@mycadet/gateway 0.12.7 → 0.12.9

package/README.md

@@ -210,9 +210,9 @@ The assistant runtime uses this URL to construct all webhook and OAuth callback
 
 ### Tunnel for Twilio Testing
 
-Tunnel is a managed ingress transport for assistant-hosted HTTP and WebSocket traffic. The gateway starts the Tunnel only after Twilio setup has been started in the workspace, or when existing Twilio config shows it was set up before. When Tunnel registration succeeds, the gateway writes the registered public assistant URL to `ingress.publicBaseUrl` and marks it with `ingress.publicBaseUrlManagedBy: "tunnel"`. Twilio URL builders use that public base URL for voice, status, and media-stream endpoints.
+Tunnel is a cloud ingress transport for assistant-hosted HTTP and WebSocket traffic. The gateway starts the Tunnel only after Twilio setup has been started in the workspace, or when existing Twilio config shows it was set up before. When Tunnel registration succeeds, the gateway writes the registered public assistant URL to `ingress.publicBaseUrl` and marks it with `ingress.publicBaseUrlManagedBy: "tunnel"`. Twilio URL builders use that public base URL for voice, status, and media-stream endpoints.
 
-Use Tunnel when testing Twilio voice webhooks or Twilio WebSocket upgrades through the platform-managed tunnel:
+Use Tunnel when testing Twilio voice webhooks or Twilio WebSocket upgrades through the cloud-managed tunnel:
 
 1. In `mycadet-platform`, start the local Tunnel service:
 
@@ -248,7 +248,7 @@ bun -e 'const ws = new WebSocket(process.argv[1]); ws.onopen = () => { console.l
   "wss://<tunnel-host>/<assistant-id>/webhooks/twilio/media-stream/session-123/<edge-token>"
 ```
 
-For a real Twilio call, expose local Tunnel with a public HTTPS/WSS tunnel and configure the platform Tunnel service with that origin as `TUNNEL_PUBLIC_BASE_URL`. After the assistant re-registers, Twilio should fetch `/webhooks/twilio/voice` and open `/webhooks/twilio/media-stream/...` through the Tunnel URL. Use ngrok or another custom tunnel in `ingress.publicBaseUrl` only for local/self-hosted workflows that are not routed through Tunnel.
+For a real Twilio call, expose local Tunnel with a public HTTPS/WSS tunnel and configure the cloud Tunnel service with that origin as `TUNNEL_PUBLIC_BASE_URL`. After the assistant re-registers, Twilio should fetch `/webhooks/twilio/voice` and open `/webhooks/twilio/media-stream/...` through the Tunnel URL. Use ngrok or another custom tunnel in `ingress.publicBaseUrl` only for local/self-hosted workflows that are not routed through Tunnel.
 
 ## Ingress Boundary Guarantees
 

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/package.json

@@ -26,7 +26,7 @@
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
-    "./platform-credential": "./src/platform-credential.ts",
+    "./cloud-credential": "./src/cloud-credential.ts",
     "./plan-credit": "./src/plan-credit.ts",
     "./integration-categories": "./src/integration-categories.ts",
     "./mcp-oauth": "./src/mcp-oauth.ts"
@@ -40,6 +40,6 @@
   },
   "devDependencies": {
     "@types/bun": "1.2.4",
-    "typescript": "5.7.3"
+    "typescript": "5.9.3"
   }
 }

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/{platform-credential.ts → cloud-credential.ts}

@@ -1,10 +1,10 @@
 /**
- * Wire contract for asking an assistant whether its stored platform-managed
+ * Wire contract for asking an assistant whether its stored cloud-managed
  * credential still authenticates.
  *
  * The daemon route is the authoritative serving side:
  *   - `POST /v1/platform/verify-credential`
- *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *       (`assistant/src/runtime/routes/cloud-routes.ts`)
  *
  * The daemon's platform client produces the verdict, the route reports it,
  * and the `cadet` CLI reads it before deciding whether a stored key can be
@@ -15,26 +15,26 @@
 import { z } from "zod";
 
 /**
- * What the platform said about the stored credential, right now.
