@delali/sirannon-db 0.3.4-next.62 → 0.3.4

package/dist/server/index.mjs

@@ -1,22 +1,22 @@
-import { restoreBackup, MAX_RESTORE_BATCH_SIZE } from '../chunk-E7Q7HE46.mjs';
-import { tablesInFkOrder, dumpSchema, dumpTablePages } from '../chunk-QP5L5DFJ.mjs';
-import { ChangeTracker, SubscriptionManager, ensureCdcEpoch, migrationChecksum, needsResync, filteredChange, TransactionGrouper, isBulkLoadDurability, PrimedSubscription } from '../chunk-M2BEAH5I.mjs';
-import '../chunk-YNTDOFTN.mjs';
-import { SEQ_STRING_RE, highestMigrationVersion, selectCountTableRows, selectTableExists, selectAppliedMigrations, PkResolver, ensureDeviceCursorsTable, upsertDeviceCursor, selectMaxChangeSeq, canonicaliseForChecksum, selectDeviceCursors, selectMinForeignChangeSeqSql, IDENTIFIER_RE, deleteDeviceCursorsUpdatedBefore } from '../chunk-45MKELYA.mjs';
-import '../chunk-2QLXDHAP.mjs';
-import { encodeTaggedValues, MIGRATIONS_TABLE, decodeTaggedValues, encodeWireRowsInPlace, CHANGES_TABLE, DEVICE_CURSORS_TABLE, INTERNAL_TABLE_PREFIX } from '../chunk-6CMCO7S4.mjs';
-import { createOperationSource, operationRegistryDigest, findRead, isRefusal, resolveArguments, findWrite } from '../chunk-TUD5CJ76.mjs';
+import { restoreBackup, MAX_RESTORE_BATCH_SIZE } from '../chunk-3BZLZ47R.mjs';
+import { tablesInFkOrder, dumpSchema, dumpTablePages } from '../chunk-FJPR2CJX.mjs';
+import { optionalDependencyError } from '../chunk-WOMADPM4.mjs';
+import { resolveDeviceRetentionPolicy, ChangeTracker, SubscriptionManager, ensureCdcEpoch, migrationChecksum, applyDeviceCursorBoundary, needsResync, filteredChange, TransactionGrouper, isBulkLoadDurability, PrimedSubscription } from '../chunk-ZN4HI5FK.mjs';
+import '../chunk-YW7IKQ7T.mjs';
+import { SEQ_STRING_RE, highestMigrationVersion, selectCountTableRows, selectTableExists, selectAppliedMigrations, PkResolver, ensureDeviceCursorsTable, upsertDeviceCursor, HLC, selectMaxChangeSeq, canonicaliseForChecksum, IDENTIFIER_RE } from '../chunk-ESTZZPT5.mjs';
+import '../chunk-BLMRNSUG.mjs';
+import { encodeTaggedValues, MIGRATIONS_TABLE, decodeTaggedValues, encodeWireRowsInPlace, CHANGES_TABLE, INTERNAL_TABLE_PREFIX } from '../chunk-2O3PP4CF.mjs';
+import { createOperationSource, operationRegistryDigest, findRead, isRefusal, resolveArguments, findWrite } from '../chunk-KB4OLJAD.mjs';
 import '../chunk-GVCNMPOS.mjs';
-import { discardStagedChain } from '../chunk-KDAHYFW7.mjs';
-import '../chunk-U445A3C4.mjs';
-import '../chunk-E6IMX7RS.mjs';
-import '../chunk-GYCEJNU4.mjs';
-import '../chunk-OUSWVNWT.mjs';
-import '../chunk-YVF2ZJTE.mjs';
+import { discardStagedChain } from '../chunk-6AOJCNRU.mjs';
+import '../chunk-QGVRRKB2.mjs';
+import '../chunk-KJLNYOOL.mjs';
+import '../chunk-R7GBXNTO.mjs';
+import '../chunk-YCMB6GR4.mjs';
+import '../chunk-CZL4D3BM.mjs';
 import '../chunk-QBBLSQHQ.mjs';
-import { SQLITE_USER_VERSION_MAX } from '../chunk-IWGIYDMZ.mjs';
-import { SirannonError, WriteOverloadError } from '../chunk-PBRXXISQ.mjs';
-import uWS from 'uWebSockets.js';
+import { SQLITE_USER_VERSION_MAX } from '../chunk-BZWDPF4G.mjs';
+import { SirannonError, WriteOverloadError } from '../chunk-KINDFBQP.mjs';
 import { createHash } from 'crypto';
 
 // src/server/protocol.ts
@@ -148,11 +148,11 @@ function describeFailure(err) {
 var BackupRestoreRuns = class {
   runs = /* @__PURE__ */ new Map();
   /**
-   * Marks a restore of one database as under way, unless one is already running.
+   * Marks a restore of one database as started, unless another restore of it is in progress.
    *
-   * @param databaseId - Identifier of the database being rebuilt.
-   * @param moment - Epoch milliseconds the caller asked to be taken back to.
-   * @returns True where this call claimed the database, false where a restore already has it.
+   * @param databaseId - The identifier of the database that the server rebuilds.
+   * @param moment - The moment, in epoch milliseconds, that the caller asked to restore to.
+   * @returns True when this call claims the database, and false when another restore of it is in progress.
    */
   claim(databaseId, moment) {
     if (this.runs.get(databaseId)?.state === "running") return false;
@@ -160,9 +160,9 @@ var BackupRestoreRuns = class {
     return true;
   }
   /**
-   * Records how far the restore of one database has got.
+   * Records the progress of one database's restore.
    *
-   * @param databaseId - Identifier of the database being rebuilt.
+   * @param databaseId - The identifier of the database that the server is rebuilding.
    * @param progress - Pieces fetched, bytes fetched, and change pieces replayed.
    */
   progressed(databaseId, progress) {
@@ -172,13 +172,14 @@ var BackupRestoreRuns = class {
   /**
    * Records a restore that rebuilt the database.
    *
-   * A reopen that failed is reported beside the report, and the state stays
-   * `done`, because Sirannon replaced the data either way and an operator shown
-   * only the failure would believe their database untouched.
+   * When the database fails to open again, this method records that error beside
+   * the report and keeps the state `done`, because Sirannon replaced the data
+   * either way, and an operator who saw only the failure could believe that the
+   * data was unchanged.
    *
-   * @param databaseId - Identifier of the database that was rebuilt.
-   * @param report - What the restore produced.
-   * @param reopenFailure - What stopped the database opening again, where anything did.
+   * @param databaseId - The identifier of the rebuilt database.
+   * @param report - The restore's report.
+   * @param reopenFailure - The error that stopped the database from opening again, if there was one.
    */
   finished(databaseId, report, reopenFailure) {
     this.runs.set(databaseId, {
@@ -191,15 +192,15 @@ var BackupRestoreRuns = class {
     });
   }
   /**
-   * Records a restore that stopped, under the code it stopped with.
+   * Records a failed restore under the code of the error that stopped it.
    *
-   * Only a `SirannonError` passes its message through. Anything else reports
-   * the same sentence the HTTP layer sends for an unexpected failure, since a
-   * runtime error names the paths and the internals of the machine serving the
-   * request.
+   * The record keeps the message of a `SirannonError` only. For any other error,
+   * it stores the message that the HTTP layer sends for an unexpected failure,
+   * because a runtime error can include file paths and other internal details of
+   * the server's machine.
    *
-   * @param databaseId - Identifier of the database it was rebuilding.
-   * @param err - What stopped it.
+   * @param databaseId - The identifier of the database that the server was rebuilding.
+   * @param err - The error that stopped the restore.
    */
   failed(databaseId, err) {
     const previous = this.runs.get(databaseId);
@@ -212,10 +213,10 @@ var BackupRestoreRuns = class {
     });
   }
   /**
-   * Reads where one database's restore stands.
+   * Returns the status of one database's restore.
    *
-   * @param databaseId - Identifier of the database to report on.
-   * @returns The restore, or an idle answer where none has run.
+   * @param databaseId - The identifier of the database.
+   * @returns The restore's status, or an `idle` status when no restore has started.
