@mycadet/gateway 0.12.11 → 0.13.0

package/src/cli/pairing.ts

@@ -2,6 +2,7 @@
  * `gateway pairing` — operator subcommands for the remote-web pairing flow.
  *
  *   gateway pairing mint <url>
+ *   gateway pairing list [--json]
  *
  * Mints (and approves) a remote-web pairing challenge by executing the
  * pairing mint logic DIRECTLY in this process — deliberately NOT over the
@@ -15,21 +16,46 @@
  * is needed and the topology (native or containerized) stops mattering.
  * Prints the challenge response as single-line JSON on stdout; the caller
  * parses it and renders the pairing link/QR.
+ *
+ * `list` reads the same file-backed store and reports EVERY persisted
+ * challenge — active and expired — with each one's mint and expiration
+ * timestamp, so the host can see in-flight and stale pairing sessions.
  */
 
+import {
+  listPersistedRemoteWebPairingChallenges,
+  type PendingRemoteWebPairingChallenge,
+} from "../remote-web/pairing-challenge-store.js";
 import { mintAndApproveRemoteWebPairingChallenge } from "../remote-web/pairing-mint.js";
 
 function printUsage(): void {
-  console.log("Usage: gateway pairing mint <url>");
+  console.log("Usage: gateway pairing <subcommand>");
+  console.log("");
+  console.log("Operator commands for the remote-web pairing flow.");
   console.log("");
+  console.log("Subcommands:");
+  console.log(
+    "  mint <url>   Mint and approve a pairing challenge; prints the",
+  );
+  console.log(
+    "               challenge (device code, pairing link, expiry) as JSON.",
+  );
   console.log(
-    "Mint and approve a remote-web pairing challenge on this machine and",
+    "  list         List every persisted pairing challenge — active and",
   );
-  console.log("print the challenge as JSON.");
+  console.log(
+    "               expired — with its mint and expiration timestamp.",
+  );
+  console.log("");
+  console.log("Options:");
+  console.log("  --json       Machine-readable JSON (list)");
   console.log("");
-  console.log("Arguments:");
-  console.log("  <url>   Public base URL to advertise in the pairing link,");
-  console.log("          e.g. https://your-assistant.ts.net");
+  console.log("Examples:");
+  console.log("  $ gateway pairing mint https://your-assistant.ts.net");
+  console.log("  $ gateway pairing list");
+  console.log("  $ gateway pairing list --json");
+  console.log("");
+  console.log("From the host: cadet exec --service gateway -- gateway pairing list");
 }
 
 /** Parse `pairing` argv (after the command word) into a subcommand + arg. */
@@ -41,6 +67,52 @@ export function parsePairingArgs(args: string[]): {
   return { subcommand, positional };
 }
 
+function listLiveness(
+  challenge: PendingRemoteWebPairingChallenge,
+  now: number,
+): "active" | "expired" {
+  return challenge.expiresAtMs <= now ? "expired" : "active";
+}
+
+function runPairingList(json: boolean): number {
+  const now = Date.now();
+  const challenges = listPersistedRemoteWebPairingChallenges();
+
+  if (json) {
+    console.log(
+      JSON.stringify({
+        ok: true,
+        challenges: challenges.map((challenge) => ({
+          ...challenge,
+          expired: challenge.expiresAtMs <= now,
+        })),
+      }),
+    );
+    return 0;
+  }
+
+  if (challenges.length === 0) {
+    console.log("No pairing challenges found.");
+    return 0;
+  }
+
+  for (const challenge of challenges) {
+    const liveness = listLiveness(challenge, now);
+    console.log(
+      `${challenge.userCode}  ${challenge.status}  ${liveness}  ` +
+        `minted ${new Date(challenge.createdAtMs).toISOString()}  ` +
+        `expires ${new Date(challenge.expiresAtMs).toISOString()}`,
+    );
+    const userAgent = challenge.requesterUserAgent
+      ? `  ${challenge.requesterUserAgent}`
+      : "";
+    console.log(
+      `  ${challenge.verificationUri}  requester ${challenge.requesterIp}${userAgent}`,
+    );
+  }
+  return 0;
+}
+
 export async function runPairingCommand(args: string[]): Promise<number> {
   const { subcommand, positional } = parsePairingArgs(args);
 
