@luckystack/sync 0.1.9 → 0.2.1

package/dist/index.js

@@ -1,45 +1,57 @@
 // src/handleSyncRequest.ts
-import { getSession } from "@luckystack/login";
-import { getProjectConfig as getProjectConfig2 } from "@luckystack/core";
-import { getRuntimeSyncMaps } from "@luckystack/core";
+import { randomUUID } from "crypto";
 import {
+  readSession,
+  getProjectConfig as getProjectConfig3,
+  getRuntimeSyncMaps,
   validateRequest,
   extractTokenFromSocket,
+  formatRoomName,
   getIoInstance as getIoInstance2,
-  tryCatch,
+  tryCatch as tryCatch2,
   parseTransportRouteName,
   checkRateLimit,
   buildSyncProgressEventName,
   buildSyncResponseEventName,
-  socketEventNames as socketEventNames2,
+  socketEventNames as socketEventNames3,
   dispatchHook as dispatchHook2,
   validateInputByType,
-  getLogger as getLogger2
+  getLogger as getLogger3,
+  resolveClientIp,
+  isLoopbackIp,
+  extractLanguageFromHeader,
+  normalizeErrorResponse as normalizeErrorResponse2,
+  runWithErrorTrackerIdentityScope,
+  setCurrentErrorTrackerIdentity,
+  registerSyncAbortController,
+  unregisterSyncAbortController,
+  deriveTokenBucketId
 } from "@luckystack/core";
-import { extractLanguageFromHeader, normalizeErrorResponse, applyErrorFormatter } from "@luckystack/core";
 
 // src/_shared/streamEmitters.ts
 import {
   dispatchHook,
   getIoInstance,
   getLogger,
-  getProjectConfig,
+  getProjectConfig as getProjectConfig2,
   socketEventNames
 } from "@luckystack/core";
-var chunkCounters = /* @__PURE__ */ new Map();
-var counterKey = (routeName, recipient) => `${routeName}|${recipient}`;
-var bumpChunkIndex = (routeName, recipient) => {
-  const key = counterKey(routeName, recipient);
-  const next = (chunkCounters.get(key) ?? 0) + 1;
-  chunkCounters.set(key, next);
-  return next;
-};
-var dispatchStreamHooks = (routeName, recipient, chunk) => {
-  void dispatchHook("preSyncStream", { routeName, chunk, recipient });
-  const chunkIndex = bumpChunkIndex(routeName, recipient);
-  void dispatchHook("postSyncStream", { routeName, chunk, recipient, chunkIndex });
-};
+
+// src/_shared/logFlags.ts
+import { getProjectConfig } from "@luckystack/core";
+var shouldLogDev = () => getProjectConfig().logging.devLogs;
 var shouldLogStream = () => getProjectConfig().logging.stream;
+
+// src/_shared/redactToken.ts
+var VISIBLE_PREFIX = 8;
+var redactToken = (token) => {
+  if (!token) return token;
+  if (token.length <= VISIBLE_PREFIX) return token;
+  return `${token.slice(0, VISIBLE_PREFIX)}\u2026`;
+};
+var redactTokens = (tokens) => tokens.map((t) => redactToken(t) ?? t);
+
+// src/_shared/streamEmitters.ts
 var DEFAULT_THRESHOLD_BYTES = 1048576;
 var AVG_PACKET_BYTES = 1024;
 var POLL_INTERVAL_MS = 10;
@@ -94,6 +106,17 @@ var buildSyncStreamEmitters = ({
   signal,
   originatorSocket
 }) => {
+  const chunkCounters = /* @__PURE__ */ new Map();
+  const bumpChunkIndex = (recipient) => {
+    const next = (chunkCounters.get(recipient) ?? 0) + 1;
+    chunkCounters.set(recipient, next);
+    return next;
+  };
+  const dispatchStreamHooks = (recipient, chunk) => {
+    void dispatchHook("preSyncStream", { routeName: resolvedName, chunk, recipient });
+    const chunkIndex = bumpChunkIndex(recipient);
+    void dispatchHook("postSyncStream", { routeName: resolvedName, chunk, recipient, chunkIndex });
+  };
   const buildBroadcastFrame = (payload) => ({
     ...payload,
     cb,
@@ -114,7 +137,7 @@ var buildSyncStreamEmitters = ({
     if (shouldLogStream()) {
       getLogger().debug(`${logLabel}: ${resolvedName} server stream`, { payload });
     }
-    dispatchStreamHooks(resolvedName, "originator", payload);
+    dispatchStreamHooks("originator", payload);
     emitOriginatorChunk(payload);
   };
   const emitBroadcastSyncStream = (payload = {}) => {
@@ -128,7 +151,7 @@ var buildSyncStreamEmitters = ({
     if (!receiver) return;
     const io = getIoInstance();
     if (!io) return;
-    dispatchStreamHooks(resolvedName, receiver, payload);
+    dispatchStreamHooks(receiver, payload);
     io.to(receiver).emit(socketEventNames.sync, buildBroadcastFrame(payload));
   };
   const emitStreamToTokens = (tokens, payload = {}) => {
@@ -140,19 +163,20 @@ var buildSyncStreamEmitters = ({
     const filtered = list.filter((t) => typeof t === "string" && t.length > 0);
     if (filtered.length === 0) return;
     if (shouldLogStream()) {
-      getLogger().debug(`${logLabel}: ${resolvedName} streamTo`, { tokens: filtered, payload });
+      getLogger().debug(`${logLabel}: ${resolvedName} streamTo`, { tokens: redactTokens(filtered), payload });
     }
     const io = getIoInstance();
     if (!io) return;
     for (const recipient of filtered) {
-      dispatchStreamHooks(resolvedName, recipient, payload);
+      dispatchStreamHooks(recipient, payload);
     }
     const frame = buildBroadcastFrame(payload);
     io.to(filtered).emit(socketEventNames.sync, frame);
   };
   const flushPressure = async ({ thresholdBytes } = {}) => {
     if (isAborted()) return;
-    const effectiveThresholdBytes = typeof thresholdBytes === "number" && thresholdBytes > 0 ? thresholdBytes : DEFAULT_THRESHOLD_BYTES;
+    const configuredBytes = getProjectConfig2().sync.flushPressure.maxBufferedBytes;
+    const effectiveThresholdBytes = typeof thresholdBytes === "number" && thresholdBytes > 0 ? thresholdBytes : typeof configuredBytes === "number" && configuredBytes > 0 ? configuredBytes : DEFAULT_THRESHOLD_BYTES;
     const packetThreshold = Math.max(1, Math.ceil(effectiveThresholdBytes / AVG_PACKET_BYTES));
     const targets = [];
     if (originatorSocket) targets.push(originatorSocket);
@@ -171,13 +195,171 @@ var buildSyncStreamEmitters = ({
   };
 };
 
-// src/handleSyncRequest.ts
+// src/_shared/errorBuilders.ts
 import {
-  registerSyncAbortController,
-  unregisterSyncAbortController
+  applyErrorFormatter,
+  normalizeErrorResponse
 } from "@luckystack/core";
-var shouldLogDev = () => getProjectConfig2().logging.devLogs;
-var shouldLogStream2 = () => getProjectConfig2().logging.stream;
+var buildFormattedError = ({
+  response,
+  preferred,
+  userLanguage,
+  routeName,
+  transport,
+  userId,
+  perRouteFormatter
+}) => {
+  const normalized = normalizeErrorResponse({
+    response,
+    preferredLocale: preferred,
+    userLanguage
+  });
+  const baseEnvelope = {
+    status: "error",
+    message: normalized.message,
+    errorCode: normalized.errorCode,
+    errorParams: normalized.errorParams,
+    httpStatus: normalized.httpStatus
+  };
+  return applyErrorFormatter({
+    response: baseEnvelope,
+    routeName: routeName ?? "sync/unknown",
+    transport,
+    userId,
+    perRouteFormatter
+  });
+};
+var ensureSyncErrorShape = (response) => {
+  if (typeof response.errorCode === "string" && response.errorCode.trim().length > 0) {
+    return response;
+  }
+  return { ...response, errorCode: "sync.clientRejected" };
+};
+
+// src/_shared/clientFanout.ts
+import { tryCatch, socketEventNames as socketEventNames2, getLogger as getLogger2 } from "@luckystack/core";
+var processClientSyncForRecipient = async ({
+  tempSocket,
+  tempToken,
+  clientSyncHandler,
+  data,
+  functionsObject,
+  serverOutput,
+  receiver,
+  resolvedName,
+  callbackKey,
+  transport,
+  handlerName,
+  logLabel,
+  shouldLogDev: shouldLogDev2,
+  shouldLogStream: shouldLogStream2,
+  buildSyncError,
+  resolvePreferredLocale,
+  sourceUserId
+}) => {
+  const emitClientSyncStream = (payload = {}) => {
+    if (shouldLogStream2()) {
+      getLogger2().debug(`${logLabel}: ${resolvedName} client stream`, { payload });
+    }
+    tempSocket.emit(socketEventNames2.sync, {
+      ...payload,
+      cb: callbackKey,
+      fullName: resolvedName,
+      status: "stream"
+    });
+  };
+  const [clientSyncError, clientSyncResult] = await tryCatch(
+    async () => await clientSyncHandler({ clientInput: data, token: tempToken, functions: functionsObject, serverOutput, roomCode: receiver, stream: emitClientSyncStream }),
+    void 0,
+    {
+      handler: handlerName,
+      sync: resolvedName,
+      stage: "client",
+      sourceUserId,
+      //? Redact the raw bearer session token before it lands in the
+      //? error-tracker context (`captureException`) — a verbatim token there is
+      //? a usable credential (defeats HttpOnly-cookie mode). The 8-char prefix
+      //? still correlates error events.