    */
   read(databaseId) {
     return this.runs.get(databaseId) ?? { state: "idle" };
@@ -224,6 +225,8 @@ var BackupRestoreRuns = class {
 
 // src/server/http-common.ts
 var SQL_NOT_ACCEPTED_MESSAGE = "This server does not accept SQL statements over the wire; call a registered operation by name";
+var TABLE_SUBSCRIPTION_NOT_ACCEPTED_MESSAGE = "This server keeps table subscriptions off; subscribe to a registered read by name, or give the server acceptSql: true or an onBeforeSubscribe hook";
+var DEVICE_SYNC_NOT_ACCEPTED_MESSAGE = "This server keeps device sync off; the server has to set acceptDeviceSync before a device can sync";
 function initAbortHandler(res) {
   const listeners = [];
   let aborted = false;
@@ -428,7 +431,7 @@ var SERVER_CAPABILITIES = [...REQUIRED_DEVICE_SYNC_CAPABILITIES, STAGED_STREAM_C
 var NAMED_QUERY_CAPABILITY = "query.named";
 var SQL_QUERY_CAPABILITY = "query.sql";
 function buildCapabilitiesResponse(options) {
-  const capabilities = [...SERVER_CAPABILITIES];
+  const capabilities = options?.acceptDeviceSync === true ? [...SERVER_CAPABILITIES] : [];
   if (options?.registryDigest !== void 0) capabilities.push(NAMED_QUERY_CAPABILITY);
   if (options?.acceptSql === true) capabilities.push(SQL_QUERY_CAPABILITY);
   const response = { capabilities };
@@ -472,6 +475,408 @@ function writeCorsOrigin(res, cors, requestOrigin) {
   }
 }
 
+// src/server/wire-rows.ts
+async function queryWireRows(target, sql, params, options) {
+  if (target.queryForWire) {
+    return target.queryForWire(sql, params, options);
+  }
+  return encodeTaggedValues(await target.query(sql, params, options));
+}
+
+// src/server/http-handler.ts
+function decodeBatchParams(res, raw) {
+  const decoded = [];
+  for (const entry of raw) {
+    const result = decodeBoundParams(entry, "paramsBatch");
+    if (!result.ok) {
+      sendError(res, 400, "INVALID_REQUEST", result.message);
+      return null;
+    }
+    decoded.push(result.value);
+  }
+  return decoded;
+}
+function handleQuery(sirannon, resolveTarget) {
+  return async (res, dbId, rawBody, abort) => {
+    const body = parseBody(res, rawBody);
+    if (!body) return;
+    if (!body.sql || typeof body.sql !== "string") {
+      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
+      return;
+    }
+    const readConcern = parseReadConcern(res, body.readConcern);
+    if (!readConcern.ok) return;
+    const params = decodeBoundParams(body.params, "params");
+    if (!params.ok) {
+      sendError(res, 400, "INVALID_REQUEST", params.message);
+      return;
+    }
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
+    if (!target) return;
+    try {
+      const rows = await queryWireRows(
+        target,
+        body.sql,
+        params.value,
+        readConcern.value ? { readConcern: readConcern.value } : void 0
+      );
+      if (abort.aborted) return;
+      sendJson(res, { rows });
+    } catch (err) {
+      sendCaughtError(res, abort, err);
+    }
+  };
+}
+function handleExecute(sirannon, resolveTarget) {
+  return async (res, dbId, rawBody, abort) => {
+    const body = parseBody(res, rawBody);
+    if (!body) return;
+    if (!body.sql || typeof body.sql !== "string") {
+      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
+      return;
+    }
+    const writeConcern = parseWriteConcern(res, body.writeConcern);
+    if (!writeConcern.ok) return;
+    const params = decodeBoundParams(body.params, "params");
+    if (!params.ok) {
+      sendError(res, 400, "INVALID_REQUEST", params.message);
+      return;
+    }
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
+    if (!target) return;
+    try {
+      const result = await target.execute(
+        body.sql,
+        params.value,
+        writeConcern.value ? { writeConcern: writeConcern.value } : void 0
+      );
+      if (abort.aborted) return;
+      sendJson(res, toExecuteResponse(result));
+    } catch (err) {
+      sendCaughtError(res, abort, err);
+    }
+  };
+}
+function handleTransaction(sirannon, resolveTarget) {
+  return async (res, dbId, rawBody, abort) => {
+    const body = parseBody(res, rawBody);
+    if (!body) return;
+    const statementsError = transactionStatementsValidationError(body.statements);
+    if (statementsError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", statementsError);
+      return;
+    }
+    const writeConcern = parseWriteConcern(res, body.writeConcern);
+    if (!writeConcern.ok) return;
+    const statements = [];
+    for (const stmt of body.statements) {
+      const params = decodeBoundParams(stmt.params, "params");
+      if (!params.ok) {
+        sendError(res, 400, "INVALID_REQUEST", params.message);
+        return;
+      }
+      statements.push({ sql: stmt.sql, params: params.value });
+    }
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
+    if (!target) return;
+    const txOptions = writeConcern.value ? { writeConcern: writeConcern.value } : void 0;
+    try {
+      const results = target.executeTransaction ? await target.executeTransaction(statements, txOptions) : await target.transaction(async (tx) => {
+        const txResults = [];
+        for (const stmt of statements) {
+          txResults.push(await tx.execute(stmt.sql, stmt.params));
+        }
+        return txResults;
+      }, txOptions);
+      if (abort.aborted) return;
+      sendJson(res, {
+        results: results.map(toExecuteResponse)
+      });
+    } catch (err) {
+      sendCaughtError(res, abort, err);
+    }
+  };
+}
+function handleBatch(sirannon, resolveTarget) {
+  return async (res, dbId, rawBody, abort) => {
+    const body = parseBody(res, rawBody);
+    if (!body) return;
+    if (!body.sql || typeof body.sql !== "string") {
+      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
+      return;
+    }
+    const paramsBatchError = paramsBatchValidationError(body.paramsBatch);
+    if (paramsBatchError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", paramsBatchError);
+      return;
+    }
+    const writeConcern = parseWriteConcern(res, body.writeConcern);
+    if (!writeConcern.ok) return;
+    const paramsBatch = decodeBatchParams(res, body.paramsBatch);
+    if (paramsBatch === null) return;
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
+    if (!target) return;
+    try {
+      const results = await target.transaction(
+        async (tx) => tx.executeBatch(body.sql, paramsBatch),
+        writeConcern.value ? { writeConcern: writeConcern.value } : void 0
+      );
+      if (abort.aborted) return;
+      sendJson(res, {
+        results: results.map(toExecuteResponse)
+      });
+    } catch (err) {
+      sendCaughtError(res, abort, err);
+    }
+  };
+}
+function handleLoad(sirannon, resolveTarget) {
+  return async (res, dbId, rawBody, abort) => {
+    const body = parseBody(res, rawBody);
+    if (!body) return;
+    if (!body.sql || typeof body.sql !== "string") {
+      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
+      return;
+    }
+    const paramsBatchError = paramsBatchValidationError(body.paramsBatch);
+    if (paramsBatchError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", paramsBatchError);
+      return;
+    }
+    const durabilityError = loadDurabilityValidationError(body.durability);
+    if (durabilityError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", durabilityError);
+      return;
+    }
+    const checkpointError = loadCheckpointValidationError(body.checkpoint);
+    if (checkpointError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", checkpointError);
+      return;
+    }
+    const paramsBatch = decodeBatchParams(res, body.paramsBatch);
+    if (paramsBatch === null) return;
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
+    if (!target) return;
+    const bulkLoad = target.bulkLoad;
+    if (typeof bulkLoad !== "function") {
+      sendError(res, 501, "BULK_LOAD_UNSUPPORTED", "The execution target for this database does not support bulk load");
+      return;
+    }
+    try {
+      const summary = await bulkLoad.call(target, body.sql, paramsBatch, toBulkLoadOptions(body));
+      if (abort.aborted) return;
+      sendJson(res, summary);
+    } catch (err) {
+      sendCaughtError(res, abort, err);
+    }
+  };
+}
+function sendClusterUnavailable(res, dbId) {
+  sendError(res, 404, "NOT_FOUND", `Cluster status is not available for database '${dbId}'`);
+}
+function handleClusterStatus(getClusterStatus, authorizeClusterStatus) {
+  return async (res, dbId, ctx, abort) => {
+    if (!getClusterStatus || !authorizeClusterStatus) {
+      sendClusterUnavailable(res, dbId);
+      return;
+    }
+    let allowed;
+    try {
+      allowed = await authorizeClusterStatus(ctx);
+    } catch {
+      if (abort.aborted) return;
+      sendError(res, 500, "HOOK_ERROR", "authorizeClusterStatus threw an error");
+      return;
+    }
+    if (abort.aborted) return;
+    if (!allowed) {
+      sendClusterUnavailable(res, dbId);
+      return;
+    }
+    const status = getClusterStatus(dbId);
+    if (!status) {
+      sendError(res, 404, "DATABASE_NOT_FOUND", `Database '${dbId}' not found`);
+      return;
+    }
+    sendJson(res, toClusterStatusResponse(status));
+  };
+}
+function toClusterStatusResponse(status) {
+  return {
+    ...status,
+    currentPrimary: status.currentPrimary ? { ...status.currentPrimary } : status.currentPrimary,
+    readEndpoints: status.readEndpoints?.map((endpoint) => ({
+      ...endpoint,
+      readConcerns: [...endpoint.readConcerns]
+    })),
+    primaryTerm: status.primaryTerm?.toString()
+  };
+}
+
+// src/core/ws-handshake.ts
+var SIRANNON_WS_SUBPROTOCOL = "sirannon.v1";
+var WS_CLOSE_UNAUTHENTICATED = 4401;
+var WS_CLOSE_FORBIDDEN = 4403;
+function selectSubprotocol(header) {
+  const offered = header.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  if (offered.length === 0) return { ok: true, protocol: "" };
