borgmcp-server 0.1.4 → 0.1.5

package/src/credentials.ts

@@ -41,9 +41,7 @@ export interface CubeInvitationResult extends InvitationCubeScope {
   readonly invitation: string;
 }
 
-export interface SeatAttachResponse extends SeatAttachRecord {
-  readonly credential: string;
-}
+export type SeatAttachResponse = SeatAttachRecord;
 
 export class CredentialDigester {
   readonly #key: Buffer;
@@ -88,8 +86,9 @@ export class CredentialDigester {
 export class LiveCredentialRegistry {
   readonly #sessions = new Map<string, Set<AbortController>>();
   readonly #keys = new Map<AbortController, readonly string[]>();
+  readonly #timers = new Map<AbortController, NodeJS.Timeout>();
 
-  register(identities: string | readonly string[]): {
+  register(identities: string | readonly string[], expiresInMs?: number): {
     readonly signal: AbortSignal;
     readonly release: () => void;
   } {
@@ -101,6 +100,15 @@ export class LiveCredentialRegistry {
       sessions.add(controller);
       this.#sessions.set(key, sessions);
     }
+    if (expiresInMs !== undefined) {
+      if (expiresInMs <= 0) {
+        this.#expire(controller);
+      } else {
+        const timer = setTimeout(() => this.#expire(controller), expiresInMs);
+        timer.unref();
+        this.#timers.set(controller, timer);
+      }
+    }
     return {
       signal: controller.signal,
       release: () => this.#release(controller),
@@ -121,6 +129,11 @@ export class LiveCredentialRegistry {
   }
 
   #release(controller: AbortController): void {
+    const timer = this.#timers.get(controller);
+    if (timer !== undefined) {
+      clearTimeout(timer);
+      this.#timers.delete(controller);
+    }
     const keys = this.#keys.get(controller);
     if (keys === undefined) return;
     this.#keys.delete(controller);
@@ -130,6 +143,11 @@ export class LiveCredentialRegistry {
       if (sessions?.size === 0) this.#sessions.delete(key);
     }
   }
+
+  #expire(controller: AbortController): void {
+    this.#release(controller);
+    controller.abort();
+  }
 }
 
 export class CredentialAuthority {
@@ -269,7 +287,7 @@ export class CredentialAuthority {
 
   authenticateStatus(
     authorization: string | undefined,
-  ): Principal | "missing" | "invalid" | "revoked" {
+  ): Principal | "missing" | "invalid" | "revoked" | "evicted" {
     if (authorization === undefined) return "missing";
     const secret = bearerSecret(authorization);
     const clientDigest = safeDigest(this.#digester, secret, "client");
@@ -285,6 +303,7 @@ export class CredentialAuthority {
       return clientPrincipal(client!.clientId!);
     }
     if (droneValid) {
+      if (drone!.evictedAt !== null) return "evicted";
       if (drone!.revokedAt != null || drone!.expiresAt <= this.#clock().toISOString()) {
         return "revoked";
       }
@@ -303,32 +322,30 @@ export class CredentialAuthority {
     request: {
       readonly cubeId: string;
       readonly roleId: string;
-      readonly retryKey: string;
+      readonly sessionCredential: string;
       readonly priorDroneId?: string;
     },
   ): SeatAttachResponse {
-    const credential = generateSecret();
     const record = store.attachSeat({
-      ...request,
+      cubeId: request.cubeId,
+      roleId: request.roleId,
+      ...(request.priorDroneId === undefined ? {} : { priorDroneId: request.priorDroneId }),
       droneId: randomUUID(),
       sessionId: randomUUID(),
       credentialId: randomUUID(),
-      credentialDigest: this.#digester.digest(credential, "drone-session"),
+      credentialDigest: this.#digester.digest(request.sessionCredential, "drone-session"),
       expiresAt: new Date(this.#clock().getTime() + 86_400_000).toISOString(),
     });
-    for (const sessionId of record.revokedSessionIds) {
-      this.#registry.invalidate(sessionId);
-      this.#debugLogger.emit({ event: "credential", action: "session_revoked", sessionId });
+    if (record.result === "created") {
+      this.#debugLogger.emit({
+        event: "credential",
+        action: "session_created",
+        sessionId: record.sessionId,
+        cubeId: record.cube.id,
+        droneId: record.drone.id,
+      });
     }
-    this.#debugLogger.emit({
-      event: "credential",
-      action: "session_created",
-      sessionId: record.sessionId,
-      cubeId: record.cube.id,
-      droneId: record.drone.id,
-      generation: record.generation,
-    });
-    return { ...record, credential };
+    return record;
   }
 
