mindoodb 0.0.85 → 0.0.88

package/dist/node/server/MindooDBServer.js

@@ -2,6 +2,12 @@
 /**
  * MindooDB Server - Express HTTP server implementing the sync API.
  *
+ * The route handlers themselves are platform-neutral and live in
+ * {@link MindooDBServerCore} (`src/server/http`); this class is the Node host:
+ * it wires the server's components, mounts the handlers on Express and adds
+ * what only a Node process provides — HTTP/2 + TLS, static files, Iroh, the
+ * peer and cluster routers, and the middleware stack below.
+ *
  * Security features:
  * - Capabilities-based system admin authorization via config.json
  * - Challenge/response (Ed25519) authentication for /system/* endpoints
@@ -55,104 +61,29 @@ const http2_1 = __importDefault(require("http2"));
 const path_1 = __importDefault(require("path"));
 const fs_1 = require("fs");
 const helmet_1 = __importDefault(require("helmet"));
-const errors_1 = require("../../core/errors");
 const cors_1 = __importDefault(require("cors"));
 const express_rate_limit_1 = __importStar(require("express-rate-limit"));
 const compressionMiddleware_1 = require("./compressionMiddleware");
-const binaryEntryFraming_1 = require("../../core/appendonlystores/network/binaryEntryFraming");
-const entryWireCodec_1 = require("../../core/appendonlystores/network/entryWireCodec");
-const SyncEventBus_1 = require("./SyncEventBus");
-const ClusterManager_1 = require("./peer/ClusterManager");
+const SyncEventBus_1 = require("../../server/SyncEventBus");
+const ClusterManager_1 = require("../../server/peer/ClusterManager");
+const FileClusterAuditStorage_1 = require("./peer/FileClusterAuditStorage");
+const IrohPeerLink_1 = require("./peer/IrohPeerLink");
 const routes_1 = require("./peer/routes");
-const types_1 = require("./peer/types");
-const types_2 = require("../../core/appendonlystores/types");
-const types_3 = require("../../core/appendonlystores/network/types");
 const TenantManager_1 = require("./TenantManager");
-const CapabilityMatcher_1 = require("./CapabilityMatcher");
-const SystemAdminAuth_1 = require("./SystemAdminAuth");
-const DeviceDiscoveryService_1 = require("./DeviceDiscoveryService");
+const CapabilityMatcher_1 = require("../../server/CapabilityMatcher");
+const SystemAdminAuth_1 = require("../../server/SystemAdminAuth");
+const DeviceDiscoveryService_1 = require("../../server/DeviceDiscoveryService");
 const config_1 = require("./config");
 const SystemIpAllowlist_1 = require("./SystemIpAllowlist");
 const IrohServerRpc_1 = require("./IrohServerRpc");
 const IrohServerEndpoint_1 = require("./IrohServerEndpoint");
-const validation_1 = require("./validation");
-const urlSafety_1 = require("../../core/utils/urlSafety");
-const types_4 = require("./types");
-const timestampProxy_1 = require("./timestampProxy");
-const rateLimits_1 = require("./rateLimits");
-/**
- * Wire-format types for the sync HTTP API live in
- * {@link ../../core/appendonlystores/network/entryWireCodec}: binary fields
- * (signature, encryptedData, rsaEncryptedPayload) are base64 strings in
- * transit. Client and server share that codec so signed trailing blocks
- * cannot drift off the wire.
- */
-/**
- * Rate-limit defaults. Auth and sync have separate tiers because a single
- * challenge/authenticate handshake is two requests; with multiple tenants,
- * store kinds, and token renewals the auth budget exhausts quickly if set
- * too low. These can be overridden in config.json under `rateLimits.auth`
- * and `rateLimits.sync`.
- */
-const DEFAULT_AUTH_RATE_LIMIT_WINDOW_MS = 60000;
-const DEFAULT_AUTH_RATE_LIMIT_MAX = 120;
-const DEFAULT_SYNC_RATE_LIMIT_WINDOW_MS = 60000;
-/**
- * Sync is keyed per authenticated principal, and a client legitimately opens
- * several databases at once: a host like Teacher's Desk reads six, and a cold
- * pass over one of them costs a few hundred batched requests. A budget sized
- * for a single database turns that normal open into a throttled one.
- */
-const DEFAULT_SYNC_RATE_LIMIT_MAX = 3000;
-/**
- * The global limiter is a coarse net for unauthenticated floods and unknown
- * routes; the per-tier limiters are the real budgets. It runs first, so a
- * global max below a tier max silently replaces that tier — the sync budget
- * was unreachable while this was a hardcoded 500. The default is therefore
- * derived from the tiers, and an override that would shadow one is honoured
- * but flagged at startup rather than quietly applied.
- */
-const DEFAULT_GLOBAL_RATE_LIMIT_WINDOW_MS = 60000;
-const GLOBAL_RATE_LIMIT_TIER_HEADROOM = 500;
-/**
- * Timestamping gets its own budget rather than sharing the sync one. Sync is
- * chatty and high-volume; sealing a document is a deliberate, rare user action.
- * Sharing a bucket would let ordinary sync traffic starve the seal endpoint, and
- * a runaway seal loop degrade sync.
- *
- * The daily cap matters more than the burst cap: proxying collapses every user
- * onto the server's IP, so one tenant can exhaust an upstream's per-IP allowance
- * (open-tsa.eu publishes 60/minute) and lock out everyone else on this server.
- */
-const DEFAULT_TIMESTAMP_RATE_LIMIT_WINDOW_MS = 60000;
-const DEFAULT_TIMESTAMP_RATE_LIMIT_MAX = 10;
-const DEFAULT_TIMESTAMP_DAILY_LIMIT_MAX = 500;
-const TIMESTAMP_DAILY_WINDOW_MS = 24 * 60 * 60 * 1000;
+const types_1 = require("../../server/types");
+const timestampProxy_1 = require("../../server/timestampProxy");
+const rateLimits_1 = require("../../server/rateLimits");
+const MindooDBServerCore_1 = require("../../server/http/MindooDBServerCore");
+const expressAdapter_1 = require("./expressAdapter");
+const types_2 = require("../../server/http/types");
 const DEFAULT_SERVER_SOCKET_TIMEOUT_MS = 120000;
-/** Parse a human-readable size string ("5mb", "1024", "100kb") into bytes. */
-function parseBodySizeLimitToBytes(limit) {
-    const normalized = limit.trim().toLowerCase();
-    if (!normalized) {
-        return null;
-    }
-    if (/^\d+$/.test(normalized)) {
-        return Number(normalized);
-    }
-    const match = normalized.match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)$/);
-    if (!match) {
-        return null;
-    }
-    const value = Number(match[1]);
-    const unit = match[2];
-    const multiplier = unit === "b"
-        ? 1
-        : unit === "kb"
-            ? 1024
-            : unit === "mb"
-                ? 1024 * 1024
-                : 1024 * 1024 * 1024;
-    return Math.round(value * multiplier);
-}
 class MindooDBServer {
     /**
      * @param dataDir      Root directory for on-disk tenant data and server identity
@@ -171,9 +102,9 @@ class MindooDBServer {
         this.staticDir = staticDir;
         this.configPath = configPath ?? path_1.default.join(dataDir, "config.json");
         this.jsonBodyLimit = process.env.MINDOODB_JSON_BODY_LIMIT?.trim() || "5mb";
-        this.jsonBodyLimitBytes = parseBodySizeLimitToBytes(this.jsonBodyLimit);
-        this.tsaProviders = (0, timestampProxy_1.parseTsaProviders)(process.env[types_4.ENV_VARS.TSA_PROVIDERS], {
-            allowInsecureUrls: /^(1|true)$/i.test(process.env[types_4.ENV_VARS.ALLOW_INSECURE_SYNC_URLS] ?? ""),
+        const allowInsecureSyncUrls = /^(1|true)$/i.test(process.env[types_1.ENV_VARS.ALLOW_INSECURE_SYNC_URLS] ?? "");
+        this.tsaProviders = (0, timestampProxy_1.parseTsaProviders)(process.env[types_1.ENV_VARS.TSA_PROVIDERS], {
+            allowInsecureUrls: allowInsecureSyncUrls,
         });
         if (this.tsaProviders.length > 0) {
             console.log(`[MindooDBServer] RFC 3161 timestamp proxy enabled with providers: ${this.tsaProviders
@@ -191,7 +122,7 @@ class MindooDBServer {
         this.deviceDiscovery = new DeviceDiscoveryService_1.DeviceDiscoveryService(this.tenantManager, cryptoAdapter);
         this.cluster = new ClusterManager_1.ClusterManager({
             cryptoAdapter,
-            dataDir,
+            auditStorage: new FileClusterAuditStorage_1.FileClusterAuditStorage(dataDir),
             eventBus: this.syncEventBus,
             listTrustedServers: () => this.tenantManager.listTrustedServers(),
             localServerName: () => this.tenantManager.getServerPublicInfo()?.name ?? null,
@@ -205,6 +136,7 @@ class MindooDBServer {
             onDirectoryPulled: (tenantId) => this.tenantManager.executePendingPurges(tenantId),
             localRole: this.serverConfig.cluster?.role,
             getIrohStreamIO: () => this.irohEndpoint.getStreamIO(),
+            openIrohLink: (io, ticket) => new IrohPeerLink_1.IrohPeerLink(io, ticket),
         });
         // Peer tokens are accepted by the tenant sync routes so a peer can mirror
         // the encrypted stores through the ordinary protocol; the store bypasses
@@ -225,6 +157,24 @@ class MindooDBServer {
             },
             trustedWitnessResolver: (receivedByPublicKey) => this.cluster.auth.findTrustedServerByKey(receivedByPublicKey) !== null,
         });
+        this.core = new MindooDBServerCore_1.MindooDBServerCore({
+            tenantManager: this.tenantManager,
+            systemAdminAuth: this.systemAdminAuth,
+            capabilityMatcher: this.capabilityMatcher,
+            deviceDiscovery: this.deviceDiscovery,
+            syncEvents: this.syncEventBus,
+            configRepository: new config_1.FileServerConfigRepository(this.configPath),
+            getServerConfig: () => this.serverConfig,
+            reloadConfig: (newConfig) => this.reloadConfig(newConfig),
+            tsaProviders: this.tsaProviders,
+            jsonBodyLimit: this.jsonBodyLimit,
+            allowInsecureSyncUrls,
+            cluster: {
+                mirrorsForTenant: (tenantId) => this.cluster.mirrorsForTenant(tenantId),
+                syncReplicators: () => this.cluster.syncReplicators(),
+                resolvePeerName: (token) => this.cluster.auth.validateToken(token).then((payload) => payload?.sub),
+            },
+        });
         const principalCount = Object.values(this.serverConfig.capabilities).reduce((sum, arr) => sum + arr.length, 0);
         if (principalCount === 0) {
             console.log(`[MindooDBServer] WARNING: No system admin principals configured. All /system/* endpoints are locked down.`);
@@ -328,10 +278,7 @@ class MindooDBServer {
                 config: irohConfig,
                 handler: (0, IrohServerRpc_1.createMindooDBServerIrohHandler)({
                     getServerPublicInfo: () => this.tenantManager.getServerPublicInfo(),
-                    getJsonBodyLimit: () => ({
-                        limit: this.jsonBodyLimit,
-                        bytes: this.jsonBodyLimitBytes,
-                    }),
+                    getJsonBodyLimit: () => this.core.getJsonBodyLimit(),
                     getClusterRole: () => this.serverConfig.cluster?.role ?? "peer",
                     listTenantPublicInfosFingerprints: (tenantId) => this.tenantManager.listTenantPublicInfosFingerprints(tenantId),
                     getAuthService: (tenantId) => this.tenantManager.getAuthService(tenantId),
@@ -369,6 +316,10 @@ class MindooDBServer {
             console.error("[MindooDBServer] Failed to start Iroh listener:", error);
         }
     }
+    /** Every limiter tier, resolved against the current config.json. */
+    rateLimitPolicy() {
+        return (0, rateLimits_1.resolveServerRateLimits)(this.serverConfig.rateLimits);
+    }
     /**
      * Global middleware stack applied to every request, in order:
      * 1. helmet — security headers (CSP, X-Frame-Options, etc.)
