@mycadet/gateway 0.12.10 → 0.13.0

package/src/cli/__tests__/pairing.test.ts

@@ -16,6 +16,7 @@ const { parsePairingArgs, runPairingCommand } = await import("../pairing.js");
 const {
   getRemoteWebPairingChallengeForTests,
   resetRemoteWebPairingChallengesForTests,
+  setRemoteWebPairingChallengeNowForTests,
 } = await import("../../remote-web/pairing-challenge-store.js");
 const { resetRemoteWebPairingChallengeRateLimiterForTests } =
   await import("../../remote-web/pairing-challenge-rate-limit-store.js");
@@ -129,3 +130,97 @@ describe("parsePairingArgs", () => {
     });
   });
 });
+
+// ---------------------------------------------------------------------------
+// `gateway pairing list`
+// ---------------------------------------------------------------------------
+
+const ListChallengeSchema = z.object({
+  id: z.string(),
+  userCode: z.string(),
+  publicBaseUrl: z.string(),
+  verificationUri: z.string(),
+  status: z.enum(["pending", "approved", "exchanging", "consumed"]),
+  createdAtMs: z.number(),
+  expiresAtMs: z.number(),
+  requesterIp: z.string(),
+  requesterUserAgent: z.string().nullable(),
+  viaEdgeProxy: z.boolean(),
+  expired: z.boolean(),
+});
+
+function lastLoggedChallenges() {
+  const line = logs[logs.length - 1];
+  expect(line).toBeTruthy();
+  const parsed = z
+    .object({ ok: z.literal(true), challenges: z.array(ListChallengeSchema) })
+    .parse(JSON.parse(line!));
+  return parsed.challenges;
+}
+
+describe("gateway pairing list", () => {
+  test("empty store prints a no-results line and exits 0", async () => {
+    const code = await runPairingCommand(["list"]);
+
+    expect(code).toBe(0);
+    expect(logs.join("\n")).toContain("No pairing challenges found.");
+  });
+
+  test("--json lists every persisted challenge newest-first", async () => {
+    // Both mints land inside the last minute so their 10-minute TTL keeps
+    // them active against the real wall clock the CLI checks with, while
+    // the frozen seam still pins deterministic createdAtMs values.
+    const older = Date.now() - 60_000;
+    const newer = Date.now() - 30_000;
+    setRemoteWebPairingChallengeNowForTests(() => older);
+    await runPairingCommand(["mint", "https://older.example.com"]);
+    setRemoteWebPairingChallengeNowForTests(() => newer);
+    await runPairingCommand(["mint", "https://newer.example.com"]);
+    setRemoteWebPairingChallengeNowForTests(() => Date.now());
+
+    const code = await runPairingCommand(["list", "--json"]);
+    expect(code).toBe(0);
+
+    const challenges = lastLoggedChallenges();
+    expect(challenges).toHaveLength(2);
+    expect(challenges[0]!.publicBaseUrl).toBe("https://newer.example.com");
+    expect(challenges[1]!.publicBaseUrl).toBe("https://older.example.com");
+    expect(challenges[1]!.createdAtMs).toBe(older);
+    expect(challenges[1]!.status).toBe("approved");
+    expect(challenges[1]!.expired).toBe(false);
+    expect(challenges[1]!.requesterIp).toBe("cli");
+    expect(challenges[1]!.userCode).toMatch(/^[A-Z2-9]{4}-[A-Z2-9]{4}$/);
+  });
+
+  test("expired challenges still list, flagged expired", async () => {
+    // Mint at a frozen time an hour ago: the challenge's persisted expiry
+    // (mint + 10-minute TTL) is then in the past of the real wall clock the
+    // CLI checks against, without the store's own expiry paths deleting it.
+    setRemoteWebPairingChallengeNowForTests(() => Date.now() - 3_600_000);
+    await runPairingCommand(["mint", "https://stale.example.com"]);
+    setRemoteWebPairingChallengeNowForTests(() => Date.now());
+
+    const code = await runPairingCommand(["list", "--json"]);
+    expect(code).toBe(0);
+
+    const challenges = lastLoggedChallenges();
+    expect(challenges).toHaveLength(1);
+    expect(challenges[0]!.expired).toBe(true);
+    expect(challenges[0]!.status).toBe("approved");
+    expect(challenges[0]!.publicBaseUrl).toBe("https://stale.example.com");
+  });
+
+  test("human output shows user code, status, liveness, and timestamps", async () => {
+    await runPairingCommand(["mint", "https://shown.example.com"]);
+
+    const code = await runPairingCommand(["list"]);
+    expect(code).toBe(0);
+
+    const output = logs.join("\n");
+    expect(output).toContain("approved");
+    expect(output).toContain("active");
+    expect(output).toContain("minted ");
+    expect(output).toContain("expires ");
+    expect(output).toContain("https://shown.example.com/assistant/pair");
+  });
+});

