@mycadet/gateway 0.12.11 → 0.13.0

package/src/__tests__/contacts-mirror-op-reporter.test.ts

@@ -1,121 +1,65 @@
 /**
  * Fail-loud mirror-op-missing reporter (contacts-mirror-op-reporter.ts):
  *
- *  - First report per op emits one error log and one telemetry relay POST with
- *    the `contacts_mirror_op_missing` check name and `{ op, ...detail }`.
+ *  - First report per op emits one error log carrying `{ op, ...detail }`.
  *  - Repeat reports for the same op inside the hourly window are dropped; a
  *    DIFFERENT op still reports (per-op rate limit).
- *  - Relay failures never throw out of the caller.
  *  - `isUnknownIpcMethodError` matches only the IPC server's unknown-method
  *    rejection shape.
  *
- * Logging is observed through the reporter's test-only `log` override —
- * bun's mock.module is process-global and would leak into other test files.
+ * Logs are observed by mocking the logger module (a side-effect boundary —
+ * the same convention as sleep-wake-detector.test.ts). Per-file CI truth:
+ * the mock is process-global, so this file pins nothing else.
  */
-import { beforeEach, afterEach, describe, expect, test } from "bun:test";
+import { beforeEach, describe, expect, mock, spyOn, test } from "bun:test";
 
-const errorLogs: unknown[] = [];
-const warnLogs: unknown[] = [];
+const errorLogs: [Record<string, unknown>, string][] = [];
+
+mock.module("../logger.js", () => ({
+  getLogger: () => ({
+    error: (detail: Record<string, unknown>, msg: string) => {
+      errorLogs.push([detail, msg]);
+    },
+    warn: () => {},
+  }),
+}));
 
 await import("./test-preload.js");
-const {
-  MIRROR_OP_MISSING_CHECK_NAME,
-  flushMirrorOpReporterForTesting,
-  isUnknownIpcMethodError,
-  reportMirrorOpMissing,
-  resetMirrorOpReporterForTesting,
-  setMirrorOpReporterOverridesForTesting,
-} = await import("../contacts-mirror-op-reporter.js");
+const { isUnknownIpcMethodError, reportMirrorOpMissing } =
+  await import("../contacts-mirror-op-reporter.js");
 
-type FetchCall = { url: string; init: RequestInit };
-let fetchCalls: FetchCall[] = [];
-let fetchResult: () => Promise<Response> = async () => new Response("{}");
+let fakeNow = 1_000_000_000_000;
 
 beforeEach(() => {
-  fetchCalls = [];
-  fetchResult = async () => new Response("{}");
   errorLogs.length = 0;
-  warnLogs.length = 0;
-  resetMirrorOpReporterForTesting();
-  setMirrorOpReporterOverridesForTesting({
-    fetchImpl: async (url, init) => {
-      fetchCalls.push({ url: String(url), init: init ?? {} });
-      return fetchResult();
-    },
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: {
-      error: (detail, msg) => {
-        errorLogs.push([detail, msg]);
-      },
-      warn: (detail, msg) => {
-        warnLogs.push([detail, msg]);
-      },
-    },
-  });
-});
-
-afterEach(() => {
-  resetMirrorOpReporterForTesting();
+  fakeNow += 24 * 60 * 60 * 1000; // start each test outside prior windows
+  spyOn(Date, "now").mockImplementation(() => fakeNow);
 });
 