@@ -48,6 +120,9 @@ export async function runPairingCommand(args: string[]): Promise<number> {
     printUsage();
     return subcommand ? 0 : 1;
   }
+  if (subcommand === "list") {
+    return runPairingList(args.includes("--json"));
+  }
   if (subcommand !== "mint") {
     console.error(`Error: unknown pairing subcommand '${subcommand}'.`);
     printUsage();

package/src/contacts-mirror-op-reporter.ts

@@ -2,21 +2,18 @@
 // with "Unknown method" (old daemon behind a newer gateway). The mirror ops
 // deliberately have no raw-SQL fallback, so the gateway write has already
 // applied while the assistant mirror silently missed it — divergence persists
-// until reconciliation. Emits an error-level log and relays a
-// `contacts_mirror_op_missing` watchdog telemetry event to the daemon's
-// internal telemetry route (the route predates the mirror ops, so an old
-// daemon still accepts it). Rate-limited per op per process; a lost event is
-// acceptable for a rare, high-signal check (no retry). Scaffolding:
-// watchdog-reporter.ts.
+// until reconciliation. Emits an error-level log, rate-limited per op per
+// process (the state is sticky until the daemon updates, so every op would
+// otherwise re-fire it).
 
 import { getLogger } from "./logger.js";
-import { createWatchdogReporter } from "./watchdog-reporter.js";
 
-/**
- * Watchdog `check_name` for a daemon missing a contacts mirror op. Platform
- * dashboards filter on this exact string — it is the cross-repo contract.
- */
-export const MIRROR_OP_MISSING_CHECK_NAME = "contacts_mirror_op_missing";
+const log = getLogger("contacts-mirror-op-reporter");
+
+// At most one report per op per hour per process.
+const REPORT_INTERVAL_MS = 60 * 60 * 1000;
+
+const lastReportAtByKey = new Map<string, number>();
 
 /**
  * True when a daemon IPC failure is the IPC server's unknown-method rejection
@@ -27,35 +24,21 @@ export function isUnknownIpcMethodError(err: unknown): boolean {
   return err instanceof Error && err.message.startsWith("Unknown method:");
 }
 
-const reporter = createWatchdogReporter({
-  log: getLogger("contacts-mirror-op-reporter"),
-  relayFailedMessage: "mirror-op-missing telemetry relay failed (non-fatal)",
-  relayRejectedMessage:
-    "mirror-op-missing telemetry relay rejected (non-fatal)",
-});
-
 /**
- * Report a mirror op the daemon doesn't implement: error log + telemetry
- * relay. At most one report per op per hour per process. Fire-and-forget —
- * never throws, never blocks the caller.
+ * Report a mirror op the daemon doesn't implement: a rate-limited error log.
+ * Fire-and-forget — never throws, never blocks the caller.
  */
 export function reportMirrorOpMissing(
   op: string,
   detail: Record<string, unknown>,
 ): void {
-  reporter.report({
-    key: op,
-    checkName: MIRROR_OP_MISSING_CHECK_NAME,
-    message:
-      "daemon does not implement this contacts mirror op — gateway write applied " +
+  const now = Date.now();
+  const last = lastReportAtByKey.get(op) ?? Number.NEGATIVE_INFINITY;
+  if (now - last < REPORT_INTERVAL_MS) return;
+  lastReportAtByKey.set(op, now);
+  log.error(
+    { op, ...detail },
+    "daemon does not implement this contacts mirror op — gateway write applied " +
       "without the assistant mirror (divergence until the daemon updates)",
-    detail: { op, ...detail },
-    warnContext: { op },
-  });
+  );
 }
-
-/** Test-only seams; see {@link createWatchdogReporter}. */
-export const setMirrorOpReporterOverridesForTesting =
-  reporter.setOverridesForTesting;
-export const resetMirrorOpReporterForTesting = reporter.resetForTesting;
-export const flushMirrorOpReporterForTesting = reporter.flushForTesting;

package/src/db/connection.ts

@@ -208,16 +208,6 @@ export function getGatewayDb(): GatewayDb {
   return db;
 }
 