@@ -412,7 +363,6 @@ class MindooDBServer {
             next();
         });
     }
-    /** Parse MINDOODB_CORS_ORIGIN env var; supports comma-separated multiple origins. */
     /**
      * Teach Express which upstream hops to trust for `X-Forwarded-For`, so
      * `req.ip` is the client rather than the proxy. Every rate limiter keys on
@@ -427,7 +377,7 @@ class MindooDBServer {
      * list over `true`, which trusts the whole chain.
      */
     applyTrustProxySetting() {
-        const raw = process.env[types_4.ENV_VARS.TRUST_PROXY]?.trim();
+        const raw = process.env[types_1.ENV_VARS.TRUST_PROXY]?.trim();
         if (!raw || /^(0|false)$/i.test(raw)) {
             return;
         }
@@ -447,6 +397,7 @@ class MindooDBServer {
             console.log(`[MindooDBServer] trust proxy set to ${JSON.stringify(value)}`);
         }
     }
+    /** Parse MINDOODB_CORS_ORIGIN env var; supports comma-separated multiple origins. */
     readCorsOriginsFromEnv() {
         const raw = process.env.MINDOODB_CORS_ORIGIN?.trim();
         if (!raw) {
@@ -471,6 +422,7 @@ class MindooDBServer {
      *  /:tenantId/*              — per-tenant sync & auth API
      */
     setupRoutes() {
+        const core = this.core;
         this.app.get("/", (req, res) => {
             if (this.staticDir && (0, fs_1.existsSync)(path_1.default.join(this.staticDir, "index.html"))) {
                 res.redirect(302, "/statics/index.html");
@@ -479,99 +431,24 @@ class MindooDBServer {
                 res.status(404).json({ error: "Not found" });
             }
         });
-        this.app.get("/health", (req, res) => {
-            res.json({ status: "ok", timestamp: Date.now() });
-        });
+        this.app.get("/health", (0, expressAdapter_1.route)(() => core.health()));
         // Server-wide device discovery (before /:tenantId so "device" is not a tenant id).
         // Aggressive rate limit: challenge+discover scans every local tenant.
+        const deviceLimit = this.rateLimitPolicy().device;
         const deviceDiscoveryRateLimit = (0, express_rate_limit_1.default)({
-            windowMs: 60000,
-            max: 10,
+            windowMs: deviceLimit.windowMs,
+            max: deviceLimit.max,
             standardHeaders: true,
             legacyHeaders: false,
             message: { error: "Too many device discovery requests, please try again later" },
         });
-        this.app.post("/device/challenge", deviceDiscoveryRateLimit, this.handleDeviceChallenge.bind(this));
-        this.app.post("/device/discover", deviceDiscoveryRateLimit, this.handleDeviceDiscover.bind(this));
+        this.app.post("/device/challenge", deviceDiscoveryRateLimit, (0, expressAdapter_1.route)((req) => core.deviceChallenge(req)));
+        this.app.post("/device/discover", deviceDiscoveryRateLimit, (0, expressAdapter_1.route)((req) => core.deviceDiscover(req)));
         // .well-known endpoints are unauthenticated so clients can discover
         // server identity and tenant availability before attempting to authenticate.
-        this.app.get("/.well-known/mindoodb-server-info", (req, res) => {
-            const info = this.tenantManager.getServerPublicInfo();
-            if (!info) {
-                res.status(503).json({ error: "Server identity not initialized" });
-                return;
-            }
-            res.json({
-                ...info,
-                // Its own mesh role, so `add-to-network` can propagate it into the
-                // other side's trusted-servers entry instead of asking the operator to
-                // repeat it on every node.
-                clusterRole: this.serverConfig.cluster?.role ?? "peer",
-                maxJsonRequestBodyLimit: this.jsonBodyLimit,
-                maxJsonRequestBodyBytes: this.jsonBodyLimitBytes ?? undefined,
-                // Lets a client decide between calling a browser-reachable TSA directly
-                // and routing through this server, per tenant and without a probe.
-                timestamping: {
-                    enabled: this.tsaProviders.length > 0,
-                    providers: (0, timestampProxy_1.toPublicTsaProviders)(this.tsaProviders),
-                },
-            });
-        });
-        /**
-         * Mirrors of one tenant, for client failover.
-         *
-         * Scoped to the tenant in the query on purpose: a client asking about
-         * tenant A must not learn which other tenants this server replicates, or
-         * to whom. Unauthenticated like the other discovery endpoints — a client
-         * needs it precisely when it cannot reach a server to authenticate with.
-         */
-        this.app.get("/.well-known/mindoodb-cluster", (req, res) => {
-            const tenantId = typeof req.query.tenantId === "string" ? req.query.tenantId.toLowerCase() : "";
-            if (!tenantId) {
-                res.status(400).json({ error: "tenantId query parameter is required" });
-                return;
-            }
-            try {
-                (0, validation_1.validateTenantId)(tenantId);
-            }
-            catch {
-                res.status(400).json({ error: "Invalid tenantId format" });
-                return;
-            }
-            if (!this.tenantManager.tenantExists(tenantId)) {
-                res.status(404).json({ error: "Tenant not found on server" });
-                return;
-            }
-            res.json({ tenantId, mirrors: this.cluster.mirrorsForTenant(tenantId) });
-        });
-        this.app.get("/.well-known/mindoodb-tenants/:tenantId/publicinfos-fingerprints", async (req, res) => {
-            const tenantId = req.params.tenantId.toLowerCase();
-            try {
-                (0, validation_1.validateTenantId)(tenantId);
-                const fingerprints = await this.tenantManager.listTenantPublicInfosFingerprints(tenantId);
-                if (fingerprints.length === 0) {
-                    res.status(404).json({ error: "Tenant not found on server" });
-                    return;
-                }
-                const response = {
-                    tenantId,
-                    fingerprints,
-                };
-                res.json(response);
-            }
-            catch (error) {
-                if (error instanceof validation_1.ValidationError) {
-                    res.status(400).json({ error: error.message });
-                    return;
-                }
-                if (error instanceof Error && error.message.includes("not found")) {
-                    res.status(404).json({ error: "Tenant not found on server" });
-                    return;
-                }
-                console.error("[MindooDBServer] Error reading tenant publicInfos fingerprints:", error);
-                res.status(500).json({ error: "Failed to read tenant publicInfos fingerprints" });
-            }
-        });
+        this.app.get("/.well-known/mindoodb-server-info", (0, expressAdapter_1.route)(() => core.serverInfo()));
+        this.app.get("/.well-known/mindoodb-cluster", (0, expressAdapter_1.route)((req) => core.clusterMirrors(req)));
+        this.app.get("/.well-known/mindoodb-tenants/:tenantId/publicinfos-fingerprints", (0, expressAdapter_1.route)((req) => core.publicInfosFingerprints(req)));
         // Static file serving
         if (this.staticDir) {
             const resolvedStaticDir = path_1.default.resolve(this.staticDir);
@@ -592,9 +469,10 @@ class MindooDBServer {
         if (!(0, SystemIpAllowlist_1.isSystemIpAllowListDisabled)(systemIpRaw)) {
             console.log(`[MindooDBServer] MINDOODB_ADMIN_ALLOWED_IPS is set — /system/* limited to: ${systemIpRaw}`);
         }
+        const systemLimit = this.rateLimitPolicy().system;
         const systemRateLimit = (0, express_rate_limit_1.default)({
-            windowMs: this.serverConfig.rateLimits?.system?.windowMs ?? 60000,
-            max: this.serverConfig.rateLimits?.system?.max ?? 30,
+            windowMs: systemLimit.windowMs,
+            max: systemLimit.max,
             standardHeaders: true,
             legacyHeaders: false,
             message: { error: "Too many system requests, please try again later" },
@@ -604,9 +482,10 @@ class MindooDBServer {
         // would lock out the operator's own cluster, and 30 req/min would throttle
         // replication to a crawl. They are protected by the peer JWT, which is only
         // issued to a key in trusted-servers.json.
+        const peerLimit = this.rateLimitPolicy().peer;
         this.app.use("/system/peer", (0, express_rate_limit_1.default)({
-            windowMs: 60000,
-            max: 600,
+            windowMs: peerLimit.windowMs,
+            max: peerLimit.max,
             standardHeaders: true,
             legacyHeaders: false,
             message: { error: "Too many peer requests, please try again later" },
@@ -619,93 +498,12 @@ class MindooDBServer {
         const systemRouter = (0, express_1.Router)();
         this.setupSystemRoutes(systemRouter);
         this.app.use("/system", SystemIpAllowlist_1.systemIpAllowlistMiddleware, systemRateLimit, systemRouter);
-        // Tenant-scoped routes: tenantMiddleware validates the :tenantId param
+        // Tenant-scoped routes: the tenant guard validates the :tenantId param
         // and rejects unknown tenants before any handler runs.
-        this.app.use("/:tenantId", this.tenantMiddleware.bind(this), this.createTenantRouter());
+        this.app.use("/:tenantId", (0, expressAdapter_1.guard)((req) => core.tenantGuard(req)), this.createTenantRouter());
         // Express error handler — must be registered last and have the 4-arg signature
         this.app.use(this.errorHandler.bind(this));
     }
-    // ==================== System Admin Auth Middleware ====================
-    /**
-     * JWT-based middleware for /system/* routes (excluding /system/auth/*).
-     * Extracts and validates the bearer token, then checks capabilities
-     * for the current (method, path, username, publicsignkey).
-     *
-     * `DELETE /system/tenants/:tenantId` is also allowed when the JWT signing
-     * key is that tenant's registered `adminSigningPublicKey` (own-tenant
-     * delete). Sub-resources and other tenants stay capability-gated.
-     */
-    async systemAdminMiddleware(req, res, next) {
-        const auth = req.headers.authorization;
-        if (!auth || !auth.startsWith("Bearer ")) {
-            res.status(401).json({ error: "Missing or invalid Authorization header" });
-            return;
-        }
-        const token = auth.substring(7);
-        const payload = await this.systemAdminAuth.validateToken(token);
-        if (!payload) {
-            res.status(401).json({ error: "Invalid or expired token" });
-            return;
-        }
-        // The original request path relative to the /system mount is in req.path,
-        // but we need the full path for capability matching.