+ * What the cloud said about the stored credential, right now.
  *
- *   - `valid`: the platform accepted it.
- *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *   - `valid`: the cloud accepted it.
+ *   - `rejected`: the cloud refused it (unauthorized or forbidden); the
  *     credential needs replacing.
  *   - `unknown`: the check itself could not run (no credential stored, the
  *     platform unreachable, a server error). Not evidence either way.
  */
-export const PlatformCredentialVerificationStatusSchema = z.enum([
+export const CloudCredentialVerificationStatusSchema = z.enum([
   "valid",
   "rejected",
   "unknown",
 ]);
-export type PlatformCredentialVerificationStatus = z.infer<
-  typeof PlatformCredentialVerificationStatusSchema
+export type CloudCredentialVerificationStatus = z.infer<
+  typeof CloudCredentialVerificationStatusSchema
 >;
 
 /** `POST /v1/platform/verify-credential` response body. */
 export const PlatformVerifyCredentialResponseSchema = z.object({
-  status: PlatformCredentialVerificationStatusSchema,
+  status: CloudCredentialVerificationStatusSchema,
 });
 export type PlatformVerifyCredentialResponse = z.infer<
   typeof PlatformVerifyCredentialResponseSchema

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/handles.ts

@@ -15,9 +15,9 @@
  *    Format: `local_oauth:<providerKey>/<connectionId>` where providerKey
  *    is the bare provider name (e.g. `google`).
  *
- * 3. **Managed OAuth** — references an OAuth connection managed by the
+ * 3. **Cloud OAuth** — references an OAuth connection managed by the
  *    platform. Format: `platform_oauth:<connectionId>` where connectionId
- *    is the platform-assigned connection identifier.
+ *    is the cloud-assigned connection identifier.
  */
 
 import { z } from "zod";
@@ -96,7 +96,7 @@ export function localOAuthHandle(
 }
 
 /**
- * Build a managed (platform) OAuth credential handle from a connection ID.
+ * Build a cloud (platform) OAuth credential handle from a connection ID.
  */
 export function platformOAuthHandle(connectionId: string): string {
   return `${HandleType.PlatformOAuth}:${connectionId}`;

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/index.ts

@@ -31,7 +31,7 @@ export * from "./no-response.js";
 export * from "./plan-credit.js";
 export * from "./integration-categories.js";
 export * from "./mcp-oauth.js";
-export * from "./platform-credential.js";
+export * from "./cloud-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -4,7 +4,7 @@
  * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
- * managed-speech transport can't drift.
+ * cloud-speech transport can't drift.
  */
 export function tunnelHostForPlatformHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/remote-web-pairing.ts

@@ -152,7 +152,7 @@ export const DEFAULT_REMOTE_WEB_PAIRING_PLATFORM: RemoteWebPairingPlatform =
 
 /**
  * A requested platform coerced to a known value. The pairing-token route is
- * publicly reachable and the platform renders verbatim in the host's
+ * publicly reachable and the cloud renders verbatim in the host's
  * paired-devices list, so an unrecognized value never reaches the DB.