 describe("reportMirrorOpMissing", () => {
-  test("first report logs an error and relays one watchdog event", async () => {
-    reportMirrorOpMissing("contacts_mirror_merge_contact", {
-      keepId: "ct_keep",
-      mergeId: "ct_merge",
-    });
-    await flushMirrorOpReporterForTesting();
-
-    expect(errorLogs.length).toBe(1);
-    expect(fetchCalls.length).toBe(1);
-    expect(fetchCalls[0].url).toBe(
-      "http://127.0.0.1:7821/v1/internal/telemetry/watchdog",
-    );
-    const headers = fetchCalls[0].init.headers as Record<string, string>;
-    expect(headers.Authorization).toBe("Bearer svc-token");
-    expect(JSON.parse(String(fetchCalls[0].init.body))).toEqual({
-      check_name: MIRROR_OP_MISSING_CHECK_NAME,
-      detail: {
-        op: "contacts_mirror_merge_contact",
+  test("first report logs one error with the op + detail", () => {
+    expect(() =>
+      reportMirrorOpMissing("contacts_mirror_merge_contact", {
         keepId: "ct_keep",
         mergeId: "ct_merge",
-      },
+      }),
+    ).not.toThrow();
+
+    expect(errorLogs.length).toBe(1);
+    expect(errorLogs[0]![0]).toMatchObject({
+      op: "contacts_mirror_merge_contact",
+      keepId: "ct_keep",
+      mergeId: "ct_merge",
     });
+    expect(errorLogs[0]![1]).toContain("divergence until the daemon updates");
   });
 
-  test("repeat reports for the same op are dropped; a different op still fires", async () => {
+  test("repeat reports for the same op are dropped; a different op still fires", () => {
     reportMirrorOpMissing("contacts_mirror_merge_contact", { keepId: "a" });
     reportMirrorOpMissing("contacts_mirror_merge_contact", { keepId: "b" });
     reportMirrorOpMissing("contacts_mirror_upsert_full", { contactId: "c" });
-    await flushMirrorOpReporterForTesting();
 
     expect(errorLogs.length).toBe(2);
-    expect(fetchCalls.length).toBe(2);
-  });
-
-  test("a rejected relay never throws out of the caller", async () => {
-    fetchResult = async () => {
-      throw new Error("daemon unreachable");
-    };
-
-    expect(() =>
-      reportMirrorOpMissing("contacts_mirror_upsert_full", { contactId: "x" }),
-    ).not.toThrow();
-    await flushMirrorOpReporterForTesting();
-
-    expect(errorLogs.length).toBe(1);
-    expect(warnLogs.length).toBe(1);
-  });
-
-  test("a non-ok relay response is swallowed with a warning", async () => {
-    fetchResult = async () => new Response("nope", { status: 500 });
-
-    reportMirrorOpMissing("contacts_mirror_upsert_full", { contactId: "x" });
-    await flushMirrorOpReporterForTesting();
-
-    expect(fetchCalls.length).toBe(1);
-    expect(warnLogs.length).toBe(1);
   });
 });
 

package/src/__tests__/credential-requests.test.ts

@@ -121,7 +121,7 @@ describe("credential-request mint (IPC)", () => {
   test("makes public ingress live on the successful mint path", async () => {
     const ensurePublicIngressLive = mock(async () => {});
     const result = await createCredentialRequest(
-      fakeGatewayConfig("https://tunnel-dev.mycadet.ai"),
+      fakeGatewayConfig("https://dev-tunnel.mycadet.ai"),
       fakeConfigFile(undefined),
       { service: "github", field: "api_token" },
       {
@@ -152,7 +152,7 @@ describe("credential-request mint (IPC)", () => {
   test("does not read the cloud assistant id when the config URL resolves", async () => {
     const getCloudAssistantId = mock(async () => "assistant-123");
     const result = await createCredentialRequest(
-      fakeGatewayConfig("https://tunnel-dev.mycadet.ai"),
+      fakeGatewayConfig("https://dev-tunnel.mycadet.ai"),
       fakeConfigFile("https://assistant.example.com"),
       { service: "github", field: "api_token" },
       { getCloudAssistantId },
@@ -165,7 +165,7 @@ describe("credential-request mint (IPC)", () => {
     // ingress.publicBaseUrl is Tunnel-managed and cleared on tunnel flaps, so
     // the mint must still resolve a URL from tunnelBaseUrl + the assistant id.
     const result = await createCredentialRequest(
-      fakeGatewayConfig("https://tunnel-dev.mycadet.ai"),
+      fakeGatewayConfig("https://dev-tunnel.mycadet.ai"),
       fakeConfigFile(undefined),
       { service: "github", field: "api_token" },
       { getCloudAssistantId: async () => "assistant-123" },
@@ -173,7 +173,7 @@ describe("credential-request mint (IPC)", () => {
 