-/**
- * Write a consistent copy of the gateway database to `destPath`.
- *
- * `VACUUM INTO` reads through the live connection, so committed rows still
- * sitting in the WAL are included and the copy needs no -wal/-shm files.
- */
-export function snapshotGatewayDb(destPath: string): void {
-  getRawDb(getGatewayDb()).run("VACUUM INTO ?", [destPath]);
-}
-
 /**
  * Extract the underlying bun:sqlite Database from a Drizzle instance.
  * Internal helper — not exported. Production code should use getGatewayDb()

package/src/feature-flag-resolver.ts

@@ -1,13 +1,12 @@
 import { loadFeatureFlagDefaults } from "./feature-flag-defaults.js";
 import { readEnvFeatureFlagOverrides } from "./feature-flag-env-overrides.js";
-import { readRemoteFeatureFlags } from "./feature-flag-remote-store.js";
 import { readPersistedFeatureFlags } from "./feature-flag-store.js";
 
 /**
  * Resolve the raw value for a feature flag.
  *
- * Priority: env override > persisted (user-toggled) > remote (platform-pushed) > registry default.
- * Undeclared keys return `false` (fail closed), even if stale local/remote
+ * Priority: env override > persisted (user-toggled) > registry default.
+ * Undeclared keys return `false` (fail closed), even if stale local
  * state contains a value for them.
  */
 export function getFeatureFlagValue(key: string): boolean | string {
@@ -22,10 +21,6 @@ export function getFeatureFlagValue(key: string): boolean | string {
   const persistedValue = persisted[key];
   if (persistedValue !== undefined) return persistedValue;
 
-  const remote = readRemoteFeatureFlags();
-  const remoteValue = remote[key];
-  if (remoteValue !== undefined) return remoteValue;
-
   return defaultDef.defaultEnabled;
 }
 

package/src/feature-flag-watcher.ts

@@ -15,10 +15,6 @@ import {
   clearFeatureFlagStoreCache,
   getFeatureFlagStorePath,
 } from "./feature-flag-store.js";
-import {
-  refreshRemoteFeatureFlagStoreCache,
-  getRemoteFeatureFlagStorePath,
-} from "./feature-flag-remote-store.js";
 import { getLogger } from "./logger.js";
 
 const log = getLogger("feature-flag-watcher");
@@ -33,14 +29,12 @@ export class FeatureFlagWatcher {
   private watcher: FSWatcher | null = null;
   private debounceTimer: ReturnType<typeof setTimeout> | null = null;
   private localFlagFilename: string;
-  private remoteFlagFilename: string;
   /** Accumulates which files changed during the debounce window. */
   private pendingFilenames = new Set<string>();
   private onChanged?: () => void;
 
   constructor(options?: FeatureFlagWatcherOptions) {
     this.localFlagFilename = basename(getFeatureFlagStorePath());
-    this.remoteFlagFilename = basename(getRemoteFeatureFlagStorePath());
     this.onChanged = options?.onChanged;
   }
 
@@ -55,11 +49,7 @@ export class FeatureFlagWatcher {
 
     try {
       this.watcher = watch(dir, { persistent: false }, (_event, filename) => {
-        if (
-          filename &&
-          filename !== this.localFlagFilename &&
-          filename !== this.remoteFlagFilename
-        ) {
+        if (filename && filename !== this.localFlagFilename) {
           return;
         }
         this.scheduleInvalidation(filename ?? undefined);
@@ -105,9 +95,6 @@ export class FeatureFlagWatcher {
       if (filenames.has(this.localFlagFilename)) {
         clearFeatureFlagStoreCache();
       }
-      if (filenames.has(this.remoteFlagFilename)) {
-        refreshRemoteFeatureFlagStoreCache();
-      }
       log.info(
         { filenames: [...filenames] },
         "Feature flag cache invalidated due to file change",