package/src/cli/index.ts

@@ -20,7 +20,7 @@ function printUsage(): void {
     "  contacts    Manage the contact ACL with list, get, set-risk-threshold",
   );
   console.log(
-    "  pairing     Mint/approve a remote-web pairing challenge (mint <url>)",
+    "  pairing     Remote-web pairing challenges (mint <url> | list [--json])",
   );
 }
 

package/src/cli/pairing.ts

@@ -2,6 +2,7 @@
  * `gateway pairing` — operator subcommands for the remote-web pairing flow.
  *
  *   gateway pairing mint <url>
+ *   gateway pairing list [--json]
  *
  * Mints (and approves) a remote-web pairing challenge by executing the
  * pairing mint logic DIRECTLY in this process — deliberately NOT over the
@@ -15,21 +16,46 @@
  * is needed and the topology (native or containerized) stops mattering.
  * Prints the challenge response as single-line JSON on stdout; the caller
  * parses it and renders the pairing link/QR.
+ *
+ * `list` reads the same file-backed store and reports EVERY persisted
+ * challenge — active and expired — with each one's mint and expiration
+ * timestamp, so the host can see in-flight and stale pairing sessions.
  */
 
+import {
+  listPersistedRemoteWebPairingChallenges,
+  type PendingRemoteWebPairingChallenge,
+} from "../remote-web/pairing-challenge-store.js";
 import { mintAndApproveRemoteWebPairingChallenge } from "../remote-web/pairing-mint.js";
 
 function printUsage(): void {
-  console.log("Usage: gateway pairing mint <url>");
+  console.log("Usage: gateway pairing <subcommand>");
+  console.log("");
+  console.log("Operator commands for the remote-web pairing flow.");
   console.log("");
+  console.log("Subcommands:");
+  console.log(
+    "  mint <url>   Mint and approve a pairing challenge; prints the",
+  );
+  console.log(
+    "               challenge (device code, pairing link, expiry) as JSON.",
+  );
   console.log(
-    "Mint and approve a remote-web pairing challenge on this machine and",
+    "  list         List every persisted pairing challenge — active and",
   );
-  console.log("print the challenge as JSON.");
+  console.log(
+    "               expired — with its mint and expiration timestamp.",
+  );
+  console.log("");
+  console.log("Options:");
+  console.log("  --json       Machine-readable JSON (list)");
   console.log("");
-  console.log("Arguments:");
-  console.log("  <url>   Public base URL to advertise in the pairing link,");
-  console.log("          e.g. https://your-assistant.ts.net");
+  console.log("Examples:");
+  console.log("  $ gateway pairing mint https://your-assistant.ts.net");
+  console.log("  $ gateway pairing list");
+  console.log("  $ gateway pairing list --json");
+  console.log("");
+  console.log("From the host: cadet exec --service gateway -- gateway pairing list");
 }
 
 /** Parse `pairing` argv (after the command word) into a subcommand + arg. */
@@ -41,6 +67,52 @@ export function parsePairingArgs(args: string[]): {
   return { subcommand, positional };
 }
 
