/session-123/<edge-token>"
 ```
 
-For a real Twilio call, expose local Tunnel with a public HTTPS/WSS tunnel and configure the platform Tunnel service with that origin as `TUNNEL_PUBLIC_BASE_URL`. After the assistant re-registers, Twilio should fetch `/webhooks/twilio/voice` and open `/webhooks/twilio/media-stream/...` through the Tunnel URL. Use ngrok or another custom tunnel in `ingress.publicBaseUrl` only for local/self-hosted workflows that are not routed through Tunnel.
+For a real Twilio call, expose local Tunnel with a public HTTPS/WSS tunnel and configure the cloud Tunnel service with that origin as `TUNNEL_PUBLIC_BASE_URL`. After the assistant re-registers, Twilio should fetch `/webhooks/twilio/voice` and open `/webhooks/twilio/media-stream/...` through the Tunnel URL. Use ngrok or another custom tunnel in `ingress.publicBaseUrl` only for local/self-hosted workflows that are not routed through Tunnel.
 
 ## Ingress Boundary Guarantees
 

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/package.json

@@ -26,7 +26,7 @@
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
-    "./platform-credential": "./src/platform-credential.ts",
+    "./cloud-credential": "./src/cloud-credential.ts",
     "./plan-credit": "./src/plan-credit.ts",
     "./integration-categories": "./src/integration-categories.ts",
     "./mcp-oauth": "./src/mcp-oauth.ts"

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/{platform-credential.ts → cloud-credential.ts}

@@ -1,10 +1,10 @@
 /**
- * Wire contract for asking an assistant whether its stored platform-managed
+ * Wire contract for asking an assistant whether its stored cloud-managed
  * credential still authenticates.
  *
  * The daemon route is the authoritative serving side:
  *   - `POST /v1/platform/verify-credential`
- *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *       (`assistant/src/runtime/routes/cloud-routes.ts`)
  *
  * The daemon's platform client produces the verdict, the route reports it,
  * and the `cadet` CLI reads it before deciding whether a stored key can be
@@ -15,26 +15,26 @@
 import { z } from "zod";
 
 /**
- * What the platform said about the stored credential, right now.
+ * What the cloud said about the stored credential, right now.
  *
- *   - `valid`: the platform accepted it.
- *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *   - `valid`: the cloud accepted it.
+ *   - `rejected`: the cloud refused it (unauthorized or forbidden); the
  *     credential needs replacing.
  *   - `unknown`: the check itself could not run (no credential stored, the
  *     platform unreachable, a server error). Not evidence either way.
  */
-export const PlatformCredentialVerificationStatusSchema = z.enum([
+export const CloudCredentialVerificationStatusSchema = z.enum([
   "valid",
   "rejected",
   "unknown",
 ]);
-export type PlatformCredentialVerificationStatus = z.infer<
-  typeof PlatformCredentialVerificationStatusSchema
+export type CloudCredentialVerificationStatus = z.infer<
+  typeof CloudCredentialVerificationStatusSchema
 >;
 
 /** `POST /v1/platform/verify-credential` response body. */
 export const PlatformVerifyCredentialResponseSchema = z.object({
-  status: PlatformCredentialVerificationStatusSchema,
+  status: CloudCredentialVerificationStatusSchema,
 });
 export type PlatformVerifyCredentialResponse = z.infer<
   typeof PlatformVerifyCredentialResponseSchema

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/handles.ts

@@ -15,9 +15,9 @@
  *    Format: `local_oauth:<providerKey>/<connectionId>` where providerKey
  *    is the bare provider name (e.g. `google`).
  *
- * 3. **Managed OAuth** — references an OAuth connection managed by the
+ * 3. **Cloud OAuth** — references an OAuth connection managed by the
  *    platform. Format: `platform_oauth:<connectionId>` where connectionId
- *    is the platform-assigned connection identifier.
+ *    is the cloud-assigned connection identifier.
  */
 
 import { z } from "zod";
@@ -96,7 +96,7 @@ export function localOAuthHandle(
 }
 
 /**
- * Build a managed (platform) OAuth credential handle from a connection ID.
+ * Build a cloud (platform) OAuth credential handle from a connection ID.