package/src/guardian-integrity-reporter.ts

@@ -2,46 +2,28 @@
 // lost its guardian rows while carrying evidence of prior onboarding
 // (`gateway_guardian_missing`, see auth/guardian-integrity.ts) and a refused
 // cadet-guardian mint (`gateway_guardian_mint_refused`, see
-// auth/guardian-bootstrap.ts). Emits an error-level log and relays a watchdog
-// telemetry event to the daemon's internal telemetry route, which POSTs it
-// directly to platform ingest — bypassing any state owned by the broken trust
-// path so the alarm cannot suppress itself. Rate-limited per check_name per
-// process; a lost event is acceptable for a rare, high-signal check (no
-// retry). Scaffolding: watchdog-reporter.ts.
+// auth/guardian-bootstrap.ts). Emits an error-level log, rate-limited per
+// check per process (both states are sticky until repair, so every verdict
+// or mint attempt would otherwise re-fire them).
 
 import { getLogger } from "./logger.js";
-import { createWatchdogReporter } from "./watchdog-reporter.js";
 
-/**
- * Watchdog `check_name` for the missing-guardian integrity failure. Platform
- * dashboards filter on this exact string — it is the cross-repo contract.
- */
-export const GUARDIAN_MISSING_CHECK_NAME = "gateway_guardian_missing";
+const log = getLogger("guardian-integrity-reporter");
 
-/**
- * Watchdog `check_name` for a refused cadet-guardian mint (evidence of a
- * prior guardian, no active cadet binding). Fires even when the integrity
- * state is `ok` — a guardian contact row can be intact while the cadet
- * binding is lost/inactive, and clients see `guardian_repair_required` 401s.
- */
-export const GUARDIAN_MINT_REFUSED_CHECK_NAME = "gateway_guardian_mint_refused";
+// At most one report per check per hour per process.
+const REPORT_INTERVAL_MS = 60 * 60 * 1000;
 
-const reporter = createWatchdogReporter({
-  log: getLogger("guardian-integrity-reporter"),
-  relayFailedMessage: "guardian-integrity telemetry relay failed (non-fatal)",
-  relayRejectedMessage:
-    "guardian-integrity telemetry relay rejected (non-fatal)",
-});
+const lastReportAtByKey = new Map<string, number>();
 
 /**
- * Report the missing-guardian state: error log + telemetry relay. Fires on
- * the first detection per process and at most hourly thereafter (the state is
+ * Report the missing-guardian state: a rate-limited error log. Fires on the
+ * first detection per process and at most hourly thereafter (the state is
  * sticky until the guardian is re-seeded, so every verdict would otherwise
  * re-fire it). Fire-and-forget — never throws, never blocks the caller.
  */
 export function reportMissingGuardian(detail: Record<string, unknown>): void {
   report(
-    GUARDIAN_MISSING_CHECK_NAME,
+    "gateway_guardian_missing",
     "gateway DB has no guardian rows but evidence of prior onboarding — " +
       "trust verdicts will fail closed until the guardian is re-seeded",
     detail,
@@ -49,9 +31,9 @@ export function reportMissingGuardian(detail: Record<string, unknown>): void {
 }
 
 /**
- * Report a refused cadet-guardian mint: error log + telemetry relay. Same
+ * Report a refused cadet-guardian mint: a rate-limited error log. Same
  * per-check rate limiting and fire-and-forget semantics as
- * {@link reportMissingGuardian}; the sibling check_name distinguishes the
+ * {@link reportMissingGuardian}; the sibling check distinguishes the
  * cadet-binding-lost-but-contact-intact refusal, which the missing-guardian
  * state check cannot see.
  */
@@ -59,7 +41,7 @@ export function reportGuardianMintRefused(
   detail: Record<string, unknown>,
 ): void {
   report(
-    GUARDIAN_MINT_REFUSED_CHECK_NAME,
+    "gateway_guardian_mint_refused",
     "refused to mint a cadet guardian principal over evidence of a prior " +
       "guardian — clients get guardian_repair_required until re-pair",
     detail,
@@ -67,23 +49,13 @@ export function reportGuardianMintRefused(
 }
 