  */
 export function resolveRemoteWebPairingPlatform(

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/rpc.ts

@@ -34,7 +34,7 @@ import { RpcErrorSchema } from "./error.js";
 
 export const CesRpcMethod = {
   /** Push an updated assistant credential to CES after post-hatch provisioning. */
-  UpdateManagedCredential: "update_managed_credential",
+  UpdateCloudCredential: "update_managed_credential",
   /** Retrieve a single credential by account name. */
   GetCredential: "get_credential",
   /** Store or update a credential by account name. */
@@ -63,7 +63,7 @@ export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
 // update_managed_credential
 // ---------------------------------------------------------------------------
 
-export const UpdateManagedCredentialSchema = z.object({
+export const UpdateCloudCredentialSchema = z.object({
   /** The assistant API key to push to CES for platform credential materialization. */
   assistantApiKey: z.string(), // nosemgrep: not-a-secret
   /**
@@ -72,16 +72,16 @@ export const UpdateManagedCredentialSchema = z.object({
    */
   assistantId: z.string().optional(),
 });
-export type UpdateManagedCredential = z.infer<
-  typeof UpdateManagedCredentialSchema
+export type UpdateCloudCredential = z.infer<
+  typeof UpdateCloudCredentialSchema
 >;
 
-export const UpdateManagedCredentialResponseSchema = z.object({
-  /** Whether the managed credential was successfully updated. */
+export const UpdateCloudCredentialResponseSchema = z.object({
+  /** Whether the cloud credential was successfully updated. */
   updated: z.boolean(),
 });
-export type UpdateManagedCredentialResponse = z.infer<
-  typeof UpdateManagedCredentialResponseSchema
+export type UpdateCloudCredentialResponse = z.infer<
+  typeof UpdateCloudCredentialResponseSchema
 >;
 
 // ---------------------------------------------------------------------------
@@ -311,9 +311,9 @@ export type BulkSetCredentialRecordsResponse = z.infer<
  * schemas. Useful for building type-safe RPC dispatch layers.
  */
 export interface CesRpcContract {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredential;
-    response: UpdateManagedCredentialResponse;
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredential;
+    response: UpdateCloudCredentialResponse;
   };
   [CesRpcMethod.GetCredential]: {
     request: GetCredential;
@@ -361,9 +361,9 @@ export interface CesRpcContract {
  * Schema lookup map for runtime validation of RPC payloads.
  */
 export const CesRpcSchemas = {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredentialSchema,
-    response: UpdateManagedCredentialResponseSchema,
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredentialSchema,
+    response: UpdateCloudCredentialResponseSchema,
   },
   [CesRpcMethod.GetCredential]: {
     request: GetCredentialSchema,

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/trust-rules.ts

@@ -15,7 +15,7 @@
  * - **URL**: tools whose candidates include a URL (`web_fetch`,
  *   `network_request`).
  * - **Managed skill**: tools that manage first-party skill packages
- *   (`scaffold_managed_skill`, `delete_managed_skill`).
+ *   (`scaffold_cloud_skill`, `delete_cloud_skill`).
  * - **Skill load**: the `skill_load` tool, which uses a distinct candidate
  *   namespace (`skill_load:selector` or `skill_load_dynamic:selector`).
  * - **Generic**: everything else (computer-use tools, UI surface tools,
@@ -58,8 +58,8 @@ export const URL_TOOLS = ["web_fetch", "network_request"] as const;
  * Tools that manage first-party skill packages (scaffold/delete).
  */
 export const MANAGED_SKILL_TOOLS = [
-  "scaffold_managed_skill",
-  "delete_managed_skill",
+  "scaffold_cloud_skill",
+  "delete_cloud_skill",
 ] as const;
 
 /**
@@ -89,8 +89,8 @@ export function isUrlRule(rule: { tool: string }): boolean {
   return URL_TOOLS_SET.has(rule.tool);
 }
 
-/** Returns true when the rule's tool belongs to the managed-skill-tool family. */
-export function isManagedSkillRule(rule: { tool: string }): boolean {
+/** Returns true when the rule's tool belongs to the cloud-skill-tool family. */
+export function isCloudSkillRule(rule: { tool: string }): boolean {
   return MANAGED_SKILL_TOOLS_SET.has(rule.tool);
 }
 

package/node_modules/@mycadet/ces-client/package.json

@@ -19,6 +19,6 @@
   },
   "devDependencies": {
     "@types/bun": "1.2.4",
-    "typescript": "5.7.3"
+    "typescript": "5.9.3"
   }
 }

package/node_modules/@mycadet/ces-client/src/__tests__/ces-client.test.ts

@@ -141,7 +141,7 @@ describe("CesHttpCredentialClient", () => {
       Promise.resolve(
         Response.json({ account: "test-acct", value: "secret-123" }),
       ),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -156,7 +156,7 @@ describe("CesHttpCredentialClient", () => {
   test("get returns not-found on 404", async () => {
     globalThis.fetch = mock(() =>