  */
 export function platformOAuthHandle(connectionId: string): string {
   return `${HandleType.PlatformOAuth}:${connectionId}`;

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/index.ts

@@ -31,7 +31,7 @@ export * from "./no-response.js";
 export * from "./plan-credit.js";
 export * from "./integration-categories.js";
 export * from "./mcp-oauth.js";
-export * from "./platform-credential.js";
+export * from "./cloud-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -4,7 +4,7 @@
  * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
- * managed-speech transport can't drift.
+ * cloud-speech transport can't drift.
  */
 export function tunnelHostForPlatformHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/remote-web-pairing.ts

@@ -152,7 +152,7 @@ export const DEFAULT_REMOTE_WEB_PAIRING_PLATFORM: RemoteWebPairingPlatform =
 
 /**
  * A requested platform coerced to a known value. The pairing-token route is
- * publicly reachable and the platform renders verbatim in the host's
+ * publicly reachable and the cloud renders verbatim in the host's
  * paired-devices list, so an unrecognized value never reaches the DB.
  */
 export function resolveRemoteWebPairingPlatform(

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/rpc.ts

@@ -34,7 +34,7 @@ import { RpcErrorSchema } from "./error.js";
 
 export const CesRpcMethod = {
   /** Push an updated assistant credential to CES after post-hatch provisioning. */
-  UpdateManagedCredential: "update_managed_credential",
+  UpdateCloudCredential: "update_managed_credential",
   /** Retrieve a single credential by account name. */
   GetCredential: "get_credential",
   /** Store or update a credential by account name. */
@@ -63,7 +63,7 @@ export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
 // update_managed_credential
 // ---------------------------------------------------------------------------
 
-export const UpdateManagedCredentialSchema = z.object({
+export const UpdateCloudCredentialSchema = z.object({
   /** The assistant API key to push to CES for platform credential materialization. */
   assistantApiKey: z.string(), // nosemgrep: not-a-secret
   /**
@@ -72,16 +72,16 @@ export const UpdateManagedCredentialSchema = z.object({
    */
   assistantId: z.string().optional(),
 });
-export type UpdateManagedCredential = z.infer<
-  typeof UpdateManagedCredentialSchema
+export type UpdateCloudCredential = z.infer<
+  typeof UpdateCloudCredentialSchema
 >;
 
-export const UpdateManagedCredentialResponseSchema = z.object({
-  /** Whether the managed credential was successfully updated. */
+export const UpdateCloudCredentialResponseSchema = z.object({
+  /** Whether the cloud credential was successfully updated. */
   updated: z.boolean(),
 });
-export type UpdateManagedCredentialResponse = z.infer<
-  typeof UpdateManagedCredentialResponseSchema
+export type UpdateCloudCredentialResponse = z.infer<
+  typeof UpdateCloudCredentialResponseSchema
 >;
 
 // ---------------------------------------------------------------------------
@@ -311,9 +311,9 @@ export type BulkSetCredentialRecordsResponse = z.infer<
  * schemas. Useful for building type-safe RPC dispatch layers.
  */
 export interface CesRpcContract {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredential;
-    response: UpdateManagedCredentialResponse;
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredential;
+    response: UpdateCloudCredentialResponse;
   };
   [CesRpcMethod.GetCredential]: {
     request: GetCredential;
@@ -361,9 +361,9 @@ export interface CesRpcContract {
  * Schema lookup map for runtime validation of RPC payloads.
  */
 export const CesRpcSchemas = {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredentialSchema,
-    response: UpdateManagedCredentialResponseSchema,
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredentialSchema,
+    response: UpdateCloudCredentialResponseSchema,
   },
   [CesRpcMethod.GetCredential]: {
     request: GetCredentialSchema,

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/trust-rules.ts

@@ -15,7 +15,7 @@
  * - **URL**: tools whose candidates include a URL (`web_fetch`,
  *   `network_request`).
  * - **Managed skill**: tools that manage first-party skill packages
- *   (`scaffold_managed_skill`, `delete_managed_skill`).
+ *   (`scaffold_cloud_skill`, `delete_cloud_skill`).
  * - **Skill load**: the `skill_load` tool, which uses a distinct candidate
  *   namespace (`skill_load:selector` or `skill_load_dynamic:selector`).