-        const fullPath = `/system${req.path}`;
-        const method = req.method.toUpperCase();
-        const capabilityAuthorized = this.capabilityMatcher.isAuthorized(method, fullPath, payload.sub, payload.publicsignkey);
-        const ownerDeleteAuthorized = !capabilityAuthorized &&
-            this.isOwnTenantDeleteAuthorized(method, fullPath, payload.publicsignkey);
-        if (!capabilityAuthorized && !ownerDeleteAuthorized) {
-            res.status(403).json({ error: "Forbidden: insufficient capabilities" });
-            return;
-        }
-        req.systemAdmin = {
-            username: payload.sub,
-            publicsignkey: payload.publicsignkey,
-        };
-        next();
-    }
-    /**
-     * Owner bypass for deleting the caller's own tenant. Matches only
-     * `DELETE /system/tenants/:tenantId` (no sub-resource) and requires the
-     * JWT public key to equal that tenant's stored admin signing key.
-     */
-    isOwnTenantDeleteAuthorized(method, fullPath, publicsignkey) {
-        if (method !== "DELETE") {
-            return false;
-        }
-        const tenantId = (0, CapabilityMatcher_1.parseSystemTenantItemPath)(fullPath);
-        if (!tenantId) {
-            return false;
-        }
-        try {
-            (0, validation_1.validateTenantIdFormat)(tenantId);
-        }
-        catch {
-            return false;
-        }
-        return this.tenantManager.isTenantAdminSigningKeyFor(tenantId, publicsignkey);
-    }
-    // ==================== Tenant Middleware ====================
-    tenantMiddleware(req, res, next) {
-        const rawTenantId = req.params.tenantId?.toLowerCase();
-        if (!rawTenantId) {
-            res.status(400).json({ error: "Tenant ID required" });
-            return;
-        }
-        try {
-            (0, validation_1.validateTenantIdFormat)(rawTenantId);
-        }
-        catch {
-            res.status(400).json({ error: "Invalid tenant ID format" });
-            return;
-        }
-        if (!this.tenantManager.tenantExists(rawTenantId)) {
-            res.status(404).json({ error: this.formatTenantNotFoundOnServerError(rawTenantId) });
-            return;
-        }
-        req.tenantId = rawTenantId;
-        next();
-    }
     // ==================== System Routes ====================
     /**
      * Wire up all /system/* routes. Auth endpoints sit outside the JWT
@@ -714,379 +512,39 @@ class MindooDBServer {
      * passes through the CapabilityMatcher for fine-grained authorization.
      */
     setupSystemRoutes(router) {
+        const core = this.core;
         const challengeRateLimit = this.createAuthRateLimit("system", "challenge");
         const authenticateRateLimit = this.createAuthRateLimit("system", "authenticate");
-        router.post("/auth/challenge", challengeRateLimit, this.handleSystemChallenge.bind(this));
-        router.post("/auth/authenticate", authenticateRateLimit, this.handleSystemAuthenticate.bind(this));
-        const authMiddleware = this.systemAdminMiddleware.bind(this);
+        router.post("/auth/challenge", challengeRateLimit, (0, expressAdapter_1.route)((req) => core.systemChallenge(req)));
+        router.post("/auth/authenticate", authenticateRateLimit, (0, expressAdapter_1.route)((req) => core.systemAuthenticate(req)));
+        // Capabilities are matched against the full path below /system. req.path
+        // is relative to the mount the middleware runs under, so a middleware
+        // mounted below /system names its own prefix.
+        const authMiddlewareFor = (prefix) => (req, res, next) => (0, expressAdapter_1.guard)((serverRequest) => core.systemAdminGuard(serverRequest, `${prefix}${req.path}`))(req, res, next);
+        const authMiddleware = authMiddlewareFor("/system");
         // Cluster administration. Behind the same JWT + capability middleware as
         // the rest of /system, so config.json can grant an auditor principal the
         // GET routes without granting the POST/PATCH/DELETE ones.
-        router.use("/cluster", authMiddleware, (0, routes_1.createClusterRouter)({
+        router.use("/cluster", authMiddlewareFor("/system/cluster"), (0, routes_1.createClusterRouter)({
             cluster: this.cluster,
             listTrustedServers: () => this.tenantManager.listTrustedServers(),
             saveTrustedServer: (peer) => this.tenantManager.saveTrustedServer(peer),
             removeTrustedServer: (name) => this.tenantManager.removeTrustedServer(name),
         }));
         // Tenant CRUD
-        router.get("/tenants", authMiddleware, (req, res) => {
-            try {
-                const tenants = this.tenantManager.listTenants();
-                const response = { tenants };
-                res.json(response);
-            }
-            catch (error) {
-                console.error("[MindooDBServer] Error listing tenants:", error);
-                res.status(500).json({ error: "Failed to list tenants" });
-            }
-        });
-        // Tenant registration is idempotent: re-POSTing with the same tenantId
-        // and matching $publicinfos key returns 200 instead of 409.
-        router.post("/tenants/:tenantId", authMiddleware, async (req, res) => {
-            try {
-                const tenantId = req.params.tenantId.toLowerCase();
-                try {
-                    (0, validation_1.validateTenantId)(tenantId);
-                }
-                catch (validationError) {
-                    res.status(400).json({
-                        error: validationError instanceof validation_1.ValidationError
-                            ? validationError.message
-                            : "Invalid tenantId format",
-                    });
-                    return;
-                }
-                const request = {
-                    ...req.body,
-                    tenantId,
-                };
-                if (!request.adminSigningPublicKey) {
-                    res.status(400).json({ error: "adminSigningPublicKey is required" });
-                    return;
-                }
-                if (!request.adminEncryptionPublicKey) {
-                    res.status(400).json({ error: "adminEncryptionPublicKey is required" });
-                    return;
-                }
-                if (request.adminUsername !== undefined) {
-                    (0, validation_1.validateUsername)(request.adminUsername);
-                }
-                (0, validation_1.validateStringLength)(request.adminSigningPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "adminSigningPublicKey");
-                (0, validation_1.validateStringLength)(request.adminEncryptionPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "adminEncryptionPublicKey");
-                if (!request.encryptedPublicInfosKey && !request.publicInfosKey) {
-                    res.status(400).json({ error: "encryptedPublicInfosKey or publicInfosKey is required" });
-                    return;
-                }
-                if (request.publicInfosKey !== undefined) {
-                    (0, validation_1.validateStringLength)(request.publicInfosKey, validation_1.MAX_PEM_KEY_LENGTH, "publicInfosKey");
-                }
-                if (request.encryptedPublicInfosKey !== undefined) {
-                    (0, validation_1.validateStringLength)(request.encryptedPublicInfosKey, validation_1.MAX_PEM_KEY_LENGTH, "encryptedPublicInfosKey");
-                }
-                const result = await this.tenantManager.registerTenant(request);
-                const response = {
-                    success: true,
-                    tenantId: result.context.tenantId,
-                    created: result.created,
-                    message: result.created
-                        ? `Tenant ${result.context.tenantId} registered successfully`
-                        : `Tenant ${result.context.tenantId} already exists with matching $publicinfos key`,
-                };
-                res.status(result.created ? 201 : 200).json(response);
-            }
-            catch (error) {
-                if (error instanceof validation_1.ValidationError) {
-                    res.status(400).json({ error: error.message });
-                    return;
-                }
-                if (error instanceof Error && error.message.includes("different $publicinfos key")) {
-                    res.status(409).json({ error: error.message });
-                    return;
-                }
-                console.error("[MindooDBServer] Error registering tenant:", error);
-                res.status(500).json({ error: "Failed to register tenant" });
-            }
-        });
-        router.put("/tenants/:tenantId", authMiddleware, (req, res) => {
-            try {
-                const tenantId = req.params.tenantId.toLowerCase();
-                try {
-                    (0, validation_1.validateTenantId)(tenantId);
-                }
-                catch {
-                    res.status(400).json({ error: "Invalid tenantId format" });
-                    return;
-                }
-                if (!this.tenantManager.tenantExists(tenantId)) {
-                    res.status(404).json({ error: "Tenant not found" });
-                    return;
-                }
-                this.tenantManager.updateTenantConfig(tenantId, req.body);
-                res.json({ success: true, message: `Tenant ${tenantId} updated` });
-            }
-            catch (error) {
-                if (error instanceof validation_1.ValidationError) {
-                    res.status(400).json({ error: error.message });
-                    return;
-                }
-                console.error("[MindooDBServer] Error updating tenant:", error);
-                res.status(500).json({ error: "Failed to update tenant" });
-            }
-        });
-        router.delete("/tenants/:tenantId", authMiddleware, async (req, res) => {
-            try {
-                const tenantId = req.params.tenantId.toLowerCase();
-                try {
-                    (0, validation_1.validateTenantId)(tenantId);
-                }
-                catch {
-                    res.status(400).json({ error: "Invalid tenantId format" });
-                    return;
-                }
-                if (!this.tenantManager.tenantExists(tenantId)) {
-                    res.status(404).json({ error: "Tenant not found" });
-                    return;
-                }
-                await this.tenantManager.removeTenant(tenantId);
-                res.json({ success: true, message: `Tenant ${tenantId} removed` });
-            }
-            catch (error) {
-                console.error("[MindooDBServer] Error removing tenant:", error);
-                res.status(500).json({ error: "Failed to remove tenant" });
-            }
-        });
+        router.get("/tenants", authMiddleware, (0, expressAdapter_1.route)(() => core.listTenants()));
+        router.post("/tenants/:tenantId", authMiddleware, (0, expressAdapter_1.route)((req) => core.registerTenant(req)));
+        router.put("/tenants/:tenantId", authMiddleware, (0, expressAdapter_1.route)((req) => core.updateTenant(req)));
+        router.delete("/tenants/:tenantId", authMiddleware, (0, expressAdapter_1.route)((req) => core.deleteTenant(req)));
         // Trusted server management
-        router.get("/trusted-servers", authMiddleware, (req, res) => {
-            try {
-                res.json({ servers: this.tenantManager.listTrustedServers() });
-            }
-            catch (error) {
-                console.error("[MindooDBServer] Error listing trusted servers:", error);
-                res.status(500).json({ error: "Failed to list trusted servers" });
-            }
-        });
-        router.post("/trusted-servers", authMiddleware, (req, res) => {
-            try {
-                const { name, signingPublicKey, encryptionPublicKey, url, direction, role, attachments } = req.body;
-                if (!name || !signingPublicKey || !encryptionPublicKey) {
-                    res.status(400).json({ error: "name, signingPublicKey, and encryptionPublicKey are required" });
-                    return;
-                }
-                (0, validation_1.validateStringLength)(name, 256, "name");
-                (0, validation_1.validateStringLength)(signingPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "signingPublicKey");
-                (0, validation_1.validateStringLength)(encryptionPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "encryptionPublicKey");
-                const server = { name, signingPublicKey, encryptionPublicKey };
-                // Replication settings are optional: an entry without a url is a trust
-                // relationship only (inbound peers may authenticate, we never dial).