       Promise.resolve(new Response(null, { status: 404 })),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -171,7 +171,7 @@ describe("CesHttpCredentialClient", () => {
   test("get returns unreachable on 500", async () => {
     globalThis.fetch = mock(() =>
       Promise.resolve(new Response("internal error", { status: 500 })),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -186,7 +186,7 @@ describe("CesHttpCredentialClient", () => {
   test("get returns unreachable on network error", async () => {
     globalThis.fetch = mock(() =>
       Promise.reject(new Error("ECONNREFUSED")),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -201,7 +201,7 @@ describe("CesHttpCredentialClient", () => {
   test("delete returns deleted on 200", async () => {
     globalThis.fetch = mock(() =>
       Promise.resolve(Response.json({ ok: true, account: "acct" })),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -215,7 +215,7 @@ describe("CesHttpCredentialClient", () => {
   test("delete returns not-found on 404", async () => {
     globalThis.fetch = mock(() =>
       Promise.resolve(new Response(null, { status: 404 })),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -229,7 +229,7 @@ describe("CesHttpCredentialClient", () => {
   test("delete returns error on network failure", async () => {
     globalThis.fetch = mock(() =>
       Promise.reject(new Error("network down")),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -243,7 +243,7 @@ describe("CesHttpCredentialClient", () => {
   test("list returns accounts on 200", async () => {
     globalThis.fetch = mock(() =>
       Promise.resolve(Response.json({ accounts: ["a", "b", "c"] })),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -258,7 +258,7 @@ describe("CesHttpCredentialClient", () => {
   test("list returns unreachable on error", async () => {
     globalThis.fetch = mock(() =>
       Promise.reject(new Error("timeout")),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -273,7 +273,7 @@ describe("CesHttpCredentialClient", () => {
   test("bulkSet returns all-failed when request fails", async () => {
     globalThis.fetch = mock(() =>
       Promise.reject(new Error("network")),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const client = createCesHttpCredentialClient(
       createTestConfig(),
@@ -311,7 +311,7 @@ describe("fetchCesLogExport", () => {
           headers: { "Content-Type": "application/gzip" },
         }),
       ),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const result = await fetchCesLogExport({
       baseUrl: "http://ces-test:8090",
@@ -327,7 +327,7 @@ describe("fetchCesLogExport", () => {
   test("returns error on non-OK status", async () => {
     globalThis.fetch = mock(() =>
       Promise.resolve(new Response("forbidden", { status: 403 })),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const result = await fetchCesLogExport({
       baseUrl: "http://ces-test:8090",
@@ -343,7 +343,7 @@ describe("fetchCesLogExport", () => {
   test("returns error on network failure", async () => {
     globalThis.fetch = mock(() =>
       Promise.reject(new Error("connection refused")),
-    ) as typeof fetch;
+    ) as unknown as typeof fetch;
 
     const result = await fetchCesLogExport({
       baseUrl: "http://ces-test:8090",
@@ -361,7 +361,7 @@ describe("fetchCesLogExport", () => {
     globalThis.fetch = mock((url: string | URL | Request) => {
       capturedUrl = typeof url === "string" ? url : url.toString();
       return Promise.resolve(new Response(new ArrayBuffer(0), { status: 200 }));
-    }) as typeof fetch;
+    }) as unknown as typeof fetch;
 
     await fetchCesLogExport(
       { baseUrl: "http://ces-test:8090", serviceToken: "tok" },

package/node_modules/@mycadet/ces-client/src/rpc-client.ts

@@ -416,7 +416,7 @@ export function createCesRpcClient(
       assistantApiKey: string,
       assistantId?: string,
     ): Promise<{ updated: boolean }> {
-      return call(CesRpcMethod.UpdateManagedCredential, {
+      return call(CesRpcMethod.UpdateCloudCredential, {
         assistantApiKey,
         ...(assistantId ? { assistantId } : {}),
       });

package/node_modules/@mycadet/environments/src/seeds.ts

@@ -64,12 +64,12 @@ export function cloudAssistantHubUrl(envName: string | undefined): string {
 export const SEEDS: Record<string, EnvironmentDefinition> = {
   production: {
     name: "production",
-    platformUrl: "https://cloud.mycadet.ai",
+    cloudUrl: "https://cloud.mycadet.ai",
     webUrl: "https://mycadet.ai",
   },
   staging: {
     name: "staging",
-    platformUrl: "https://staging-cloud.mycadet.ai",
+    cloudUrl: "https://staging-cloud.mycadet.ai",
     webUrl: "https://staging.mycadet.ai",
     portsOverride: portBlock(17000),
   },
@@ -77,21 +77,21 @@ export const SEEDS: Record<string, EnvironmentDefinition> = {
     name: "test",
     // Non-functional URL — used only by unit tests for URL resolution, never
     // hit in production.