+  if (offered.includes(SIRANNON_WS_SUBPROTOCOL)) return { ok: true, protocol: SIRANNON_WS_SUBPROTOCOL };
+  return { ok: false };
+}
+
+// src/server/request-hook.ts
+function decodeRemoteAddress(res) {
+  return Buffer.from(res.getRemoteAddressAsText()).toString();
+}
+var CLOSE_REASON_MAX_BYTES = 123;
+var RETURNED_REFUSAL_MESSAGE = "The authenticate hook returned a refusal object rather than an identity. A hook refuses a request by throwing a SirannonError; every value it returns becomes the caller identity.";
+function looksLikeRefusal(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return typeof candidate.status === "number" && typeof candidate.code === "string" && typeof candidate.message === "string";
+}
+async function invokeAuthenticate(ctx, hook) {
+  try {
+    const identity = await hook(ctx);
+    if (looksLikeRefusal(identity)) return { status: "returned-refusal" };
+    return { status: "identity", identity };
+  } catch (error) {
+    return { status: "threw", error };
+  }
+}
+function sendRefusal(res, abort, outcome) {
+  if (!abort.claim()) return;
+  if (outcome.status === "returned-refusal") {
+    sendError(res, 500, "HOOK_ERROR", RETURNED_REFUSAL_MESSAGE);
+    return;
+  }
+  if (outcome.status === "threw" && outcome.error instanceof SirannonError) {
+    sendCaughtError(res, abort, outcome.error);
+    return;
+  }
+  sendError(res, 500, "HOOK_ERROR", "authenticate hook threw an error");
+}
+function truncateCloseReason(reason) {
+  if (Buffer.byteLength(reason, "utf-8") <= CLOSE_REASON_MAX_BYTES) return reason;
+  let truncated = reason.slice(0, CLOSE_REASON_MAX_BYTES);
+  while (truncated.length > 0 && Buffer.byteLength(truncated, "utf-8") > CLOSE_REASON_MAX_BYTES) {
+    truncated = truncated.slice(0, -1);
+  }
+  return truncated;
+}
+function upgradeRefusalFor(error) {
+  if (!(error instanceof SirannonError)) return void 0;
+  const status = httpStatusForError(error);
+  if (status !== 401 && status !== 403) return void 0;
+  return {
+    code: status === 403 ? WS_CLOSE_FORBIDDEN : WS_CLOSE_UNAUTHENTICATED,
+    reason: truncateCloseReason(`${error.code}: ${error.message}`)
+  };
+}
+async function runAuthenticate(res, abort, ctx, hook) {
+  const outcome = await invokeAuthenticate(ctx, hook);
+  if (outcome.status === "identity") return { ok: true, identity: outcome.identity };
+  sendRefusal(res, abort, outcome);
+  return { ok: false };
+}
+async function authenticateUpgrade(res, abort, ctx, hook) {
+  const outcome = await invokeAuthenticate(ctx, hook);
+  if (outcome.status === "identity") return { ok: true, identity: outcome.identity };
+  if (outcome.status === "threw") {
+    const refusal = upgradeRefusalFor(outcome.error);
+    if (refusal) return { ok: false, refusal };
+  }
+  sendRefusal(res, abort, outcome);
+  return { ok: false, refusal: void 0 };
+}
+
+// src/server/db-route.ts
+function readHeaders(req) {
+  const headers = {};
+  req.forEach((key, value) => {
+    headers[key] = value;
+  });
+  return headers;
+}
+function wrapDbRoute(deps, handler) {
+  const { authenticateHook, cors, maxBodyBytes } = deps;
+  return (res, req) => {
+    const dbId = req.getParameter(0) ?? "";
+    const method = req.getMethod();
+    const path = req.getUrl();
+    if (cors) {
+      writeCorsOrigin(res, cors, req.getHeader("origin"));
+    }
+    const abort = initAbortHandler(res);
+    const bodyPromise = readBody(res, maxBodyBytes, abort);
+    if (!authenticateHook) {
+      bodyPromise.then(async (rawBody) => {
+        if (!abort.claim()) return;
+        try {
+          await handler(res, dbId, rawBody, abort, void 0);
+        } catch {
+          if (!abort.aborted) {
+            sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
+          }
+        }
+      }).catch(() => {
+      });
+      return;
+    }
+    const ctx = {
+      headers: readHeaders(req),
+      method,
+      path,
+      databaseId: dbId,
+      remoteAddress: decodeRemoteAddress(res)
+    };
+    const hookPromise = runAuthenticate(res, abort, ctx, authenticateHook);
+    Promise.all([bodyPromise, hookPromise]).then(async ([rawBody, authenticated]) => {
+      if (!authenticated.ok || !abort.claim()) return;
+      try {
+        await handler(res, dbId, rawBody, abort, authenticated.identity);
+      } catch {
+        if (!abort.aborted) {
+          sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
+        }
+      }
+    }).catch(() => {
+    });
+  };
+}
+function wrapDbGetRoute(deps, handler) {
+  const { authenticateHook, cors } = deps;
+  return (res, req) => {
+    const dbId = req.getParameter(0) ?? "";
+    const method = req.getMethod();
+    const path = req.getUrl();
+    if (cors) {
+      writeCorsOrigin(res, cors, req.getHeader("origin"));
+    }
+    const ctx = {
+      headers: readHeaders(req),
+      method,
+      path,
+      databaseId: dbId,
+      remoteAddress: decodeRemoteAddress(res)
+    };
+    const abort = initAbortHandler(res);
+    const run = async () => {
+      if (authenticateHook && !(await runAuthenticate(res, abort, ctx, authenticateHook)).ok) return;
+      if (!abort.claim()) return;
+      try {
+        await handler(res, dbId, ctx, abort);
+      } catch {
+        if (!abort.aborted) {
+          sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
+        }
+      }
+    };
+    run().catch(() => {
+    });
+  };
+}
+
 // src/server/health.ts
 function handleLiveness() {
   const payload = JSON.stringify({ status: "ok" });
@@ -881,204 +1286,49 @@ function toChangesResponse(result) {
   return { applied: result.applied, skipped: result.skipped, conflicts: result.conflicts };
 }
 
-// src/server/wire-rows.ts
-async function queryWireRows(target, sql, params, options) {
-  if (target.queryForWire) {
-    return target.queryForWire(sql, params, options);
-  }
-  return encodeTaggedValues(await target.query(sql, params, options));
-}
-
-// src/server/http-handler.ts
-function decodeBatchParams(res, raw) {
-  const decoded = [];
-  for (const entry of raw) {
-    const result = decodeBoundParams(entry, "paramsBatch");
-    if (!result.ok) {
-      sendError(res, 400, "INVALID_REQUEST", result.message);
-      return null;
-    }
-    decoded.push(result.value);
-  }
-  return decoded;
-}
-function handleQuery(sirannon, resolveTarget) {
-  return async (res, dbId, rawBody, abort) => {
-    const body = parseBody(res, rawBody);
-    if (!body) return;
-    if (!body.sql || typeof body.sql !== "string") {
-      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
-      return;
-    }
-    const readConcern = parseReadConcern(res, body.readConcern);
-    if (!readConcern.ok) return;
-    const params = decodeBoundParams(body.params, "params");
-    if (!params.ok) {
-      sendError(res, 400, "INVALID_REQUEST", params.message);
-      return;
-    }
-    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
-    if (!target) return;
-    try {
-      const rows = await queryWireRows(
-        target,
-        body.sql,
-        params.value,
-        readConcern.value ? { readConcern: readConcern.value } : void 0
-      );
-      if (abort.aborted) return;
-      sendJson(res, { rows });
-    } catch (err) {
-      sendCaughtError(res, abort, err);
-    }
-  };
-}
-function handleExecute(sirannon, resolveTarget) {
-  return async (res, dbId, rawBody, abort) => {
-    const body = parseBody(res, rawBody);
-    if (!body) return;
-    if (!body.sql || typeof body.sql !== "string") {
-      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
-      return;
-    }
-    const writeConcern = parseWriteConcern(res, body.writeConcern);
-    if (!writeConcern.ok) return;
-    const params = decodeBoundParams(body.params, "params");
-    if (!params.ok) {
-      sendError(res, 400, "INVALID_REQUEST", params.message);
-      return;
-    }
-    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
-    if (!target) return;
+// src/server/http-changes.ts
+var MAX_DEVICE_CLOCK_AHEAD_MS = 3e5;
+function changeClockRefusal(batch, nowMs) {
+  for (const [index, change] of batch.changes.entries()) {
+    let wallMs;
     try {
-      const result = await target.execute(
-        body.sql,
-        params.value,
-        writeConcern.value ? { writeConcern: writeConcern.value } : void 0
-      );
-      if (abort.aborted) return;
-      sendJson(res, toExecuteResponse(result));
-    } catch (err) {
-      sendCaughtError(res, abort, err);
-    }
-  };
-}
-function handleTransaction(sirannon, resolveTarget) {
-  return async (res, dbId, rawBody, abort) => {
-    const body = parseBody(res, rawBody);
-    if (!body) return;
-    const statementsError = transactionStatementsValidationError(body.statements);
-    if (statementsError !== null) {
-      sendError(res, 400, "INVALID_REQUEST", statementsError);
-      return;
+      wallMs = HLC.decode(change.hlc).wallMs;
+    } catch {
+      wallMs = Number.NaN;
     }
-    const writeConcern = parseWriteConcern(res, body.writeConcern);
-    if (!writeConcern.ok) return;
-    const statements = [];
-    for (const stmt of body.statements) {
-      const params = decodeBoundParams(stmt.params, "params");
-      if (!params.ok) {
-        sendError(res, 400, "INVALID_REQUEST", params.message);
-        return;
-      }
-      statements.push({ sql: stmt.sql, params: params.value });
+    if (!Number.isFinite(wallMs)) {
+      return { code: "INVALID_REQUEST", message: `changes[${index}].hlc is not a valid timestamp` };
     }
-    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
-    if (!target) return;
-    const txOptions = writeConcern.value ? { writeConcern: writeConcern.value } : void 0;
-    try {
-      const results = target.executeTransaction ? await target.executeTransaction(statements, txOptions) : await target.transaction(async (tx) => {
