From 87cc80b2910ab1aae5ebe0a854dd70d2c3f551e3 Mon Sep 17 00:00:00 2001
From: LukeGus <bugattiguy527@gmail.com>
Date: Mon, 19 Oct 2026 16:06:04 -0500
Subject: [PATCH] feat: api key socket tickets so a master can open remote
 sessions (#1654)

---
 .../routes/user-socket-ticket-routes.ts       |  34 +
 src/backend/sync/client/engine.ts             | 780 ------------------
 src/backend/sync/client/routes.ts             | 761 -----------------
 src/backend/sync/protocol.ts                  |   2 -
 src/backend/sync/server/routes.ts             | 605 --------------
 .../routes/user-socket-ticket-routes.test.ts  |  30 +-
 src/backend/tests/sync/server/changes.test.ts |  75 --
 .../tests/sync/server/host-lookup.test.ts     |  74 --
 src/backend/tests/sync/two-way.test.ts        | 768 -----------------
 .../tests/utils/auth-manager-token.test.ts    |  24 +
 src/backend/utils/auth-manager.ts             |  18 +
 11 files changed, 105 insertions(+), 3066 deletions(-)
 delete mode 100644 src/backend/sync/client/engine.ts
 delete mode 100644 src/backend/sync/client/routes.ts
 delete mode 100644 src/backend/sync/protocol.ts
 delete mode 100644 src/backend/sync/server/routes.ts
 delete mode 100644 src/backend/tests/sync/server/changes.test.ts
 delete mode 100644 src/backend/tests/sync/server/host-lookup.test.ts
 delete mode 100644 src/backend/tests/sync/two-way.test.ts

diff --git a/src/backend/database/routes/user-socket-ticket-routes.ts b/src/backend/database/routes/user-socket-ticket-routes.ts
index cf30a01b7..19f2f8ee1 100644
--- a/src/backend/database/routes/user-socket-ticket-routes.ts
+++ b/src/backend/database/routes/user-socket-ticket-routes.ts
@@ -61,4 +61,38 @@ export function registerUserSocketTicketRoutes(
       res.status(500).json({ error: "Failed to issue a socket ticket" });
     }
   });
+
+  /**
+   * @openapi
+   * /users/ws-ticket/api-key:
+   *   post:
+   *     summary: Get a WebSocket ticket for an API key
+   *     description: For another Termix server that manages this one with an API key. Returns a token that is valid for one minute and only opens plugin WebSockets, as the key's user. It cannot call any other route.
+   *     tags:
+   *       - Users
+   *     responses:
+   *       200:
+   *         description: The ticket.
+   *       401:
+   *         description: The request did not use an API key.
+   *       500:
+   *         description: Failed to issue the ticket.
+   */
+  router.post("/ws-ticket/api-key", authenticateJWT, async (req, res) => {
+    const authReq = req as AuthenticatedRequest;
+    if (!authReq.apiKeyId) {
+      return res.status(401).json({ error: "An API key is required" });
+    }
+    try {
+      const ticket = await authManager.issueApiKeySocketTicket(
+        authReq.userId,
+        authReq.apiKeyId,
+      );
+      res.setHeader("Cache-Control", "no-store");
+      res.json({ ticket });
+    } catch (err) {
+      authLogger.error("Failed to issue an API key socket ticket", err);
+      res.status(500).json({ error: "Failed to issue a socket ticket" });
+    }
+  });
 }
diff --git a/src/backend/sync/client/engine.ts b/src/backend/sync/client/engine.ts
deleted file mode 100644
index 34b0c46ff..000000000
--- a/src/backend/sync/client/engine.ts
+++ /dev/null
@@ -1,780 +0,0 @@
-/**
- * The linked desktop's side of sync.
- *
- * A pass pushes local edits, then pulls what changed on the server after the
- * saved cursor, then backfills any entity type this device has never pulled
- * (first link, a feature switched on, a category turned back on). Local
- * edits are found the same way the server finds changes: by comparing each
- * row's hash with the one recorded at the last sync.