-    platformUrl: "https://test-cloud.mycadet.ai",
+    cloudUrl: "https://test-cloud.mycadet.ai",
     webUrl: "https://dev.mycadet.ai",
     portsOverride: portBlock(19000),
   },
   dev: {
     name: "dev",
-    platformUrl: "https://dev-cloud.mycadet.ai",
+    cloudUrl: "https://dev-cloud.mycadet.ai",
     webUrl: "https://dev.mycadet.ai",
     portsOverride: portBlock(18000),
   },
   local: {
     name: "local",
-    platformUrl: "http://localhost:8000",
+    cloudUrl: "http://localhost:8000",
     webUrl: "http://localhost:3000",
-    // assistantPlatformUrl: "http://host.docker.internal:8000",
+    // assistantCloudUrl: "http://host.docker.internal:8000",
     // ^ uncomment this once dockerized hatch path is live.
     // The assistant runs in a different network namespace than the host.
     portsOverride: portBlock(20000),

package/node_modules/@mycadet/environments/src/shell.test.ts

@@ -72,7 +72,7 @@ describe("buildShellSpawnFlags", () => {
 });
 
 describe("path list handling", () => {
-  test("uses the platform delimiter", () => {
+  test("uses the cloud delimiter", () => {
     expect(pathListDelimiter("win32")).toBe(";");
     expect(pathListDelimiter("linux")).toBe(":");
   });

package/node_modules/@mycadet/environments/src/types.ts

@@ -21,14 +21,14 @@ export interface PortMap {
 
 /**
  * A resolved environment definition. Required fields are `name` and
- * `platformUrl`. All other fields are optional and declared upfront — new
+ * `cloudUrl`. All other fields are optional and declared upfront — new
  * fields are additive, never breaking. `name` is intentionally typed as
  * `string` (not `keyof SEEDS`) so custom environments can be represented by
  * future layers (user config file, ad-hoc env vars, etc.).
  */
 export interface EnvironmentDefinition {
   name: string;
-  platformUrl: string;
+  cloudUrl: string;
 
   /**
    * The web app (Next.js) base URL for browser-facing pages like
@@ -41,13 +41,13 @@ export interface EnvironmentDefinition {
   webUrl: string;
 
   /**
-   * Override for the platform URL the assistant process itself uses. Only
-   * differs from `platformUrl` when the assistant runs in a different network
+   * Override for the cloud URL the assistant process itself uses. Only
+   * differs from `cloudUrl` when the assistant runs in a different network
    * namespace than the host (e.g. Docker on macOS, where the host's localhost
-   * is reached via `host.docker.internal`). Falls back to `platformUrl` when
+   * is reached via `host.docker.internal`). Falls back to `cloudUrl` when
    * unset.
    */
-  assistantPlatformUrl?: string;
+  assistantCloudUrl?: string;
 
   /** Human-readable label for UI surfaces. */
   displayName?: string;

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/package.json

@@ -26,7 +26,7 @@
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
-    "./platform-credential": "./src/platform-credential.ts",
+    "./cloud-credential": "./src/cloud-credential.ts",
     "./plan-credit": "./src/plan-credit.ts",
     "./integration-categories": "./src/integration-categories.ts",
     "./mcp-oauth": "./src/mcp-oauth.ts"
@@ -40,6 +40,6 @@
   },
   "devDependencies": {
     "@types/bun": "1.2.4",
-    "typescript": "5.7.3"
+    "typescript": "5.9.3"
   }
 }

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/{platform-credential.ts → cloud-credential.ts}

@@ -1,10 +1,10 @@
 /**
- * Wire contract for asking an assistant whether its stored platform-managed
+ * Wire contract for asking an assistant whether its stored cloud-managed
  * credential still authenticates.