-                if (url !== undefined) {
-                    (0, validation_1.validateStringLength)(url, 2048, "url");
-                    const allowInsecure = /^(1|true)$/i.test(process.env[types_4.ENV_VARS.ALLOW_INSECURE_SYNC_URLS] ?? "");
-                    try {
-                        (0, urlSafety_1.assertSafeSyncUrl)(url, {
-                            requireHttps: !allowInsecure,
-                            allowPrivate: allowInsecure,
-                        });
-                    }
-                    catch (e) {
-                        if (e instanceof urlSafety_1.UnsafeUrlError) {
-                            res.status(400).json({ error: e.message });
-                            return;
-                        }
-                        throw e;
-                    }
-                    server.url = url;
-                }
-                for (const [field, value, guard] of [
-                    ["direction", direction, types_1.isPeerSyncDirection],
-                    ["role", role, types_1.isPeerRole],
-                    ["attachments", attachments, types_1.isPeerAttachmentMode],
-                ]) {
-                    if (value === undefined)
-                        continue;
-                    if (!guard(value)) {
-                        res.status(400).json({ error: `Invalid ${field}: ${String(value)}` });
-                        return;
-                    }
-                    Object.assign(server, { [field]: value });
-                }
-                this.tenantManager.addTrustedServer(server);
-                this.cluster.syncReplicators();
-                res.status(201).json({ success: true, message: `Trusted server "${name}" added` });
-            }
-            catch (error) {
-                if (error instanceof validation_1.ValidationError) {
-                    res.status(400).json({ error: error.message });
-                    return;
-                }
-                if (error instanceof Error && error.message.includes("already exists")) {
-                    res.status(409).json({ error: error.message });
-                    return;
-                }
-                console.error("[MindooDBServer] Error adding trusted server:", error);
-                res.status(500).json({ error: "Failed to add trusted server" });
-            }
-        });
-        router.delete("/trusted-servers/:serverName", authMiddleware, (req, res) => {
-            try {
-                const serverName = req.params.serverName;
-                (0, validation_1.validateStringLength)(serverName, 256, "serverName");
-                const removed = this.tenantManager.removeTrustedServer(serverName);
-                if (!removed) {
-                    res.status(404).json({ error: "Trusted server not found" });
-                    return;
-                }
-                // Revoking trust must also stop replicating with that server.
-                this.cluster.syncReplicators();
-                res.json({ success: true, message: `Trusted server "${serverName}" removed` });
-            }
-            catch (error) {
-                if (error instanceof validation_1.ValidationError) {
-                    res.status(400).json({ error: error.message });
-                    return;
-                }
-                console.error("[MindooDBServer] Error removing trusted server:", error);
-                res.status(500).json({ error: "Failed to remove trusted server" });
-            }
-        });
+        router.get("/trusted-servers", authMiddleware, (0, expressAdapter_1.route)(() => core.listTrustedServers()));
+        router.post("/trusted-servers", authMiddleware, (0, expressAdapter_1.route)((req) => core.addTrustedServer(req)));
+        router.delete("/trusted-servers/:serverName", authMiddleware, (0, expressAdapter_1.route)((req) => core.removeTrustedServer(req)));
         // Runtime config management
-        router.get("/config/backups", authMiddleware, (req, res) => {
-            try {
-                res.json({ backups: (0, config_1.listConfigBackups)(this.configPath) });
-            }
-            catch (error) {
-                console.error("[MindooDBServer] Error listing config backups:", error);
-                res.status(500).json({ error: "Failed to list config backups" });
-            }
-        });
-        router.get("/config/backups/:backupFile", authMiddleware, (req, res) => {
-            try {
-                const backupFile = decodeURIComponent(req.params.backupFile);
-                if (!(0, config_1.isConfigBackupFilename)(backupFile)) {
-                    res.status(400).json({ error: "Invalid config backup filename" });
-                    return;
-                }
-                const config = (0, config_1.loadConfigBackup)(this.configPath, backupFile);
-                res.json({ file: backupFile, config });
-            }
-            catch (error) {
-                if (error instanceof Error && error.message.startsWith("Config backup not found:")) {
-                    res.status(404).json({ error: "Config backup not found" });
-                    return;
-                }
-                if (error instanceof Error && error.message.startsWith("Invalid config backup filename:")) {
-                    res.status(400).json({ error: "Invalid config backup filename" });
-                    return;
-                }
-                console.error("[MindooDBServer] Error reading config backup:", error);
-                res.status(500).json({ error: "Failed to read config backup" });
-            }
-        });
-        router.get("/config", authMiddleware, (req, res) => {
-            res.json(this.serverConfig);
-        });
-        router.put("/config", authMiddleware, this.handleUpdateConfig.bind(this));
-    }
-    // ==================== System Auth Handlers ====================
-    async handleSystemChallenge(req, res) {
-        try {
-            const { username, publicsignkey } = req.body;
-            if (!username || typeof username !== "string") {
-                res.status(400).json({ error: "username is required" });
-                return;
-            }
-            if (!publicsignkey || typeof publicsignkey !== "string") {
-                res.status(400).json({ error: "publicsignkey is required" });
-                return;
-            }
-            (0, validation_1.validateUsername)(username);
-            (0, validation_1.validateStringLength)(publicsignkey, validation_1.MAX_PEM_KEY_LENGTH, "publicsignkey");
-            const challenge = await this.systemAdminAuth.generateChallenge(username, publicsignkey);
-            res.json({ challenge });
-        }
-        catch (error) {
-            if (error instanceof Error && error.message === "Unknown system admin principal") {
-                res.status(404).json({ error: "System admin principal not found" });
-                return;
-            }
-            if (error instanceof validation_1.ValidationError) {
-                res.status(400).json({ error: error.message });
-                return;
-            }
-            console.error("[MindooDBServer] System challenge error:", error);
-            res.status(500).json({ error: "Internal server error" });
-        }
-    }
-    async handleSystemAuthenticate(req, res) {
-        try {
-            const { challenge, signature } = req.body;
-            if (!challenge || !signature) {
-                res.status(400).json({ error: "challenge and signature are required" });
-                return;
-            }
-            (0, validation_1.validateStringLength)(challenge, validation_1.MAX_CHALLENGE_LENGTH, "challenge");
-            (0, validation_1.validateStringLength)(signature, validation_1.MAX_SIGNATURE_LENGTH, "signature");
-            const signatureBytes = this.base64ToUint8Array(signature);
-            const result = await this.systemAdminAuth.authenticate(challenge, signatureBytes);
-            // Return 401 on a failed authentication instead of 200 (audit, Low).
-            if (!result.success) {
-                res.status(401).json(result);
-                return;
-            }
-            res.json(result);
-        }
-        catch (error) {
-            if (error instanceof validation_1.ValidationError) {
-                res.status(400).json({ error: error.message });
-                return;
-            }
-            console.error("[MindooDBServer] System authenticate error:", error);
-            res.status(500).json({ error: "Internal server error" });
-        }
-    }
-    // ==================== Config Update Handler ====================
-    async handleUpdateConfig(req, res) {
-        try {
-            let newConfig;
-            try {
-                newConfig = (0, config_1.validateServerConfig)(req.body, "request body");
-            }
-            catch (err) {
-                res.status(400).json({
-                    error: err instanceof Error ? err.message : "Invalid config format",
-                });
-                return;
-            }
-            // Self-lockout protection: simulate the proposed config against the calling
-            // admin's identity — reject if they would lose their own config access.
-            const callingAdmin = req.systemAdmin;
-            const proposedMatcher = new CapabilityMatcher_1.CapabilityMatcher(newConfig);
-            if (!proposedMatcher.isAuthorized("PUT", "/system/config", callingAdmin.username, callingAdmin.publicsignkey)) {
-                res.status(400).json({
-                    error: "This change would remove your own access to PUT /system/config",
-                });
-                return;
-            }
-            // Backup the current config before overwriting
-            const { existsSync: fsExists } = await import("fs");
-            let backupFile = null;
-            if (fsExists(this.configPath)) {
-                backupFile = (0, config_1.backupConfig)(this.configPath);
-            }
-            // Persist new config to disk
-            (0, config_1.writeConfig)(this.configPath, newConfig);
-            // Hot-swap in-memory state
-            this.reloadConfig(newConfig);
-            console.log(`[MindooDBServer] Config updated by ${callingAdmin.username}` +
-                (backupFile ? ` (backup: ${backupFile})` : ""));
-            res.json({
-                success: true,
-                ...(backupFile ? { backupFile } : {}),
-            });
-        }
-        catch (error) {
-            console.error("[MindooDBServer] Error updating config:", error);
-            res.status(500).json({ error: "Failed to update config" });
-        }
+        router.get("/config/backups", authMiddleware, (0, expressAdapter_1.route)(() => core.listConfigBackups()));
+        router.get("/config/backups/:backupFile", authMiddleware, (0, expressAdapter_1.route)((req) => core.getConfigBackup(req)));
+        router.get("/config", authMiddleware, (0, expressAdapter_1.route)(() => core.getConfig()));
+        router.put("/config", authMiddleware, (0, expressAdapter_1.route)((req) => core.updateConfig(req)));
     }
     // ==================== Tenant Routes ====================
     /**
@@ -1095,52 +553,47 @@ class MindooDBServer {
      * createSyncRateLimit), sync with a much higher ceiling.
      *
      * Both "docs" and "attachments" store kinds expose the same set of sync
-     * operations, mounted at /sync/docs/* and /sync/attachments/*.
+     * operations (SYNC_ROUTES), mounted at /sync/docs/* and /sync/attachments/*.
      */
     createTenantRouter() {
+        const core = this.core;
         const router = (0, express_1.Router)({ mergeParams: true });
         const authRateLimitConfig = this.getAuthRateLimitConfig();
         const challengeRateLimit = this.createAuthRateLimit("tenant", "challenge");
         const authenticateRateLimit = this.createAuthRateLimit("tenant", "authenticate");
         // Identity resolution precedes the limiter so it can key on the caller.
         const syncGuards = [
-            this.syncPrincipalMiddleware.bind(this),
+            (0, expressAdapter_1.guard)(async (req) => {
+                await core.resolveSyncPrincipal(req);
+                return null;
+            }),
             this.createSyncRateLimit(),
         ];
         console.log(`[MindooDBServer] Tenant auth rate limit configured windowMs=${authRateLimitConfig.windowMs} max=${authRateLimitConfig.max}`);
-        router.post("/auth/challenge", challengeRateLimit, this.handleChallenge.bind(this));
-        router.post("/auth/authenticate", authenticateRateLimit, this.handleAuthenticate.bind(this));
+        router.post("/auth/challenge", challengeRateLimit, (0, expressAdapter_1.route)((req) => core.challenge(req)));
+        router.post("/auth/authenticate", authenticateRateLimit, (0, expressAdapter_1.route)((req) => core.authenticate(req)));
         // RFC 3161 proxy. Authentication runs *before* the limiters so they can key
         // on the identity rather than only the IP — otherwise everyone behind one
         // NAT shares a budget, and a single tenant can lock out the rest.
-        router.post("/timestamps/rfc3161", this.timestampAuthMiddleware.bind(this), this.createTimestampRateLimit("burst"), this.createTimestampRateLimit("daily"), express_1.default.raw({ type: timestampProxy_1.TIMESTAMP_QUERY_CONTENT_TYPE, limit: timestampProxy_1.MAX_TIMESTAMP_REQUEST_BYTES }), this.handleTimestampRequest.bind(this));
-        for (const storeKind of ["docs", "attachments"]) {
-            const syncBase = `/sync/${storeKind}`;
-            router.post(`${syncBase}/findNewEntries`, syncGuards, this.handleFindNewEntries.bind(this));
-            router.post(`${syncBase}/findNewEntriesForDoc`, syncGuards, this.handleFindNewEntriesForDoc.bind(this));
-            router.post(`${syncBase}/findEntries`, syncGuards, this.handleFindEntries.bind(this));
-            router.post(`${syncBase}/scanEntriesSince`, syncGuards, this.handleScanEntriesSince.bind(this));
-            router.post(`${syncBase}/getStoreHead`, syncGuards, this.handleGetStoreHead.bind(this));
-            router.post(`${syncBase}/getIdBloomSummary`, syncGuards, this.handleGetIdBloomSummary.bind(this));
-            router.post(`${syncBase}/getCompactionStatus`, syncGuards, this.handleGetCompactionStatus.bind(this));
-            router.get(`${syncBase}/capabilities`, syncGuards, this.handleGetCapabilities.bind(this));
-            // SSE live change feed (sync-v5, phase 5): one long-lived GET per
-            // subscriber; putEntries publishes into the in-process event bus.