     if (!result.ok) throw new Error(`mint failed: ${result.error}`);
     expect(result.url).toBe(
-      `https://tunnel-dev.mycadet.ai/assistant-123/assistant/credentials/enter#token=${encodeURIComponent(result.token)}`,
+      `https://dev-tunnel.mycadet.ai/assistant-123/assistant/credentials/enter#token=${encodeURIComponent(result.token)}`,
     );
   });
 

package/src/__tests__/devices-mine.test.ts

@@ -0,0 +1,187 @@
+/**
+ * Tests for GET /v1/devices/mine — the caller's own paired-device row. The
+ * bearer IS the credential (browser-reachable by design), and the response
+ * mirrors the /v1/devices projection for the caller's device so a
+ * `devices/mine` answer matches that device's row in the host-side
+ * `cadet devices` list field for field — including the cross-status
+ * max(lastUsedAt) that keeps activity history across token rotation.
+ */
+import { describe, test, expect, mock, beforeEach, afterEach } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { eq } from "drizzle-orm";
+
+import { initSigningKey } from "../auth/token-service.js";
+
+initSigningKey(Buffer.from("test-signing-key-at-least-32-bytes-long-xx"));
+
+// The pair guardian-lookup reads the gateway DB; the assistant DB proxy is
+// mocked so any incidental assistant access stays inert in tests.
+mock.module("../db/assistant-db-proxy.js", () => ({
+  assistantDbQuery: mock(),
+  assistantDbRun: mock(),
+  assistantDbExec: mock(),
+}));
+
+const { initGatewayDb, resetGatewayDb, getGatewayDb } = await import(
+  "../db/connection.js"
+);
+const { actorTokenRecords, contacts, contactChannels } = await import(
+  "../db/schema.js"
+);
+const { hashToken, mintAndRecordBrowserTokenPair } = await import(
+  "../auth/guardian-bootstrap.js"
+);
+const { handleGetMyDevice } = await import("../http/routes/devices-mine.js");
+
+const GUARDIAN_ID = "guardian-001";
+
+let testRoot: string;
+
+function mineRequest(bearer: string | null): Request {
+  const headers = new Headers({ host: "localhost:7830" });
+  if (bearer) {
+    headers.set("authorization", `Bearer ${bearer}`);
+  }
+  return new Request("http://localhost:7830/v1/devices/mine", {
+    method: "GET",
+    headers,
+  });
+}
+
+function rowForToken(token: string) {
+  return getGatewayDb()
+    .select()
+    .from(actorTokenRecords)
+    .where(eq(actorTokenRecords.tokenHash, hashToken(token)))
+    .get();
+}
+
+beforeEach(async () => {
+  testRoot = mkdtempSync(join(tmpdir(), "devices-mine-test-"));
+  const securityDir = join(testRoot, "protected");
+  mkdirSync(securityDir, { recursive: true });
+  process.env.GATEWAY_SECURITY_DIR = securityDir;
+  await initGatewayDb();
+
+  // The route answers for any actor-token row; the guardian contact seed
+  // mirrors the devices.test.ts fixture shape.
+  const now = Date.now();
+  getGatewayDb()
+    .insert(contacts)
+    .values({
+      id: GUARDIAN_ID,
+      displayName: "Guardian",
+      role: "guardian",
+      principalId: GUARDIAN_ID,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+  getGatewayDb()
+    .insert(contactChannels)
+    .values({
+      id: `ch-${GUARDIAN_ID}`,
+      contactId: GUARDIAN_ID,
+      type: "cadet",
+      address: "guardian-cadet",
+      isPrimary: false,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+});
+
+afterEach(() => {