+      targetToken: redactToken(tempToken),
+      receiver,
+      transport
+    }
+  );
+  const preferred = resolvePreferredLocale(tempSocket.handshake.headers);
+  if (clientSyncError) {
+    tempSocket.emit(socketEventNames2.sync, {
+      cb: callbackKey,
+      fullName: resolvedName,
+      ...buildSyncError({
+        response: { status: "error", errorCode: "sync.clientExecutionFailed" },
+        preferred
+      })
+    });
+    return;
+  }
+  if (clientSyncResult?.status === "error") {
+    tempSocket.emit(socketEventNames2.sync, {
+      cb: callbackKey,
+      fullName: resolvedName,
+      ...buildSyncError({
+        response: ensureSyncErrorShape(clientSyncResult),
+        preferred
+      })
+    });
+    return;
+  }
+  if (clientSyncResult?.status !== "success") {
+    tempSocket.emit(socketEventNames2.sync, {
+      cb: callbackKey,
+      fullName: resolvedName,
+      ...buildSyncError({
+        response: { status: "error", errorCode: "sync.invalidClientResponse" },
+        preferred
+      })
+    });
+    return;
+  }
+  const result = {
+    cb: callbackKey,
+    fullName: resolvedName,
+    serverOutput,
+    clientOutput: clientSyncResult,
+    // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- an empty message should fall back to the default too
+    message: clientSyncResult.message || `${resolvedName} sync success`,
+    status: "success"
+  };
+  if (shouldLogDev2()) {
+    getLogger2().debug(`${logLabel}: ${resolvedName} client success`, { result });
+  }
+  tempSocket.emit(socketEventNames2.sync, result);
+};
+
+// src/_shared/validationMode.ts
+var resolveSyncValidationMode = (validation) => {
+  if (!validation) return "strict";
+  if (typeof validation === "string") {
+    return validation === "relaxed" ? "relaxed" : "strict";
+  }
+  return validation.input === "skip" ? "relaxed" : "strict";
+};
+
+// src/_shared/receiverAuth.ts
+var authorizeSyncReceiver = ({
+  receiver,
+  allowClientReceiverAll,
+  requireRoomMembership,
+  isMember
+}) => {
+  if (receiver === "all" && !allowClientReceiverAll) {
+    return { allowed: false, errorCode: "sync.receiverNotAllowed" };
+  }
+  if (requireRoomMembership && receiver !== "all" && !isMember?.()) {
+    return { allowed: false, errorCode: "sync.notRoomMember" };
+  }
+  return { allowed: true };
+};
+
+// src/handleSyncRequest.ts
 var applySyncRateLimits = async ({
   resolvedName,
   token,
@@ -185,13 +367,22 @@ var applySyncRateLimits = async ({
   user,
   responseIndex,
   buildSyncError,
-  preferredLocale
+  preferredLocale,
+  routeLimit
 }) => {
-  const config = getProjectConfig2();
-  const defaultApiLimit = config.rateLimiting.defaultApiLimit;
+  const config = getProjectConfig3();
+  const resolvedIp = resolveClientIp({
+    rawAddress: socket.handshake.address,
+    headers: socket.handshake.headers,
+    trustProxy: config.http.trustProxy,
+    trustedProxyHopCount: config.http.trustedProxyHopCount
+  });
+  const defaultApiLimit = routeLimit === void 0 ? config.rateLimiting.defaultApiLimit : routeLimit;
   if (defaultApiLimit !== false && defaultApiLimit > 0) {
-    const requesterIdentity = token ?? socket.handshake.address ?? "unknown";
-    const keyPrefix = token ? "token" : "ip";
+    const identityCb = config.rateLimiting.identity;
+    const customIdentity = identityCb?.({ routeName: resolvedName, userId: user?.id ?? null, ip: resolvedIp, transport: "socket" }) ?? null;
+    const requesterIdentity = customIdentity?.id ?? (token ? deriveTokenBucketId(token) : resolvedIp);
+    const keyPrefix = customIdentity?.scope ?? (token ? "token" : "ip");
     const rateLimitKey = `${keyPrefix}:${requesterIdentity}:sync:${resolvedName}`;
     const { allowed, resetIn } = await checkRateLimit({
       key: rateLimitKey,
@@ -200,13 +391,17 @@ var applySyncRateLimits = async ({
     });
     if (!allowed) {
       void dispatchHook2("rateLimitExceeded", {
-        scope: token ? "user" : "route",
+        //? Parity with the API handler: an anonymous per-route bucket is IP-keyed,
+        //? so the scope is `ip` (with `route` still set to mark it a per-route
+        //? bucket vs the global `:sync:all` IP bucket), never `route`.
+        scope: token ? "user" : "ip",
         key: rateLimitKey,
         limit: defaultApiLimit,
         windowMs: config.rateLimiting.windowMs,
         count: defaultApiLimit + 1,
         route: resolvedName,
-        userId: user?.id
+        userId: user?.id,
+        ip: token ? void 0 : resolvedIp
       });
       if (typeof responseIndex === "number") {
         socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
@@ -224,8 +419,9 @@ var applySyncRateLimits = async ({
     }
   }
   const defaultIpLimit = config.rateLimiting.defaultIpLimit;
-  if (defaultIpLimit !== false && defaultIpLimit > 0) {
-    const requesterIp = socket.handshake.address ?? "unknown";
+  const requesterIsLoopback = config.rateLimiting.skipLoopbackInDev && process.env.NODE_ENV !== "production" && isLoopbackIp(resolvedIp);
+  if (!requesterIsLoopback && defaultIpLimit !== false && defaultIpLimit > 0) {
+    const requesterIp = resolvedIp;
     const ipKey = `ip:${requesterIp}:sync:all`;
     const { allowed, resetIn } = await checkRateLimit({
       key: ipKey,
@@ -258,176 +454,237 @@ var applySyncRateLimits = async ({
   }
   return true;
 };
-async function handleSyncRequest({ msg, socket, token }) {
-  const ioInstance = getIoInstance2();
-  if (!ioInstance) {
-    return;
+function rejectSync({
+  socket,
+  responseIndex,
+  buildSyncError,
+  response,
+  preferred,
+  userLanguage
+}) {
+  if (typeof responseIndex === "number") {
+    socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
+      response,
+      preferred,
+      userLanguage
+    }));
   }
+}
+function validateSyncMessage({
+  msg,
+  socket,
+  preferredLocale
+}) {
   if (typeof msg != "object") {
     if (shouldLogDev()) {
-      getLogger2().warn("sync: socket message was not a json object");
+      getLogger3().warn("sync: socket message was not a json object");
     }
-    const normalized = normalizeErrorResponse({
+    const normalized = normalizeErrorResponse2({
       response: { status: "error", errorCode: "sync.invalidRequest" },
-      preferredLocale: extractLanguageFromHeader(socket.handshake.headers["x-language"]) || extractLanguageFromHeader(socket.handshake.headers["accept-language"])
+      preferredLocale
     });
-    return socket.emit(socketEventNames2.sync, {
+    socket.emit(socketEventNames3.sync, {
       status: normalized.status,
       message: normalized.message,
       errorCode: normalized.errorCode,
       errorParams: normalized.errorParams,
       httpStatus: normalized.httpStatus
     });
+    return false;
   }
-  const { name, data, cb, receiver: rawReceiver, responseIndex, ignoreSelf } = msg;
+  return true;
+}
+function parseSyncFields({
+  msg,
+  socket,
+  responseIndex,
+  preferredLocale,
+  buildSyncError
+}) {
+  const { name, data, cb, receiver: rawReceiver, ignoreSelf } = msg;
   const receiver = typeof rawReceiver === "string" ? rawReceiver.trim() : "";
-  const preferredLocale = extractLanguageFromHeader(socket.handshake.headers["x-language"]) || extractLanguageFromHeader(socket.handshake.headers["accept-language"]);
-  let currentRouteName;
-  let currentPerRouteFormatter;
-  let currentUserId;
-  const buildSyncError = ({
-    response,
-    preferred,
-    userLanguage
-  }) => {
-    const normalized = normalizeErrorResponse({
-      response,
-      preferredLocale: preferred,
-      userLanguage
-    });
-    const baseEnvelope = {
-      status: normalized.status,
-      message: normalized.message,
-      errorCode: normalized.errorCode,
-      errorParams: normalized.errorParams,
-      httpStatus: normalized.httpStatus
-    };
-    return applyErrorFormatter({
-      response: baseEnvelope,
-      routeName: currentRouteName ?? "sync/unknown",
-      transport: "socket",
-      userId: currentUserId,
-      perRouteFormatter: currentPerRouteFormatter
-    });
-  };
-  const ensureSyncErrorShape = (response) => {
-    if (typeof response.errorCode === "string" && response.errorCode.trim().length > 0) {
-      return response;
-    }
-    return {
-      ...response,
-      errorCode: "sync.clientRejected"
-    };
-  };
-  if (!name || !data || typeof name != "string" || typeof data != "object") {
-    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-      response: { status: "error", errorCode: "sync.invalidRequest" },
-      preferred: preferredLocale
-    }));
+  if (!name || !data || typeof name != "string" || typeof data != "object" || Array.isArray(data)) {
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.invalidRequest" }, preferred: preferredLocale });
+    return { ok: false };
   }
-  const normalizedData = data;
   const parsedRoute = parseTransportRouteName({ value: name, prefix: "sync" });
   if (parsedRoute.status === "error") {
-    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
+    rejectSync({
+      socket,
+      responseIndex,
+      buildSyncError,
       response: {
         status: "error",
         errorCode: "routing.invalidServiceRouteName",
         errorParams: [{ key: "name", value: name }]
       },
       preferred: preferredLocale
-    }));
+    });
+    return { ok: false };
   }
   const resolvedName = parsedRoute.normalizedFullName;
-  currentRouteName = resolvedName;
   if (!cb || typeof cb != "string") {
-    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-      response: { status: "error", errorCode: "sync.invalidCallback" },
-      preferred: preferredLocale
-    }));
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.invalidCallback" }, preferred: preferredLocale });
+    return { ok: false };
   }
   if (!receiver) {
     if (shouldLogDev()) {
-      getLogger2().warn("sync: missing receiver / roomCode", { receiver });
+      getLogger3().warn("sync: missing receiver / roomCode", { receiver });
     }
-    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-      response: { status: "error", errorCode: "sync.missingReceiver" },
-      preferred: preferredLocale
-    }));
-  }
-  if (shouldLogDev()) {
-    getLogger2().debug(`sync: ${resolvedName} called`, { sync: resolvedName });
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.missingReceiver" }, preferred: preferredLocale });
+    return { ok: false };
   }
-  const user = await getSession(token);
-  currentUserId = user?.id;
-  const { syncObject, functionsObject } = await getRuntimeSyncMaps();
+  return {
+    ok: true,
+    name,
+    normalizedData: data,
+    cb,
+    receiver,
+    ignoreSelf: typeof ignoreSelf === "boolean" ? ignoreSelf : void 0,
+    resolvedName
+  };
+}
+function setupAbortController({
+  socket,
+  responseIndex
+}) {
+  const cancelId = randomUUID();
   const abortController = new AbortController();
-  const abortKey = registerSyncAbortController(socket.id, cb, abortController);
+  const abortKey = registerSyncAbortController(socket.id, cancelId, abortController);
+  if (typeof responseIndex === "number") {
+    socket.emit(buildSyncProgressEventName(responseIndex), { __cancelId: cancelId });
+  }
   const onSocketDisconnect = () => {