-            router.get(`${syncBase}/events`, syncGuards, this.handleSyncEvents.bind(this));
-            router.post(`${syncBase}/getEntries`, syncGuards, this.handleGetEntries.bind(this));
-            // Binary wire format v2 (sync-v5, phase 3): octet-stream framing for the
-            // two payload-heavy endpoints. putEntriesBinary needs its own raw body
-            // parser (the global JSON parser only handles application/json).
-            router.post(`${syncBase}/getEntriesBinary`, syncGuards, this.handleGetEntriesBinary.bind(this));
-            router.post(`${syncBase}/putEntriesBinary`, syncGuards, express_1.default.raw({ type: binaryEntryFraming_1.BINARY_ENTRIES_CONTENT_TYPE, limit: this.jsonBodyLimit }), this.handlePutEntriesBinary.bind(this));
-            router.post(`${syncBase}/getEntryMetadata`, syncGuards, this.handleGetEntryMetadata.bind(this));
-            router.post(`${syncBase}/putEntries`, syncGuards, this.handlePutEntries.bind(this));
-            router.post(`${syncBase}/hasEntries`, syncGuards, this.handleHasEntries.bind(this));
-            router.get(`${syncBase}/getAllIds`, syncGuards, this.handleGetAllIds.bind(this));
-            router.post(`${syncBase}/resolveDependencies`, syncGuards, this.handleResolveDependencies.bind(this));
-            router.post(`${syncBase}/planDocumentMaterialization`, syncGuards, this.handlePlanDocumentMaterialization.bind(this));
-            router.post(`${syncBase}/planDocumentMaterializationBatch`, syncGuards, this.handlePlanDocumentMaterializationBatch.bind(this));
-            router.post(`${syncBase}/planAttachmentReadByWalkingMetadata`, syncGuards, this.handlePlanAttachmentReadByWalkingMetadata.bind(this));
+        router.post("/timestamps/rfc3161", (0, expressAdapter_1.guard)((req) => core.timestampAuthGuard(req)), this.createTimestampRateLimit("burst"), this.createTimestampRateLimit("daily"), express_1.default.raw({ type: timestampProxy_1.TIMESTAMP_QUERY_CONTENT_TYPE, limit: timestampProxy_1.MAX_TIMESTAMP_REQUEST_BYTES }), (0, expressAdapter_1.route)((req) => core.timestampRequest(req)));
+        for (const storeKind of MindooDBServerCore_1.SYNC_STORE_KINDS) {
+            for (const syncRoute of MindooDBServerCore_1.SYNC_ROUTES) {
+                const routePath = `/sync/${storeKind}/${syncRoute.name}`;
+                const handlers = [...syncGuards];
+                if ("rawBodyType" in syncRoute) {
+                    // The global JSON parser only handles application/json.
+                    handlers.push(express_1.default.raw({ type: syncRoute.rawBodyType, limit: this.jsonBodyLimit }));
+                }
+                handlers.push(syncRoute.name === "events"
+                    ? (req, res, next) => this.handleSyncEvents(storeKind, req, res).catch(next)
+                    : (0, expressAdapter_1.route)((req) => core.sync(syncRoute.name, req, storeKind)));
+                if (syncRoute.method === "GET") {
+                    router.get(routePath, handlers);
+                }
+                else {
+                    router.post(routePath, handlers);
+                }
+            }
         }
         return router;
     }
@@ -1150,12 +603,7 @@ class MindooDBServer {
      * the net catches only traffic no tier claims.
      */
     getGlobalRateLimitConfig() {
-        const resolved = (0, rateLimits_1.resolveGlobalRateLimit)(this.serverConfig.rateLimits?.global, {
-            sync: this.getSyncRateLimitConfig(),
-            auth: this.getAuthRateLimitConfig(),
-            defaultWindowMs: DEFAULT_GLOBAL_RATE_LIMIT_WINDOW_MS,
-            headroom: GLOBAL_RATE_LIMIT_TIER_HEADROOM,
-        });
+        const resolved = this.rateLimitPolicy().global;
         if (resolved.shadowsTiers) {
             console.warn(`[MindooDBServer] rateLimits.global.max=${resolved.max} is below the ${resolved.tierFloor} ` +
                 "requests the sync and auth tiers may spend in the same window; the global limiter " +
@@ -1165,49 +613,26 @@ class MindooDBServer {
     }
     /** Resolved auth rate-limit config; falls back to defaults when not set in config.json. */
     getAuthRateLimitConfig() {
-        return {
-            windowMs: this.serverConfig.rateLimits?.auth?.windowMs ?? DEFAULT_AUTH_RATE_LIMIT_WINDOW_MS,
-            max: this.serverConfig.rateLimits?.auth?.max ?? DEFAULT_AUTH_RATE_LIMIT_MAX,
-        };
-    }
-    /** Resolved sync rate-limit config; falls back to defaults when not set in config.json. */
-    getSyncRateLimitConfig() {
-        return {
-            windowMs: this.serverConfig.rateLimits?.sync?.windowMs ?? DEFAULT_SYNC_RATE_LIMIT_WINDOW_MS,
-            max: this.serverConfig.rateLimits?.sync?.max ?? DEFAULT_SYNC_RATE_LIMIT_MAX,
-        };
-    }
-    /** Resolved timestamp rate-limit config; falls back to defaults when not set in config.json. */
-    getTimestampRateLimitConfig() {
-        const configured = this.serverConfig.rateLimits?.timestamps;
-        return {
-            windowMs: configured?.windowMs ?? DEFAULT_TIMESTAMP_RATE_LIMIT_WINDOW_MS,
-            max: configured?.max ?? DEFAULT_TIMESTAMP_RATE_LIMIT_MAX,
-            dailyMax: configured?.dailyMax ?? DEFAULT_TIMESTAMP_DAILY_LIMIT_MAX,
-        };
+        return this.rateLimitPolicy().auth;
     }
     /**
      * Two limiters guard the timestamp proxy: a short burst window that keeps a
      * misbehaving client from hammering an upstream, and a daily cap that bounds
      * total consumption of a shared (often free) upstream allowance.
      *
-     * Both key on tenant + principal + IP. The principal is present because
-     * {@link timestampAuthMiddleware} runs first.
+     * Both key on tenant + principal + IP. The principal is present because the
+     * timestamp auth guard runs first.
      */
     createTimestampRateLimit(tier) {
-        const config = this.getTimestampRateLimitConfig();
-        const windowMs = tier === "burst" ? config.windowMs : TIMESTAMP_DAILY_WINDOW_MS;
+        const config = this.rateLimitPolicy().timestamp;
+        const windowMs = tier === "burst" ? config.windowMs : rateLimits_1.TIMESTAMP_DAILY_WINDOW_MS;
         const max = tier === "burst" ? config.max : config.dailyMax;
         return (0, express_rate_limit_1.default)({
             windowMs,
             max,
             standardHeaders: true,
             legacyHeaders: false,
-            keyGenerator: (req) => {
-                const tenantId = req.tenantId ?? "unknown";
-                const principal = req.timestampPrincipal ?? "anonymous";
-                return `timestamp:${tier}:${tenantId}:${principal}:${this.getClientIpForRateLimit(req)}`;
-            },
+            keyGenerator: (req) => (0, rateLimits_1.buildTimestampRateLimitKey)(tier, req.tenantId, req.timestampPrincipal, this.getClientIpForRateLimit(req)),
             handler: (req, res, _next, options) => {
                 console.warn(`[MindooDBServer] Timestamp rate limit hit (${tier}) tenant=${req.tenantId} ip=${req.ip}`);
                 res.status(options.statusCode).json(options.message);
@@ -1219,30 +644,6 @@ class MindooDBServer {
             },
         });
     }
-    /**
-     * Resolve the caller of a sync request so {@link createSyncRateLimit} can
-     * bucket per identity instead of per address.
-     *
-     * Unlike {@link timestampAuthMiddleware} this never rejects: the route
-     * handlers do their own token validation and own the 401, and this pass only
-     * needs to know whose budget to spend. An unverifiable token simply falls
-     * back to address-only bucketing — a forged one must not be able to conjure
-     * a fresh budget, which is why the token is verified rather than decoded.
-     */
-    async syncPrincipalMiddleware(req, _res, next) {
-        try {
-            const token = this.extractToken(req);
-            const authService = await this.tenantManager.getAuthService(req.tenantId);
-            const payload = await authService.validateToken(token);
-            if (payload && payload.tenantId === req.tenantId) {
-                req.syncPrincipal = payload.deviceSigningKey ?? payload.sub;
-            }
-        }
-        catch {
-            // No usable token; fall through to address-only bucketing.
-        }
-        next();
-    }
     /**
      * Sync budget, keyed on tenant + principal + IP like the auth and timestamp
      * tiers. Address-only keying would put every user behind one NAT or reverse
@@ -1250,7 +651,7 @@ class MindooDBServer {
      * throttle everyone else on that address.
      */
     createSyncRateLimit() {
-        const config = this.getSyncRateLimitConfig();
+        const config = this.rateLimitPolicy().sync;
         console.log(`[MindooDBServer] Tenant sync rate limit configured windowMs=${config.windowMs} max=${config.max}`);
         return (0, express_rate_limit_1.default)({
             windowMs: config.windowMs,
@@ -1266,91 +667,12 @@ class MindooDBServer {
             message: { error: "Too many sync requests, please try again later" },
         });
     }
-    /**
-     * Authenticate a timestamp request with the tenant's existing bearer token and
-     * record the principal for rate-limit bucketing.
-     *
-     * The proxy makes outbound requests on the caller's behalf, so it must never
-     * be open: unauthenticated it would be a free relay to third-party services.
-     */
-    async timestampAuthMiddleware(req, res, next) {
-        try {
-            const token = this.extractToken(req);
-            const authService = await this.tenantManager.getAuthService(req.tenantId);
-            const payload = await authService.validateToken(token);
-            if (!payload || payload.tenantId !== req.tenantId) {
-                res.status(401).json({ error: "Invalid or expired token" });
-                return;
-            }
-            req.timestampPrincipal = payload.deviceSigningKey ?? payload.sub;
-            next();
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    /**
-     * Forward a DER TimeStampReq to a configured TSA and return the DER
-     * TimeStampResp verbatim.
-     *
-     * The server neither parses nor validates the ASN.1: the client checks that
-     * the returned token's `messageImprint` matches the digest it sent and that
-     * the token chains to a trusted root. That is what reduces a hostile proxy —
-     * ours or anyone's — from a forgery risk to a denial-of-service risk.
-     */
-    async handleTimestampRequest(req, res) {
-        if (this.tsaProviders.length === 0) {
-            res.status(503).json({ error: "Timestamping is not enabled on this server" });
-            return;
-        }
-        const body = req.body;
-        if (!Buffer.isBuffer(body)) {
-            res.status(415).json({
-                error: `Timestamp requests must be sent as ${timestampProxy_1.TIMESTAMP_QUERY_CONTENT_TYPE}`,
-            });
-            return;
-        }
-        // The provider is named by id and resolved against the env allowlist; a
-        // client-supplied URL would make this an SSRF gadget.