+function listLiveness(
+  challenge: PendingRemoteWebPairingChallenge,
+  now: number,
+): "active" | "expired" {
+  return challenge.expiresAtMs <= now ? "expired" : "active";
+}
+
+function runPairingList(json: boolean): number {
+  const now = Date.now();
+  const challenges = listPersistedRemoteWebPairingChallenges();
+
+  if (json) {
+    console.log(
+      JSON.stringify({
+        ok: true,
+        challenges: challenges.map((challenge) => ({
+          ...challenge,
+          expired: challenge.expiresAtMs <= now,
+        })),
+      }),
+    );
+    return 0;
+  }
+
+  if (challenges.length === 0) {
+    console.log("No pairing challenges found.");
+    return 0;
+  }
+
+  for (const challenge of challenges) {
+    const liveness = listLiveness(challenge, now);
+    console.log(
+      `${challenge.userCode}  ${challenge.status}  ${liveness}  ` +
+        `minted ${new Date(challenge.createdAtMs).toISOString()}  ` +
+        `expires ${new Date(challenge.expiresAtMs).toISOString()}`,
+    );
+    const userAgent = challenge.requesterUserAgent
+      ? `  ${challenge.requesterUserAgent}`
+      : "";
+    console.log(
+      `  ${challenge.verificationUri}  requester ${challenge.requesterIp}${userAgent}`,
+    );
+  }
+  return 0;
+}
+
 export async function runPairingCommand(args: string[]): Promise<number> {
   const { subcommand, positional } = parsePairingArgs(args);
 
@@ -48,6 +120,9 @@ export async function runPairingCommand(args: string[]): Promise<number> {
     printUsage();
     return subcommand ? 0 : 1;
   }
+  if (subcommand === "list") {
+    return runPairingList(args.includes("--json"));
+  }
   if (subcommand !== "mint") {
     console.error(`Error: unknown pairing subcommand '${subcommand}'.`);
     printUsage();

package/src/contacts-mirror-op-reporter.ts

@@ -2,21 +2,18 @@
 // with "Unknown method" (old daemon behind a newer gateway). The mirror ops
 // deliberately have no raw-SQL fallback, so the gateway write has already
 // applied while the assistant mirror silently missed it — divergence persists
-// until reconciliation. Emits an error-level log and relays a
-// `contacts_mirror_op_missing` watchdog telemetry event to the daemon's
-// internal telemetry route (the route predates the mirror ops, so an old
-// daemon still accepts it). Rate-limited per op per process; a lost event is
-// acceptable for a rare, high-signal check (no retry). Scaffolding:
-// watchdog-reporter.ts.
+// until reconciliation. Emits an error-level log, rate-limited per op per
+// process (the state is sticky until the daemon updates, so every op would
+// otherwise re-fire it).
 
 import { getLogger } from "./logger.js";
-import { createWatchdogReporter } from "./watchdog-reporter.js";
 
-/**
- * Watchdog `check_name` for a daemon missing a contacts mirror op. Platform
- * dashboards filter on this exact string — it is the cross-repo contract.
- */
-export const MIRROR_OP_MISSING_CHECK_NAME = "contacts_mirror_op_missing";
+const log = getLogger("contacts-mirror-op-reporter");
+
+// At most one report per op per hour per process.
+const REPORT_INTERVAL_MS = 60 * 60 * 1000;
+
+const lastReportAtByKey = new Map<string, number>();
 
 /**
  * True when a daemon IPC failure is the IPC server's unknown-method rejection
@@ -27,35 +24,21 @@ export function isUnknownIpcMethodError(err: unknown): boolean {
   return err instanceof Error && err.message.startsWith("Unknown method:");
 }
 