     abortController.abort();
   };
-  socket.once(socketEventNames2.disconnect, onSocketDisconnect);
+  socket.once(socketEventNames3.disconnect, onSocketDisconnect);
   let cleanupDone = false;
   const cleanupRequest = () => {
     if (cleanupDone) return;
     cleanupDone = true;
-    socket.off(socketEventNames2.disconnect, onSocketDisconnect);
+    socket.off(socketEventNames3.disconnect, onSocketDisconnect);
     unregisterSyncAbortController(abortKey);
   };
+  return { abortController, abortKey, cleanupRequest };
+}
+function checkRouteExists({
+  syncObject,
+  resolvedName,
+  name,
+  socket,
+  responseIndex,
+  buildSyncError,
+  preferredLocale,
+  user,
+  cleanupRequest
+}) {
   if (!syncObject[`${resolvedName}_client`] && !syncObject[`${resolvedName}_server`]) {
     if (shouldLogDev()) {
-      getLogger2().warn(`sync: ${name} has no _client or _server file`, { sync: name });
+      getLogger3().warn(`sync: ${name} has no _client or _server file`, { sync: name });
+    }
+    cleanupRequest();
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.notFound" }, preferred: preferredLocale, userLanguage: user?.language });
+    return false;
+  }
+  if (!syncObject[`${resolvedName}_server`]) {
+    if (shouldLogDev()) {
+      getLogger3().warn(`sync: ${resolvedName} has a _client file but no required _server file`, { sync: resolvedName });
+    }
+    cleanupRequest();
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.notFound" }, preferred: preferredLocale, userLanguage: user?.language });
+    return false;
+  }
+  return true;
+}
+function runSyncAuth({
+  serverSyncEntry,
+  user,
+  resolvedName,
+  socket,
+  responseIndex,
+  buildSyncError,
+  preferredLocale,
+  cleanupRequest
+}) {
+  if (!serverSyncEntry) return true;
+  const { auth } = serverSyncEntry;
+  if (auth.login && !user?.id) {
+    if (shouldLogDev()) {
+      getLogger3().warn(`sync: ${resolvedName} requires login`, { sync: resolvedName });
+    }
+    cleanupRequest();
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "auth.required" }, preferred: preferredLocale });
+    return false;
+  }
+  if (auth.additional && auth.additional.length > 0 && !user) {
+    if (shouldLogDev()) {
+      getLogger3().warn(`sync: ${resolvedName} requires a session for additional auth`, { sync: resolvedName });
+    }
+    cleanupRequest();
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "auth.required" }, preferred: preferredLocale });
+    return false;
+  }
+  const validationResult = validateRequest({ auth, user });
+  if (validationResult.status === "error") {
+    if (shouldLogDev()) {
+      getLogger3().warn(`sync: auth failed for ${resolvedName}`, { sync: resolvedName, errorCode: validationResult.errorCode });
     }
     cleanupRequest();
-    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-      response: { status: "error", errorCode: "sync.notFound" },
+    rejectSync({
+      socket,
+      responseIndex,
+      buildSyncError,
+      response: {
+        status: "error",
+        errorCode: validationResult.errorCode || "auth.forbidden",
+        errorParams: validationResult.errorParams,
+        httpStatus: validationResult.httpStatus
+      },
       preferred: preferredLocale,
       userLanguage: user?.language
-    }));
+    });
+    return false;
   }
-  const { emitServerSyncStream, emitBroadcastSyncStream, emitStreamToTokens, flushPressure } = buildSyncStreamEmitters({
-    cb,
+  return true;
+}
+function runReceiverAuth({
+  receiver,
+  resolvedName,
+  socket,
+  responseIndex,
+  buildSyncError,
+  preferredLocale,
+  user,
+  cleanupRequest
+}) {
+  const syncConfig = getProjectConfig3().sync;
+  const receiverAuth = authorizeSyncReceiver({
     receiver,
-    resolvedName,
-    logLabel: "sync",
-    signal: abortController.signal,
-    originatorSocket: socket,
-    emitOriginatorChunk: (payload) => {
-      if (typeof responseIndex !== "number") return;
-      socket.emit(buildSyncProgressEventName(responseIndex), payload);
-    }
+    allowClientReceiverAll: syncConfig.allowClientReceiverAll,
+    requireRoomMembership: syncConfig.requireRoomMembership,
+    isMember: () => socket.rooms.has(receiver)
   });
-  const serverSyncEntry = syncObject[`${resolvedName}_server`];
-  currentPerRouteFormatter = serverSyncEntry?.errorFormatter;
-  if (serverSyncEntry) {
-    const { auth } = serverSyncEntry;
-    if (auth.login && !user?.id) {
-      if (shouldLogDev()) {
-        getLogger2().warn(`sync: ${resolvedName} requires login`, { sync: resolvedName });
-      }
-      cleanupRequest();
-      return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-        response: { status: "error", errorCode: "auth.required" },
-        preferred: preferredLocale
-      }));
-    }
-    const validationResult = validateRequest({ auth, user });
-    if (validationResult.status === "error") {
-      if (shouldLogDev()) {
-        getLogger2().warn(`sync: auth failed for ${resolvedName}`, { sync: resolvedName, errorCode: validationResult.errorCode });
-      }
-      cleanupRequest();
-      return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-        response: {
-          status: "error",
-          errorCode: validationResult.errorCode || "auth.forbidden",
-          errorParams: validationResult.errorParams,
-          httpStatus: validationResult.httpStatus
-        },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      }));
+  if (!receiverAuth.allowed) {
+    if (shouldLogDev()) {
+      getLogger3().warn(`sync: receiver authorization failed for ${resolvedName}`, { sync: resolvedName, receiver, errorCode: receiverAuth.errorCode });
     }
+    cleanupRequest();
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: receiverAuth.errorCode, httpStatus: 403 }, preferred: preferredLocale, userLanguage: user?.language });
+    return false;
   }
+  return true;
+}
+async function runPreAuthorizeHook({
+  resolvedName,
+  normalizedData,
+  user,
+  receiver,
+  socket,
+  responseIndex,
+  buildSyncError,
+  preferredLocale,
+  cleanupRequest
+}) {
   const preAuthorizeResult = await dispatchHook2("preSyncAuthorize", {
     routeName: resolvedName,
     data: normalizedData,
@@ -437,10 +694,13 @@ async function handleSyncRequest({ msg, socket, token }) {
   });
   if (preAuthorizeResult.stopped) {
     if (shouldLogDev()) {
-      getLogger2().warn(`sync: preSyncAuthorize stopped ${resolvedName}`, { sync: resolvedName, errorCode: preAuthorizeResult.signal.errorCode });
+      getLogger3().warn(`sync: preSyncAuthorize stopped ${resolvedName}`, { sync: resolvedName, errorCode: preAuthorizeResult.signal.errorCode });
     }
     cleanupRequest();
-    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
+    rejectSync({
+      socket,
+      responseIndex,
+      buildSyncError,
       response: {
         status: "error",
         errorCode: preAuthorizeResult.signal.errorCode,
@@ -448,7 +708,8 @@ async function handleSyncRequest({ msg, socket, token }) {
       },
       preferred: preferredLocale,
       userLanguage: user?.language
-    }));
+    });
+    return false;
   }
   void dispatchHook2("postSyncAuthorize", {
     routeName: resolvedName,
@@ -457,108 +718,198 @@ async function handleSyncRequest({ msg, socket, token }) {
     receiver,
     transport: "socket"
   });
-  const rateLimitOk = await applySyncRateLimits({
-    resolvedName,
-    token,
-    socket,
+  return true;
+}
+async function runSyncServerExecution({
+  serverSyncEntry,
+  resolvedName,
+  normalizedData,
+  user,
+  receiver,
+  socket,
+  responseIndex,
+  buildSyncError,
+  preferredLocale,
+  cleanupRequest,
+  functionsObject,
+  emitServerSyncStream,
+  emitBroadcastSyncStream,
+  emitStreamToTokens,
+  flushPressure,
+  abortController
+}) {
+  if (!serverSyncEntry) return { ok: true, serverOutput: {} };
+  const { main: serverMain, inputType, inputTypeFilePath } = serverSyncEntry;
+  const preValidateResult = await dispatchHook2("preSyncValidate", {
+    routeName: resolvedName,
+    data: normalizedData,
     user,
-    responseIndex,
-    buildSyncError,
-    preferredLocale
+    receiver,
+    transport: "socket"
   });
-  if (!rateLimitOk) {
+  if (preValidateResult.stopped) {
     cleanupRequest();
-    return;
+    rejectSync({
+      socket,
+      responseIndex,
+      buildSyncError,
+      response: {
+        status: "error",
+        errorCode: preValidateResult.signal.errorCode,
+        httpStatus: preValidateResult.signal.httpStatus
+      },
+      preferred: preferredLocale,
+      userLanguage: user?.language
+    });
+    return { ok: false };
   }
-  let serverOutput = {};
-  if (serverSyncEntry) {
-    const { main: serverMain, inputType, inputTypeFilePath } = serverSyncEntry;
+  if (resolveSyncValidationMode(serverSyncEntry.validation) === "strict") {
     const inputValidation = await validateInputByType({
       typeText: inputType,
       value: normalizedData,
       rootKey: "clientInput",
       filePath: inputTypeFilePath
     });
+    void dispatchHook2("postSyncValidate", {
+      routeName: resolvedName,
+      data: normalizedData,
+      user,
+      receiver,
+      transport: "socket",
+      validation: inputValidation.status === "error" ? { status: "error", message: inputValidation.message } : { status: "success" }
+    });
     if (inputValidation.status === "error") {
-      cleanupRequest();
-      return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-        response: {
-          status: "error",
-          errorCode: "sync.invalidInputType",
-          errorParams: [{ key: "message", value: inputValidation.message }]
-        },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      }));
-    }
-    const [serverSyncError, serverSyncResult] = await tryCatch(
-      async () => await serverMain({
-        clientInput: normalizedData,
-        user,
-        functions: functionsObject,
-        roomCode: receiver,
-        stream: emitServerSyncStream,
-        broadcastStream: emitBroadcastSyncStream,
-        streamTo: emitStreamToTokens,
-        abortSignal: abortController.signal,
-        flushPressure
-      }),
-      void 0,
-      {
-        handler: "handleSyncRequest",
-        sync: resolvedName,
-        stage: "server",
-        userId: user?.id,
-        receiver,
-        transport: "socket"
-      }
-    );
-    if (serverSyncError) {
       if (shouldLogDev()) {
-        getLogger2().error(`sync: server execution failed for ${resolvedName}`, serverSyncError, { sync: resolvedName });
+        getLogger3().warn(`sync: input validation failed for ${resolvedName}`, { sync: resolvedName, message: inputValidation.message });
       }
       cleanupRequest();
-      return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-        response: { status: "error", errorCode: "sync.serverExecutionFailed" },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      }));
-    } else if (serverSyncResult?.status == "error") {
-      const normalizedServerError = buildSyncError({
-        response: serverSyncResult,
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      });
-      if (shouldLogDev()) {
-        getLogger2().warn(`sync: server returned error for ${resolvedName}`, { sync: resolvedName, message: normalizedServerError.message });