  * - **Generic**: everything else (computer-use tools, UI surface tools,
@@ -58,8 +58,8 @@ export const URL_TOOLS = ["web_fetch", "network_request"] as const;
  * Tools that manage first-party skill packages (scaffold/delete).
  */
 export const MANAGED_SKILL_TOOLS = [
-  "scaffold_managed_skill",
-  "delete_managed_skill",
+  "scaffold_cloud_skill",
+  "delete_cloud_skill",
 ] as const;
 
 /**
@@ -89,8 +89,8 @@ export function isUrlRule(rule: { tool: string }): boolean {
   return URL_TOOLS_SET.has(rule.tool);
 }
 
-/** Returns true when the rule's tool belongs to the managed-skill-tool family. */
-export function isManagedSkillRule(rule: { tool: string }): boolean {
+/** Returns true when the rule's tool belongs to the cloud-skill-tool family. */
+export function isCloudSkillRule(rule: { tool: string }): boolean {
   return MANAGED_SKILL_TOOLS_SET.has(rule.tool);
 }
 

package/node_modules/@mycadet/ces-client/src/rpc-client.ts

@@ -416,7 +416,7 @@ export function createCesRpcClient(
       assistantApiKey: string,
       assistantId?: string,
     ): Promise<{ updated: boolean }> {
-      return call(CesRpcMethod.UpdateManagedCredential, {
+      return call(CesRpcMethod.UpdateCloudCredential, {
         assistantApiKey,
         ...(assistantId ? { assistantId } : {}),
       });

package/node_modules/@mycadet/environments/src/seeds.ts

@@ -64,12 +64,12 @@ export function cloudAssistantHubUrl(envName: string | undefined): string {
 export const SEEDS: Record<string, EnvironmentDefinition> = {
   production: {
     name: "production",
-    platformUrl: "https://cloud.mycadet.ai",
+    cloudUrl: "https://cloud.mycadet.ai",
     webUrl: "https://mycadet.ai",
   },
   staging: {
     name: "staging",
-    platformUrl: "https://staging-cloud.mycadet.ai",
+    cloudUrl: "https://staging-cloud.mycadet.ai",
     webUrl: "https://staging.mycadet.ai",
     portsOverride: portBlock(17000),
   },
@@ -77,21 +77,21 @@ export const SEEDS: Record<string, EnvironmentDefinition> = {
     name: "test",
     // Non-functional URL — used only by unit tests for URL resolution, never
     // hit in production.
-    platformUrl: "https://test-cloud.mycadet.ai",
+    cloudUrl: "https://test-cloud.mycadet.ai",
     webUrl: "https://dev.mycadet.ai",
     portsOverride: portBlock(19000),
   },
   dev: {
     name: "dev",
-    platformUrl: "https://dev-cloud.mycadet.ai",
+    cloudUrl: "https://dev-cloud.mycadet.ai",
     webUrl: "https://dev.mycadet.ai",
     portsOverride: portBlock(18000),
   },
   local: {
     name: "local",
-    platformUrl: "http://localhost:8000",
+    cloudUrl: "http://localhost:8000",
     webUrl: "http://localhost:3000",
-    // assistantPlatformUrl: "http://host.docker.internal:8000",
+    // assistantCloudUrl: "http://host.docker.internal:8000",
     // ^ uncomment this once dockerized hatch path is live.
     // The assistant runs in a different network namespace than the host.
     portsOverride: portBlock(20000),

package/node_modules/@mycadet/environments/src/shell.test.ts

@@ -72,7 +72,7 @@ describe("buildShellSpawnFlags", () => {
 });
 
 describe("path list handling", () => {
-  test("uses the platform delimiter", () => {
+  test("uses the cloud delimiter", () => {
     expect(pathListDelimiter("win32")).toBe(";");
     expect(pathListDelimiter("linux")).toBe(":");
   });

package/node_modules/@mycadet/environments/src/types.ts

@@ -21,14 +21,14 @@ export interface PortMap {
 
 /**
  * A resolved environment definition. Required fields are `name` and
- * `platformUrl`. All other fields are optional and declared upfront — new
+ * `cloudUrl`. All other fields are optional and declared upfront — new
  * fields are additive, never breaking. `name` is intentionally typed as
  * `string` (not `keyof SEEDS`) so custom environments can be represented by
  * future layers (user config file, ad-hoc env vars, etc.).