   rotateClient(clientId: string): string {
@@ -354,11 +371,12 @@ export class CredentialAuthority {
 
   registerLiveSession(principal: string | Principal) {
     if (typeof principal === "string") return this.#registry.register(principal);
-    return this.#registry.register(
-      principal.kind === "drone-session"
-        ? [principal.id, principal.clientId]
-        : principal.id,
-    );
+    if (principal.kind !== "drone-session") return this.#registry.register(principal.id);
+    const expiresAt = this.#store.findActiveDroneSessionExpiry(principal.id);
+    const expiresInMs = expiresAt === null
+      ? 0
+      : new Date(expiresAt).getTime() - this.#clock().getTime();
+    return this.#registry.register([principal.id, principal.clientId], expiresInMs);
   }
 }
 

package/src/debug-log.ts

@@ -10,6 +10,7 @@ export type DebugRoute =
   | "cube_roles"
   | "cube_role"
   | "cube_role_section_patch"
+  | "cube_taxonomy_patch"
   | "cube_drones"
   | "cube_logs"
   | "cube_acks"
@@ -20,14 +21,14 @@ export type DebugRoute =
 export type DebugEvent =
   | { readonly event: "startup"; readonly bindMode: "loopback" | "lan"; readonly port: number; readonly dataDirectory: "configured" | "tls_only" }
   | { readonly event: "lifecycle"; readonly action: "listening" | "stopped" }
-  | { readonly event: "request"; readonly route: DebugRoute; readonly method: string; readonly authentication: "not_required" | "missing" | "invalid" | "revoked" | "accepted"; readonly authorization: "not_checked" | "accepted" | "denied_or_not_found"; readonly principal?: Principal; readonly status: number; readonly durationMs: number }
+  | { readonly event: "request"; readonly route: DebugRoute; readonly method: string; readonly authentication: "not_required" | "missing" | "invalid" | "revoked" | "evicted" | "accepted"; readonly authorization: "not_checked" | "accepted" | "denied_or_not_found"; readonly principal?: Principal; readonly status: number; readonly durationMs: number }
   | { readonly event: "activity_append"; readonly cubeId: string; readonly entryId: string; readonly principal: Principal; readonly droneId: string | null; readonly visibility: "broadcast" | "direct"; readonly recipientDroneIds: readonly string[] }
   | { readonly event: "cursor_replay"; readonly mode: "page" | "sse"; readonly cubeId: string; readonly cursorId: string | null; readonly returnedCount: number; readonly behindBy: number; readonly truncated: boolean }
   | { readonly event: "ack_write"; readonly cubeId: string; readonly entryId: string; readonly kind: "ack" | "claim"; readonly principal: Principal }
   | { readonly event: "decision_write"; readonly cubeId: string; readonly decisionId: string; readonly principal: Principal }
   | { readonly event: "sse_subscribe"; readonly connectionId: string; readonly cubeId: string; readonly principal: Principal; readonly replayCount: number; readonly truncated: boolean }
   | { readonly event: "sse_unsubscribe"; readonly connectionId: string; readonly cubeId: string; readonly principal: Principal; readonly deliveryCount: number }
-  | { readonly event: "credential"; readonly action: "invitation_created" | "enrollment_accepted" | "enrollment_rejected" | "session_created" | "session_revoked" | "client_rotated" | "client_revoked"; readonly purpose?: "owner" | "client"; readonly clientId?: string; readonly cubeId?: string; readonly droneId?: string; readonly sessionId?: string; readonly generation?: number }
+  | { readonly event: "credential"; readonly action: "invitation_created" | "enrollment_accepted" | "enrollment_rejected" | "session_created" | "session_revoked" | "client_rotated" | "client_revoked"; readonly purpose?: "owner" | "client"; readonly clientId?: string; readonly cubeId?: string; readonly droneId?: string; readonly sessionId?: string }
   | { readonly event: "transport_rejection"; readonly reason: "tls_client_error" | "http_parser_error" };
 