  *
  * The daemon route is the authoritative serving side:
  *   - `POST /v1/platform/verify-credential`
- *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *       (`assistant/src/runtime/routes/cloud-routes.ts`)
  *
  * The daemon's platform client produces the verdict, the route reports it,
  * and the `cadet` CLI reads it before deciding whether a stored key can be
@@ -15,26 +15,26 @@
 import { z } from "zod";
 
 /**
- * What the platform said about the stored credential, right now.
+ * What the cloud said about the stored credential, right now.
  *
- *   - `valid`: the platform accepted it.
- *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *   - `valid`: the cloud accepted it.
+ *   - `rejected`: the cloud refused it (unauthorized or forbidden); the
  *     credential needs replacing.
  *   - `unknown`: the check itself could not run (no credential stored, the
  *     platform unreachable, a server error). Not evidence either way.
  */
-export const PlatformCredentialVerificationStatusSchema = z.enum([
+export const CloudCredentialVerificationStatusSchema = z.enum([
   "valid",
   "rejected",
   "unknown",
 ]);
-export type PlatformCredentialVerificationStatus = z.infer<
-  typeof PlatformCredentialVerificationStatusSchema
+export type CloudCredentialVerificationStatus = z.infer<
+  typeof CloudCredentialVerificationStatusSchema
 >;
 
 /** `POST /v1/platform/verify-credential` response body. */
 export const PlatformVerifyCredentialResponseSchema = z.object({
-  status: PlatformCredentialVerificationStatusSchema,
+  status: CloudCredentialVerificationStatusSchema,
 });
 export type PlatformVerifyCredentialResponse = z.infer<
   typeof PlatformVerifyCredentialResponseSchema

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/handles.ts

@@ -15,9 +15,9 @@
  *    Format: `local_oauth:<providerKey>/<connectionId>` where providerKey
  *    is the bare provider name (e.g. `google`).
  *
- * 3. **Managed OAuth** — references an OAuth connection managed by the
+ * 3. **Cloud OAuth** — references an OAuth connection managed by the
  *    platform. Format: `platform_oauth:<connectionId>` where connectionId
- *    is the platform-assigned connection identifier.
+ *    is the cloud-assigned connection identifier.
  */
 
 import { z } from "zod";
@@ -96,7 +96,7 @@ export function localOAuthHandle(
 }
 
 /**
- * Build a managed (platform) OAuth credential handle from a connection ID.
+ * Build a cloud (platform) OAuth credential handle from a connection ID.
  */
 export function platformOAuthHandle(connectionId: string): string {
   return `${HandleType.PlatformOAuth}:${connectionId}`;

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/index.ts

@@ -31,7 +31,7 @@ export * from "./no-response.js";
 export * from "./plan-credit.js";
 export * from "./integration-categories.js";
 export * from "./mcp-oauth.js";
-export * from "./platform-credential.js";
+export * from "./cloud-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -4,7 +4,7 @@
  * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
- * managed-speech transport can't drift.
+ * cloud-speech transport can't drift.
  */
 export function tunnelHostForPlatformHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/remote-web-pairing.ts

@@ -152,7 +152,7 @@ export const DEFAULT_REMOTE_WEB_PAIRING_PLATFORM: RemoteWebPairingPlatform =
 
 /**
  * A requested platform coerced to a known value. The pairing-token route is
- * publicly reachable and the platform renders verbatim in the host's
+ * publicly reachable and the cloud renders verbatim in the host's
  * paired-devices list, so an unrecognized value never reaches the DB.
  */
 export function resolveRemoteWebPairingPlatform(