  */
 export interface EnvironmentDefinition {
   name: string;
-  platformUrl: string;
+  cloudUrl: string;
 
   /**
    * The web app (Next.js) base URL for browser-facing pages like
@@ -41,13 +41,13 @@ export interface EnvironmentDefinition {
   webUrl: string;
 
   /**
-   * Override for the platform URL the assistant process itself uses. Only
-   * differs from `platformUrl` when the assistant runs in a different network
+   * Override for the cloud URL the assistant process itself uses. Only
+   * differs from `cloudUrl` when the assistant runs in a different network
    * namespace than the host (e.g. Docker on macOS, where the host's localhost
-   * is reached via `host.docker.internal`). Falls back to `platformUrl` when
+   * is reached via `host.docker.internal`). Falls back to `cloudUrl` when
    * unset.
    */
-  assistantPlatformUrl?: string;
+  assistantCloudUrl?: string;
 
   /** Human-readable label for UI surfaces. */
   displayName?: string;

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/package.json

@@ -26,7 +26,7 @@
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
-    "./platform-credential": "./src/platform-credential.ts",
+    "./cloud-credential": "./src/cloud-credential.ts",
     "./plan-credit": "./src/plan-credit.ts",
     "./integration-categories": "./src/integration-categories.ts",
     "./mcp-oauth": "./src/mcp-oauth.ts"

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/{platform-credential.ts → cloud-credential.ts}

@@ -1,10 +1,10 @@
 /**
- * Wire contract for asking an assistant whether its stored platform-managed
+ * Wire contract for asking an assistant whether its stored cloud-managed
  * credential still authenticates.
  *
  * The daemon route is the authoritative serving side:
  *   - `POST /v1/platform/verify-credential`
- *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *       (`assistant/src/runtime/routes/cloud-routes.ts`)
  *
  * The daemon's platform client produces the verdict, the route reports it,
  * and the `cadet` CLI reads it before deciding whether a stored key can be
@@ -15,26 +15,26 @@
 import { z } from "zod";
 
 /**
- * What the platform said about the stored credential, right now.
+ * What the cloud said about the stored credential, right now.
  *
- *   - `valid`: the platform accepted it.
- *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *   - `valid`: the cloud accepted it.
+ *   - `rejected`: the cloud refused it (unauthorized or forbidden); the
  *     credential needs replacing.
  *   - `unknown`: the check itself could not run (no credential stored, the
  *     platform unreachable, a server error). Not evidence either way.
  */
-export const PlatformCredentialVerificationStatusSchema = z.enum([
+export const CloudCredentialVerificationStatusSchema = z.enum([
   "valid",
   "rejected",
   "unknown",
 ]);
-export type PlatformCredentialVerificationStatus = z.infer<
-  typeof PlatformCredentialVerificationStatusSchema
+export type CloudCredentialVerificationStatus = z.infer<
+  typeof CloudCredentialVerificationStatusSchema
 >;
 
 /** `POST /v1/platform/verify-credential` response body. */
 export const PlatformVerifyCredentialResponseSchema = z.object({
-  status: PlatformCredentialVerificationStatusSchema,
+  status: CloudCredentialVerificationStatusSchema,
 });
 export type PlatformVerifyCredentialResponse = z.infer<
   typeof PlatformVerifyCredentialResponseSchema

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/handles.ts

@@ -15,9 +15,9 @@
  *    Format: `local_oauth:<providerKey>/<connectionId>` where providerKey
  *    is the bare provider name (e.g. `google`).
  *
- * 3. **Managed OAuth** — references an OAuth connection managed by the
+ * 3. **Cloud OAuth** — references an OAuth connection managed by the
  *    platform. Format: `platform_oauth:<connectionId>` where connectionId
- *    is the platform-assigned connection identifier.
+ *    is the cloud-assigned connection identifier.
  */
 
 import { z } from "zod";
@@ -96,7 +96,7 @@ export function localOAuthHandle(
 }
 
 /**
- * Build a managed (platform) OAuth credential handle from a connection ID.