 export interface DebugLogger {
@@ -113,7 +114,6 @@ function projectEvent(event: DebugEvent): Record<string, unknown> | null {
         ...optionalUuid("cube_id", value["cubeId"]),
         ...optionalUuid("drone_id", value["droneId"]),
         ...optionalUuid("session_id", value["sessionId"]),
-        ...(Number.isSafeInteger(value["generation"]) ? { generation: value["generation"] } : {}),
       };
     case "transport_rejection":
       return { event: "transport_rejection", reason: enumValue(value["reason"], ["tls_client_error", "http_parser_error"], "tls_client_error") };
@@ -158,8 +158,8 @@ function enumValue<const T extends string>(value: unknown, allowed: readonly T[]
 }
 
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
-const DEBUG_ROUTES: readonly DebugRoute[] = ["health", "protocol", "enrollment_exchange", "client_attach", "cubes", "cube", "cube_roles", "cube_role", "cube_role_section_patch", "cube_drones", "cube_logs", "cube_acks", "cube_decisions", "cube_stream", "unknown"];
+const DEBUG_ROUTES: readonly DebugRoute[] = ["health", "protocol", "enrollment_exchange", "client_attach", "cubes", "cube", "cube_roles", "cube_role", "cube_role_section_patch", "cube_taxonomy_patch", "cube_drones", "cube_logs", "cube_acks", "cube_decisions", "cube_stream", "unknown"];
 const HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OTHER"] as const;
-const AUTH_RESULTS = ["not_required", "missing", "invalid", "revoked", "accepted"] as const;
+const AUTH_RESULTS = ["not_required", "missing", "invalid", "revoked", "evicted", "accepted"] as const;
 const AUTHZ_RESULTS = ["not_checked", "accepted", "denied_or_not_found"] as const;
 const CREDENTIAL_ACTIONS = ["invitation_created", "enrollment_accepted", "enrollment_rejected", "session_created", "session_revoked", "client_rotated", "client_revoked"] as const;

package/src/enrollment.ts

@@ -1,26 +1,37 @@
+import {
+  ErrorCode,
+  PROTOCOL_VERSION,
+  ProtocolContractError,
+  createProtocolEnvelope,
+  decodeEnrollmentExchangeRequestEnvelope,
+  type EnrollmentExchangeRequest,
+  type ProtocolEnvelope,
+} from "borgmcp-shared/protocol";
 import type { CredentialAuthority } from "./credentials.js";
 import { StorageCapacityError } from "./store.js";
 
-interface EnrollmentEnvelope {
-  readonly protocol_version: "1";
-  readonly request_id: string;
-  readonly payload: {
-    readonly invitation: string;
-    readonly retry_key: string;
-    readonly client_credential: string;
-    readonly client_name?: string;
-  };
-}
+type EnrollmentEnvelope = ProtocolEnvelope<EnrollmentExchangeRequest>;
 
 export function createEnrollmentExchange(authority: CredentialAuthority) {
   return async (body: unknown): Promise<{
-    readonly status: 201 | 400 | 401 | 507;
+    readonly status: 201 | 400 | 401 | 426 | 507;
     readonly body?: unknown;
   }> => {
     let envelope: EnrollmentEnvelope;
     try {
       envelope = decodeEnrollmentEnvelope(body);
-    } catch {
+    } catch (error) {
+      if (error instanceof ProtocolContractError &&
+          error.code === ErrorCode.UNSUPPORTED_PROTOCOL_VERSION) {
+        return {
+          status: 426,
+          body: errorEnvelope(
+            ErrorCode.UNSUPPORTED_PROTOCOL_VERSION,
+            "Unsupported protocol version.",
+            safeRequestId(body),
+          ),
+        };
+      }
       return {
         status: 400,
         body: errorEnvelope(
@@ -59,26 +70,22 @@ export function createEnrollmentExchange(authority: CredentialAuthority) {
     }
     return {
       status: 201,
-      body: {
-        protocol_version: "1",
-        request_id: envelope.request_id,
-        payload: {
+      body: createProtocolEnvelope(envelope.request_id, {
           purpose: response.purpose,
           client_id: response.clientId,
           server_capabilities: response.serverCapabilities,
-        },
-      },
+      }),
     };
   };
 }
 