-        const txResults = [];
-        for (const stmt of statements) {
-          txResults.push(await tx.execute(stmt.sql, stmt.params));
-        }
-        return txResults;
-      }, txOptions);
-      if (abort.aborted) return;
-      sendJson(res, {
-        results: results.map(toExecuteResponse)
-      });
-    } catch (err) {
-      sendCaughtError(res, abort, err);
+    if (wallMs > nowMs + MAX_DEVICE_CLOCK_AHEAD_MS) {
+      return {
+        code: "DEVICE_CLOCK_AHEAD",
+        message: `changes[${index}] is stamped more than ${MAX_DEVICE_CLOCK_AHEAD_MS} ms ahead of the server clock; correct the device clock`
+      };
     }
-  };
+  }
+  return null;
 }
-function handleBatch(sirannon, resolveTarget) {
-  return async (res, dbId, rawBody, abort) => {
-    const body = parseBody(res, rawBody);
-    if (!body) return;
-    if (!body.sql || typeof body.sql !== "string") {
-      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
-      return;
-    }
-    const paramsBatchError = paramsBatchValidationError(body.paramsBatch);
-    if (paramsBatchError !== null) {
-      sendError(res, 400, "INVALID_REQUEST", paramsBatchError);
-      return;
-    }
-    const writeConcern = parseWriteConcern(res, body.writeConcern);
-    if (!writeConcern.ok) return;
-    const paramsBatch = decodeBatchParams(res, body.paramsBatch);
-    if (paramsBatch === null) return;
-    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
-    if (!target) return;
-    try {
-      const results = await target.transaction(
-        async (tx) => tx.executeBatch(body.sql, paramsBatch),
-        writeConcern.value ? { writeConcern: writeConcern.value } : void 0
-      );
-      if (abort.aborted) return;
-      sendJson(res, {
-        results: results.map(toExecuteResponse)
-      });
-    } catch (err) {
-      sendCaughtError(res, abort, err);
-    }
-  };
+async function refuseUngrantedPush(sirannon, databaseId, batch, identity) {
+  if (!sirannon.hookRegistry.has("beforePush")) return;
+  const tables = new Set(batch.changes.map((change) => change.table));
+  for (const table of tables) {
+    const ctx = { databaseId, table, deviceId: batch.sourceNodeId, identity };
+    await sirannon.hookRegistry.invoke("beforePush", ctx);
+  }
 }
-function handleLoad(sirannon, resolveTarget) {
-  return async (res, dbId, rawBody, abort) => {
-    const body = parseBody(res, rawBody);
-    if (!body) return;
-    if (!body.sql || typeof body.sql !== "string") {
-      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
-      return;
-    }
-    const paramsBatchError = paramsBatchValidationError(body.paramsBatch);
-    if (paramsBatchError !== null) {
-      sendError(res, 400, "INVALID_REQUEST", paramsBatchError);
-      return;
-    }
-    const durabilityError = loadDurabilityValidationError(body.durability);
-    if (durabilityError !== null) {
-      sendError(res, 400, "INVALID_REQUEST", durabilityError);
-      return;
-    }
-    const checkpointError = loadCheckpointValidationError(body.checkpoint);
-    if (checkpointError !== null) {
-      sendError(res, 400, "INVALID_REQUEST", checkpointError);
-      return;
-    }
-    const paramsBatch = decodeBatchParams(res, body.paramsBatch);
-    if (paramsBatch === null) return;
-    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
-    if (!target) return;
-    const bulkLoad = target.bulkLoad;
-    if (typeof bulkLoad !== "function") {
-      sendError(res, 501, "BULK_LOAD_UNSUPPORTED", "The execution target for this database does not support bulk load");
-      return;
-    }
-    try {
-      const summary = await bulkLoad.call(target, body.sql, paramsBatch, toBulkLoadOptions(body));
-      if (abort.aborted) return;
-      sendJson(res, summary);
-    } catch (err) {
-      sendCaughtError(res, abort, err);
-    }
-  };
+async function refuseSchemaMismatch(res, abort, target, deviceVersion) {
+  const appliedMigrations = target.appliedMigrations;
+  if (typeof appliedMigrations !== "function") return false;
+  const serverVersion = highestMigrationVersion(await appliedMigrations.call(target));
+  const refusal = schemaVersionGateRefusal(deviceVersion, serverVersion);
+  if (refusal === null) return false;
+  if (!abort.aborted) {
+    sendError(res, 409, refusal.code, refusal.message, { serverVersion });
+  }
+  return true;
 }
 function handleChanges(sirannon, resolveTarget) {
-  return async (res, dbId, rawBody, abort) => {
+  return async (res, dbId, rawBody, abort, identity) => {
     const body = parseBody(res, rawBody);
     if (!body) return;
     const batchError = syncBatchValidationError(body.batch);
@@ -1093,33 +1343,26 @@ function handleChanges(sirannon, resolveTarget) {
     }
     const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
     if (!target) return;
-    const appliedMigrations = target.appliedMigrations;
-    if (typeof appliedMigrations === "function") {
-      try {
-        const serverVersion = highestMigrationVersion(await appliedMigrations.call(target));
-        const refusal = schemaVersionGateRefusal(body.schemaVersion ?? 0, serverVersion);
-        if (refusal !== null) {
-          if (abort.aborted) return;
-          sendError(res, 409, refusal.code, refusal.message, { serverVersion });
-          return;
-        }
-      } catch (err) {
-        sendCaughtError(res, abort, err);
+    try {
+      const batch = decodeSyncBatch(body.batch);
+      await refuseUngrantedPush(sirannon, dbId, batch, identity);
+      const clockRefusal = changeClockRefusal(batch, Date.now());
+      if (clockRefusal !== null) {
+        sendError(res, 400, clockRefusal.code, clockRefusal.message);
         return;
       }
-    }
-    const applyChanges = target.applyChanges;
-    if (typeof applyChanges !== "function") {
-      sendError(
-        res,
-        501,
-        "SYNC_UNSUPPORTED",
-        "The execution target for this database does not support applying sync changes"
-      );
-      return;
-    }
-    try {
-      const result = await applyChanges.call(target, decodeSyncBatch(body.batch));
+      if (await refuseSchemaMismatch(res, abort, target, body.schemaVersion ?? 0)) return;
+      const applyChanges = target.applyChanges;
+      if (typeof applyChanges !== "function") {
+        sendError(
+          res,
+          501,
+          "SYNC_UNSUPPORTED",
+          "The execution target for this database does not support applying sync changes"
+        );
+        return;
+      }
+      const result = await applyChanges.call(target, batch);
       if (abort.aborted) return;
       sendJson(res, toChangesResponse(result));
     } catch (err) {
@@ -1127,47 +1370,6 @@ function handleChanges(sirannon, resolveTarget) {
     }
   };
 }
-function sendClusterUnavailable(res, dbId) {
-  sendError(res, 404, "NOT_FOUND", `Cluster status is not available for database '${dbId}'`);
-}
-function handleClusterStatus(getClusterStatus, authorizeClusterStatus) {
-  return async (res, dbId, ctx, abort) => {
-    if (!getClusterStatus || !authorizeClusterStatus) {
-      sendClusterUnavailable(res, dbId);
-      return;
-    }
-    let allowed;
-    try {
-      allowed = await authorizeClusterStatus(ctx);
-    } catch {
-      if (abort.aborted) return;
-      sendError(res, 500, "HOOK_ERROR", "authorizeClusterStatus threw an error");
-      return;
-    }
-    if (abort.aborted) return;
-    if (!allowed) {
-      sendClusterUnavailable(res, dbId);
-      return;
-    }
-    const status = getClusterStatus(dbId);
-    if (!status) {
-      sendError(res, 404, "DATABASE_NOT_FOUND", `Database '${dbId}' not found`);
-      return;
-    }
-    sendJson(res, toClusterStatusResponse(status));
-  };
-}
-function toClusterStatusResponse(status) {
-  return {
-    ...status,
-    currentPrimary: status.currentPrimary ? { ...status.currentPrimary } : status.currentPrimary,
-    readEndpoints: status.readEndpoints?.map((endpoint) => ({
-      ...endpoint,
-      readConcerns: [...endpoint.readConcerns]
-    })),
-    primaryTerm: status.primaryTerm?.toString()
-  };
-}
 
 // src/server/http-migrations.ts
 function handleMigrationList(sirannon) {
@@ -1232,9 +1434,9 @@ function decodeArguments(res, raw) {
   }
   return decoded.value ?? {};
 }
-function handleOperationQuery(sirannon, registry, resolveTarget) {
+function handleOperationQuery(sirannon, sets, resolveTarget) {
   return async (res, dbId, name, identity, rawBody, abort) => {
-    const operation = findRead(registry, dbId, name);
+    const operation = findRead(sets, dbId, name);
     if (isRefusal(operation)) {
       sendError(res, operation.status, operation.code, operation.message);
       return;
@@ -1273,9 +1475,9 @@ function handleOperationQuery(sirannon, registry, resolveTarget) {
     }
   };
 }
-function handleOperationExecute(sirannon, registry, resolveTarget) {
+function handleOperationExecute(sirannon, sets, resolveTarget) {
   return async (res, dbId, name, identity, rawBody, abort) => {
-    const operation = findWrite(registry, dbId, name);
+    const operation = findWrite(sets, dbId, name);
     if (isRefusal(operation)) {
       sendError(res, operation.status, operation.code, operation.message);
       return;
@@ -1514,6 +1716,14 @@ function assertBackupRestoreAuthenticated(acceptBackupRestore, hasAuthenticate)
     );
   }
 }
+function assertDeviceSyncAuthenticated(acceptDeviceSync, hasAuthenticate) {
+  if (acceptDeviceSync && !hasAuthenticate) {
+    throw new SirannonError(
+      "ServerOptions.acceptDeviceSync opens a route that writes rows into every table of a database, so it needs an authenticate hook to name the caller",
+      "INVALID_DEVICE_SYNC"
+    );
+  }
+}
 function resolveMaxBodyBytes(value) {
   if (value === void 0) return DEFAULT_MAX_BODY_BYTES;
   if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
@@ -1553,83 +1763,6 @@ function resolveWsBackpressure(value, maxBodyBytes) {