-      }
-      cleanupRequest();
-      return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), normalizedServerError);
-    } else if (serverSyncResult?.status !== "success") {
-      if (shouldLogDev()) {
-        getLogger2().warn(`sync: ${resolvedName}_server returned invalid response`, { sync: resolvedName });
-      }
-      cleanupRequest();
-      return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-        response: { status: "error", errorCode: "sync.invalidServerResponse" },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      }));
-    } else if (serverSyncResult?.status == "success") {
-      serverOutput = serverSyncResult;
+      rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.invalidInputType" }, preferred: preferredLocale, userLanguage: user?.language });
+      return { ok: false };
     }
+  } else {
+    void dispatchHook2("postSyncValidate", {
+      routeName: resolvedName,
+      data: normalizedData,
+      user,
+      receiver,
+      transport: "socket",
+      validation: { status: "success" }
+    });
   }
-  const sockets = receiver === "all" ? await ioInstance.fetchSockets() : await ioInstance.in(receiver).fetchSockets();
-  if (sockets.length === 0) {
+  const executePayload = {
+    routeName: resolvedName,
+    data: normalizedData,
+    user,
+    receiver,
+    transport: "socket",
+    result: void 0,
+    error: null,
+    durationMs: 0
+  };
+  const preExecuteResult = await dispatchHook2("preSyncExecute", executePayload);
+  if (preExecuteResult.stopped) {
+    cleanupRequest();
+    rejectSync({
+      socket,
+      responseIndex,
+      buildSyncError,
+      response: {
+        status: "error",
+        errorCode: preExecuteResult.signal.errorCode,
+        httpStatus: preExecuteResult.signal.httpStatus
+      },
+      preferred: preferredLocale,
+      userLanguage: user?.language
+    });
+    return { ok: false };
+  }
+  const executeStart = Date.now();
+  const [serverSyncError, serverSyncResult] = await tryCatch2(
+    async () => await serverMain({
+      clientInput: normalizedData,
+      user,
+      functions: functionsObject,
+      roomCode: receiver,
+      stream: emitServerSyncStream,
+      broadcastStream: emitBroadcastSyncStream,
+      streamTo: emitStreamToTokens,
+      abortSignal: abortController.signal,
+      flushPressure
+    }),
+    void 0,
+    {
+      handler: "handleSyncRequest",
+      sync: resolvedName,
+      stage: "server",
+      userId: user?.id,
+      receiver,
+      transport: "socket"
+    }
+  );
+  executePayload.result = serverSyncResult;
+  executePayload.error = serverSyncError ?? null;
+  executePayload.durationMs = Date.now() - executeStart;
+  await dispatchHook2("postSyncExecute", executePayload);
+  if (serverSyncError) {
     if (shouldLogDev()) {
-      getLogger2().warn("sync: no sockets found for receiver", { receiver, sync: resolvedName });
+      getLogger3().error(`sync: server execution failed for ${resolvedName}`, serverSyncError, { sync: resolvedName });
     }
     cleanupRequest();
-    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
-      response: { status: "error", errorCode: "sync.noReceiversFound" },
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.serverExecutionFailed" }, preferred: preferredLocale, userLanguage: user?.language });
+    return { ok: false };
+  }
+  if (serverSyncResult?.status == "error") {
+    const normalizedServerError = buildSyncError({
+      response: serverSyncResult,
       preferred: preferredLocale,
       userLanguage: user?.language
-    }));
+    });
+    if (shouldLogDev()) {
+      getLogger3().warn(`sync: server returned error for ${resolvedName}`, { sync: resolvedName, message: normalizedServerError.message });
+    }
+    cleanupRequest();
+    if (typeof responseIndex === "number") {
+      socket.emit(buildSyncResponseEventName(responseIndex), normalizedServerError);
+    }
+    return { ok: false };
+  }
+  if (serverSyncResult?.status !== "success") {
+    if (shouldLogDev()) {
+      getLogger3().warn(`sync: ${resolvedName}_server returned invalid response`, { sync: resolvedName });
+    }
+    cleanupRequest();
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.invalidServerResponse" }, preferred: preferredLocale, userLanguage: user?.language });
+    return { ok: false };
+  }
+  return { ok: true, serverOutput: serverSyncResult };
+}
+async function runSyncFanout({
+  ioInstance,
+  receiver,
+  resolvedName,
+  normalizedData,
+  serverOutput,
+  user,
+  socket,
+  responseIndex,
+  buildSyncError,
+  preferredLocale,
+  cleanupRequest,
+  ignoreSelf,
+  token,
+  cb,
+  syncObject,
+  functionsObject
+}) {
+  const physicalReceiver = receiver === "all" ? "all" : formatRoomName(receiver, { purpose: "broadcast", userId: user?.id ?? null });
+  const sockets = physicalReceiver === "all" ? await ioInstance.fetchSockets() : await ioInstance.in(physicalReceiver).fetchSockets();
+  if (sockets.length === 0) {
+    if (shouldLogDev()) {
+      getLogger3().warn("sync: no sockets found for receiver", { receiver, sync: resolvedName });
+    }
+    cleanupRequest();
+    rejectSync({ socket, responseIndex, buildSyncError, response: { status: "error", errorCode: "sync.noReceiversFound" }, preferred: preferredLocale, userLanguage: user?.language });
+    return false;
   }
   const fanoutPayload = {
     routeName: resolvedName,
@@ -572,7 +923,10 @@ async function handleSyncRequest({ msg, socket, token }) {
   const preFanoutResult = await dispatchHook2("preSyncFanout", fanoutPayload);
   if (preFanoutResult.stopped) {
     cleanupRequest();
-    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
+    rejectSync({
+      socket,
+      responseIndex,
+      buildSyncError,
       response: {
         status: "error",
         errorCode: preFanoutResult.signal.errorCode,
@@ -580,152 +934,277 @@ async function handleSyncRequest({ msg, socket, token }) {
       },
       preferred: preferredLocale,
       userLanguage: user?.language
-    }));
+    });
+    return false;
   }
-  const { fanoutYieldEvery, fanoutYieldMs } = getProjectConfig2().sync;
+  let originatorAcked = false;
+  if (typeof responseIndex === "number") {
+    socket.emit(buildSyncResponseEventName(responseIndex), {
+      status: "success",
+      message: `sync ${resolvedName} success`,
+      result: serverOutput
+    });
+    originatorAcked = true;
+  }
+  const { fanoutYieldEvery, fanoutYieldMs } = getProjectConfig3().sync;
+  const yieldEvery = Math.max(1, fanoutYieldEvery);
   let recipientCount = 0;
   let tempCount = 1;
   for (const tempSocket of sockets) {
     tempCount++;
-    if (tempCount % fanoutYieldEvery === 0) {
+    if (tempCount % yieldEvery === 0) {
       await new Promise((resolve) => setTimeout(resolve, fanoutYieldMs));
     }
     const tempToken = extractTokenFromSocket(tempSocket);
-    if (ignoreSelf && typeof ignoreSelf == "boolean" && token == tempToken) {
+    if (ignoreSelf && typeof ignoreSelf === "boolean" && token && token === tempToken) {
+      continue;
+    }
+    const preRecipientResult = await dispatchHook2("preSyncRecipient", {
+      routeName: resolvedName,
+      receiver,
+      recipientSocketId: tempSocket.id,
+      recipientUserId: null,
+      serverOutput
+    });
+    if (preRecipientResult.stopped && preRecipientResult.signal.overrideOutput === void 0) {
       continue;
     }
+    const effectiveServerOutput = preRecipientResult.stopped ? preRecipientResult.signal.overrideOutput : serverOutput;
     recipientCount++;
     if (syncObject[`${resolvedName}_client`]) {
       const clientSyncHandler = syncObject[`${resolvedName}_client`];
-      const emitClientSyncStream = (payload = {}) => {
-        if (shouldLogStream2()) {
-          getLogger2().debug(`sync: ${resolvedName} client stream`, { payload });
-        }
-        tempSocket.emit(socketEventNames2.sync, {
-          ...payload,
-          cb,
-          fullName: resolvedName,
-          status: "stream"
-        });
-      };
-      const [clientSyncError, clientSyncResult] = await tryCatch(
-        async () => await clientSyncHandler({ clientInput: normalizedData, token: tempToken, functions: functionsObject, serverOutput, roomCode: receiver, stream: emitClientSyncStream }),
-        void 0,
-        {
-          handler: "handleSyncRequest",
-          sync: resolvedName,
-          stage: "client",
-          sourceUserId: user?.id,
-          targetToken: tempToken,
-          receiver,
-          transport: "socket"
-        }
-      );
-      if (clientSyncError) {
-        tempSocket.emit(socketEventNames2.sync, {
-          cb,
-          fullName: resolvedName,
-          ...buildSyncError({
-            response: { status: "error", errorCode: "sync.clientExecutionFailed" },
-            preferred: extractLanguageFromHeader(tempSocket.handshake.headers["x-language"]) || extractLanguageFromHeader(tempSocket.handshake.headers["accept-language"])
-          })
-        });
-        continue;
-      }
-      if (clientSyncResult?.status == "error") {
-        tempSocket.emit(socketEventNames2.sync, {
-          cb,
-          fullName: resolvedName,
-          ...buildSyncError({
-            response: ensureSyncErrorShape(clientSyncResult),
-            preferred: extractLanguageFromHeader(tempSocket.handshake.headers["x-language"]) || extractLanguageFromHeader(tempSocket.handshake.headers["accept-language"])
-          })
-        });
-        continue;
-      }
-      if (clientSyncResult?.status !== "success") {
-        tempSocket.emit(socketEventNames2.sync, {
-          cb,
-          fullName: resolvedName,
-          ...buildSyncError({
-            response: { status: "error", errorCode: "sync.invalidClientResponse" },
-            preferred: extractLanguageFromHeader(tempSocket.handshake.headers["x-language"]) || extractLanguageFromHeader(tempSocket.handshake.headers["accept-language"])
-          })
-        });
-        continue;
-      } else if (clientSyncResult?.status == "success") {
-        const result = {
-          cb,
-          fullName: resolvedName,
-          serverOutput,
-          clientOutput: clientSyncResult,
-          // Return from _client file (success only)
-          message: clientSyncResult.message || `${resolvedName} sync success`,
-          status: "success"
-        };
-        if (shouldLogDev()) {
-          getLogger2().debug(`sync: ${resolvedName} client success`, { result });
-        }
-        tempSocket.emit(socketEventNames2.sync, result);
-      }
+      await processClientSyncForRecipient({
+        tempSocket,
+        tempToken,
+        clientSyncHandler,
+        data: normalizedData,
+        functionsObject,
+        serverOutput: effectiveServerOutput,
+        receiver,
+        resolvedName,
+        callbackKey: cb,
+        transport: "socket",
+        handlerName: "handleSyncRequest",
+        logLabel: "sync",
+        shouldLogDev,
+        shouldLogStream,
+        buildSyncError,
+        //? Socket transport prefers `x-language` over `accept-language` —
+        //? preserved verbatim from the previous inlined error path.