 function errorEnvelope(
-  code: "INVALID_INPUT" | "AUTH_INVALID" | "CAPACITY_EXCEEDED",
+  code: "INVALID_INPUT" | "AUTH_INVALID" | "CAPACITY_EXCEEDED" | "UNSUPPORTED_PROTOCOL_VERSION",
   message: string,
   requestId?: string,
 ) {
   return {
-    protocol_version: "1" as const,
+    protocol_version: PROTOCOL_VERSION,
     ...(requestId === undefined ? {} : { request_id: requestId }),
     error: { code, message },
   };
@@ -93,64 +100,11 @@ function safeRequestId(value: unknown): string | undefined {
 }
 
 export function decodeEnrollmentEnvelope(value: unknown): EnrollmentEnvelope {
-  const envelope = exactRecord(value, ["protocol_version", "request_id", "payload"]);
-  if (envelope["protocol_version"] !== "1") throw new Error("Invalid enrollment request.");
-  const requestId = envelope["request_id"];
-  if (typeof requestId !== "string" || !/^[A-Za-z0-9._-]{8,128}$/u.test(requestId)) {
-    throw new Error("Invalid enrollment request.");
-  }
-  const payload = exactRecord(
-    envelope["payload"],
-    ["invitation", "retry_key", "client_credential"],
-    ["client_name"],
-  );
-  const invitation = payload["invitation"];
-  if (typeof invitation !== "string" || !/^[A-Za-z0-9_-]{43,1024}$/u.test(invitation)) {
-    throw new Error("Invalid enrollment request.");
-  }
-  const retryKey = payload["retry_key"];
-  if (typeof retryKey !== "string" ||
-      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(retryKey)) {
-    throw new Error("Invalid enrollment request.");
-  }
-  const clientCredential = payload["client_credential"];
-  if (typeof clientCredential !== "string" ||
-      !/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/u.test(clientCredential)) {
-    throw new Error("Invalid enrollment request.");
-  }
-  const clientName = payload["client_name"];
-  if (clientName !== undefined &&
-      (typeof clientName !== "string" || Buffer.byteLength(clientName) > 120 ||
-       !/^[A-Za-z0-9][A-Za-z0-9 ._-]*$/u.test(clientName))) {
-    throw new Error("Invalid enrollment request.");
-  }
-  return {
-    protocol_version: "1",
-    request_id: requestId,
-    payload: clientName === undefined
-      ? { invitation, retry_key: retryKey.toLowerCase(), client_credential: clientCredential }
-      : {
-          invitation,
-          retry_key: retryKey.toLowerCase(),
-          client_credential: clientCredential,
-          client_name: clientName,
-        },
-  };
-}
-
-function exactRecord(
-  value: unknown,
-  required: readonly string[],
-  optional: readonly string[] = [],
-): Record<string, unknown> {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error("Invalid enrollment request.");
-  }
-  const record = value as Record<string, unknown>;
-  const allowed = new Set([...required, ...optional]);
-  if (Object.keys(record).some((key) => !allowed.has(key)) ||
-      required.some((key) => !Object.hasOwn(record, key))) {
+  try {
+    return decodeEnrollmentExchangeRequestEnvelope(value);
+  } catch (error) {
+    if (error instanceof ProtocolContractError &&
+        error.code === ErrorCode.UNSUPPORTED_PROTOCOL_VERSION) throw error;
     throw new Error("Invalid enrollment request.");
   }
-  return record;
 }