-        const requestedProvider = req.query.provider;
-        let preferredProviderId;
-        if (typeof requestedProvider === "string" && requestedProvider.length > 0) {
-            preferredProviderId = requestedProvider.toLowerCase();
-        }
-        else if (requestedProvider !== undefined) {
-            res.status(400).json({ error: "provider must be a single string value" });
-            return;
-        }
-        try {
-            const result = await (0, timestampProxy_1.requestTimestampToken)({
-                providers: this.tsaProviders,
-                request: new Uint8Array(body),
-                preferredProviderId,
-            });
-            res.setHeader("content-type", timestampProxy_1.TIMESTAMP_REPLY_CONTENT_TYPE);
-            res.setHeader("x-mindoodb-tsa-provider", result.providerId);
-            res.status(200).send(Buffer.from(result.response));
-        }
-        catch (error) {
-            if (error instanceof timestampProxy_1.TimestampProxyError) {
-                if (error.attempts.length > 0) {
-                    console.warn(`[MindooDBServer] Timestamp request failed for tenant ${req.tenantId}: ${error.attempts
-                        .map((attempt) => `${attempt.providerId}=${attempt.error ?? "ok"}`)
-                        .join("; ")}`);
-                }
-                res.status(error.status).json({ error: error.message });
-                return;
-            }
-            console.error("[MindooDBServer] Unexpected timestamp proxy error:", error);
-            res.status(500).json({ error: "Failed to obtain a timestamp" });
-        }
-    }
     /**
      * Create a rate-limiter for authentication endpoints. Challenge and
      * authenticate get separate limiters so that one phase can't starve the
-     * other. The custom keyGenerator buckets by (scope, tenant, phase, IP,
-     * username) — this prevents users behind a shared IP (NAT / reverse
-     * proxy) from exhausting each other's budgets.
+     * other. The key buckets by (scope, tenant, phase, IP, username) — this
+     * prevents users behind a shared IP (NAT / reverse proxy) from exhausting
+     * each other's budgets.
      */
     createAuthRateLimit(scope, phase) {
         const authRateLimitConfig = this.getAuthRateLimitConfig();
@@ -1359,7 +681,7 @@ class MindooDBServer {
             max: authRateLimitConfig.max,
             standardHeaders: true,
             legacyHeaders: false,
-            keyGenerator: (req) => this.getAuthRateLimitKey(req, scope, phase),
+            keyGenerator: (req) => (0, rateLimits_1.buildAuthRateLimitKey)(scope, phase, req.tenantId ?? req.params.tenantId?.toLowerCase(), this.getClientIpForRateLimit(req), req.body),
             handler: (req, res, _next, options) => {
                 this.logAuthRateLimitHit(req, scope, phase);
                 res.status(options.statusCode).json(options.message);
@@ -1367,30 +689,6 @@ class MindooDBServer {
             message: { error: "Too many authentication attempts, please try again later" },
         });
     }
-    /**
-     * Composite rate-limit key. Challenge requests include the username so
-     * that brute-forcing one account doesn't block legitimate users on the
-     * same IP. Authenticate requests omit username because the challenge
-     * token is already scoped to a single principal.
-     */
-    getAuthRateLimitKey(req, scope, phase) {
-        const tenantId = scope === "tenant"
-            ? req.tenantId ?? req.params.tenantId?.toLowerCase() ?? "-"
-            : "system";
-        const clientIp = this.getClientIpForRateLimit(req);
-        if (phase === "challenge") {
-            // Bucket by username when supplied, otherwise by the signing public key a
-            // key-based client identifies with, so key-based clients still get a
-            // stable per-principal bucket instead of all sharing "-".
-            const principal = typeof req.body?.username === "string" && req.body.username.trim()
-                ? req.body.username.trim().toLowerCase()
-                : typeof req.body?.signingPublicKey === "string" && req.body.signingPublicKey.trim()
-                    ? req.body.signingPublicKey.trim()
-                    : "-";
-            return `${scope}:${tenantId}:${phase}:${clientIp}:${principal}`;
-        }
-        return `${scope}:${tenantId}:${phase}:${clientIp}`;
-    }
     /**
      * Emit a structured warning when an auth rate limit is triggered.
      * The forwarded-for header is logged to help diagnose situations where
@@ -1420,739 +718,47 @@ class MindooDBServer {
             : req.socket?.remoteAddress) ?? "unknown";
         return (0, express_rate_limit_1.ipKeyGenerator)(raw);
     }
-    // ==================== Validation Helpers ====================
-    validateDbId(dbId) {
-        return (0, validation_1.validateIdentifier)(dbId, "dbId");
-    }
-    formatTenantNotFoundOnServerError(tenantId) {
-        const serverName = this.tenantManager.getServerPublicInfo()?.name ?? "unknown";
-        return `Tenant ${tenantId} not found on server ${serverName}`;
-    }
-    // ==================== Device Discovery (server-wide) ====================
-    async handleDeviceChallenge(req, res) {
-        try {
-            const { signingPublicKey } = req.body ?? {};
-            if (typeof signingPublicKey !== "string" || !signingPublicKey.trim()) {
-                res.status(400).json({ error: "signingPublicKey is required" });
-                return;
-            }
-            (0, validation_1.validateStringLength)(signingPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "signingPublicKey");
-            const challenge = this.deviceDiscovery.createChallenge(signingPublicKey);
-            res.json({ challenge });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleDeviceDiscover(req, res) {
-        try {
-            const { challenge, signature } = req.body ?? {};
-            if (typeof challenge !== "string" || !challenge.trim()) {
-                res.status(400).json({ error: "challenge is required" });
-                return;
-            }
-            if (typeof signature !== "string" || !signature.trim()) {
-                res.status(400).json({ error: "signature is required" });
-                return;
-            }
-            (0, validation_1.validateStringLength)(challenge, validation_1.MAX_CHALLENGE_LENGTH, "challenge");
-            (0, validation_1.validateStringLength)(signature, validation_1.MAX_SIGNATURE_LENGTH, "signature");
-            const signatureBytes = this.base64ToUint8Array(signature);
-            const result = await this.deviceDiscovery.discover(challenge, signatureBytes);
-            res.json(result);
-        }
-        catch (error) {
-            if (error instanceof DeviceDiscoveryService_1.DeviceDiscoveryAuthError) {
-                res.status(401).json({ error: error.message });
-                return;
-            }
-            this.handleRequestError(error, res);
-        }
-    }
-    // ==================== Tenant Auth Handlers ====================
-    // Two-step challenge-response flow:
-    //  1. POST /auth/challenge  → client sends username, server returns a random nonce
-    //  2. POST /auth/authenticate → client signs the nonce with its Ed25519 private key,
-    //     server verifies the signature and returns a JWT for subsequent sync calls
-    async handleChallenge(req, res) {
-        try {
-            const { username, signingPublicKey } = req.body;
-            // The username is optional: a client may identify itself by its device
-            // signing public key instead, so the server never needs the cleartext
-            // name. Validate whichever was supplied.
-            if (username !== undefined && username !== null) {
-                (0, validation_1.validateUsername)(username);
-            }
-            if (signingPublicKey !== undefined && signingPublicKey !== null) {
-                (0, validation_1.validateStringLength)(signingPublicKey, validation_1.MAX_SIGNATURE_LENGTH, "signingPublicKey");
-            }
-            const authService = await this.tenantManager.getAuthService(req.tenantId);
-            const challenge = await authService.generateChallenge(typeof username === "string" ? username : undefined, typeof signingPublicKey === "string" ? { signingPublicKey } : undefined);
-            res.json({ challenge });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleAuthenticate(req, res) {
-        try {
-            const { challenge, signature } = req.body;
-            if (!challenge || !signature) {
-                res.status(400).json({ error: "challenge and signature are required" });
-                return;
-            }
-            (0, validation_1.validateStringLength)(challenge, validation_1.MAX_CHALLENGE_LENGTH, "challenge");
-            (0, validation_1.validateStringLength)(signature, validation_1.MAX_SIGNATURE_LENGTH, "signature");
-            const authService = await this.tenantManager.getAuthService(req.tenantId);
-            const signatureBytes = this.base64ToUint8Array(signature);
-            const result = await authService.authenticate(challenge, signatureBytes);
-            // Return 401 on a failed authentication instead of 200 (audit, Low): a
-            // failed credential check must not look like a success at the HTTP layer.
-            if (!result.success) {
-                res.status(401).json(result);
-                return;
-            }
-            res.json(result);
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    // ==================== Sync Handlers ====================
-    async handleFindNewEntries(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, haveIds } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            (0, validation_1.validateArraySize)(haveIds, validation_1.MAX_HAVE_IDS, "haveIds");
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const entries = await serverStore.handleFindNewEntries(token, haveIds || []);
-            res.json({
-                entries: entries.map((e) => this.serializeEntryMetadata(e)),
-            });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleFindNewEntriesForDoc(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, haveIds, docId } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            if (!docId) {
-                res.status(400).json({ error: "docId is required" });
-                return;
-            }
-            (0, validation_1.validateArraySize)(haveIds, validation_1.MAX_HAVE_IDS, "haveIds");
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const entries = await serverStore.handleFindNewEntriesForDoc(token, haveIds || [], docId);
-            res.json({
-                entries: entries.map((e) => this.serializeEntryMetadata(e)),
-            });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleFindEntries(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, type, creationDateFrom, creationDateUntil } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const entries = await serverStore.handleFindEntries(token, type, creationDateFrom ?? null, creationDateUntil ?? null);
-            res.json({
-                entries: entries.map((e) => this.serializeEntryMetadata(e)),
-            });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleScanEntriesSince(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, cursor, limit, filters } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const result = await serverStore.handleScanEntriesSince(token, cursor ?? null, limit, filters);
-            res.json({
-                entries: result.entries.map((e) => this.serializeEntryMetadata(e)),
-                nextCursor: result.nextCursor,
-                hasMore: result.hasMore,
-            });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleGetStoreHead(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const head = await serverStore.handleGetStoreHead(token);
-            res.json({ head });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleGetIdBloomSummary(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const summary = await serverStore.handleGetIdBloomSummary(token);
-            res.json({ summary: summary });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleGetCapabilities(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const validDbId = this.validateDbId(req.query.dbId);
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const capabilities = await serverStore.handleGetCapabilities(token);
-            // HTTP-layer features on top of the transport-agnostic capability set:
-            // binary octet-stream framing routes (phase 3) and the SSE change feed
-            // (phase 5) exist only in this Express host.
-            res.json({
-                capabilities: {
-                    ...capabilities,
-                    supportsBinaryEntries: true,
-                    supportsPayloadOnlyEntries: true,
-                    supportsChangeEvents: true,
-                },
-            });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    /**
-     * SSE live change feed (sync-v5, phase 5).
-     *
-     * `GET /:tenantId/sync/:storeKind/events` — Bearer-authenticated like every
-     * other sync route (fetch-streaming clients can set headers; native
-     * EventSource cannot, which is why the SDK uses a fetch reader).