-const reporter = createWatchdogReporter({
-  log: getLogger("contacts-mirror-op-reporter"),
-  relayFailedMessage: "mirror-op-missing telemetry relay failed (non-fatal)",
-  relayRejectedMessage:
-    "mirror-op-missing telemetry relay rejected (non-fatal)",
-});
-
 /**
- * Report a mirror op the daemon doesn't implement: error log + telemetry
- * relay. At most one report per op per hour per process. Fire-and-forget —
- * never throws, never blocks the caller.
+ * Report a mirror op the daemon doesn't implement: a rate-limited error log.
+ * Fire-and-forget — never throws, never blocks the caller.
  */
 export function reportMirrorOpMissing(
   op: string,
   detail: Record<string, unknown>,
 ): void {
-  reporter.report({
-    key: op,
-    checkName: MIRROR_OP_MISSING_CHECK_NAME,
-    message:
-      "daemon does not implement this contacts mirror op — gateway write applied " +
+  const now = Date.now();
+  const last = lastReportAtByKey.get(op) ?? Number.NEGATIVE_INFINITY;
+  if (now - last < REPORT_INTERVAL_MS) return;
+  lastReportAtByKey.set(op, now);
+  log.error(
+    { op, ...detail },
+    "daemon does not implement this contacts mirror op — gateway write applied " +
       "without the assistant mirror (divergence until the daemon updates)",
-    detail: { op, ...detail },
-    warnContext: { op },
-  });
+  );
 }
-
-/** Test-only seams; see {@link createWatchdogReporter}. */
-export const setMirrorOpReporterOverridesForTesting =
-  reporter.setOverridesForTesting;
-export const resetMirrorOpReporterForTesting = reporter.resetForTesting;
-export const flushMirrorOpReporterForTesting = reporter.flushForTesting;

package/src/db/connection.ts

@@ -208,16 +208,6 @@ export function getGatewayDb(): GatewayDb {
   return db;
 }
 
-/**
- * Write a consistent copy of the gateway database to `destPath`.
- *
- * `VACUUM INTO` reads through the live connection, so committed rows still
- * sitting in the WAL are included and the copy needs no -wal/-shm files.
- */
-export function snapshotGatewayDb(destPath: string): void {
-  getRawDb(getGatewayDb()).run("VACUUM INTO ?", [destPath]);
-}
-
 /**
  * Extract the underlying bun:sqlite Database from a Drizzle instance.
  * Internal helper — not exported. Production code should use getGatewayDb()

package/src/feature-flag-resolver.ts

@@ -1,13 +1,12 @@
 import { loadFeatureFlagDefaults } from "./feature-flag-defaults.js";
 import { readEnvFeatureFlagOverrides } from "./feature-flag-env-overrides.js";
-import { readRemoteFeatureFlags } from "./feature-flag-remote-store.js";
 import { readPersistedFeatureFlags } from "./feature-flag-store.js";
 
 /**
  * Resolve the raw value for a feature flag.
  *
- * Priority: env override > persisted (user-toggled) > remote (platform-pushed) > registry default.
- * Undeclared keys return `false` (fail closed), even if stale local/remote
+ * Priority: env override > persisted (user-toggled) > registry default.
+ * Undeclared keys return `false` (fail closed), even if stale local
  * state contains a value for them.
  */
 export function getFeatureFlagValue(key: string): boolean | string {
@@ -22,10 +21,6 @@ export function getFeatureFlagValue(key: string): boolean | string {
   const persistedValue = persisted[key];
   if (persistedValue !== undefined) return persistedValue;
 
-  const remote = readRemoteFeatureFlags();
-  const remoteValue = remote[key];
-  if (remoteValue !== undefined) return remoteValue;
-
   return defaultDef.defaultEnabled;
 }
 

package/src/feature-flag-watcher.ts

@@ -15,10 +15,6 @@ import {
   clearFeatureFlagStoreCache,
   getFeatureFlagStorePath,
 } from "./feature-flag-store.js";
-import {
-  refreshRemoteFeatureFlagStoreCache,
-  getRemoteFeatureFlagStorePath,
-} from "./feature-flag-remote-store.js";
 import { getLogger } from "./logger.js";
 
 const log = getLogger("feature-flag-watcher");
@@ -33,14 +29,12 @@ export class FeatureFlagWatcher {
   private watcher: FSWatcher | null = null;
   private debounceTimer: ReturnType<typeof setTimeout> | null = null;
   private localFlagFilename: string;
-  private remoteFlagFilename: string;
   /** Accumulates which files changed during the debounce window. */
   private pendingFilenames = new Set<string>();
   private onChanged?: () => void;
 
   constructor(options?: FeatureFlagWatcherOptions) {
     this.localFlagFilename = basename(getFeatureFlagStorePath());
-    this.remoteFlagFilename = basename(getRemoteFeatureFlagStorePath());
     this.onChanged = options?.onChanged;
   }
 