package/src/https-server.ts

@@ -2,27 +2,22 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { createServer, type Server as HttpsServer } from "node:https";
 import type { AddressInfo, Socket } from "node:net";
 import { createHash, X509Certificate } from "node:crypto";
+import {
+  ATTACH_PATH,
+  CUBES_PATH,
+  ENROLLMENT_EXCHANGE_PATH,
+  ErrorCode,
+  HEALTH_PATH,
+  PROTOCOL_INFO_PATH,
+  PROTOCOL_VERSION,
+  createProtocolTagPreflight,
+} from "borgmcp-shared/protocol";
 
 import { resolveBindOptions, type BindOptionsInput } from "./network-policy.js";
 import type { CoordinationRequest, CoordinationResponse } from "./coordination-api.js";
 import type { Principal } from "./principal.js";
 import { disabledDebugLogger, type DebugLogger, type DebugRoute } from "./debug-log.js";
 
-export interface ProtocolInfoDocument {
-  readonly protocol_version: string;
-  readonly package: {
-    readonly name: "borgmcp-shared";
-    readonly version: string;
-  };
-  readonly capabilities: readonly string[];
-  readonly limits: {
-    readonly max_request_bytes: number;
-    readonly max_log_message_bytes: number;
-    readonly max_read_page_size: number;
-    readonly max_replay_page_size: number;
-  };
-}
-
 export interface ServiceLimits {
   readonly maxConnections: number;
   readonly maxConnectionsPerAddress: number;
@@ -62,18 +57,13 @@ export const DEFAULT_SERVICE_LIMITS: ServiceLimits = {
 };
 
 export interface RequestHandlerContext {
-  readonly protocolInfo: ProtocolInfoDocument;
-  readonly authorizeProtocol: (
-    authorization: string | undefined,
-    signal: AbortSignal,
-  ) => Promise<boolean | "missing" | "invalid" | "revoked">;
   readonly exchangeEnrollment?: (
     body: unknown,
-  ) => Promise<{ readonly status: 201 | 400 | 401 | 507; readonly body?: unknown }>;
+  ) => Promise<{ readonly status: 201 | 400 | 401 | 426 | 507; readonly body?: unknown }>;
   readonly authorizeCoordination?: (
     authorization: string | undefined,
     signal: AbortSignal,
-  ) => Promise<Principal | "missing" | "invalid" | "revoked">;
+  ) => Promise<Principal | "missing" | "invalid" | "revoked" | "evicted">;
   readonly handleCoordination?: (request: CoordinationRequest) => Promise<CoordinationResponse>;
   readonly debugLogger: DebugLogger;
 }
@@ -85,8 +75,6 @@ export interface HttpsServerOptions {
     readonly cert: string | Buffer;
     readonly ca?: string | Buffer;
   };
-  readonly protocolInfo: ProtocolInfoDocument;
-  readonly authorizeProtocol: RequestHandlerContext["authorizeProtocol"];
   readonly exchangeEnrollment?: RequestHandlerContext["exchangeEnrollment"];
   readonly authorizeCoordination?: RequestHandlerContext["authorizeCoordination"];
   readonly handleCoordination?: RequestHandlerContext["handleCoordination"];
@@ -168,8 +156,6 @@ export function createRequestHandlerContext(
   options: HttpsServerOptions,
 ): RequestHandlerContext {
   return Object.freeze({
-    protocolInfo: options.protocolInfo,
-    authorizeProtocol: options.authorizeProtocol,
     ...(options.exchangeEnrollment === undefined
       ? {}
       : { exchangeEnrollment: options.exchangeEnrollment }),
@@ -290,44 +276,23 @@ async function handleRequest(
     return;
   }
 
-  if (path === "/healthz") {
+  if (path === HEALTH_PATH) {
     if (requestBody.length !== 0) return sendEmpty(response, 400, true);
     sendEmpty(response, request.method === "GET" ? 204 : 405);
     return;
   }
 