-     *
-     * The subscribe-time read gate runs via `handleGetCapabilities` against the
-     * database given in `?dbId=` (default `directory`, which every tenant member
-     * can read): it validates the token and runs the database-open gate. Events
-     * carry only `{dbId, storeKind, epoch, maxReceiptOrder}` — metadata, never
-     * content. A heartbeat comment every 30 s keeps proxies from closing the
-     * stream. Token expiry does not tear down an open stream; the events are
-     * non-sensitive change hints and a reconnect re-authenticates.
-     */
-    async handleSyncEvents(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const tenantId = req.tenantId;
-            const storeKind = this.getStoreKindFromRequest(req);
-            const gateDbId = this.validateDbId(typeof req.query.dbId === "string" && req.query.dbId ? req.query.dbId : "directory");
-            // Validates the token and runs the database-open/read gate before any
-            // event is delivered.
-            const serverStore = await this.tenantManager.getServerStore(tenantId, gateDbId, storeKind);
-            await serverStore.handleGetCapabilities(token);
-            res.status(200);
-            res.setHeader("Content-Type", "text/event-stream");
-            res.setHeader("Cache-Control", "no-cache, no-transform");
-            res.setHeader("X-Accel-Buffering", "no");
-            if (!req.httpVersion.startsWith("2")) {
-                // Forbidden (and unnecessary) on HTTP/2 streams.
-                res.setHeader("Connection", "keep-alive");
-            }
-            res.flushHeaders();
-            res.write(`event: hello\ndata: ${JSON.stringify({ protocolVersion: "sync-v5" })}\n\n`);
-            const unsubscribe = this.syncEventBus.subscribe((event) => {
-                if (event.tenantId !== tenantId || event.storeKind !== storeKind) {
-                    return;
-                }
-                res.write(`event: change\ndata: ${JSON.stringify({
-                    dbId: event.dbId,
-                    storeKind: event.storeKind,
-                    epoch: event.epoch,
-                    maxReceiptOrder: event.maxReceiptOrder,
-                })}\n\n`);
-            });
-            const heartbeat = setInterval(() => {
-                res.write(`: heartbeat ${Date.now()}\n\n`);
-            }, 30000);
-            const cleanup = () => {
-                clearInterval(heartbeat);
-                unsubscribe();
-            };
-            req.on("close", cleanup);
-            res.on("close", cleanup);
-            console.log(`[MindooDBServer] SSE subscriber connected tenant=${tenantId} storeKind=${storeKind} subscribers=${this.syncEventBus.listenerCount}`);
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
+    // ==================== Sync Event Stream ====================
     /**
-     * Publish a change event after an accepted putEntries write (sync-v5,
-     * phase 5). Fire-and-forget: head lookup failures must never affect the
-     * write path.
+     * SSE transport for the change feed: the core runs the subscribe-time read
+     * gate, this keeps the stream open on the in-process event bus with a
+     * heartbeat every 30 s.
      */
-    publishSyncChangeEvent(tenantId, dbId, storeKind, serverStore, token) {
-        if (this.syncEventBus.listenerCount === 0) {
+    async handleSyncEvents(storeKind, req, res) {
+        const response = await this.core.sync("events", (0, expressAdapter_1.toServerRequest)(req), storeKind);
+        if (!(0, types_2.isEventStreamResponse)(response)) {
+            await (0, expressAdapter_1.sendServerResponse)(req, res, response);
             return;
         }
-        // Peer replicators subscribe to this bus, so a write that arrived from a
-        // peer has to be labelled: without the label it would be pushed straight
-        // back to its origin, and two bidirectional peers would ping-pong.
-        const originPeer = this.cluster?.auth
-            ? this.cluster.auth.validateToken(token).then((payload) => payload?.sub)
-            : Promise.resolve(undefined);
-        void Promise.all([serverStore.handleGetStoreHead(token).catch(() => null), originPeer]).then(([head, peerName]) => {
-            this.syncEventBus.publish({
-                tenantId,
-                dbId,
-                storeKind,
-                epoch: head?.epoch,
-                maxReceiptOrder: head?.maxReceiptOrder,
-                originPeer: peerName,
-            });
-        });
-    }
-    async handleGetCompactionStatus(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const status = await serverStore.handleGetCompactionStatus(token);
-            res.json({ status: status });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleGetEntries(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, ids, sessionKeyWrap } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            (0, validation_1.validateArraySize)(ids, validation_1.MAX_ENTRY_IDS, "ids");
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            // Session-key transport format (sync-v5, phase 2): one RSA-wrapped
-            // AES-256-GCM key per response instead of per-entry RSA. Negotiated via
-            // the `sessionKeyWrap` request flag; legacy clients get the old format.
-            if (sessionKeyWrap === true) {
-                const batch = await serverStore.handleGetEntriesSessionWrapped(token, ids || []);
-                res.json({
-                    wrappedSessionKey: this.uint8ArrayToBase64(batch.wrappedSessionKey),
-                    entries: batch.entries.map((e) => ({
-                        ...this.serializeEntryMetadata(e),
-                        iv: this.uint8ArrayToBase64(e.iv),
-                        sessionEncryptedPayload: this.uint8ArrayToBase64(e.sessionEncryptedPayload),
-                    })),
-                });
-                return;
-            }
-            const entries = await serverStore.handleGetEntries(token, ids || []);
-            res.json({
-                entries: entries.map((e) => ({
-                    ...this.serializeEntryMetadata(e),
-                    rsaEncryptedPayload: this.uint8ArrayToBase64(e.rsaEncryptedPayload),
-                })),
-            });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    /**
-     * Binary variant of getEntries (sync-v5, phase 3): always session-key
-     * encrypted, response framed as `application/octet-stream` (see
-     * binaryEntryFraming.ts). The request stays JSON (small).
-     */
-    async handleGetEntriesBinary(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, ids, payloadOnly } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            (0, validation_1.validateArraySize)(ids, validation_1.MAX_ENTRY_IDS, "ids");
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const batch = await serverStore.handleGetEntriesSessionWrapped(token, ids || []);
-            // `payloadOnly` (capability supportsPayloadOnlyEntries): the client
-            // already holds the metadata from its scan, so each frame carries only
-            // what it cannot have yet. Same entries, same session-key encryption.
-            const body = (0, binaryEntryFraming_1.encodeBinaryEntryMessage)({
-                header: {
-                    format: binaryEntryFraming_1.BINARY_GET_ENTRIES_FORMAT,
-                    wrappedSessionKey: this.uint8ArrayToBase64(batch.wrappedSessionKey),
-                    ...(payloadOnly === true ? { payloadOnly: true } : {}),
-                },
-                entries: batch.entries.map((e) => ({
-                    meta: payloadOnly === true
-                        ? { id: e.id, iv: this.uint8ArrayToBase64(e.iv) }
-                        : { ...this.serializeEntryMetadata(e), iv: this.uint8ArrayToBase64(e.iv) },
-                    payload: e.sessionEncryptedPayload,
-                })),
-            });
-            const payloadBytes = batch.entries.reduce((sum, e) => sum + e.sessionEncryptedPayload.byteLength, 0);
-            res.setHeader("Content-Type", binaryEntryFraming_1.BINARY_ENTRIES_CONTENT_TYPE);
-            await (0, compressionMiddleware_1.sendBinaryEntryBody)(req, res, body, body.byteLength - payloadBytes);
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleGetEntryMetadata(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, id } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            if (!id) {
-                res.status(400).json({ error: "id is required" });
-                return;
-            }
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const entry = await serverStore.handleGetEntryMetadata(token, id);
-            res.json({
-                entry: entry ? this.serializeEntryMetadata(entry) : null,
-            });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    /**
-     * Ingest encrypted entries from a client. The `stage` variable tracks
-     * progress through the pipeline so that error logs pinpoint the failing
-     * step (token extraction → body parsing → deserialization → storage).
-     */
-    async handlePutEntries(req, res) {
-        let stage = "extract-token";
-        try {
-            const token = this.extractToken(req);
-            stage = "read-body";
-            const { dbId, entries } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            (0, validation_1.validateArraySize)(entries, validation_1.MAX_PUT_ENTRIES, "entries");
-            const serializedEntries = Array.isArray(entries) ? entries : [];
-            const serializedEntryTypeCounts = serializedEntries.reduce((acc, entry) => {
-                const key = entry?.entryType ?? "unknown";
-                acc[key] = (acc[key] ?? 0) + 1;
-                return acc;
-            }, {});
-            console.log(`[MindooDBServer] putEntries request tenant=${req.tenantId ?? "-"} db=${validDbId} entries=${serializedEntries.length} parsed-bytes=${req.jsonBodyBytes ?? "-"} content-length=${req.headers["content-length"] ?? "-"} types=${JSON.stringify(serializedEntryTypeCounts)}`);
-            stage = "load-server-store";
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            stage = "deserialize-entries";
-            const deserializedEntries = serializedEntries.map((entry, index) => {
-                try {
-                    return this.deserializeEntry(entry);
-                }
-                catch (error) {
-                    console.error("[MindooDBServer] putEntries failed while deserializing entry", {
-                        index,
-                        id: entry?.id ?? "-",
-                        type: entry?.entryType ?? "-",
-                        docId: entry?.docId ?? "-",
-                        encryptedSize: entry?.encryptedSize ?? "-",
-                        originalSize: entry?.originalSize ?? "-",
-                        signatureLength: entry?.signature?.length ?? "-",
-                        encryptedDataLength: entry?.encryptedData?.length ?? "-",
-                        error,
-                    });
-                    throw error;
-                }
-            });
-            const totalEncryptedBytes = deserializedEntries.reduce((sum, entry) => sum + entry.encryptedData.byteLength, 0);
-            const totalOriginalBytes = deserializedEntries.reduce((sum, entry) => sum + entry.originalSize, 0);
-            console.log(`[MindooDBServer] putEntries deserialized tenant=${req.tenantId ?? "-"} db=${validDbId} entries=${deserializedEntries.length} totalEncryptedBytes=${totalEncryptedBytes} totalOriginalBytes=${totalOriginalBytes}`);
-            stage = "store-entries";
-            const ack = await serverStore.handlePutEntries(token, deserializedEntries);
-            stage = "respond-success";
-            // Return witness receipts for accepted entries so the pushing client (and
-            // every replica it later syncs with) can persist the attestation
-            // (docs/accesscontrol.md §5.3), plus per-entry rejections for
-            // signature-class failures the server skipped. Older clients ignore the
-            // extra fields.
-            res.json({
-                success: true,
-                receipts: ack.receipts.map((e) => this.serializeEntryMetadata(e)),
-                rejected: ack.rejected,
-            });
-            // Announce the accepted write to SSE subscribers (sync-v5, phase 5).
-            if (ack.receipts.length > 0) {
-                this.publishSyncChangeEvent(req.tenantId, validDbId, this.getStoreKindFromRequest(req), serverStore, token);
-            }
-            // A directory push may carry new admin-signed purge requests
-            // (docs/accesscontrol.md §13). Execute any pending purges after the
-            // response so the server physically removes purged history from its own
-            // stores and arms the re-push denylist. Fire-and-forget: failures are
-            // logged and retried on the next directory push.