@@ -55,11 +49,7 @@ export class FeatureFlagWatcher {
 
     try {
       this.watcher = watch(dir, { persistent: false }, (_event, filename) => {
-        if (
-          filename &&
-          filename !== this.localFlagFilename &&
-          filename !== this.remoteFlagFilename
-        ) {
+        if (filename && filename !== this.localFlagFilename) {
           return;
         }
         this.scheduleInvalidation(filename ?? undefined);
@@ -105,9 +95,6 @@ export class FeatureFlagWatcher {
       if (filenames.has(this.localFlagFilename)) {
         clearFeatureFlagStoreCache();
       }
-      if (filenames.has(this.remoteFlagFilename)) {
-        refreshRemoteFeatureFlagStoreCache();
-      }
       log.info(
         { filenames: [...filenames] },
         "Feature flag cache invalidated due to file change",

package/src/guardian-integrity-reporter.ts

@@ -2,46 +2,28 @@
 // lost its guardian rows while carrying evidence of prior onboarding
 // (`gateway_guardian_missing`, see auth/guardian-integrity.ts) and a refused
 // cadet-guardian mint (`gateway_guardian_mint_refused`, see
-// auth/guardian-bootstrap.ts). Emits an error-level log and relays a watchdog
-// telemetry event to the daemon's internal telemetry route, which POSTs it
-// directly to platform ingest — bypassing any state owned by the broken trust
-// path so the alarm cannot suppress itself. Rate-limited per check_name per
-// process; a lost event is acceptable for a rare, high-signal check (no
-// retry). Scaffolding: watchdog-reporter.ts.
+// auth/guardian-bootstrap.ts). Emits an error-level log, rate-limited per
+// check per process (both states are sticky until repair, so every verdict
+// or mint attempt would otherwise re-fire them).
 
 import { getLogger } from "./logger.js";
-import { createWatchdogReporter } from "./watchdog-reporter.js";
 
-/**
- * Watchdog `check_name` for the missing-guardian integrity failure. Platform
- * dashboards filter on this exact string — it is the cross-repo contract.
- */
-export const GUARDIAN_MISSING_CHECK_NAME = "gateway_guardian_missing";
+const log = getLogger("guardian-integrity-reporter");
 
-/**
- * Watchdog `check_name` for a refused cadet-guardian mint (evidence of a
- * prior guardian, no active cadet binding). Fires even when the integrity
- * state is `ok` — a guardian contact row can be intact while the cadet
- * binding is lost/inactive, and clients see `guardian_repair_required` 401s.
- */
-export const GUARDIAN_MINT_REFUSED_CHECK_NAME = "gateway_guardian_mint_refused";
+// At most one report per check per hour per process.
+const REPORT_INTERVAL_MS = 60 * 60 * 1000;
 
-const reporter = createWatchdogReporter({
-  log: getLogger("guardian-integrity-reporter"),
-  relayFailedMessage: "guardian-integrity telemetry relay failed (non-fatal)",
-  relayRejectedMessage:
-    "guardian-integrity telemetry relay rejected (non-fatal)",
-});
+const lastReportAtByKey = new Map<string, number>();
 
 /**
- * Report the missing-guardian state: error log + telemetry relay. Fires on
- * the first detection per process and at most hourly thereafter (the state is
+ * Report the missing-guardian state: a rate-limited error log. Fires on the
+ * first detection per process and at most hourly thereafter (the state is
  * sticky until the guardian is re-seeded, so every verdict would otherwise
  * re-fire it). Fire-and-forget — never throws, never blocks the caller.
  */
 export function reportMissingGuardian(detail: Record<string, unknown>): void {
   report(
-    GUARDIAN_MISSING_CHECK_NAME,
+    "gateway_guardian_missing",
     "gateway DB has no guardian rows but evidence of prior onboarding — " +
       "trust verdicts will fail closed until the guardian is re-seeded",
     detail,
@@ -49,9 +31,9 @@ export function reportMissingGuardian(detail: Record<string, unknown>): void {
 }
 