+        resolvePreferredLocale: (headers) => extractLanguageFromHeader(headers["x-language"]) || extractLanguageFromHeader(headers["accept-language"]),
+        sourceUserId: user?.id
+      });
     } else {
       const result = {
         cb,
         fullName: resolvedName,
-        serverOutput,
+        serverOutput: effectiveServerOutput,
         clientOutput: {},
-        // No client file, so empty output
         message: `${resolvedName} sync success`,
         status: "success"
       };
       if (shouldLogDev()) {
-        getLogger2().debug(`sync: ${resolvedName} server-only success`, { result });
+        getLogger3().debug(`sync: ${resolvedName} server-only success`, { result });
       }
-      tempSocket.emit(socketEventNames2.sync, result);
+      tempSocket.emit(socketEventNames3.sync, result);
     }
   }
   fanoutPayload.recipientCount = recipientCount;
   await dispatchHook2("postSyncFanout", fanoutPayload);
   cleanupRequest();
-  return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), {
-    status: "success",
-    message: `sync ${resolvedName} success`,
-    result: serverOutput
+  return originatorAcked;
+}
+async function handleSyncRequest(args) {
+  await runWithErrorTrackerIdentityScope(() => handleSyncRequestInner(args));
+}
+async function handleSyncRequestInner({ msg, socket, token }) {
+  const ioInstance = getIoInstance2();
+  if (!ioInstance) {
+    return;
+  }
+  const preferredLocale = extractLanguageFromHeader(socket.handshake.headers["x-language"]) || extractLanguageFromHeader(socket.handshake.headers["accept-language"]);
+  if (!validateSyncMessage({ msg, socket, preferredLocale })) return;
+  const { responseIndex } = msg;
+  const preMessageResult = await dispatchHook2("preSocketMessage", {
+    channel: "sync",
+    socketId: socket.id,
+    ip: socket.handshake.address,
+    authenticated: Boolean(token),
+    routeName: typeof msg.name === "string" ? msg.name : void 0
+  });
+  if (preMessageResult.stopped) {
+    return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), normalizeErrorResponse2({
+      response: {
+        status: "error",
+        errorCode: preMessageResult.signal.errorCode,
+        httpStatus: preMessageResult.signal.httpStatus
+      },
+      preferredLocale
+    }));
+  }
+  let currentRouteName;
+  let currentPerRouteFormatter;
+  let currentUserId;
+  const buildSyncError = ({
+    response,
+    preferred,
+    userLanguage
+  }) => buildFormattedError({
+    response,
+    preferred,
+    userLanguage,
+    routeName: currentRouteName,
+    transport: "socket",
+    userId: currentUserId,
+    perRouteFormatter: currentPerRouteFormatter
+  });
+  const parsedFields = parseSyncFields({ msg, socket, responseIndex, preferredLocale, buildSyncError });
+  if (!parsedFields.ok) return;
+  const { name, normalizedData, cb, receiver, resolvedName } = parsedFields;
+  currentRouteName = resolvedName;
+  if (shouldLogDev()) {
+    getLogger3().debug(`sync: ${resolvedName} called`, { sync: resolvedName });
+  }
+  const user = await readSession(token);
+  currentUserId = user?.id;
+  setCurrentErrorTrackerIdentity(user?.id ? { id: user.id, email: user.email ?? void 0, username: user.name ?? void 0 } : null);
+  const { syncObject, functionsObject } = await getRuntimeSyncMaps();
+  const { abortController, cleanupRequest } = setupAbortController({ socket, responseIndex });
+  let originatorAcked = false;
+  const [handlerError] = await tryCatch2(async () => {
+    if (!checkRouteExists({ syncObject, resolvedName, name, socket, responseIndex, buildSyncError, preferredLocale, user, cleanupRequest })) return;
+    const { emitServerSyncStream, emitBroadcastSyncStream, emitStreamToTokens, flushPressure } = buildSyncStreamEmitters({
+      cb,
+      receiver,
+      resolvedName,
+      logLabel: "sync",
+      signal: abortController.signal,
+      originatorSocket: socket,
+      emitOriginatorChunk: (payload) => {
+        if (typeof responseIndex !== "number") return;
+        socket.emit(buildSyncProgressEventName(responseIndex), payload);
+      }
+    });
+    const serverSyncEntry = syncObject[`${resolvedName}_server`];
+    currentPerRouteFormatter = serverSyncEntry?.errorFormatter;
+    if (!runSyncAuth({ serverSyncEntry, user, resolvedName, socket, responseIndex, buildSyncError, preferredLocale, cleanupRequest })) return;
+    if (!runReceiverAuth({ receiver, resolvedName, socket, responseIndex, buildSyncError, preferredLocale, user, cleanupRequest })) return;
+    const rateLimitOk = await applySyncRateLimits({
+      resolvedName,
+      token,
+      socket,
+      user,
+      responseIndex,
+      buildSyncError,
+      preferredLocale,
+      routeLimit: serverSyncEntry?.rateLimit
+    });
+    if (!rateLimitOk) {
+      cleanupRequest();
+      return;
+    }
+    if (!await runPreAuthorizeHook({ resolvedName, normalizedData, user, receiver, socket, responseIndex, buildSyncError, preferredLocale, cleanupRequest })) return;
+    const executionResult = await runSyncServerExecution({
+      serverSyncEntry,
+      resolvedName,
+      normalizedData,
+      user,
+      receiver,
+      socket,
+      responseIndex,
+      buildSyncError,
+      preferredLocale,
+      cleanupRequest,
+      functionsObject,
+      emitServerSyncStream,
+      emitBroadcastSyncStream,
+      emitStreamToTokens,
+      flushPressure,
+      abortController
+    });
+    if (!executionResult.ok) return;
+    const { serverOutput } = executionResult;
+    const fanoutAcked = await runSyncFanout({
+      ioInstance,
+      receiver,
+      resolvedName,
+      normalizedData,
+      serverOutput,
+      user,
+      socket,
+      responseIndex,
+      buildSyncError,
+      preferredLocale,
+      cleanupRequest,
+      ignoreSelf: parsedFields.ignoreSelf,
+      token,
+      cb,
+      syncObject,
+      functionsObject
+    });
+    if (typeof fanoutAcked === "boolean") {
+      originatorAcked = fanoutAcked || originatorAcked;
+    }
+  }, void 0, {
+    handler: "handleSyncRequest",
+    sync: currentRouteName,
+    stage: "handler",
+    userId: currentUserId,
+    receiver,
+    transport: "socket"
   });
+  if (handlerError) {
+    if (shouldLogDev()) {
+      getLogger3().error(`sync: unhandled error for ${currentRouteName ?? msg.name}`, handlerError, { sync: currentRouteName });
+    }
+    cleanupRequest();
+    if (!originatorAcked) {
+      return typeof responseIndex == "number" && socket.emit(buildSyncResponseEventName(responseIndex), buildSyncError({
+        response: { status: "error", errorCode: "sync.serverExecutionFailed" },
+        preferred: preferredLocale
+      }));
+    }
+  }
 }
 
 // src/handleHttpSyncRequest.ts
-import { getSession as getSession2 } from "@luckystack/login";
-import { getProjectConfig as getProjectConfig3 } from "@luckystack/core";
-import { getRuntimeSyncMaps as getRuntimeSyncMapsFromSource } from "@luckystack/core";
 import {
+  readSession as readSession2,
+  getProjectConfig as getProjectConfig4,
+  getRuntimeSyncMaps as getRuntimeSyncMapsFromSource,
   validateRequest as validateRequest2,
   extractTokenFromSocket as extractTokenFromSocket2,
+  formatRoomName as formatRoomName2,
   getIoInstance as getIoInstance3,
-  tryCatch as tryCatch2,
+  tryCatch as tryCatch3,
   parseTransportRouteName as parseTransportRouteName2,
   checkRateLimit as checkRateLimit2,
-  socketEventNames as socketEventNames3,
+  socketEventNames as socketEventNames4,
   validateInputByType as validateInputByType2,
   dispatchHook as dispatchHook3,
-  getLogger as getLogger3
+  getLogger as getLogger4,
+  runWithErrorTrackerIdentityScope as runWithErrorTrackerIdentityScope2,
+  setCurrentErrorTrackerIdentity as setCurrentErrorTrackerIdentity2,
+  deriveTokenBucketId as deriveTokenBucketId2,
+  isLoopbackIp as isLoopbackIp2,
+  extractLanguageFromHeader as extractLanguageFromHeader2
 } from "@luckystack/core";
-import { extractLanguageFromHeader as extractLanguageFromHeader2, normalizeErrorResponse as normalizeErrorResponse2, applyErrorFormatter as applyErrorFormatter2 } from "@luckystack/core";
-var shouldLogDev2 = () => getProjectConfig3().logging.devLogs;
-var shouldLogStream3 = () => getProjectConfig3().logging.stream;
 var applyHttpSyncRateLimits = async ({
   resolvedName,
   token,
   requesterIp,
   user,
   buildSyncError,
-  preferredLocale
+  preferredLocale,
+  routeLimit
 }) => {
-  const config = getProjectConfig3();
-  const effectiveSyncLimit = config.rateLimiting.defaultApiLimit;
+  const config = getProjectConfig4();
+  const effectiveSyncLimit = routeLimit === void 0 ? config.rateLimiting.defaultApiLimit : routeLimit;
   if (effectiveSyncLimit !== false && effectiveSyncLimit > 0) {
-    const requesterIdentity = token ?? requesterIp ?? "anonymous";
-    const keyPrefix = token ? "token" : "ip";
+    const identityCb = config.rateLimiting.identity;
+    const customIdentity = identityCb?.({ routeName: resolvedName, userId: user?.id ?? null, ip: requesterIp ?? "", transport: "http" }) ?? null;
+    const requesterIdentity = customIdentity?.id ?? (token ? deriveTokenBucketId2(token) : requesterIp ?? "unknown");
+    const keyPrefix = customIdentity?.scope ?? (token ? "token" : "ip");
     const rateLimitKey = `${keyPrefix}:${requesterIdentity}:sync:${resolvedName}`;
     const { allowed, resetIn } = await checkRateLimit2({
       key: rateLimitKey,
@@ -734,13 +1213,17 @@ var applyHttpSyncRateLimits = async ({
     });
     if (!allowed) {
       void dispatchHook3("rateLimitExceeded", {
-        scope: token ? "user" : "route",
+        //? Parity with the API handler: an anonymous per-route bucket is IP-keyed,
+        //? so the scope is `ip` (with `route` still set to mark it a per-route
+        //? bucket vs the global `:sync:all` IP bucket), never `route`.