-            if (validDbId === "directory") {
-                const tenantId = req.tenantId;
-                void this.tenantManager.executePendingPurges(tenantId).catch((error) => {
-                    console.error(`[MindooDBServer] executePendingPurges failed for ${tenantId}:`, error);
-                });
-            }
-        }
-        catch (error) {
-            console.error("[MindooDBServer] putEntries failed", {
-                stage,
-                tenantId: req.tenantId ?? "-",
-                dbId: req.body?.dbId ?? "-",
-                parsedBytes: req.jsonBodyBytes ?? "-",
-                contentLength: req.headers["content-length"] ?? "-",
-                entryCount: Array.isArray(req.body?.entries) ? req.body.entries.length : "-",
-                error,
-            });
-            this.handleRequestError(error, res);
-        }
-    }
-    /**
-     * Binary variant of putEntries (sync-v5, phase 3). The request body is
-     * octet-stream framing; `dbId` travels in the message header JSON because
-     * there is no JSON body. Receipts are returned as JSON like putEntries.
-     */
-    async handlePutEntriesBinary(req, res) {
-        let stage = "extract-token";
-        try {
-            const token = this.extractToken(req);
-            stage = "decode-body";
-            if (!Buffer.isBuffer(req.body)) {
-                res.status(400).json({ error: `putEntriesBinary requires a ${binaryEntryFraming_1.BINARY_ENTRIES_CONTENT_TYPE} body` });
-                return;
-            }
-            const message = (0, binaryEntryFraming_1.decodeBinaryEntryMessage)(new Uint8Array(req.body.buffer, req.body.byteOffset, req.body.byteLength));
-            if (message.header.format !== binaryEntryFraming_1.BINARY_PUT_ENTRIES_FORMAT) {
-                res.status(400).json({ error: `Unsupported binary entry format: ${String(message.header.format)}` });
-                return;
-            }
-            const validDbId = this.validateDbId(message.header.dbId);
-            (0, validation_1.validateArraySize)(message.entries, validation_1.MAX_PUT_ENTRIES, "entries");
-            console.log(`[MindooDBServer] putEntriesBinary request tenant=${req.tenantId ?? "-"} db=${validDbId} entries=${message.entries.length} content-length=${req.headers["content-length"] ?? "-"}`);
-            stage = "load-server-store";
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            stage = "deserialize-entries";
-            const deserializedEntries = message.entries.map((frame, index) => {
-                const meta = frame.meta;
-                try {
-                    return {
-                        ...this.deserializeEntryMetadata(meta),
-                        encryptedData: frame.payload,
-                    };
-                }
-                catch (error) {
-                    console.error("[MindooDBServer] putEntriesBinary failed while deserializing entry", {
-                        index,
-                        id: meta?.id ?? "-",
-                        type: meta?.entryType ?? "-",
-                        docId: meta?.docId ?? "-",
-                        payloadLength: frame.payload?.byteLength ?? "-",
-                        error,
-                    });
-                    throw error;
-                }
-            });
-            stage = "store-entries";
-            const ack = await serverStore.handlePutEntries(token, deserializedEntries);
-            stage = "respond-success";
-            res.json({
-                success: true,
-                receipts: ack.receipts.map((e) => this.serializeEntryMetadata(e)),
-                rejected: ack.rejected,
-            });
-            // Announce the accepted write to SSE subscribers (sync-v5, phase 5).
-            if (ack.receipts.length > 0) {
-                this.publishSyncChangeEvent(req.tenantId, validDbId, this.getStoreKindFromRequest(req), serverStore, token);
-            }
-            // Same post-response purge hook as the JSON putEntries path.
-            if (validDbId === "directory") {
-                const tenantId = req.tenantId;
-                void this.tenantManager.executePendingPurges(tenantId).catch((error) => {
-                    console.error(`[MindooDBServer] executePendingPurges failed for ${tenantId}:`, error);
-                });
-            }
-        }
-        catch (error) {
-            console.error("[MindooDBServer] putEntriesBinary failed", {
-                stage,
-                tenantId: req.tenantId ?? "-",
-                contentLength: req.headers["content-length"] ?? "-",
-                error,
-            });
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleHasEntries(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, ids } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            (0, validation_1.validateArraySize)(ids, validation_1.MAX_ENTRY_IDS, "ids");
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const existingIds = await serverStore.handleHasEntries(token, ids || []);
-            res.json({ ids: existingIds });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handleGetAllIds(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const validDbId = this.validateDbId(req.query.dbId);
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const ids = await serverStore.handleGetAllIds(token);
-            res.json({ ids });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
+        this.openSyncEventStream(req, res, response.events);
     }
-    async handleResolveDependencies(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, startId, options } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            if (!startId) {
-                res.status(400).json({ error: "startId is required" });
-                return;
-            }
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const ids = await serverStore.handleResolveDependencies(token, startId, options);
-            res.json({ ids });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
+    openSyncEventStream(req, res, subscription) {
+        res.status(200);
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("X-Accel-Buffering", "no");
+        if (!req.httpVersion.startsWith("2")) {
+            // Forbidden (and unnecessary) on HTTP/2 streams.
+            res.setHeader("Connection", "keep-alive");
         }
-    }
-    async handlePlanDocumentMaterialization(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, docId, options } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            if (!docId) {
-                res.status(400).json({ error: "docId is required" });
-                return;
+        res.flushHeaders();
+        res.write((0, MindooDBServerCore_1.formatSyncHelloEvent)());
+        const unsubscribe = this.syncEventBus.subscribe((event) => {
+            const frame = (0, MindooDBServerCore_1.formatSyncChangeEvent)(subscription, event);
+            if (frame) {
+                res.write(frame);
             }
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const plan = await serverStore.handlePlanDocumentMaterialization(token, docId, options);
-            res.json({ plan: plan });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handlePlanDocumentMaterializationBatch(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, docIds, options } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            (0, validation_1.validateArraySize)(docIds, validation_1.MAX_HAVE_IDS, "docIds");
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const batchPlan = await serverStore.handlePlanDocumentMaterializationBatch(token, docIds || [], options);
-            res.json({ batchPlan: batchPlan });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    async handlePlanAttachmentReadByWalkingMetadata(req, res) {
-        try {
-            const token = this.extractToken(req);
-            const { dbId, lastChunkId, attachmentSize, options } = req.body;
-            const validDbId = this.validateDbId(dbId);
-            if (!lastChunkId) {
-                res.status(400).json({ error: "lastChunkId is required" });
-                return;
-            }
-            if (typeof attachmentSize !== "number" || !Number.isFinite(attachmentSize)) {
-                res.status(400).json({ error: "attachmentSize is required" });
-                return;
-            }
-            if (!options || typeof options.startByte !== "number") {
-                res.status(400).json({ error: "options.startByte is required" });
-                return;
-            }
-            const serverStore = await this.tenantManager.getServerStore(req.tenantId, validDbId, this.getStoreKindFromRequest(req));
-            const plan = await serverStore.handlePlanAttachmentReadByWalkingMetadata(token, lastChunkId, attachmentSize, options);
-            res.json({ plan: plan });
-        }
-        catch (error) {
-            this.handleRequestError(error, res);
-        }
-    }
-    // ==================== Management Handlers ====================
-    // ==================== Helper Methods ====================
-    /**
-     * Derive the StoreKind from the request path. Both "docs" and
-     * "attachments" share the same handler implementations; the store kind
-     * selects which on-disk append-only store to operate against.
-     */
-    getStoreKindFromRequest(req) {
-        const trimmedPath = req.path.replace(/\/$/, "");
-        if (trimmedPath.startsWith("/sync/docs/") || trimmedPath === "/sync/docs/capabilities" || trimmedPath === "/sync/docs/getAllIds") {
-            return types_2.StoreKind.docs;
-        }
-        if (trimmedPath.startsWith("/sync/attachments/") || trimmedPath === "/sync/attachments/capabilities" || trimmedPath === "/sync/attachments/getAllIds") {
-            return types_2.StoreKind.attachments;
-        }
-        throw new Error(`Unsupported sync store kind for path: ${req.path}`);
-    }
-    extractToken(req) {
-        const auth = req.headers.authorization;
-        if (!auth || !auth.startsWith("Bearer ")) {
-            throw new types_3.NetworkError("INVALID_TOKEN", "Missing or invalid Authorization header");
-        }
-        return auth.substring(7);
-    }
-    /** Map domain errors to HTTP status codes; unknown errors become 500. */
-    handleRequestError(error, res) {
-        if (error instanceof validation_1.ValidationError) {
-            res.status(400).json({ error: error.message });
-            return;
-        }
-        if (error instanceof Error && error.name === "NetworkError") {
-            const networkError = error;
-            const status = this.getStatusForErrorType(networkError.type);
-            // The status alone loses the distinction the client needs: several
-            // NetworkErrorTypes map onto the same code (USER_REVOKED and
-            // ACCESS_DENIED both become 403), and a client that has to guess falls
-            // back to matching on the message text. Carry the type so it does not
-            // have to.
-            res.status(status).json({ error: networkError.message, type: networkError.type });
-            return;
-        }
-        if ((0, errors_1.isMissingDependencyError)(error)) {
-            // Not a server fault: the requested chain is incomplete in this store.
-            // Pass the details on so the caller can tell what is missing.
-            res.status(409).json({ error: error.message, type: "MISSING_DEPENDENCY" });
-            return;
-        }
-        console.error("[MindooDBServer] Request error:", error);
-        res.status(500).json({ error: "Internal server error" });
-    }
-    getStatusForErrorType(type) {
-        switch (type) {
-            case "INVALID_TOKEN":
-                return 401;
-            case "USER_REVOKED":
-                return 403;
-            case "USER_NOT_FOUND":
-                return 404;
-            case "INVALID_SIGNATURE":
-                return 403;
-            case "CHALLENGE_EXPIRED":
-                return 401;
-            case "ACCESS_DENIED":
-                return 403;
-            default:
-                return 500;
-        }
+        });
+        const heartbeat = setInterval(() => {
+            res.write((0, MindooDBServerCore_1.formatSyncHeartbeat)(Date.now()));
+        }, MindooDBServerCore_1.SYNC_EVENT_HEARTBEAT_MS);
+        const cleanup = () => {
+            clearInterval(heartbeat);
+            unsubscribe();
+        };
+        req.on("close", cleanup);
+        res.on("close", cleanup);
+        console.log(`[MindooDBServer] SSE subscriber connected tenant=${subscription.tenantId} storeKind=${subscription.storeKind} subscribers=${this.syncEventBus.listenerCount}`);
     }
     /**
      * Express error handler (4-arg signature). Handles body-parser errors
@@ -2193,25 +799,6 @@ class MindooDBServer {
         });
         res.status(500).json({ error: "Internal server error" });
     }
-    // ==================== Serialization ====================
-    // Entries are stored with binary fields (Uint8Array) internally but
-    // transmitted as base64 strings over JSON. Shared with the client
-    // (entryWireCodec) so signed trailing blocks cannot drift off the wire.
-    serializeEntryMetadata(metadata) {
-        return (0, entryWireCodec_1.serializeEntryMetadata)(metadata);
-    }
-    deserializeEntryMetadata(serialized) {
-        return (0, entryWireCodec_1.deserializeEntryMetadata)(serialized);
-    }
-    deserializeEntry(serialized) {
-        return (0, entryWireCodec_1.deserializeStoreEntry)(serialized);
-    }
-    uint8ArrayToBase64(bytes) {
-        return Buffer.from(bytes).toString("base64");
-    }
-    base64ToUint8Array(base64) {
-        return new Uint8Array(Buffer.from(base64, "base64"));
-    }
 }
 exports.MindooDBServer = MindooDBServer;
 //# sourceMappingURL=MindooDBServer.js.map