   return resolved;
 }
 
-// src/core/ws-handshake.ts
-var SIRANNON_WS_SUBPROTOCOL = "sirannon.v1";
-var WS_CLOSE_UNAUTHENTICATED = 4401;
-var WS_CLOSE_FORBIDDEN = 4403;
-function selectSubprotocol(header) {
-  const offered = header.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
-  if (offered.length === 0) return { ok: true, protocol: "" };
-  if (offered.includes(SIRANNON_WS_SUBPROTOCOL)) return { ok: true, protocol: SIRANNON_WS_SUBPROTOCOL };
-  return { ok: false };
-}
-
-// src/server/request-hook.ts
-function decodeRemoteAddress(res) {
-  return Buffer.from(res.getRemoteAddressAsText()).toString();
-}
-var CLOSE_REASON_MAX_BYTES = 123;
-var RETURNED_REFUSAL_MESSAGE = "The authenticate hook returned a refusal object rather than an identity. A hook refuses a request by throwing a SirannonError; every value it returns becomes the caller identity.";
-function looksLikeRefusal(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const candidate = value;
-  return typeof candidate.status === "number" && typeof candidate.code === "string" && typeof candidate.message === "string";
-}
-async function invokeAuthenticate(ctx, hook) {
-  try {
-    const identity = await hook(ctx);
-    if (looksLikeRefusal(identity)) return { status: "returned-refusal" };
-    return { status: "identity", identity };
-  } catch (error) {
-    return { status: "threw", error };
-  }
-}
-function sendRefusal(res, abort, outcome) {
-  if (!abort.claim()) return;
-  if (outcome.status === "returned-refusal") {
-    sendError(res, 500, "HOOK_ERROR", RETURNED_REFUSAL_MESSAGE);
-    return;
-  }
-  if (outcome.status === "threw" && outcome.error instanceof SirannonError) {
-    sendCaughtError(res, abort, outcome.error);
-    return;
-  }
-  sendError(res, 500, "HOOK_ERROR", "authenticate hook threw an error");
-}
-function truncateCloseReason(reason) {
-  if (Buffer.byteLength(reason, "utf-8") <= CLOSE_REASON_MAX_BYTES) return reason;
-  let truncated = reason.slice(0, CLOSE_REASON_MAX_BYTES);
-  while (truncated.length > 0 && Buffer.byteLength(truncated, "utf-8") > CLOSE_REASON_MAX_BYTES) {
-    truncated = truncated.slice(0, -1);
-  }
-  return truncated;
-}
-function upgradeRefusalFor(error) {
-  if (!(error instanceof SirannonError)) return void 0;
-  const status = httpStatusForError(error);
-  if (status !== 401 && status !== 403) return void 0;
-  return {
-    code: status === 403 ? WS_CLOSE_FORBIDDEN : WS_CLOSE_UNAUTHENTICATED,
-    reason: truncateCloseReason(`${error.code}: ${error.message}`)
-  };
-}
-async function runAuthenticate(res, abort, ctx, hook) {
-  const outcome = await invokeAuthenticate(ctx, hook);
-  if (outcome.status === "identity") return { ok: true, identity: outcome.identity };
-  sendRefusal(res, abort, outcome);
-  return { ok: false };
-}
-async function authenticateUpgrade(res, abort, ctx, hook) {
-  const outcome = await invokeAuthenticate(ctx, hook);
-  if (outcome.status === "identity") return { ok: true, identity: outcome.identity };
-  if (outcome.status === "threw") {
-    const refusal = upgradeRefusalFor(outcome.error);
-    if (refusal) return { ok: false, refusal };
-  }
-  sendRefusal(res, abort, outcome);
-  return { ok: false, refusal: void 0 };
-}
-
 // src/server/operation-route.ts
 function decodePathSegment(value) {
   try {
@@ -1685,37 +1818,33 @@ function wrapOperationRoute(deps, handler) {
   };
 }
 
+// src/server/uws-loader.ts
+var UWEBSOCKETS_DEPENDENCY = {
+  packageName: "uWebSockets.js",
+  neededBy: "The Sirannon server",
+  installCommand: 'pnpm add -E "uWebSockets.js@github:uNetworking/uWebSockets.js#v20.69.0"',
+  code: "SERVER_DEPENDENCY_MISSING"
+};
+async function loadUWebSockets() {
+  try {
+    return await import('uWebSockets.js');
+  } catch (err) {
+    throw optionalDependencyError(UWEBSOCKETS_DEPENDENCY, err);
+  }
+}
+
 // src/server/device-cursors.ts
-var DEFAULT_DEVICE_CURSOR_RETENTION_MS = 30 * 24 * 36e5;
 async function upsertDeviceAck(conn, deviceId, seq) {
   await ensureDeviceCursorsTable(conn);
   await upsertDeviceCursor(conn, deviceId, seq, Date.now() / 1e3);
 }
-function evictStaleDeviceCursors(conn, retentionMs) {
-  return deleteDeviceCursorsUpdatedBefore(conn, Date.now() / 1e3 - retentionMs / 1e3);
-}
-async function effectiveMinDeviceCursor(conn, retentionMs, changesTable = CHANGES_TABLE) {
-  if (!await selectTableExists(conn, DEVICE_CURSORS_TABLE)) return null;
-  await evictStaleDeviceCursors(conn, retentionMs);
-  const cursors = await selectDeviceCursors(conn);
-  if (cursors.length === 0) return null;
-  const nextForeignStmt = await conn.prepare(selectMinForeignChangeSeqSql(changesTable));
-  const maxSeq = await selectMaxChangeSeq(conn, changesTable);
-  let min = null;
-  for (const cursor of cursors) {
-    const acked = cursor.ackedSeq;
-    const foreignRow = await nextForeignStmt.get(acked.toString(), cursor.deviceId);
-    const nextForeign = foreignRow?.seq === null || foreignRow?.seq === void 0 ? null : BigInt(foreignRow.seq);
-    const effective = nextForeign === null ? maxSeq : nextForeign - 1n;
-    if (min === null || effective < min) {
-      min = effective;
-    }
-  }
-  return min;
-}
 
 // src/server/ws-ack.ts
 async function handleAckMessage(deps, conn, state, msg, id) {
+  if (!deps.acceptDeviceSync) {
+    deps.sendError(conn, id, "DEVICE_SYNC_NOT_ACCEPTED", DEVICE_SYNC_NOT_ACCEPTED_MESSAGE);
+    return;
+  }
   if (!isValidDeviceId(msg.deviceId)) {
     deps.sendError(conn, id, "INVALID_MESSAGE", '"deviceId" must be a 32-hex device id');
     return;
@@ -1725,13 +1854,21 @@ async function handleAckMessage(deps, conn, state, msg, id) {
     return;
   }
   const deviceId = msg.deviceId;
+  const streams = [...state.deviceStreams.values()].filter((stream) => stream.deviceId === deviceId);
+  if (streams.length === 0) {
+    deps.sendError(
+      conn,
+      id,
+      "DEVICE_NOT_SUBSCRIBED",
+      "An acknowledgement names a device this connection holds no subscription for"
+    );
+    return;
+  }
   const seq = BigInt(msg.seq);
   try {
     await state.database.runCdcMaintenance((writer) => upsertDeviceAck(writer, deviceId, seq));
-    for (const stream of state.deviceStreams.values()) {
-      if (stream.deviceId === deviceId) {
-        stream.onAck(seq);
-      }
+    for (const stream of streams) {
+      stream.onAck(seq);
     }
     deps.sendResult(conn, id, { acked: true, seq: seq.toString() });
   } catch (err) {
@@ -1742,17 +1879,24 @@ async function handleAckMessage(deps, conn, state, msg, id) {
 // src/server/ws-cdc.ts
 var DEFAULT_POLL_INTERVAL_MS = 50;
 var CLEANUP_INTERVAL_TICKS = 100;
+function toChangeRetentionOptions(options) {
+  return {
+    ...options?.cdcRetentionMs === void 0 ? {} : { cdcRetention: options.cdcRetentionMs },
+    ...options?.deviceCursorRetentionMs === void 0 ? {} : { deviceCursorRetention: options.deviceCursorRetentionMs },
+    ...options?.maxChangesHeldForDevice === void 0 ? {} : { maxChangesHeldForDevice: options.maxChangesHeldForDevice }
+  };
+}
 var CdcContextRegistry = class {
   sirannon;
   retentionMs;
-  deviceCursorRetentionMs;
+  serverDeviceRetention;
   contexts = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   closed = false;
-  constructor(sirannon, retentionMs, deviceCursorRetentionMs) {
+  constructor(sirannon, serverRetention = {}) {
     this.sirannon = sirannon;
-    this.retentionMs = retentionMs;
-    this.deviceCursorRetentionMs = deviceCursorRetentionMs ?? DEFAULT_DEVICE_CURSOR_RETENTION_MS;
+    this.retentionMs = serverRetention.cdcRetention;
+    this.serverDeviceRetention = serverRetention;
   }
   async ensure(databaseId, database) {
     const existing = this.contexts.get(databaseId);
@@ -1800,8 +1944,10 @@ var CdcContextRegistry = class {
   }
   async createContext(database) {
     const cdcConn = await this.sirannon.driver.open(database.path, { walMode: true });
-    const tracker = new ChangeTracker(this.retentionMs === void 0 ? void 0 : { retention: this.retentionMs });
-    const manager = new SubscriptionManager();
+    const retention = database.changeRetention.cdcRetention ?? this.retentionMs;
+    const deviceRetention = resolveDeviceRetentionPolicy(database.changeRetention, this.serverDeviceRetention);
+    const tracker = new ChangeTracker(retention === void 0 ? void 0 : { retention });
+    const manager = new SubscriptionManager(this.sirannon.metrics?.observeDispatch(database.id));
     let epoch = "";
     try {
       await tracker.advanceToLatest(cdcConn);
@@ -1840,12 +1986,7 @@ var CdcContextRegistry = class {
         if (tickCount >= CLEANUP_INTERVAL_TICKS) {
           tickCount = 0;
           await database.runCdcMaintenance(async (writer) => {
-            const minCursor = await effectiveMinDeviceCursor(writer, this.deviceCursorRetentionMs);
-            if (minCursor === null) {
-              tracker.clearPruneBoundary();
-            } else {
-              tracker.setPruneBoundary(minCursor);
-            }
+            await applyDeviceCursorBoundary(writer, tracker, deviceRetention);
             await tracker.cleanup(writer);
           }).catch(() => {
           });
@@ -2015,14 +2156,15 @@ var DeviceChangeStream = class {
     this.deps.packer?.clear();
   }
   /**
-   * Moves a socket that stopped writing on its own. uWebSockets holds the
-   * remainder of a partial write until the next write on that socket and
-   * reports no drain in the meantime, so a stream that has queued everything
-   * it has would leave the last changes sitting there. A small buffered count
-   * that has not moved since the previous poll is that state, and a control
-   * frame carries the remainder out. A socket holding enough to count as
-   * congested is draining under its own flow control and takes nothing extra,
-   * because another frame there would cross the backpressure limit.