 /**
- * Report a refused cadet-guardian mint: error log + telemetry relay. Same
+ * Report a refused cadet-guardian mint: a rate-limited error log. Same
  * per-check rate limiting and fire-and-forget semantics as
- * {@link reportMissingGuardian}; the sibling check_name distinguishes the
+ * {@link reportMissingGuardian}; the sibling check distinguishes the
  * cadet-binding-lost-but-contact-intact refusal, which the missing-guardian
  * state check cannot see.
  */
@@ -59,7 +41,7 @@ export function reportGuardianMintRefused(
   detail: Record<string, unknown>,
 ): void {
   report(
-    GUARDIAN_MINT_REFUSED_CHECK_NAME,
+    "gateway_guardian_mint_refused",
     "refused to mint a cadet guardian principal over evidence of a prior " +
       "guardian — clients get guardian_repair_required until re-pair",
     detail,
@@ -67,23 +49,13 @@ export function reportGuardianMintRefused(
 }
 
 function report(
-  checkName: string,
+  check: string,
   message: string,
   detail: Record<string, unknown>,
 ): void {
-  reporter.report({
-    key: checkName,
-    checkName,
-    message,
-    detail,
-    warnContext: { checkName },
-  });
+  const now = Date.now();
+  const last = lastReportAtByKey.get(check) ?? Number.NEGATIVE_INFINITY;
+  if (now - last < REPORT_INTERVAL_MS) return;
+  lastReportAtByKey.set(check, now);
+  log.error({ check, ...detail }, message);
 }
-
-/** Test-only seams; see {@link createWatchdogReporter}. */
-export const setGuardianIntegrityReporterOverridesForTesting =
-  reporter.setOverridesForTesting;
-export const resetGuardianIntegrityReporterForTesting =
-  reporter.resetForTesting;
-export const flushGuardianIntegrityReporterForTesting =
-  reporter.flushForTesting;

package/src/http/middleware/auth.ts

@@ -1,6 +1,9 @@
 import type { Server } from "bun";
 
-import { admitActorToken } from "../../auth/actor-token-revocation.js";
+import {
+  admitActorToken,
+  type AdmittedActorTokenRecord,
+} from "../../auth/actor-token-revocation.js";
 import { findCadetGuardian } from "../../auth/guardian-bootstrap.js";
 import {
   isNarrowScopeProfile,
@@ -9,9 +12,9 @@ import {
 import { parseSub } from "../../auth/subject.js";
 import { validateEdgeToken } from "../../auth/token-exchange.js";
 import type { Scope, TokenClaims } from "../../auth/types.js";
-import { AuthFallbackCountTracker } from "../../auth-fallback-count-tracker.js";
 import { AuthFallbackLogThrottle } from "../../auth-fallback-log-throttle.js";
 import type { AuthRateLimiter } from "../../auth-rate-limiter.js";
+import { getIsCloud } from "../../cloud-url.js";
 import { getLogger } from "../../logger.js";
 import { readStoredCloudUserId } from "../../cloud-user-id.js";
 import { isLoopbackPeer } from "../../util/is-loopback-address.js";
@@ -25,12 +28,6 @@ const log = getLogger("auth");
 // per request, so this state can't live in its closure.
 const loopbackFallbackLogThrottle = new AuthFallbackLogThrottle();
 
-// Exact, unthrottled count of every loopback fallback, keyed by
-// (guard, path, failureKind). Drained and shipped to the daemon telemetry route
-// by AuthFallbackReporter. Process-lifetime singleton for the same reason as the
-// throttle above; exported so the reporter and tests share the one instance.
-export const loopbackFallbackCountTracker = new AuthFallbackCountTracker();
-
 type GetClientIp = () => string;
 