-  if (path === "/api/protocol") {
+  if (path === PROTOCOL_INFO_PATH) {
     if (requestBody.length !== 0) return sendEmpty(response, 400, true);
-    const authorized = await context.authorizeProtocol(request.headers.authorization, signal);
-    trace.authentication = authorized === true ? "accepted" : authorized === false ? "invalid" : authorized;
-    if (signal.aborted) return;
-    if (authorized !== true) {
-      const code = authorized === "revoked"
-        ? "SESSION_REVOKED"
-        : authorized === "missing" || request.headers.authorization === undefined
-          ? "AUTH_MISSING"
-          : "AUTH_INVALID";
-      sendJson(response, 401, protocolError(code, "Authentication failed."));
-      return;
-    }
-    const credentialRetry = consumeAuthenticatedRateLimit(
-      request.headers.authorization,
-      credentialRateLimiter,
-    );
-    if (credentialRetry !== null) return sendRateLimited(response, credentialRetry);
     if (request.method !== "GET") {
       sendEmpty(response, 405);
       return;
     }
-    sendJson(response, 200, {
-      protocol_version: "1",
-      request_id: "protocol-info",
-      payload: context.protocolInfo,
-    });
+    sendJson(response, 200, createProtocolTagPreflight());
     return;
   }
 
-  if (path === "/api/enrollment/exchange") {
+  if (path === ENROLLMENT_EXCHANGE_PATH) {
     if (request.method !== "POST" || context.exchangeEnrollment === undefined) {
       sendEmpty(response, 405);
       return;
@@ -346,7 +311,9 @@ async function handleRequest(
     if (signal.aborted) return;
     if (result.body === undefined) sendEmpty(response, result.status, result.status === 400);
     else if (result.status === 400) sendJson(response, 400, result.body, true);
-    else if (result.status === 401 || result.status === 507) sendJson(response, result.status, result.body);
+    else if (result.status === 401 || result.status === 426 || result.status === 507) {
+      sendJson(response, result.status, result.body);
+    }
     else sendJson(response, 201, result.body);
     return;
   }
@@ -372,6 +339,10 @@ async function handleRequest(
     trace.authentication = typeof authentication === "string" ? authentication : "accepted";
     if (signal.aborted) return;
     if (typeof authentication === "string") {
+      if (authentication === "evicted") {
+        sendJson(response, 410, protocolError(ErrorCode.DRONE_EVICTED, "Authentication failed."));
+        return;
+      }
       const code = authentication === "revoked"
         ? "SESSION_REVOKED"
         : authentication === "missing" || authorization === undefined ? "AUTH_MISSING" : "AUTH_INVALID";
@@ -384,8 +355,8 @@ async function handleRequest(
       : authentication.id}`;
     const credentialRetry = credentialRateLimiter.consume(clientIdentity);
     if (credentialRetry !== null) return sendRateLimited(response, credentialRetry);
-    const cursor = parseCursorParameter(request.url, path);
-    if (cursor === INVALID_COORDINATION_QUERY) {
+    const query = parseCoordinationQuery(request.url, path);
+    if (query === INVALID_COORDINATION_QUERY) {
       sendJson(response, 400, protocolError("INVALID_INPUT", "Invalid query parameters."), true);
       return;
     }
@@ -394,7 +365,7 @@ async function handleRequest(
       path,
       principal: authentication,
       ...(decoded === undefined ? {} : { body: decoded }),
-      ...(cursor === undefined ? {} : { cursor }),
+      ...query,
       signal,
     });
     if (signal.aborted) {
@@ -422,7 +393,7 @@ async function handleRequest(
 interface RequestTrace {
   readonly route: DebugRoute;
   readonly method: string;
-  authentication: "not_required" | "missing" | "invalid" | "revoked" | "accepted";
+  authentication: "not_required" | "missing" | "invalid" | "revoked" | "evicted" | "accepted";
   principal?: Principal;
 }
 