+  resetGatewayDb();
+  delete process.env.GATEWAY_SECURITY_DIR;
+  rmSync(testRoot, { recursive: true, force: true });
+});
+
+describe("GET /v1/devices/mine", () => {
+  test("returns the caller's own device row", async () => {
+    const pair = mintAndRecordBrowserTokenPair({
+      guardianPrincipalId: GUARDIAN_ID,
+      platform: "web",
+      browserRefreshCookiePath: "/",
+      identity: { pairingUserAgent: "Mozilla/5.0 TestBrowser" },
+    });
+
+    const response = await handleGetMyDevice(mineRequest(pair.accessToken));
+    expect(response.status).toBe(200);
+
+    const body = (await response.json()) as { device: Record<string, unknown> };
+    const stored = rowForToken(pair.accessToken);
+    expect(stored).toBeTruthy();
+    expect(body.device.hashedDeviceId).toBe(stored!.hashedDeviceId);
+    expect(body.device.platform).toBe("web");
+    expect(body.device.pairingUserAgent).toBe("Mozilla/5.0 TestBrowser");
+    expect(body.device.issuedAt).toBe(stored!.issuedAt);
+  });
+
+  test("lastUsedAt is the cross-status max for the device", async () => {
+    const pair = mintAndRecordBrowserTokenPair({
+      guardianPrincipalId: GUARDIAN_ID,
+      platform: "web",
+      browserRefreshCookiePath: "/",
+    });
+    const stored = rowForToken(pair.accessToken);
+    expect(stored).toBeTruthy();
+
+    // A rotation revokes the old row and mints an unstamped replacement,
+    // so the newest activity stamp can live on the revoked row — the same
+    // rule the /v1/devices list applies.
+    const now = Date.now();
+    getGatewayDb()
+      .insert(actorTokenRecords)
+      .values({
+        id: randomUUID(),
+        tokenHash: hashToken(`rotated-${stored!.hashedDeviceId}`),
+        guardianPrincipalId: GUARDIAN_ID,
+        hashedDeviceId: stored!.hashedDeviceId,
+        platform: "web",
+        status: "revoked",
+        issuedAt: now - 86_400_000,
+        expiresAt: now + 86_400_000,
+        lastUsedAt: now - 60_000,
+        createdAt: now,
+        updatedAt: now,
+      })
+      .run();
+
+    const response = await handleGetMyDevice(mineRequest(pair.accessToken));
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { device: { lastUsedAt: number | null } };
+    expect(body.device.lastUsedAt).toBe(now - 60_000);
+  });
+
+  test("an unknown bearer answers 404, not an error", async () => {
+    const response = await handleGetMyDevice(
+      mineRequest("not-a-token-anyone-minted"),
+    );
+    expect(response.status).toBe(404);
+  });
+
+  test("a cloud-hosted assistant answers 404 before any row lookup", async () => {
+    process.env.DISABLE_HTTP_AUTH = "true";
+    process.env.IS_CLOUD = "true";
+    try {
+      const response = await handleGetMyDevice(mineRequest(null));
+      expect(response.status).toBe(404);
+      const body = (await response.json()) as { error: { code: string } };
+      expect(body.error.code).toBe("NOT_AVAILABLE_ON_CLOUD");
+    } finally {
+      delete process.env.DISABLE_HTTP_AUTH;
+      delete process.env.IS_CLOUD;
+    }
+  });
+
+  test("non-GET answers method not allowed", async () => {
+    const response = await handleGetMyDevice(
+      new Request("http://localhost:7830/v1/devices/mine", { method: "POST" }),
+    );
+    expect(response.status).toBe(405);
+  });
+});