 function report(
-  checkName: string,
+  check: string,
   message: string,
   detail: Record<string, unknown>,
 ): void {
-  reporter.report({
-    key: checkName,
-    checkName,
-    message,
-    detail,
-    warnContext: { checkName },
-  });
+  const now = Date.now();
+  const last = lastReportAtByKey.get(check) ?? Number.NEGATIVE_INFINITY;
+  if (now - last < REPORT_INTERVAL_MS) return;
+  lastReportAtByKey.set(check, now);
+  log.error({ check, ...detail }, message);
 }
-
-/** Test-only seams; see {@link createWatchdogReporter}. */
-export const setGuardianIntegrityReporterOverridesForTesting =
-  reporter.setOverridesForTesting;
-export const resetGuardianIntegrityReporterForTesting =
-  reporter.resetForTesting;
-export const flushGuardianIntegrityReporterForTesting =
-  reporter.flushForTesting;

package/src/http/middleware/auth.ts

@@ -1,6 +1,9 @@
 import type { Server } from "bun";
 
-import { admitActorToken } from "../../auth/actor-token-revocation.js";
+import {
+  admitActorToken,
+  type AdmittedActorTokenRecord,
+} from "../../auth/actor-token-revocation.js";
 import { findCadetGuardian } from "../../auth/guardian-bootstrap.js";
 import {
   isNarrowScopeProfile,
@@ -9,9 +12,9 @@ import {
 import { parseSub } from "../../auth/subject.js";
 import { validateEdgeToken } from "../../auth/token-exchange.js";
 import type { Scope, TokenClaims } from "../../auth/types.js";
-import { AuthFallbackCountTracker } from "../../auth-fallback-count-tracker.js";
 import { AuthFallbackLogThrottle } from "../../auth-fallback-log-throttle.js";
 import type { AuthRateLimiter } from "../../auth-rate-limiter.js";
+import { getIsCloud } from "../../cloud-url.js";
 import { getLogger } from "../../logger.js";
 import { readStoredCloudUserId } from "../../cloud-user-id.js";
 import { isLoopbackPeer } from "../../util/is-loopback-address.js";
@@ -25,12 +28,6 @@ const log = getLogger("auth");
 // per request, so this state can't live in its closure.
 const loopbackFallbackLogThrottle = new AuthFallbackLogThrottle();
 
-// Exact, unthrottled count of every loopback fallback, keyed by
-// (guard, path, failureKind). Drained and shipped to the daemon telemetry route
-// by AuthFallbackReporter. Process-lifetime singleton for the same reason as the
-// throttle above; exported so the reporter and tests share the one instance.
-export const loopbackFallbackCountTracker = new AuthFallbackCountTracker();
-
 type GetClientIp = () => string;
 
 // ---------------------------------------------------------------------------
@@ -51,18 +48,12 @@ export function isHttpAuthDisabled(): boolean {
   return process.env.DISABLE_HTTP_AUTH?.trim().toLowerCase() === "true";
 }
 
-/** True when IS_CLOUD is set (vembda-managed deployment). */
-function isPlatformManaged(): boolean {
-  const v = process.env.IS_CLOUD?.trim();
-  return v === "1" || v?.toLowerCase() === "true";
-}
-
 /**
  * True when the cloud-managed auth bypass is in effect — both flags set.
  * Either alone leaves JWT validation in place.
  */
-function isCloudAuthBypassActive(): boolean {
-  return isHttpAuthDisabled() && isPlatformManaged();
+export function isCloudAuthBypassActive(): boolean {
+  return isHttpAuthDisabled() && getIsCloud();
 }
 
 /**
@@ -73,7 +64,7 @@ export function logAuthBypassState(): void {
   if (!isHttpAuthDisabled()) {
     return;
   }
-  if (isPlatformManaged()) {
+  if (getIsCloud()) {
     log.info(
       "DISABLE_HTTP_AUTH + IS_CLOUD both set: JWT validation bypassed; " +
         "X-Cadet-User-Id is cross-checked against the bound platform user id",
@@ -87,6 +78,23 @@ export function logAuthBypassState(): void {
   }
 }
 