+        scope: token ? "user" : "ip",
         key: rateLimitKey,
         limit: effectiveSyncLimit,
         windowMs: config.rateLimiting.windowMs,
         count: effectiveSyncLimit + 1,
         route: resolvedName,
-        userId: user?.id
+        userId: user?.id,
+        ip: token ? void 0 : requesterIp
       });
       return buildSyncError({
         response: {
@@ -755,7 +1238,7 @@ var applyHttpSyncRateLimits = async ({
     }
   }
   const defaultIpLimit = config.rateLimiting.defaultIpLimit;
-  const requesterIsLoopback = process.env.NODE_ENV !== "production" && (requesterIp === "127.0.0.1" || requesterIp === "::1" || requesterIp === "::ffff:127.0.0.1" || typeof requesterIp === "string" && requesterIp.startsWith("127."));
+  const requesterIsLoopback = config.rateLimiting.skipLoopbackInDev && process.env.NODE_ENV !== "production" && isLoopbackIp2(requesterIp ?? "");
   if (!requesterIsLoopback && defaultIpLimit !== false && defaultIpLimit > 0) {
     const ipBucket = requesterIp ?? "unknown";
     const ipKey = `ip:${ipBucket}:sync:all`;
@@ -787,7 +1270,379 @@ var applyHttpSyncRateLimits = async ({
   }
   return null;
 };
-async function handleHttpSyncRequest({
+async function stageResolveRoute(ctx) {
+  const { name, cb, normalizedReceiver, user, buildSyncError, preferredLocale } = ctx;
+  if (!name || typeof name !== "string") {
+    return {
+      error: buildSyncError({
+        response: { status: "error", errorCode: "sync.invalidRequest" },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  const parsedRoute = parseTransportRouteName2({ value: name, prefix: "sync" });
+  if (parsedRoute.status === "error") {
+    return {
+      error: buildSyncError({
+        response: {
+          status: "error",
+          errorCode: "routing.invalidServiceRouteName",
+          errorParams: [{ key: "name", value: name }]
+        },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  const resolvedName = parsedRoute.normalizedFullName;
+  const callbackName = typeof cb === "string" && cb.trim().length > 0 ? cb.trim() : `${parsedRoute.serviceRoute.normalizedRouteName}/${parsedRoute.version}`;
+  if (!normalizedReceiver) {
+    return {
+      error: buildSyncError({
+        response: { status: "error", errorCode: "sync.missingReceiver" },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  const { syncObject } = await getRuntimeSyncMapsFromSource();
+  if (!syncObject[`${resolvedName}_client`] && !syncObject[`${resolvedName}_server`]) {
+    return {
+      error: buildSyncError({
+        response: { status: "error", errorCode: "sync.notFound" },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  if (!syncObject[`${resolvedName}_server`]) {
+    if (shouldLogDev()) {
+      getLogger4().warn(`http sync: ${resolvedName} has a _client file but no required _server file`, { sync: resolvedName, transport: "http" });
+    }
+    return {
+      error: buildSyncError({
+        response: { status: "error", errorCode: "sync.notFound" },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  return { resolvedName, callbackName };
+}
+function stageCheckAuth(serverSyncEntry, ctx) {
+  const { user, preferredLocale, buildSyncError } = ctx;
+  const { auth } = serverSyncEntry;
+  if (auth.login && !user?.id) {
+    return buildSyncError({
+      response: { status: "error", errorCode: "auth.required" },
+      preferred: preferredLocale
+    });
+  }
+  if (auth.additional && auth.additional.length > 0 && !user) {
+    return buildSyncError({
+      response: { status: "error", errorCode: "auth.required" },
+      preferred: preferredLocale
+    });
+  }
+  const validationResult = validateRequest2({ auth, user });
+  if (validationResult.status === "error") {
+    return buildSyncError({
+      response: {
+        status: "error",
+        errorCode: validationResult.errorCode || "auth.forbidden",
+        errorParams: validationResult.errorParams,
+        httpStatus: validationResult.httpStatus
+      },
+      preferred: preferredLocale,
+      userLanguage: user?.language
+    });
+  }
+  return null;
+}
+function stageAuthorizeReceiver(resolvedName, ctx) {
+  const { normalizedReceiver, user, preferredLocale, buildSyncError } = ctx;
+  const syncConfig = getProjectConfig4().sync;
+  const receiverAuth = authorizeSyncReceiver({
+    receiver: normalizedReceiver,
+    allowClientReceiverAll: syncConfig.allowClientReceiverAll,
+    requireRoomMembership: syncConfig.requireRoomMembership,
+    isMember: user ? () => Boolean(user.roomCodes?.includes(normalizedReceiver)) : null
+  });
+  if (!receiverAuth.allowed) {
+    if (shouldLogDev()) {
+      getLogger4().warn(`http sync: receiver authorization failed for ${resolvedName}`, { sync: resolvedName, receiver: normalizedReceiver, errorCode: receiverAuth.errorCode, transport: "http" });
+    }
+    return buildSyncError({
+      response: { status: "error", errorCode: receiverAuth.errorCode, httpStatus: 403 },
+      preferred: preferredLocale,
+      userLanguage: user?.language
+    });
+  }
+  return null;
+}
+async function stageRunAuthorizeHooks(resolvedName, ctx) {
+  const { data, normalizedReceiver, user, preferredLocale, buildSyncError } = ctx;
+  const preAuthorizeResult = await dispatchHook3("preSyncAuthorize", {
+    routeName: resolvedName,
+    data,
+    user,
+    receiver: normalizedReceiver,
+    transport: "http"
+  });
+  if (preAuthorizeResult.stopped) {
+    return buildSyncError({
+      response: {
+        status: "error",
+        errorCode: preAuthorizeResult.signal.errorCode,
+        httpStatus: preAuthorizeResult.signal.httpStatus
+      },
+      preferred: preferredLocale,
+      userLanguage: user?.language
+    });
+  }
+  void dispatchHook3("postSyncAuthorize", {
+    routeName: resolvedName,
+    data,
+    user,
+    receiver: normalizedReceiver,
+    transport: "http"
+  });
+  return null;
+}
+async function stageValidateInput(resolvedName, serverSyncEntry, ctx) {
+  const { data, normalizedReceiver, user, preferredLocale, buildSyncError } = ctx;
+  const preValidateResult = await dispatchHook3("preSyncValidate", {
+    routeName: resolvedName,
+    data,
+    user,
+    receiver: normalizedReceiver,
+    transport: "http"
+  });
+  if (preValidateResult.stopped) {
+    return buildSyncError({
+      response: {
+        status: "error",
+        errorCode: preValidateResult.signal.errorCode,
+        httpStatus: preValidateResult.signal.httpStatus
+      },
+      preferred: preferredLocale,
+      userLanguage: user?.language
+    });
+  }
+  const { inputType, inputTypeFilePath } = serverSyncEntry;
+  if (resolveSyncValidationMode(serverSyncEntry.validation) === "strict") {
+    const inputValidation = await validateInputByType2({
+      typeText: inputType,
+      value: data,
+      rootKey: "clientInput",
+      filePath: inputTypeFilePath
+    });
+    void dispatchHook3("postSyncValidate", {
+      routeName: resolvedName,
+      data,
+      user,
+      receiver: normalizedReceiver,
+      transport: "http",
+      validation: inputValidation.status === "error" ? { status: "error", message: inputValidation.message } : { status: "success" }
+    });
+    if (inputValidation.status === "error") {
+      if (shouldLogDev()) {
+        getLogger4().warn(`http sync: input validation failed for ${resolvedName}`, { sync: resolvedName, message: inputValidation.message, transport: "http" });
+      }
+      return buildSyncError({
+        response: {
+          status: "error",
+          errorCode: "sync.invalidInputType"
+        },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      });
+    }
+  } else {
+    void dispatchHook3("postSyncValidate", {
+      routeName: resolvedName,
+      data,
+      user,
+      receiver: normalizedReceiver,
+      transport: "http",
+      validation: { status: "success" }
+    });
+  }
+  return null;
+}
+async function stageExecuteServer(resolvedName, serverSyncEntry, functionsObject, ctx) {
+  const { data, normalizedReceiver, name, user, preferredLocale, buildSyncError, effectiveAbortSignal, cb, stream } = ctx;
+  const { main: serverMain } = serverSyncEntry;
+  const { emitServerSyncStream, emitBroadcastSyncStream, emitStreamToTokens, flushPressure } = buildSyncStreamEmitters({
+    cb,
+    receiver: normalizedReceiver,
+    resolvedName,
+    logLabel: "http sync",
+    signal: effectiveAbortSignal,
+    //? No originatorSocket for HTTP/SSE — `flushPressure` falls back
+    //? to room-socket measurement only. SSE backpressure is the
+    //? caller's responsibility (Node's `res.write` returns a bool).