package/src/__tests__/edge-auth.test.ts

@@ -64,8 +64,7 @@ mock.module("../auth/token-exchange.js", () => ({
 }));
 
 const { AuthRateLimiter } = await import("../auth-rate-limiter.js");
-const { createAuthMiddleware, loopbackFallbackCountTracker } =
-  await import("../http/middleware/auth.js");
+const { createAuthMiddleware } = await import("../http/middleware/auth.js");
 const { initGatewayDb, resetGatewayDb, getGatewayDb } =
   await import("../db/connection.js");
 const { actorTokenRecords } = await import("../db/schema.js");
@@ -96,7 +95,6 @@ beforeEach(() => {
   mockReadCredential = mock(async () => undefined);
   mockPlatformUserIdUnreachable = false;
   mockValidateEdgeToken = mock(() => ({ ok: false, reason: "noop" }));
-  loopbackFallbackCountTracker.reset();
 });
 
 afterEach(() => {
@@ -238,21 +236,6 @@ describe("requireEdgeAuth — JWT mode", () => {
     );
     expect(res?.status).toBe(401);
     expect(mockValidateEdgeToken).not.toHaveBeenCalled();
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([]);
-  });
-
-  test("a loopback fallback is counted by (guard, path, failureKind)", async () => {
-    const { requireEdgeAuth } = makeMiddleware();
-    await requireEdgeAuth(makeReq(), makeLoopbackServer());
-    await requireEdgeAuth(makeReq(), makeLoopbackServer());
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([
-      {
-        guard: "edge",
-        path: "/v1/something",
-        failureKind: "missing_authorization",
-        count: 2,
-      },
-    ]);
   });
 
   test("null on valid bearer token", async () => {
@@ -389,7 +372,6 @@ describe("requireEdgeAuthWithScope — JWT mode", () => {
     );
     expect(res?.status).toBe(401);
     expect(mockValidateEdgeToken).not.toHaveBeenCalled();
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([]);
   });
 
   test("403 when token's scope_profile lacks the required scope", async () => {
@@ -512,7 +494,6 @@ describe("edge auth refuses a single-route grant", () => {
       makeLoopbackServer(),
     );
     expect(res?.status).toBe(401);
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([]);
   });
 
   test("requireEdgeAuthWithScope 401s the grant before the scope check", async () => {

package/src/__tests__/edge-guardian-auth.test.ts

@@ -53,8 +53,7 @@ mock.module("../auth/token-exchange.js", () => ({
 }));
 
 const { AuthRateLimiter } = await import("../auth-rate-limiter.js");
-const { createAuthMiddleware, loopbackFallbackCountTracker } =
-  await import("../http/middleware/auth.js");
+const { createAuthMiddleware } = await import("../http/middleware/auth.js");
 
 const PLATFORM_USER_ID = "user-abc-123";
 const GUARDIAN_PRINCIPAL = "actor-guardian-xyz";
@@ -82,7 +81,6 @@ beforeEach(() => {
   mockPlatformUserIdUnreachable = false;
   mockFindCadetGuardian = mock(async () => null);
   mockValidateEdgeToken = mock(() => ({ ok: false, reason: "noop" }));
-  loopbackFallbackCountTracker.reset();
 });
 
 afterEach(() => {
@@ -210,7 +208,6 @@ describe("requireEdgeGuardianAuth — actor principal mode", () => {
     expect(res?.status).toBe(401);
     expect(mockValidateEdgeToken).not.toHaveBeenCalled();
     expect(mockFindCadetGuardian).not.toHaveBeenCalled();
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([]);
   });
 
   test("invalid bearer token falls back to loopback", async () => {
@@ -224,19 +221,6 @@ describe("requireEdgeGuardianAuth — actor principal mode", () => {
     expect(mockFindCadetGuardian).not.toHaveBeenCalled();
   });
 
-  test("a guardian loopback fallback is counted under the edge-guardian guard", async () => {
-    const { requireEdgeGuardianAuth } = makeMiddleware();
-    await requireEdgeGuardianAuth(makeReq(), makeLoopbackServer());
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([
-      {
-        guard: "edge-guardian",
-        path: "/v1/contact-channels/abc/verify",
-        failureKind: "missing_authorization",
-        count: 1,
-      },
-    ]);
-  });
-
   test("returns 503 when findCadetGuardian throws (transient assistant DB outage)", async () => {
     mockValidateEdgeToken = mock(() => ({
       ok: true,

package/src/__tests__/feature-flag-resolver.test.ts

@@ -50,7 +50,6 @@ beforeEach(() => {
   _setRegistryCandidateOverrides([defaultsPath]);
   resetFeatureFlagDefaultsCache();
   clearFeatureFlagStoreCache();
-  clearRemoteFeatureFlagStoreCache();
 });
 
 afterEach(() => {
@@ -63,7 +62,6 @@ afterEach(() => {
   _setRegistryCandidateOverrides(null);
   resetFeatureFlagDefaultsCache();
   clearFeatureFlagStoreCache();
-  clearRemoteFeatureFlagStoreCache();
   resetEnvOverridesCache();
   delete process.env.CADET_FLAG_BROWSER;
   delete process.env.CADET_FLAG_A2A_CHANNEL;
@@ -76,8 +74,6 @@ const { resetFeatureFlagDefaultsCache, _setRegistryCandidateOverrides } =
   await import("../feature-flag-defaults.js");
 const { clearFeatureFlagStoreCache, writeFeatureFlag } =
   await import("../feature-flag-store.js");
-const { clearRemoteFeatureFlagStoreCache, writeRemoteFeatureFlags } =
-  await import("../feature-flag-remote-store.js");
 const { resetEnvOverridesCache } =
   await import("../feature-flag-env-overrides.js");
 