+ * Build a cloud (platform) OAuth credential handle from a connection ID.
  */
 export function platformOAuthHandle(connectionId: string): string {
   return `${HandleType.PlatformOAuth}:${connectionId}`;

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/index.ts

@@ -31,7 +31,7 @@ export * from "./no-response.js";
 export * from "./plan-credit.js";
 export * from "./integration-categories.js";
 export * from "./mcp-oauth.js";
-export * from "./platform-credential.js";
+export * from "./cloud-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -4,7 +4,7 @@
  * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
- * managed-speech transport can't drift.
+ * cloud-speech transport can't drift.
  */
 export function tunnelHostForPlatformHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/remote-web-pairing.ts

@@ -152,7 +152,7 @@ export const DEFAULT_REMOTE_WEB_PAIRING_PLATFORM: RemoteWebPairingPlatform =
 
 /**
  * A requested platform coerced to a known value. The pairing-token route is
- * publicly reachable and the platform renders verbatim in the host's
+ * publicly reachable and the cloud renders verbatim in the host's
  * paired-devices list, so an unrecognized value never reaches the DB.
  */
 export function resolveRemoteWebPairingPlatform(

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/rpc.ts

@@ -34,7 +34,7 @@ import { RpcErrorSchema } from "./error.js";
 
 export const CesRpcMethod = {
   /** Push an updated assistant credential to CES after post-hatch provisioning. */
-  UpdateManagedCredential: "update_managed_credential",
+  UpdateCloudCredential: "update_managed_credential",
   /** Retrieve a single credential by account name. */
   GetCredential: "get_credential",
   /** Store or update a credential by account name. */
@@ -63,7 +63,7 @@ export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
 // update_managed_credential
 // ---------------------------------------------------------------------------
 
-export const UpdateManagedCredentialSchema = z.object({
+export const UpdateCloudCredentialSchema = z.object({
   /** The assistant API key to push to CES for platform credential materialization. */
   assistantApiKey: z.string(), // nosemgrep: not-a-secret
   /**
@@ -72,16 +72,16 @@ export const UpdateManagedCredentialSchema = z.object({
    */
   assistantId: z.string().optional(),
 });
-export type UpdateManagedCredential = z.infer<
-  typeof UpdateManagedCredentialSchema
+export type UpdateCloudCredential = z.infer<
+  typeof UpdateCloudCredentialSchema
 >;
 
-export const UpdateManagedCredentialResponseSchema = z.object({
-  /** Whether the managed credential was successfully updated. */
+export const UpdateCloudCredentialResponseSchema = z.object({
+  /** Whether the cloud credential was successfully updated. */
   updated: z.boolean(),
 });
-export type UpdateManagedCredentialResponse = z.infer<
-  typeof UpdateManagedCredentialResponseSchema
+export type UpdateCloudCredentialResponse = z.infer<
+  typeof UpdateCloudCredentialResponseSchema
 >;
 
 // ---------------------------------------------------------------------------
@@ -311,9 +311,9 @@ export type BulkSetCredentialRecordsResponse = z.infer<
  * schemas. Useful for building type-safe RPC dispatch layers.
  */
 export interface CesRpcContract {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredential;
-    response: UpdateManagedCredentialResponse;
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredential;
+    response: UpdateCloudCredentialResponse;
   };
   [CesRpcMethod.GetCredential]: {
     request: GetCredential;
@@ -361,9 +361,9 @@ export interface CesRpcContract {
  * Schema lookup map for runtime validation of RPC payloads.
  */
 export const CesRpcSchemas = {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredentialSchema,
-    response: UpdateManagedCredentialResponseSchema,
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredentialSchema,
+    response: UpdateCloudCredentialResponseSchema,
   },
   [CesRpcMethod.GetCredential]: {
     request: GetCredentialSchema,

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/trust-rules.ts

@@ -15,7 +15,7 @@
  * - **URL**: tools whose candidates include a URL (`web_fetch`,
  *   `network_request`).
  * - **Managed skill**: tools that manage first-party skill packages
- *   (`scaffold_managed_skill`, `delete_managed_skill`).
+ *   (`scaffold_cloud_skill`, `delete_cloud_skill`).