@@ -434,15 +405,16 @@ function debugMethod(method: string | undefined): string {
 function debugRoute(rawUrl: string | undefined): DebugRoute {
   const path = parseRequestPath(rawUrl);
   if (path === null) return "unknown";
-  if (path === "/healthz") return "health";
-  if (path === "/api/protocol") return "protocol";
-  if (path === "/api/enrollment/exchange") return "enrollment_exchange";
-  if (path === "/api/client/attach") return "client_attach";
+  if (path === HEALTH_PATH) return "health";
+  if (path === PROTOCOL_INFO_PATH) return "protocol";
+  if (path === ENROLLMENT_EXCHANGE_PATH) return "enrollment_exchange";
+  if (path === ATTACH_PATH) return "client_attach";
   if (path === "/api/cubes") return "cubes";
   if (/^\/api\/cubes\/[0-9a-f-]{36}$/iu.test(path)) return "cube";
   if (/^\/api\/cubes\/[0-9a-f-]{36}\/roles$/iu.test(path)) return "cube_roles";
   if (/^\/api\/cubes\/[0-9a-f-]{36}\/roles\/[0-9a-f-]{36}$/iu.test(path)) return "cube_role";
   if (/^\/api\/cubes\/[0-9a-f-]{36}\/roles\/[0-9a-f-]{36}\/section-patch$/iu.test(path)) return "cube_role_section_patch";
+  if (/^\/api\/cubes\/[0-9a-f-]{36}\/taxonomy-patch$/iu.test(path)) return "cube_taxonomy_patch";
   if (/^\/api\/cubes\/[0-9a-f-]{36}\/drones$/iu.test(path)) return "cube_drones";
   if (/^\/api\/cubes\/[0-9a-f-]{36}\/logs$/iu.test(path)) return "cube_logs";
   if (/^\/api\/cubes\/[0-9a-f-]{36}\/acks$/iu.test(path)) return "cube_acks";
@@ -590,35 +562,33 @@ function waitForDrain(response: ServerResponse): Promise<void> {
 }
 
 function protocolError(code: string, message: string): object {
-  return { protocol_version: "1", error: { code, message } };
+  return { protocol_version: PROTOCOL_VERSION, error: { code, message } };
 }
 
 const INVALID_COORDINATION_QUERY = Symbol("invalid-coordination-query");
 
-function parseCursorParameter(
+function parseCoordinationQuery(
   value: string | undefined,
   path: string,
-): string | undefined | typeof INVALID_COORDINATION_QUERY {
-  if (value === undefined) return undefined;
+): { readonly cursor?: string; readonly since?: string } | typeof INVALID_COORDINATION_QUERY {
+  if (value === undefined) return {};
   try {
     const parsed = new URL(value, "https://local.invalid");
     const keys = [...parsed.searchParams.keys()];
-    if (!path.endsWith("/stream")) {
-      return keys.length === 0 ? undefined : INVALID_COORDINATION_QUERY;
-    }
-    if (keys.some((key) => key !== "cursor")) return INVALID_COORDINATION_QUERY;
-    const values = parsed.searchParams.getAll("cursor");
-    if (values.length === 0) return undefined;
-    return values.length === 1 && values[0]!.length > 0
-      ? values[0]
-      : INVALID_COORDINATION_QUERY;
+    const allowed = path.endsWith("/stream") ? "cursor" : path.endsWith("/drones") ? "since" : null;
+    if (allowed === null) return keys.length === 0 ? {} : INVALID_COORDINATION_QUERY;
+    if (keys.some((key) => key !== allowed)) return INVALID_COORDINATION_QUERY;
+    const values = parsed.searchParams.getAll(allowed);
+    if (values.length === 0) return {};
+    if (values.length !== 1 || values[0]!.length === 0) return INVALID_COORDINATION_QUERY;
+    return allowed === "cursor" ? { cursor: values[0]! } : { since: values[0]! };
   } catch {
     return INVALID_COORDINATION_QUERY;
   }
 }
 
 function isCoordinationPath(path: string | null): path is string {
-  return path === "/api/client/attach" || path === "/api/cubes" ||
+  return path === ATTACH_PATH || path === CUBES_PATH ||
     path?.startsWith("/api/cubes/") === true;
 }
 
@@ -994,14 +964,6 @@ function credentialIdentity(authorization: string | undefined): string | null {
   return `credential:${createHash("sha256").update(authorization).digest("base64url")}`;
 }
 
-function consumeAuthenticatedRateLimit(
-  authorization: string | undefined,
-  rateLimiter: RequestRateLimiter,
-): number | null {
-  const identity = credentialIdentity(authorization);
-  return identity === null ? null : rateLimiter.consume(identity);
-}
-
 function listen(server: HttpsServer, port: number, host: string): Promise<void> {
   return new Promise((resolve, reject) => {
     const onError = (error: Error): void => {