+/**
+ * The actor-token row the auth layer already loaded by the request bearer's
+ * hash while admitting it (see admitActorToken), keyed by request so routes
+ * can reuse the row instead of re-querying the same token hash.
+ */
+const admittedActorTokenRecords = new WeakMap<
+  Request,
+  AdmittedActorTokenRecord
+>();
+
+/** The admitted actor-token row for this request, when edge auth loaded one. */
+export function admittedActorTokenRecord(
+  req: Request,
+): AdmittedActorTokenRecord | undefined {
+  return admittedActorTokenRecords.get(req);
+}
+
 /**
  * Build edge-auth guard functions that share a rate limiter and IP resolver.
  *
@@ -415,7 +423,11 @@ export function createAuthMiddleware(
     token: string,
     claims: TokenClaims,
   ): Response | null {
-    if (!admitActorToken(token, claims)) {
+    const admission = admitActorToken(token, claims);
+    if (admission.record) {
+      admittedActorTokenRecords.set(req, admission.record);
+    }
+    if (!admission.admitted) {
       authRateLimiter.recordFailure(getClientIp());
       log.warn(
         { path: new URL(req.url).pathname },
@@ -443,17 +455,11 @@ export function createAuthMiddleware(
     if (!server || !isLoopbackPeer(server, req, { trustProxy })) return false;
 
     const path = new URL(req.url).pathname;
-    const failureKind =
-      typeof extra?.authFailure === "string"
-        ? extra.authFailure
-        : "unspecified";
-
-    // Count every fallback (unthrottled) for telemetry. The throttle below only
-    // governs log volume — it must not gate the count, or the data undercounts.
-    loopbackFallbackCountTracker.increment(guard, path, failureKind);
 
     if (
-      loopbackFallbackLogThrottle.shouldLog(`${guard} ${path} ${failureKind}`)
+      loopbackFallbackLogThrottle.shouldLog(
+        `${guard} ${path} ${typeof extra?.authFailure === "string" ? extra.authFailure : "unspecified"}`,
+      )
     ) {
       const peer = server.requestIP(req);
       log.warn(

package/src/http/routes/auth-token.ts

@@ -156,7 +156,7 @@ export async function handleCreateToken(
   // Don't let a revoked token re-mint a fresh one — that would be an escape
   // hatch around device revocation, since the source token still verifies by
   // signature until it expires.
-  if (!admitActorToken(bearerToken, verifyResult.claims)) {
+  if (!admitActorToken(bearerToken, verifyResult.claims).admitted) {
     log.warn("Token create rejected: source token revoked");
     return Response.json({ error: "Unauthorized" }, { status: 401 });
   }