  * - **Skill load**: the `skill_load` tool, which uses a distinct candidate
  *   namespace (`skill_load:selector` or `skill_load_dynamic:selector`).
  * - **Generic**: everything else (computer-use tools, UI surface tools,
@@ -58,8 +58,8 @@ export const URL_TOOLS = ["web_fetch", "network_request"] as const;
  * Tools that manage first-party skill packages (scaffold/delete).
  */
 export const MANAGED_SKILL_TOOLS = [
-  "scaffold_managed_skill",
-  "delete_managed_skill",
+  "scaffold_cloud_skill",
+  "delete_cloud_skill",
 ] as const;
 
 /**
@@ -89,8 +89,8 @@ export function isUrlRule(rule: { tool: string }): boolean {
   return URL_TOOLS_SET.has(rule.tool);
 }
 
-/** Returns true when the rule's tool belongs to the managed-skill-tool family. */
-export function isManagedSkillRule(rule: { tool: string }): boolean {
+/** Returns true when the rule's tool belongs to the cloud-skill-tool family. */
+export function isCloudSkillRule(rule: { tool: string }): boolean {
   return MANAGED_SKILL_TOOLS_SET.has(rule.tool);
 }
 

package/node_modules/@mycadet/gateway-client/src/binding-strength-contract.ts

@@ -34,7 +34,7 @@ export const VERIFIED_VIA_CHALLENGE = "challenge";
 /** `verified_via` written when the guardian direct-trusts a workspace-vouched identity. */
 export const VERIFIED_VIA_MANUAL = "manual";
 
-/** `verified_via` written when the guardian trusts an identity the platform is not vouching for. */
+/** `verified_via` written when the guardian trusts an identity the cloud is not vouching for. */
 export const VERIFIED_VIA_CHANNEL_CLAIM = "manual_channel_claim";
 
 // ---------------------------------------------------------------------------
@@ -48,10 +48,10 @@ export const VERIFIED_VIA_CHANNEL_CLAIM = "manual_channel_claim";
  *
  * - `verified_handshake` — the contact proved control of the channel by
  *   returning a verification code (`verified_via: "challenge"`).
- * - `internal_workspace_match` — the platform authenticated the identity inside
+ * - `internal_workspace_match` — the cloud authenticated the identity inside
  *   the guardian's own workspace; the guardian vouches directly
  *   (`verified_via: "manual"`).
- * - `inbound_channel_claim` — the guardian trusts an identity the platform is
+ * - `inbound_channel_claim` — the guardian trusts an identity the cloud is
  *   NOT vouching for (`verified_via: "manual_channel_claim"`).
  */
 export type BindingStrength =
@@ -101,7 +101,7 @@ const PROVEN_VERIFIED_VIA: ReadonlySet<string> = new Set([
   "invite", // redeemed an invite code / token
   "voice", // returned a voice (DTMF) code
   "bootstrap", // guardian binding (also protected by the guardian-downgrade guard)
-  "platform_auto_register", // guardian binding auto-registered by the platform
+  "platform_auto_register", // guardian binding auto-registered by the cloud
   "webhook_registration", // guardian binding registered via a provider webhook
 ]);
 
@@ -112,7 +112,7 @@ const PROVEN_VERIFIED_VIA: ReadonlySet<string> = new Set([
  * PRD (D4) may land on:
  *
  *   3  proven / possession — {@link PROVEN_VERIFIED_VIA}.
- *   2  workspace-vouched — the platform authenticated the identity but the
+ *   2  workspace-vouched — the cloud authenticated the identity but the
  *      actor did not actively prove control here (`manual`).
  *   1  inbound channel claim — nobody vouches; the guardian trusted an
  *      unproven claim (`manual_channel_claim`).

package/node_modules/@mycadet/gateway-client/src/gateway-ipc-contracts.ts

@@ -483,7 +483,7 @@ export type RegisterWebhookRouteIpcParams = z.infer<
 /**
  * A refusal is a normal result rather than an error: the daemon reads
  * `disabled` as "this assistant is not serving its own webhooks" and falls
- * back to the platform's callback routes.
+ * back to the cloud's callback routes.
  */
 export const RegisterWebhookRouteIpcResponseSchema = z.union([
   z.object({ disabled: z.literal(true) }),