 // ---------------------------------------------------------------------------
@@ -51,18 +48,12 @@ export function isHttpAuthDisabled(): boolean {
   return process.env.DISABLE_HTTP_AUTH?.trim().toLowerCase() === "true";
 }
 
-/** True when IS_CLOUD is set (vembda-managed deployment). */
-function isPlatformManaged(): boolean {
-  const v = process.env.IS_CLOUD?.trim();
-  return v === "1" || v?.toLowerCase() === "true";
-}
-
 /**
  * True when the cloud-managed auth bypass is in effect — both flags set.
  * Either alone leaves JWT validation in place.
  */
-function isCloudAuthBypassActive(): boolean {
-  return isHttpAuthDisabled() && isPlatformManaged();
+export function isCloudAuthBypassActive(): boolean {
+  return isHttpAuthDisabled() && getIsCloud();
 }
 
 /**
@@ -73,7 +64,7 @@ export function logAuthBypassState(): void {
   if (!isHttpAuthDisabled()) {
     return;
   }
-  if (isPlatformManaged()) {
+  if (getIsCloud()) {
     log.info(
       "DISABLE_HTTP_AUTH + IS_CLOUD both set: JWT validation bypassed; " +
         "X-Cadet-User-Id is cross-checked against the bound platform user id",
@@ -87,6 +78,23 @@ export function logAuthBypassState(): void {
   }
 }
 
+/**
+ * The actor-token row the auth layer already loaded by the request bearer's
+ * hash while admitting it (see admitActorToken), keyed by request so routes
+ * can reuse the row instead of re-querying the same token hash.
+ */
+const admittedActorTokenRecords = new WeakMap<
+  Request,
+  AdmittedActorTokenRecord
+>();
+
+/** The admitted actor-token row for this request, when edge auth loaded one. */
+export function admittedActorTokenRecord(
+  req: Request,
+): AdmittedActorTokenRecord | undefined {
+  return admittedActorTokenRecords.get(req);
+}
+
 /**
  * Build edge-auth guard functions that share a rate limiter and IP resolver.
  *
@@ -415,7 +423,11 @@ export function createAuthMiddleware(
     token: string,
     claims: TokenClaims,
   ): Response | null {
-    if (!admitActorToken(token, claims)) {
+    const admission = admitActorToken(token, claims);
+    if (admission.record) {
+      admittedActorTokenRecords.set(req, admission.record);
+    }
+    if (!admission.admitted) {
       authRateLimiter.recordFailure(getClientIp());
       log.warn(
         { path: new URL(req.url).pathname },
@@ -443,17 +455,11 @@ export function createAuthMiddleware(
     if (!server || !isLoopbackPeer(server, req, { trustProxy })) return false;
 
     const path = new URL(req.url).pathname;
-    const failureKind =
-      typeof extra?.authFailure === "string"
-        ? extra.authFailure
-        : "unspecified";
-
-    // Count every fallback (unthrottled) for telemetry. The throttle below only
-    // governs log volume — it must not gate the count, or the data undercounts.
-    loopbackFallbackCountTracker.increment(guard, path, failureKind);
 
     if (
-      loopbackFallbackLogThrottle.shouldLog(`${guard} ${path} ${failureKind}`)
+      loopbackFallbackLogThrottle.shouldLog(
+        `${guard} ${path} ${typeof extra?.authFailure === "string" ? extra.authFailure : "unspecified"}`,
+      )
     ) {
       const peer = server.requestIP(req);
       log.warn(

package/src/http/routes/auth-token.ts

@@ -156,7 +156,7 @@ export async function handleCreateToken(
   // Don't let a revoked token re-mint a fresh one — that would be an escape
   // hatch around device revocation, since the source token still verifies by
   // signature until it expires.
-  if (!admitActorToken(bearerToken, verifyResult.claims)) {
+  if (!admitActorToken(bearerToken, verifyResult.claims).admitted) {
     log.warn("Token create rejected: source token revoked");
     return Response.json({ error: "Unauthorized" }, { status: 401 });
   }