package/src/http/routes/devices-mine.ts

@@ -0,0 +1,103 @@
+import { and, eq, max } from "drizzle-orm";
+
+import { actorTokenRecordHash } from "../../auth/actor-token-revocation.js";
+import { getGatewayDb } from "../../db/connection.js";
+import { actorTokenRecords } from "../../db/schema.js";
+import { errorResponse } from "../loopback-guard.js";
+import {
+  admittedActorTokenRecord,
+  isCloudAuthBypassActive,
+} from "../middleware/auth.js";
+
+/**
+ * `GET /v1/devices/mine` — the caller's own paired-device row.
+ *
+ * Deliberately browser-reachable (no loopback guard, no origin rejection):
+ * the bearer IS the credential, and the route answers only for the token
+ * presenting it. This is how the paired web UI surfaces "this device" so
+ * its row can be matched against the host-side `cadet devices` list — the
+ * gateway stores nothing but the hashed device id, so the hash is the only
+ * matchable identity either side can name. The projection mirrors
+ * `/v1/devices` exactly (including the cross-status `max(lastUsedAt)`, since
+ * a rotation leaves the newest activity stamp on the revoked row), so a
+ * `devices/mine` response matches the same device's row in the list output
+ * field for field.
+ */
+export async function handleGetMyDevice(req: Request): Promise<Response> {
+  if (req.method !== "GET") {
+    return new Response("method not allowed", {
+      status: 405,
+      headers: { Allow: "GET" },
+    });
+  }
+
+  // Cloud-hosted assistants have no paired-device rows to name — the route
+  // only answers for self-hosted gateways.
+  if (isCloudAuthBypassActive()) {
+    return errorResponse(
+      "NOT_AVAILABLE_ON_CLOUD",
+      "this assistant is cloud-hosted — it has no paired-device rows",
+      404,
+    );
+  }
+
+  const authorization = req.headers.get("authorization") ?? "";
+  const bearer = authorization.startsWith("Bearer ")
+    ? authorization.slice("Bearer ".length).trim()
+    : "";
+
+  const db = getGatewayDb();
+  // Edge auth already loaded this row by the bearer's hash while admitting
+  // the token (admitActorToken) — reuse it when present. The fallback query
+  // covers paths where admission produced no row (fail-open on a DB error,
+  // or the handler driven directly in tests).
+  const row =
+    admittedActorTokenRecord(req) ??
+    db
+      .select({
+        guardianPrincipalId: actorTokenRecords.guardianPrincipalId,
+        hashedDeviceId: actorTokenRecords.hashedDeviceId,
+        platform: actorTokenRecords.platform,
+        pairingUserAgent: actorTokenRecords.pairingUserAgent,
+        clientReportedName: actorTokenRecords.clientReportedName,
+        issuedAt: actorTokenRecords.issuedAt,
+        expiresAt: actorTokenRecords.expiresAt,
+      })
+      .from(actorTokenRecords)
+      .where(eq(actorTokenRecords.tokenHash, actorTokenRecordHash(bearer)))
+      .get();
+
+  if (!row) {
+    return errorResponse(
+      "DEVICE_NOT_FOUND",
+      "no paired device row for this token",
+      404,
+    );
+  }
+
+  const lastUsed = db
+    .select({ lastUsedAt: max(actorTokenRecords.lastUsedAt) })
+    .from(actorTokenRecords)
+    .where(
+      and(
+        eq(actorTokenRecords.hashedDeviceId, row.hashedDeviceId),
+        eq(actorTokenRecords.guardianPrincipalId, row.guardianPrincipalId),
+      ),
+    )
+    .get();
+
+  return Response.json(
+    {
+      device: {
+        hashedDeviceId: row.hashedDeviceId,
+        platform: row.platform,
+        pairingUserAgent: row.pairingUserAgent ?? null,
+        clientReportedName: row.clientReportedName ?? null,
+        issuedAt: row.issuedAt,
+        expiresAt: row.expiresAt ?? null,
+        lastUsedAt: lastUsed?.lastUsedAt ?? null,
+      },
+    },
+    { headers: { "Cache-Control": "no-store" } },
+  );
+}

package/src/http/routes/feature-flags.ts

@@ -5,7 +5,6 @@ import {
   isFlagDeclared,
 } from "../../feature-flag-defaults.js";
 import { readEnvFeatureFlagOverrides } from "../../feature-flag-env-overrides.js";
-import { readRemoteFeatureFlags } from "../../feature-flag-remote-store.js";
 import {
   readPersistedFeatureFlags,
   writeFeatureFlag,
@@ -81,19 +80,13 @@ export function createFeatureFlagsGetHandler() {
     try {
       const defaults = loadFeatureFlagDefaults();
       const persisted = readPersistedFeatureFlags();
-      const remote = readRemoteFeatureFlags();
       const envOverrides = readEnvFeatureFlagOverrides();
 
       const entries: FeatureFlagEntry[] = [];
       for (const [key, def] of Object.entries(defaults)) {
         const persistedValue = persisted[key];
-        const remoteValue = remote[key];
         const base =
-          persistedValue !== undefined
-            ? persistedValue
-            : remoteValue !== undefined
-              ? remoteValue
-              : def.defaultEnabled;
+          persistedValue !== undefined ? persistedValue : def.defaultEnabled;
         const envValue = envOverrides[key];
         entries.push({
           key,