+   * Sends a ping on a socket whose buffered bytes have stopped flushing.
+   * uWebSockets keeps the rest of a partial write queued until the next write
+   * on that socket and fires no drain event in the meantime, so the last
+   * changes of a stream with nothing more to send could stay in the buffer.
+   * When the buffered count is above zero, unchanged since the previous poll
+   * batch, and below the congestion threshold, this method sends a ping so that
+   * uWebSockets flushes the rest. It skips a congested socket, because that
+   * socket drains under its own flow control and one more frame could push it
+   * past the backpressure limit.
    */
   nudgeStalledSocket() {
     const buffered = this.deps.socketBuffered();
@@ -2067,25 +2209,24 @@ var DeviceChangeStream = class {
     return true;
   }
   /**
-   * Waits for the socket only while it holds enough to be worth waiting for.
-   * uWebSockets reports `buffered` for a send it could not finish in one go,
-   * including one that queued a few hundred bytes of a frame it otherwise
-   * sent, and it notifies a drain only when the socket becomes writable
-   * again. A stream that parked on the outcome alone would wait on a small
-   * remainder that the next send would have flushed, and the wake-up would
-   * never come.
+   * Makes the stream wait for a drain event only while the socket is congested.
+   * uWebSockets reports `buffered` for any send that it cannot finish at once,
+   * including one that leaves only a few hundred bytes of a frame queued, and
+   * it fires a drain event only when the socket becomes writable again. If the
+   * stream waited on every `buffered` outcome, it could wait on a small
+   * remainder for a drain event that never fires.
    */
   parkOnSocket() {
     this.socketWait = this.deps.socketCongested();
   }
   /**
-   * Abandons the in-flight stream state and falls back to the change log.
-   * The grouper's held event was never queued and its seq is above both
-   * watermarks, so dropping it loses nothing. The catch-up read resumes
-   * after the last position fully settled: `highestQueuedSeq` is the last
-   * event that reached the socket, and `processedSeq` may run further ahead
-   * of it over a span whose every event was suppressed, so a long run of
-   * the device's own echoes is not re-read on every pause.
+   * Discards the in-flight stream state and switches to reading the change log.
+   * The event that the grouper holds back is still unqueued, and its seq is
+   * above both watermarks, so discarding it loses no change. The catch-up read
+   * starts after the later of two positions. `highestQueuedSeq` is the last
+   * event that the stream queued on the socket, and `processedSeq` can be further
+   * ahead when the transform suppresses every event after that one, so the
+   * stream skips a long sequence of the device's own echoes on every pause.
    */
   enterCatchup() {
     const flushed = this.deps.packer?.flush() ?? "queued";
@@ -2106,10 +2247,10 @@ var DeviceChangeStream = class {
     }
   }
   /**
-   * Starts the catch-up read, or records that one is owed when a read is
-   * already running. A read that hands back the stream mid-pass, because the
-   * socket reported backpressure it no longer holds, would otherwise leave
-   * the stream in catch-up with nothing scheduled to resume it.
+   * Starts the catch-up read, or sets a flag for another read when one is
+   * already in progress. Without the flag, a read that stops partway because
+   * of backpressure that clears before the read ends could leave the stream in
+   * catch-up mode with no read scheduled to resume it.
    */
   requestDrain() {
     if (this.draining) {
@@ -2119,24 +2260,25 @@ var DeviceChangeStream = class {
     void this.drain();
   }
   /**
-   * A closed window stops the catch-up read only where the window may pace
-   * the stream: anywhere under `perEvent` pacing, and at a transaction
-   * boundary under `perTransaction` pacing. Mid-transaction the read keeps
-   * going, because a `perTransaction` device acknowledges only applied
-   * whole transactions, and holding the rest of an open transaction back
-   * would wait for an acknowledgement that can never arrive.
+   * Returns true when the catch-up read must pause for a full delivery window,
+   * which happens at any event under `perEvent` pacing and only at a
+   * transaction boundary under `perTransaction` pacing. A `perTransaction`
+   * device acknowledges only whole transactions that it has applied, so if
+   * the stream held back the rest of an open transaction, it would wait for
+   * an acknowledgement that the device never sends.
    */
   readGateClosed() {
     if (!this.windowClosed()) return false;
     return this.deps.pacing === "perEvent" || !this.midTransaction;
   }
   /**
-   * Sizes the next catch-up read from what the socket accepted this time.
-   * A read that ends at a full socket discards everything past the event
-   * that stopped it, so a device on a congested link would otherwise decode
-   * the same rows on every pause. Doubling the accepted count keeps a
-   * caught-up device reading whole batches while a paced one reads close to
-   * what it can send.
+   * Sets the size of the next catch-up read to twice the number of events that
+   * the stream offered from the last read, between 32 and 1,000. When a read stops
+   * at a full socket, the stream discards every event after the one where it
+   * stopped, so with a larger fixed batch the server would decode the same rows again on
+   * every pause for a device on a congested link. Doubling the count gives a
+   * caught-up device full batches and a paced device batches close to the
+   * number of events that its socket accepts.
    */
   resizeCatchupBatch(accepted) {
     const doubled = accepted * 2;
@@ -2209,11 +2351,12 @@ var DeviceChangeStream = class {
     }
   }
   /**
-   * Rejoins the live feed. Runs synchronously right after a log read so that no
-   * poller tick can dispatch between the caught-up check and the mode flip.
-   * The grouper survives the transition: the event it holds is released by
-   * the boundary flush when the poller stopped at a transaction boundary,
-   * exactly as a resuming ordinary subscription does.
+   * Switches the stream back to the live feed. This method is synchronous and
+   * follows a log read directly, so that no poller tick can dispatch events
+   * between the caught-up check and the switch to `live` mode. The stream keeps its grouper across the switch,
+   * and when the poller's last batch ends at a transaction boundary, the
+   * boundary flush releases the event that the grouper holds, as it does for
+   * an ordinary subscription that resumes.