+    //? Originator chunks travel back via SSE; broadcast / targeted
+    //? chunks still flow over Socket.io to recipients in the receiver room.
+    emitOriginatorChunk: (payload) => {
+      stream?.(payload);
+    }
+  });
+  const executePayload = {
+    routeName: resolvedName,
+    data,
+    user,
+    receiver: normalizedReceiver,
+    transport: "http",
+    result: void 0,
+    error: null,
+    durationMs: 0
+  };
+  const preExecuteResult = await dispatchHook3("preSyncExecute", executePayload);
+  if (preExecuteResult.stopped) {
+    return {
+      error: buildSyncError({
+        response: {
+          status: "error",
+          errorCode: preExecuteResult.signal.errorCode,
+          httpStatus: preExecuteResult.signal.httpStatus
+        },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  const executeStart = Date.now();
+  const [serverSyncError, serverSyncResult] = await tryCatch3(
+    async () => await serverMain({
+      clientInput: data,
+      user,
+      functions: functionsObject,
+      roomCode: normalizedReceiver,
+      stream: emitServerSyncStream,
+      broadcastStream: emitBroadcastSyncStream,
+      streamTo: emitStreamToTokens,
+      abortSignal: effectiveAbortSignal,
+      flushPressure
+    }),
+    void 0,
+    {
+      handler: "handleHttpSyncRequest",
+      sync: resolvedName,
+      stage: "server",
+      userId: user?.id,
+      receiver: name,
+      transport: "http"
+    }
+  );
+  executePayload.result = serverSyncResult;
+  executePayload.error = serverSyncError ?? null;
+  executePayload.durationMs = Date.now() - executeStart;
+  await dispatchHook3("postSyncExecute", executePayload);
+  if (serverSyncError) {
+    return {
+      error: buildSyncError({
+        response: { status: "error", errorCode: "sync.serverExecutionFailed" },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  if (serverSyncResult?.status == "error") {
+    return {
+      error: buildSyncError({
+        response: serverSyncResult,
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  if (serverSyncResult?.status !== "success") {
+    return {
+      error: buildSyncError({
+        response: { status: "error", errorCode: "sync.invalidServerResponse" },
+        preferred: preferredLocale,
+        userLanguage: user?.language
+      })
+    };
+  }
+  return { serverOutput: serverSyncResult };
+}
+async function stageFanout(resolvedName, callbackName, serverOutput, syncObject, functionsObject, ctx) {
+  const { data, normalizedReceiver, token, ignoreSelf, user, buildSyncError } = ctx;
+  const ioInstance = getIoInstance3();
+  const fanoutPayload = {
+    routeName: resolvedName,
+    data,
+    user,
+    receiver: normalizedReceiver,
+    serverOutput,
+    transport: "http",
+    recipientCount: 0
+  };
+  await dispatchHook3("preSyncFanout", fanoutPayload);
+  const physicalReceiver = normalizedReceiver === "all" ? "all" : formatRoomName2(normalizedReceiver, { purpose: "broadcast", userId: user?.id ?? null });
+  const sockets = physicalReceiver === "all" ? await ioInstance.fetchSockets() : await ioInstance.in(physicalReceiver).fetchSockets();
+  let recipientCount = 0;
+  for (const tempSocket of sockets) {
+    const tempToken = extractTokenFromSocket2(tempSocket);
+    if (ignoreSelf && typeof ignoreSelf === "boolean" && token && token === tempToken) {
+      continue;
+    }
+    const preRecipientResult = await dispatchHook3("preSyncRecipient", {
+      routeName: resolvedName,
+      receiver: normalizedReceiver,
+      recipientSocketId: tempSocket.id,
+      recipientUserId: null,
+      serverOutput
+    });
+    if (preRecipientResult.stopped) {
+      continue;
+    }
+    recipientCount++;
+    if (syncObject[`${resolvedName}_client`]) {
+      const clientSyncHandler = syncObject[`${resolvedName}_client`];
+      await processClientSyncForRecipient({
+        tempSocket,
+        tempToken,
+        clientSyncHandler,
+        data,
+        functionsObject,
+        serverOutput,
+        receiver: normalizedReceiver,
+        resolvedName,
+        callbackKey: callbackName,
+        transport: "http",
+        handlerName: "handleHttpSyncRequest",
+        logLabel: "http sync",
+        shouldLogDev,
+        shouldLogStream,
+        buildSyncError,
+        //? HTTP transport prefers `accept-language` over `x-language`
+        //? (reversed vs. the socket handler) — preserved verbatim from the
+        //? previous inlined error path.
+        resolvePreferredLocale: (headers) => extractLanguageFromHeader2(headers["accept-language"] || headers["x-language"]),
+        sourceUserId: user?.id
+      });
+      continue;
+    }
+    tempSocket.emit(socketEventNames4.sync, {
+      cb: callbackName,
+      fullName: resolvedName,
+      serverOutput,
+      clientOutput: {},
+      message: `${resolvedName} sync success`,
+      status: "success"
+    });
+  }
+  fanoutPayload.recipientCount = recipientCount;
+  await dispatchHook3("postSyncFanout", fanoutPayload);
+}
+async function handleHttpSyncRequest(args) {
+  return runWithErrorTrackerIdentityScope2(() => handleHttpSyncRequestScoped(args));
+}
+async function handleHttpSyncRequestScoped({
   name,
   cb,
   data,
@@ -800,51 +1655,31 @@ async function handleHttpSyncRequest({
   stream,
   abortSignal
 }) {
-  if (shouldLogDev2()) {
-    getLogger3().debug(`http sync: ${name} called`);
+  if (shouldLogDev()) {
+    getLogger4().debug(`http sync: ${name} called`);
   }
   const effectiveAbortSignal = abortSignal ?? new AbortController().signal;
   const normalizedReceiver = typeof receiver === "string" ? receiver.trim() : "";
   const preferredLocale = extractLanguageFromHeader2(xLanguageHeader) || extractLanguageFromHeader2(acceptLanguageHeader);
-  const user = await getSession2(token);
+  const user = await readSession2(token);
+  setCurrentErrorTrackerIdentity2(user?.id ? { id: user.id, email: user.email ?? void 0, username: user.name ?? void 0 } : null);
   let currentRouteName;
   let currentPerRouteFormatter;
   const buildSyncError = ({
     response,
     preferred,
     userLanguage
-  }) => {
-    const normalized = normalizeErrorResponse2({
-      response,
-      preferredLocale: preferred,
-      userLanguage
-    });
-    const baseEnvelope = {
-      status: normalized.status,
-      message: normalized.message,
-      errorCode: normalized.errorCode,
-      errorParams: normalized.errorParams,
-      httpStatus: normalized.httpStatus
-    };
-    return applyErrorFormatter2({
-      response: baseEnvelope,
-      routeName: currentRouteName ?? "sync/unknown",
-      transport: "http",
-      userId: user?.id,
-      perRouteFormatter: currentPerRouteFormatter
-    });
-  };
-  const ensureSyncErrorShape = (response) => {
-    if (typeof response.errorCode === "string" && response.errorCode.trim().length > 0) {
-      return response;
-    }
-    return {
-      ...response,
-      errorCode: "sync.clientRejected"
-    };
-  };
+  }) => buildFormattedError({
+    response,
+    preferred,
+    userLanguage,
+    routeName: currentRouteName,
+    transport: "http",
+    userId: user?.id,
+    perRouteFormatter: currentPerRouteFormatter
+  });
   const ioInstance = getIoInstance3();
-  const [bodyError, bodyResult] = await tryCatch2(async () => {
+  const [bodyError, bodyResult] = await tryCatch3(async () => {
     if (!ioInstance) {
       return buildSyncError({
         response: { status: "error", errorCode: "sync.ioUnavailable" },
@@ -852,285 +1687,66 @@ async function handleHttpSyncRequest({
         userLanguage: user?.language
       });
     }
-    if (!name || typeof name !== "string") {
-      return buildSyncError({
-        response: { status: "error", errorCode: "sync.invalidRequest" },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      });
-    }
-    const parsedRoute = parseTransportRouteName2({ value: name, prefix: "sync" });
-    if (parsedRoute.status === "error") {
-      return buildSyncError({
-        response: {
-          status: "error",
-          errorCode: "routing.invalidServiceRouteName",
-          errorParams: [{ key: "name", value: name }]
-        },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      });
-    }
-    const resolvedName = parsedRoute.normalizedFullName;
+    const ctx = {
+      name,
+      cb,
+      data,
+      normalizedReceiver,
+      ignoreSelf,
+      token,
+      requesterIp,
+      stream,
+      effectiveAbortSignal,
+      preferredLocale,
+      user,
+      buildSyncError
+    };
+    const routeResult = await stageResolveRoute(ctx);
+    if (routeResult.error) return routeResult.error;
+    const { resolvedName, callbackName } = routeResult;
     currentRouteName = resolvedName;
-    const callbackName = typeof cb === "string" && cb.trim().length > 0 ? cb.trim() : `${parsedRoute.serviceRoute.normalizedRouteName}/${parsedRoute.version}`;
-    if (!normalizedReceiver) {
-      return buildSyncError({
-        response: { status: "error", errorCode: "sync.missingReceiver" },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      });
-    }
     const { syncObject, functionsObject } = await getRuntimeSyncMapsFromSource();
-    if (!syncObject[`${resolvedName}_client`] && !syncObject[`${resolvedName}_server`]) {
-      return buildSyncError({
-        response: { status: "error", errorCode: "sync.notFound" },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      });
-    }
     const serverSyncEntry = syncObject[`${resolvedName}_server`];
     currentPerRouteFormatter = serverSyncEntry?.errorFormatter;
     if (serverSyncEntry) {
-      const { auth } = serverSyncEntry;
-      if (auth.login && !user?.id) {
-        return buildSyncError({
-          response: { status: "error", errorCode: "auth.required" },
-          preferred: preferredLocale
-        });
-      }
-      const validationResult = validateRequest2({ auth, user });
-      if (validationResult.status === "error") {
-        return buildSyncError({
-          response: {
-            status: "error",
-            errorCode: validationResult.errorCode || "auth.forbidden",
-            errorParams: validationResult.errorParams,
-            httpStatus: validationResult.httpStatus
-          },
-          preferred: preferredLocale,
-          userLanguage: user?.language
-        });
-      }
-    }
-    const preAuthorizeResult = await dispatchHook3("preSyncAuthorize", {
-      routeName: resolvedName,
-      data,
-      user,
-      receiver: normalizedReceiver,
-      transport: "http"
-    });
-    if (preAuthorizeResult.stopped) {
-      return buildSyncError({
-        response: {
-          status: "error",
-          errorCode: preAuthorizeResult.signal.errorCode,
-          httpStatus: preAuthorizeResult.signal.httpStatus
-        },
-        preferred: preferredLocale,
-        userLanguage: user?.language
-      });
+      const authError = stageCheckAuth(serverSyncEntry, ctx);
+      if (authError) return authError;
     }
+    const receiverError = stageAuthorizeReceiver(resolvedName, ctx);
+    if (receiverError) return receiverError;
     const rateLimitResult = await applyHttpSyncRateLimits({
       resolvedName,
       token,
       requesterIp,
       user,
       buildSyncError,
-      preferredLocale
+      preferredLocale,
+      routeLimit: serverSyncEntry?.rateLimit
     });
     if (rateLimitResult) return rateLimitResult;
+    const authorizeHookError = await stageRunAuthorizeHooks(resolvedName, ctx);
+    if (authorizeHookError) return authorizeHookError;
     let serverOutput = {};
     if (serverSyncEntry) {
-      const { main: serverMain, inputType, inputTypeFilePath } = serverSyncEntry;
-      const { emitServerSyncStream, emitBroadcastSyncStream, emitStreamToTokens, flushPressure } = buildSyncStreamEmitters({
-        cb,
-        receiver: normalizedReceiver,
-        resolvedName,
-        logLabel: "http sync",
-        signal: effectiveAbortSignal,
-        //? No originatorSocket for HTTP/SSE — `flushPressure` falls back
-        //? to room-socket measurement only. SSE backpressure is the
-        //? caller's responsibility (Node's `res.write` returns a bool).