@@ -95,19 +91,8 @@ describe("isFeatureFlagEnabled", () => {
     expect(isFeatureFlagEnabled("a2a-channel")).toBe(true);
   });
 
-  test("uses explicit remote values for declared flags", () => {
-    writeRemoteFeatureFlags({
-      browser: false,
-      "a2a-channel": true,
-    });
-
-    expect(isFeatureFlagEnabled("browser")).toBe(false);
-    expect(isFeatureFlagEnabled("a2a-channel")).toBe(true);
-  });
-
-  test("ignores persisted and remote values for undeclared flags", () => {
+  test("ignores persisted values for undeclared flags", () => {
     writeFeatureFlag("unknown", true);
-    writeRemoteFeatureFlags({ unknown: true });
 
     expect(isFeatureFlagEnabled("unknown")).toBe(false);
   });
@@ -146,19 +131,7 @@ describe("getFeatureFlagValue", () => {
     expect(getFeatureFlagValue("default-model")).toBe("gpt-4");
   });
 
-  test("remote string value overrides default when no persisted value", () => {
-    writeRemoteFeatureFlags({ "default-model": "gpt-4" });
-    expect(getFeatureFlagValue("default-model")).toBe("gpt-4");
-  });
-
-  test("persisted takes precedence over remote for string flags", () => {
-    writeRemoteFeatureFlags({ "default-model": "remote-model" });
-    writeFeatureFlag("default-model", "persisted-model");
-    expect(getFeatureFlagValue("default-model")).toBe("persisted-model");
-  });
-
-  test("env override wins over persisted, remote, and default values", () => {
-    writeRemoteFeatureFlags({ browser: false });
+  test("env override wins over persisted and default values", () => {
     writeFeatureFlag("browser", false);
 
     process.env.CADET_FLAG_BROWSER = "true";
@@ -168,7 +141,6 @@ describe("getFeatureFlagValue", () => {
   });
 
   test("env override wins for string flags", () => {
-    writeRemoteFeatureFlags({ "default-model": "remote-model" });
     writeFeatureFlag("default-model", "persisted-model");
 
     process.env.CADET_FLAG_DEFAULT_MODEL = "env-model";

package/src/__tests__/feature-flag-watcher-callback.test.ts

@@ -13,12 +13,6 @@ mock.module("../feature-flag-store.js", () => ({
   getFeatureFlagStorePath: () => join(flagDir, "feature-flags.json"),
 }));
 
-mock.module("../feature-flag-remote-store.js", () => ({
-  refreshRemoteFeatureFlagStoreCache: mock(() => {}),
-  getRemoteFeatureFlagStorePath: () =>
-    join(flagDir, "remote-feature-flags.json"),
-}));
-
 const { FeatureFlagWatcher } = await import("../feature-flag-watcher.js");
 
 describe("FeatureFlagWatcher onChanged callback", () => {
@@ -52,22 +46,6 @@ describe("FeatureFlagWatcher onChanged callback", () => {
     watcher.stop();
   });
 
-  test("calls onChanged after debounce fires on remote flag file change", async () => {
-    const onChanged = mock(() => {});
-    const watcher = new FeatureFlagWatcher({ onChanged });
-    watcher.start();
-
-    writeFileSync(
-      join(flagDir, "remote-feature-flags.json"),
-      JSON.stringify({ remote: true }),
-    );
-
-    await new Promise((r) => setTimeout(r, 700));
-
-    expect(onChanged).toHaveBeenCalledTimes(1);
-    watcher.stop();
-  });
-
   test("does not call onChanged when no callback is provided", async () => {
     const watcher = new FeatureFlagWatcher();
     watcher.start();