    */
   goLive() {
     this.mode = "live";
@@ -2697,6 +2840,14 @@ async function subscribeDevice(deps, conn, state, request) {
 // src/server/ws-subscribe.ts
 var MAX_SUBSCRIBED_TABLES = 500;
 async function handleSubscribeMessage(deps, conn, state, msg, id) {
+  if (msg.deviceId !== void 0 && !deps.acceptDeviceSync) {
+    deps.sendError(conn, id, "DEVICE_SYNC_NOT_ACCEPTED", DEVICE_SYNC_NOT_ACCEPTED_MESSAGE);
+    return;
+  }
+  if (msg.deviceId === void 0 && !deps.acceptSql && !deps.hasSubscribeHook()) {
+    deps.sendError(conn, id, "SQL_NOT_ACCEPTED", TABLE_SUBSCRIPTION_NOT_ACCEPTED_MESSAGE);
+    return;
+  }
   const tables = readTableSet(msg);
   if (typeof tables === "string") {
     deps.sendError(conn, id, "INVALID_MESSAGE", tables);
@@ -2763,7 +2914,13 @@ async function handleSubscribeMessage(deps, conn, state, msg, id) {
   if (deps.hasSubscribeHook()) {
     for (const table2 of tables) {
       try {
-        await deps.beforeSubscribe({ databaseId: state.databaseId, table: table2, filter, identity: state.identity });
+        await deps.beforeSubscribe({
+          databaseId: state.databaseId,
+          table: table2,
+          filter,
+          identity: state.identity,
+          deviceId
+        });
       } catch (err) {
         deps.sendSirannonError(conn, id, err);
         return;
@@ -2944,17 +3101,19 @@ var WSHandler = class {
   maxUnacknowledgedChanges;
   socketResumeBytes;
   acceptSql;
+  acceptDeviceSync;
   operations;
   closed = false;
   constructor(sirannon, options) {
     this.sirannon = sirannon;
     this.acceptSql = options?.acceptSql === true;
-    this.operations = createOperationSource(options?.operations);
+    this.acceptDeviceSync = options?.acceptDeviceSync === true;
+    this.operations = createOperationSource(options?.operations, options?.sharedOperations);
     this.maxPayloadLength = options?.maxPayloadLength ?? DEFAULT_MAX_PAYLOAD_LENGTH;
     this.maxUnacknowledgedChanges = options?.maxUnacknowledgedChanges ?? DEFAULT_MAX_UNACKNOWLEDGED_CHANGES;
     this.socketResumeBytes = Math.ceil((options?.maxBackpressureBytes ?? DEFAULT_MAX_BACKPRESSURE_BYTES) / 2);
     this.resolveExecutionTarget = options?.resolveExecutionTarget;
-    this.cdc = new CdcContextRegistry(sirannon, options?.cdcRetentionMs, options?.deviceCursorRetentionMs);
+    this.cdc = new CdcContextRegistry(sirannon, toChangeRetentionOptions(options));
   }
   async handleOpen(conn, databaseId, identity) {
     if (this.closed) {
@@ -2997,9 +3156,9 @@ var WSHandler = class {
     });
   }
   /**
-   * Tears down a connection whose outbound buffer overflowed. Closing lets the
-   * client reject in-flight requests and reconnect; guarding on `overloaded`
-   * keeps a burst of dropped frames from repeatedly re-closing the socket.
+   * Closes a connection after the server drops a frame on it at the backpressure limit,
+   * so the client can reject its pending requests and reconnect. The `overloaded` flag
+   * makes the handler close the socket once, however many frames the server drops in a burst.
    */
   handleOverload(conn) {
     const state = this.connections.get(conn);
@@ -3137,6 +3296,8 @@ var WSHandler = class {
   subscribeDeps() {
     return {
       cdc: this.cdc,
+      acceptSql: this.acceptSql,
+      acceptDeviceSync: this.acceptDeviceSync,
       maxUnacknowledgedChanges: this.maxUnacknowledgedChanges,
       socketResumeBytes: this.socketResumeBytes,
       hasSubscribeHook: () => this.sirannon.hookRegistry.has("beforeSubscribe"),
@@ -3359,11 +3520,21 @@ function registerWebSocketRoute(options) {
 
 // src/server/server.ts
 var SQL_ROUTES = ["/db/:id/query", "/db/:id/execute", "/db/:id/transaction", "/db/:id/batch", "/db/:id/load"];
+var DEVICE_SYNC_ROUTES = [
+  "/db/:id/changes",
+  "/db/:id/migrations",
+  "/db/:id/snapshot",
+  "/db/:id/snapshot/page"
+];
 function refuseSql(res) {
   sendError(res, 403, "SQL_NOT_ACCEPTED", SQL_NOT_ACCEPTED_MESSAGE);
 }
+function refuseDeviceSync(res) {
+  sendError(res, 403, "DEVICE_SYNC_NOT_ACCEPTED", DEVICE_SYNC_NOT_ACCEPTED_MESSAGE);
+}
 var SirannonServer = class {
-  app;
+  runtime = null;
+  runtimeLoad = null;
   listenSocket = null;
   host;
   port;
@@ -3371,6 +3542,7 @@ var SirannonServer = class {
   authenticateHook;
   acceptSql;
   acceptBackupRestore;
+  acceptDeviceSync;
   restoreRuns = new BackupRestoreRuns();
   operations;
   registryDigest;
@@ -3391,8 +3563,10 @@ var SirannonServer = class {
     this.acceptSql = options?.acceptSql === true;
     this.acceptBackupRestore = options?.acceptBackupRestore === true;
     assertBackupRestoreAuthenticated(this.acceptBackupRestore, this.authenticateHook !== void 0);
-    this.operations = options?.operations;
-    this.registryDigest = operationRegistryDigest(options?.operations);
+    this.acceptDeviceSync = options?.acceptDeviceSync === true;
+    assertDeviceSyncAuthenticated(this.acceptDeviceSync, this.authenticateHook !== void 0);
+    this.operations = { registry: options?.operations, shared: options?.sharedOperations };
+    this.registryDigest = operationRegistryDigest(this.operations.registry, this.operations.shared);
     this.resolveExecutionTarget = options?.resolveExecutionTarget;
     this.getReplicationStatus = options?.getReplicationStatus;
     this.getClusterStatus = options?.getClusterStatus;
@@ -3405,21 +3579,24 @@ var SirannonServer = class {
       maxBackpressureBytes: this.maxWsBackpressureBytes,
       cdcRetentionMs: options?.cdcRetentionMs,
       deviceCursorRetentionMs: options?.deviceCursorRetentionMs,
+      maxChangesHeldForDevice: options?.maxChangesHeldForDevice,
       maxUnacknowledgedChanges: options?.maxUnacknowledgedChanges,
       acceptSql: this.acceptSql,
-      operations: options?.operations
+      acceptDeviceSync: this.acceptDeviceSync,
+      operations: this.operations.registry,
+      sharedOperations: this.operations.shared
     });
-    this.app = uWS.App();
-    this.registerRoutes();
   }
   /**
-   * Binds the configured host and port and starts serving.
+   * Loads uWebSockets.js and starts serving on the configured host and port.
    *
-   * @throws When the port is already in use.
+   * @throws A `SirannonError` with code `SERVER_DEPENDENCY_MISSING` when this process cannot load uWebSockets.js.
+   * @throws An `Error` when uWebSockets.js cannot listen on the host and port, for example because the port is already in use.
    */
-  listen() {
-    return new Promise((resolve, reject) => {
-      this.app.listen(this.host, this.port, (socket) => {
+  async listen() {
+    const { app } = await this.loadRuntime();
+    await new Promise((resolve, reject) => {
+      app.listen(this.host, this.port, (socket) => {
         if (socket) {
           this.listenSocket = socket;
           resolve();
@@ -3430,29 +3607,47 @@ var SirannonServer = class {
     });
   }
   /**
-   * Stops serving and closes every open connection.
+   * Stops listening for new connections and closes every open WebSocket connection.
    */
   async close() {
     try {
       await this.wsHandler.close();
     } finally {
-      if (this.listenSocket) {
-        uWS.us_listen_socket_close(this.listenSocket);
+      if (this.listenSocket && this.runtime) {
+        this.runtime.uws.us_listen_socket_close(this.listenSocket);
         this.listenSocket = null;
       }
     }
   }
   /**
-   * Port the server bound to, which is the resolved port when you asked for 0.
+   * The port that the server listens on, which the operating system chooses when you set `port` to 0, or -1 while the server is not listening.