-        //? Originator chunks travel back via SSE; broadcast / targeted
-        //? chunks still flow over Socket.io to recipients in the receiver room.
-        emitOriginatorChunk: (payload) => {
-          stream?.(payload);
-        }
-      });
-      const inputValidation = await validateInputByType2({
-        typeText: inputType,
-        value: data,
-        rootKey: "clientInput",
-        filePath: inputTypeFilePath
-      });
-      if (inputValidation.status === "error") {
-        return buildSyncError({
-          response: {
-            status: "error",
-            errorCode: "sync.invalidInputType",
-            errorParams: [{ key: "message", value: inputValidation.message }]
-          },
-          preferred: preferredLocale,
-          userLanguage: user?.language
-        });
-      }
-      const [serverSyncError, serverSyncResult] = await tryCatch2(
-        async () => await serverMain({
-          clientInput: data,
-          user,
-          functions: functionsObject,
-          roomCode: normalizedReceiver,
-          stream: emitServerSyncStream,
-          broadcastStream: emitBroadcastSyncStream,
-          streamTo: emitStreamToTokens,
-          abortSignal: effectiveAbortSignal,
-          flushPressure
-        }),
-        void 0,
-        {
-          handler: "handleHttpSyncRequest",
-          sync: resolvedName,
-          stage: "server",
-          userId: user?.id,
-          receiver,
-          transport: "http"
-        }
-      );
-      if (serverSyncError) {
-        return buildSyncError({
-          response: { status: "error", errorCode: "sync.serverExecutionFailed" },
-          preferred: preferredLocale,
-          userLanguage: user?.language
-        });
-      }
-      if (serverSyncResult?.status == "error") {
-        return buildSyncError({
-          response: serverSyncResult,
-          preferred: preferredLocale,
-          userLanguage: user?.language
-        });
-      }
-      if (serverSyncResult?.status !== "success") {
-        return buildSyncError({
-          response: { status: "error", errorCode: "sync.invalidServerResponse" },
-          preferred: preferredLocale,
-          userLanguage: user?.language
-        });
-      }
-      serverOutput = serverSyncResult;
-    }
-    const fanoutPayload = {
-      routeName: resolvedName,
-      data,
-      user,
-      receiver: normalizedReceiver,
-      serverOutput,
-      transport: "http",
-      recipientCount: 0
-    };
-    await dispatchHook3("preSyncFanout", fanoutPayload);
-    const sockets = receiver === "all" ? await ioInstance.fetchSockets() : await ioInstance.in(normalizedReceiver).fetchSockets();
-    let recipientCount = 0;
-    for (const tempSocket of sockets) {
-      const tempToken = extractTokenFromSocket2(tempSocket);
-      if (ignoreSelf && token && token === tempToken) {
-        continue;
-      }
-      if (syncObject[`${resolvedName}_client`]) {
-        const clientSyncHandler = syncObject[`${resolvedName}_client`];
-        const emitClientSyncStream = (payload = {}) => {
-          if (shouldLogStream3()) {
-            getLogger3().debug(`http sync: ${resolvedName} client stream`, { payload });
-          }
-          tempSocket.emit(socketEventNames3.sync, {
-            ...payload,
-            cb: callbackName,
-            fullName: resolvedName,
-            status: "stream"
-          });
-        };
-        const [clientSyncError, clientSyncResult] = await tryCatch2(
-          async () => await clientSyncHandler({ clientInput: data, token: tempToken, functions: functionsObject, serverOutput, roomCode: normalizedReceiver, stream: emitClientSyncStream }),
-          void 0,
-          {
-            handler: "handleHttpSyncRequest",
-            sync: resolvedName,
-            stage: "client",
-            sourceUserId: user?.id,
-            targetToken: tempToken,
-            receiver,
-            transport: "http"
-          }
-        );
-        if (clientSyncError) {
-          tempSocket.emit(socketEventNames3.sync, {
-            cb: callbackName,
-            fullName: resolvedName,
-            ...buildSyncError({
-              response: { status: "error", errorCode: "sync.clientExecutionFailed" },
-              preferred: extractLanguageFromHeader2(tempSocket.handshake.headers["accept-language"] || tempSocket.handshake.headers["x-language"])
-            })
-          });
-          continue;
-        }
-        if (clientSyncResult?.status === "error") {
-          tempSocket.emit(socketEventNames3.sync, {
-            cb: callbackName,
-            fullName: resolvedName,
-            ...buildSyncError({
-              response: ensureSyncErrorShape(clientSyncResult),
-              preferred: extractLanguageFromHeader2(tempSocket.handshake.headers["accept-language"] || tempSocket.handshake.headers["x-language"])
-            })
-          });
-          continue;
-        }
-        if (clientSyncResult?.status !== "success") {
-          tempSocket.emit(socketEventNames3.sync, {
-            cb: callbackName,
-            fullName: resolvedName,
-            ...buildSyncError({
-              response: { status: "error", errorCode: "sync.invalidClientResponse" },
-              preferred: extractLanguageFromHeader2(tempSocket.handshake.headers["accept-language"] || tempSocket.handshake.headers["x-language"])
-            })
-          });
-          continue;
-        }
-        tempSocket.emit(socketEventNames3.sync, {
-          cb: callbackName,
-          fullName: resolvedName,
-          serverOutput,
-          clientOutput: clientSyncResult,
-          message: clientSyncResult.message || `${resolvedName} sync success`,
-          status: "success"
-        });
-        recipientCount++;
-        continue;
-      }
-      tempSocket.emit(socketEventNames3.sync, {
-        cb: callbackName,
-        fullName: resolvedName,
-        serverOutput,
-        clientOutput: {},
-        message: `${resolvedName} sync success`,
-        status: "success"
-      });
-      recipientCount++;
+      const validationError = await stageValidateInput(resolvedName, serverSyncEntry, ctx);
+      if (validationError) return validationError;
+      const executeResult = await stageExecuteServer(resolvedName, serverSyncEntry, functionsObject, ctx);
+      if (executeResult.error) return executeResult.error;
+      serverOutput = executeResult.serverOutput;
     }
-    fanoutPayload.recipientCount = recipientCount;
-    await dispatchHook3("postSyncFanout", fanoutPayload);
-    if (shouldLogDev2()) {
-      getLogger3().debug(`http sync: ${resolvedName} completed`);
+    await stageFanout(resolvedName, callbackName, serverOutput, syncObject, functionsObject, ctx);
+    if (shouldLogDev()) {
+      getLogger4().debug(`http sync: ${resolvedName} completed`);
     }
     const serverMessage = serverOutput.message;
     return {
-      ...serverOutput,
       status: "success",
-      message: typeof serverMessage === "string" ? serverMessage : `${resolvedName} sync success`
+      message: typeof serverMessage === "string" ? serverMessage : `${resolvedName} sync success`,
+      result: serverOutput
     };
   });
   if (bodyError) {
-    getLogger3().error(`http sync: ${name} threw`, bodyError, { sync: name });
+    getLogger4().error(`http sync: ${name} threw`, bodyError, { sync: name });
     return buildSyncError({
       response: { status: "error", errorCode: "sync.serverExecutionFailed" },
       preferred: preferredLocale,
@@ -1145,9 +1761,9 @@ async function handleHttpSyncRequest({
 }
 
 // src/streamThrottle.ts
-import { getProjectConfig as getProjectConfig4 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig5 } from "@luckystack/core";
 var createStreamThrottle = (options = {}) => {
-  const defaults = getProjectConfig4().sync.streamThrottle;
+  const defaults = getProjectConfig5().sync.streamThrottle;
   const flushAtChars = options.flushAtChars ?? defaults.flushAtChars;
   const flushEveryMs = options.flushEveryMs ?? defaults.flushEveryMs;
   const field = options.field ?? defaults.field;