    */
   get listeningPort() {
-    if (!this.listenSocket) return -1;
-    return uWS.us_socket_local_port(this.listenSocket);
+    if (!this.listenSocket || !this.runtime) return -1;
+    return this.runtime.uws.us_socket_local_port(this.listenSocket);
+  }
+  loadRuntime() {
+    if (!this.runtimeLoad) {
+      this.runtimeLoad = loadUWebSockets().then(
+        (uws) => {
+          const app = uws.App();
+          this.registerRoutes(app);
+          const runtime = { uws, app };
+          this.runtime = runtime;
+          return runtime;
+        },
+        (err) => {
+          this.runtimeLoad = null;
+          throw err;
+        }
+      );
+    }
+    return this.runtimeLoad;
   }
-  registerRoutes() {
+  registerRoutes(app) {
     if (this.cors) {
       const cors = this.cors;
-      this.app.options("/*", (res, req) => {
+      app.options("/*", (res, req) => {
         const requestOrigin = req.getHeader("origin");
         res.cork(() => {
           res.writeStatus("204 No Content");
@@ -3461,68 +3656,74 @@ var SirannonServer = class {
         });
       });
     }
-    this.app.get(
+    app.get(
       "/capabilities",
-      this.withCors(handleCapabilities({ registryDigest: this.registryDigest, acceptSql: this.acceptSql }))
+      this.withCors(
+        handleCapabilities({
+          registryDigest: this.registryDigest,
+          acceptSql: this.acceptSql,
+          acceptDeviceSync: this.acceptDeviceSync
+        })
+      )
     );
-    this.app.get("/health", this.withCors(handleLiveness()));
-    this.app.get("/health/ready", this.withCors(handleReadiness(this.sirannon, this.getReplicationStatus)));
-    this.app.get(
+    app.get("/health", this.withCors(handleLiveness()));
+    app.get("/health/ready", this.withCors(handleReadiness(this.sirannon, this.getReplicationStatus)));
+    app.get(
       "/db/:id/cluster",
       this.wrapDbGetRoute(handleClusterStatus(this.getClusterStatus, this.authorizeClusterStatus))
     );
     if (this.acceptSql) {
-      this.app.post("/db/:id/query", this.wrapDbRoute(handleQuery(this.sirannon, this.resolveExecutionTarget)));
-      this.app.post("/db/:id/execute", this.wrapDbRoute(handleExecute(this.sirannon, this.resolveExecutionTarget)));
-      this.app.post(
-        "/db/:id/transaction",
-        this.wrapDbRoute(handleTransaction(this.sirannon, this.resolveExecutionTarget))
-      );
-      this.app.post("/db/:id/batch", this.wrapDbRoute(handleBatch(this.sirannon, this.resolveExecutionTarget)));
-      this.app.post("/db/:id/load", this.wrapDbRoute(handleLoad(this.sirannon, this.resolveExecutionTarget)));
+      app.post("/db/:id/query", this.wrapDbRoute(handleQuery(this.sirannon, this.resolveExecutionTarget)));
+      app.post("/db/:id/execute", this.wrapDbRoute(handleExecute(this.sirannon, this.resolveExecutionTarget)));
+      app.post("/db/:id/transaction", this.wrapDbRoute(handleTransaction(this.sirannon, this.resolveExecutionTarget)));
+      app.post("/db/:id/batch", this.wrapDbRoute(handleBatch(this.sirannon, this.resolveExecutionTarget)));
+      app.post("/db/:id/load", this.wrapDbRoute(handleLoad(this.sirannon, this.resolveExecutionTarget)));
     } else {
       for (const route of SQL_ROUTES) {
-        this.app.post(route, this.withCors(refuseSql));
+        app.post(route, this.withCors(refuseSql));
       }
     }
-    this.app.post(
+    app.post(
       "/db/:id/query/:name",
       this.wrapOperationRoute(handleOperationQuery(this.sirannon, this.operations, this.resolveExecutionTarget))
     );
-    this.app.post(
+    app.post(
       "/db/:id/execute/:name",
       this.wrapOperationRoute(handleOperationExecute(this.sirannon, this.operations, this.resolveExecutionTarget))
     );
-    this.registerBackupRoutes();
-    this.app.post("/db/:id/changes", this.wrapDbRoute(handleChanges(this.sirannon, this.resolveExecutionTarget)));
-    this.app.post("/db/:id/migrations", this.wrapDbRoute(handleMigrationList(this.sirannon)));
-    this.app.post("/db/:id/snapshot", this.wrapDbRoute(handleSnapshotManifest(this.sirannon)));
-    this.app.post("/db/:id/snapshot/page", this.wrapDbRoute(handleSnapshotPage(this.sirannon)));
-    this.registerWebSocketRoute();
-    this.app.any("/*", (res) => {
-      sendError(res, 404, "NOT_FOUND", "Route not found");
-    });
-  }
-  registerBackupRoutes() {
-    this.app.post("/db/:id/backup", this.wrapDbRoute(handleBackupTrigger(this.sirannon)));
-    this.app.get("/db/:id/backup", this.wrapDbGetRoute(handleBackupStatus(this.sirannon)));
-    this.app.get("/db/:id/backup/chain", this.wrapDbGetRoute(handleBackupChain(this.sirannon)));
-    this.app.post("/db/:id/backup/verify", this.wrapDbRoute(handleBackupVerify(this.sirannon)));
-    this.app.post("/db/:id/backup/safe-to-delete", this.wrapDbRoute(handleBackupSafeToDelete(this.sirannon)));
-    this.app.post(
-      "/db/:id/backup/restore",
-      this.wrapDbRoute(handleBackupRestore(this.sirannon, this.acceptBackupRestore, this.restoreRuns))
-    );
-    this.app.get("/db/:id/backup/restore", this.wrapDbGetRoute(handleBackupRestoreStatus(this.restoreRuns)));
-  }
-  registerWebSocketRoute() {
+    this.registerBackupRoutes(app);
+    if (this.acceptDeviceSync) {
+      app.post("/db/:id/changes", this.wrapDbRoute(handleChanges(this.sirannon, this.resolveExecutionTarget)));
+      app.post("/db/:id/migrations", this.wrapDbRoute(handleMigrationList(this.sirannon)));
+      app.post("/db/:id/snapshot", this.wrapDbRoute(handleSnapshotManifest(this.sirannon)));
+      app.post("/db/:id/snapshot/page", this.wrapDbRoute(handleSnapshotPage(this.sirannon)));
+    } else {
+      for (const route of DEVICE_SYNC_ROUTES) {
+        app.post(route, this.withCors(refuseDeviceSync));
+      }
+    }
     registerWebSocketRoute({
-      app: this.app,
+      app,
       wsHandler: this.wsHandler,
       authenticateHook: this.authenticateHook,
       maxBodyBytes: this.maxBodyBytes,
       maxBackpressureBytes: this.maxWsBackpressureBytes
     });
+    app.any("/*", (res) => {
+      sendError(res, 404, "NOT_FOUND", "Route not found");
+    });
+  }
+  registerBackupRoutes(app) {
+    app.post("/db/:id/backup", this.wrapDbRoute(handleBackupTrigger(this.sirannon)));
+    app.get("/db/:id/backup", this.wrapDbGetRoute(handleBackupStatus(this.sirannon)));
+    app.get("/db/:id/backup/chain", this.wrapDbGetRoute(handleBackupChain(this.sirannon)));
+    app.post("/db/:id/backup/verify", this.wrapDbRoute(handleBackupVerify(this.sirannon)));
+    app.post("/db/:id/backup/safe-to-delete", this.wrapDbRoute(handleBackupSafeToDelete(this.sirannon)));
+    app.post(
+      "/db/:id/backup/restore",
+      this.wrapDbRoute(handleBackupRestore(this.sirannon, this.acceptBackupRestore, this.restoreRuns))
+    );
+    app.get("/db/:id/backup/restore", this.wrapDbGetRoute(handleBackupRestoreStatus(this.restoreRuns)));
   }
   withCors(handler) {
     if (!this.cors) return handler;
@@ -3532,105 +3733,21 @@ var SirannonServer = class {
       handler(res, req);
     };
   }
-  wrapDbRoute(handler) {
-    const authenticateHook = this.authenticateHook;
-    const corsHeaders = this.cors;
-    const maxBody = this.maxBodyBytes;
-    return (res, req) => {
-      const dbId = req.getParameter(0) ?? "";
-      const method = req.getMethod();
-      const path = req.getUrl();
-      if (corsHeaders) {
-        writeCorsOrigin(res, corsHeaders, req.getHeader("origin"));
-      }
-      const abort = initAbortHandler(res);
-      const bodyPromise = readBody(res, maxBody, abort);
-      if (!authenticateHook) {
-        bodyPromise.then(async (rawBody) => {
-          if (!abort.claim()) return;
-          try {
-            await handler(res, dbId, rawBody, abort, void 0);
-          } catch {
-            if (!abort.aborted) {
-              sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
-            }
-          }
-        }).catch(() => {
-        });
-        return;
-      }
-      const headers = {};
-      req.forEach((key, value) => {
-        headers[key] = value;
-      });
-      const remoteAddress = decodeRemoteAddress(res);
-      const ctx = {
-        headers,
-        method,
-        path,
-        databaseId: dbId,
-        remoteAddress
-      };
-      const hookPromise = runAuthenticate(res, abort, ctx, authenticateHook);
-      Promise.all([bodyPromise, hookPromise]).then(async ([rawBody, authenticated]) => {
-        if (!authenticated.ok || !abort.claim()) return;
-        try {
-          await handler(res, dbId, rawBody, abort, authenticated.identity);
-        } catch {
-          if (!abort.aborted) {
-            sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
-          }
-        }
-      }).catch(() => {
-      });
+  routeDeps() {
+    return {
+      cors: this.cors,
+      maxBodyBytes: this.maxBodyBytes,
+      authenticateHook: this.authenticateHook
     };
   }
-  wrapOperationRoute(handler) {
-    return wrapOperationRoute(
-      {
-        cors: this.cors,
-        maxBodyBytes: this.maxBodyBytes,
-        authenticateHook: this.authenticateHook
-      },
-      handler
-    );
+  wrapDbRoute(handler) {
+    return wrapDbRoute(this.routeDeps(), handler);
   }
   wrapDbGetRoute(handler) {
-    const authenticateHook = this.authenticateHook;
-    const corsHeaders = this.cors;
-    return (res, req) => {
-      const dbId = req.getParameter(0) ?? "";
-      const method = req.getMethod();
-      const path = req.getUrl();
-      if (corsHeaders) {
-        writeCorsOrigin(res, corsHeaders, req.getHeader("origin"));
-      }
-      const headers = {};
-      req.forEach((key, value) => {
-        headers[key] = value;
-      });
-      const ctx = {
-        headers,
-        method,
-        path,
-        databaseId: dbId,
-        remoteAddress: decodeRemoteAddress(res)
-      };
-      const abort = initAbortHandler(res);
-      const run = async () => {
-        if (authenticateHook && !(await runAuthenticate(res, abort, ctx, authenticateHook)).ok) return;
-        if (!abort.claim()) return;
-        try {
-          await handler(res, dbId, ctx, abort);
-        } catch {
-          if (!abort.aborted) {
-            sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
-          }
-        }
-      };
-      run().catch(() => {
-      });
-    };
+    return wrapDbGetRoute(this.routeDeps(), handler);
+  }
+  wrapOperationRoute(handler) {
+    return wrapOperationRoute(this.routeDeps(), handler);
   }
 };
 function createServer(sirannon, options) {