- */
-
-import os from "os";
-import type { SyncRow } from "@termix-ssh/plugin-sdk/backend";
-import {
-  getEntity,
-  listEntities,
-  onEntitiesChanged,
-  type RegisteredSyncEntity,
-} from "../../plugins/sync-registry.js";
-import { syncLogger } from "../../utils/logger.js";
-import { sendCoreAlert } from "../../notify/core-notify.js";
-import { registerCoreSyncEntities } from "../entities.js";
-import {
-  createResolvers,
-  deleteStoredRow,
-  loadWireRow,
-  loadWireRows,
-  writeWireRow,
-} from "../store.js";
-import {
-  listRecords,
-  putRecord,
-  recordKey,
-  saveConflict,
-  setRecordError,
-  type SyncRecord,
-} from "../records.js";
-import { orderSelfReferences } from "../wire.js";
-import { onLocalWrite } from "../server/change-watcher.js";
-import { getLink, updateLink, type SyncLink } from "./link-store.js";
-import { RemoteError, remoteFetch, remoteJson } from "./http.js";
-import { mirrorPlugins } from "./plugins.js";
-import { applyElectronProxyConfig } from "./electron-proxy.js";
-
-export interface RemoteChange {
-  seq: number;
-  entityType: string;
-  syncId: string;
-  revision: number;
-  deleted: boolean;
-  row: SyncRow | null;
-}
-
-interface ChangesPage {
-  changes: RemoteChange[];
-  nextCursor: number;
-  hasMore: boolean;
-  entityTypes: Array<{
-    type: string;
-    owner: string;
-    order: number;
-    readOnly: boolean;
-  }>;
-}
-
-interface PushOp {
-  entityType: string;
-  syncId: string;
-  baseRevision: number;
-  op: "upsert" | "delete";
-  row?: SyncRow;
-}
-
-type PushResult =
-  | { syncId: string; entityType: string; status: "ok"; revision: number }
-  | {
-      syncId: string;
-      entityType: string;
-      status: "conflict";
-      revision: number;
-      deleted: boolean;
-      row: SyncRow | null;
-    }
-  | { syncId: string; entityType: string; status: "rejected"; reason: string };
-
-const MAX_BATCH_OPS = 200;
-const MAX_BATCH_BYTES = 1_000_000;
-const MAX_PAGES = 500;
-const SAFETY_INTERVAL_MS = 5 * 60_000;
-const REFRESH_CHECK_MS = 24 * 60 * 60_000;
-const DELETED_HASH = "deleted";
-
-export interface EngineState {
-  running: boolean;
-  /** Local changes found in the last pass that the server has not taken. */
-  pending: number;
-  /** Entity types the server runs, from the last pull. */
-  serverTypes: Array<{ type: string; owner: string; readOnly: boolean }>;
-  lastPassAt: string | null;
-}
-
-/** An entity this device could sync: registered here, and on the server. */
-function syncable(
-  entity: RegisteredSyncEntity,
-  link: SyncLink,
-  serverTypes: Set<string> | null,
-): boolean {
-  if (link.disabledTypes.includes(entity.type)) return false;
-  if (serverTypes && !serverTypes.has(entity.type)) return false;
-  return true;
-}
-
-function sortChanges(changes: RemoteChange[]): RemoteChange[] {
-  const byType = new Map<string, RemoteChange[]>();
-  for (const change of changes) {
-    const list = byType.get(change.entityType) ?? [];
-    list.push(change);
-    byType.set(change.entityType, list);
-  }
-  const types = [...byType.keys()].sort(
-    (a, b) => (getEntity(a)?.order ?? 1e6) - (getEntity(b)?.order ?? 1e6),
-  );
-  const out: RemoteChange[] = [];
-  for (const type of types) {
-    const list = byType.get(type)!;
-    const entity = getEntity(type);
-    // Only the latest record of each row matters.
-    const latest = new Map<string, RemoteChange>();
-    for (const change of list) latest.set(change.syncId, change);
-    const live = [...latest.values()].filter((change) => !change.deleted);
-    const gone = [...latest.values()].filter((change) => change.deleted);
-    if (entity) {
-      const bySyncId = new Map(live.map((change) => [change.syncId, change]));
-      const ordered = orderSelfReferences(
-        entity,
-        live.map((change) => ({
-          ...(change.row ?? {}),
-          syncId: change.syncId,
-        })),
-      );
-      out.push(...ordered.map((row) => bySyncId.get(row.syncId as string)!));
-    } else {
-      out.push(...live);
-    }
-    out.push(...gone);
-  }
-  return out;
-}
-
-export class SyncEngine {
-  private running = false;
-  private again = false;
-  private timer: NodeJS.Timeout | null = null;
-  private safety: NodeJS.Timeout | null = null;
-  private backoffMs = 0;
-  private events: AbortController | null = null;
-  private eventsFor: string | null = null;
-  private lastRefreshCheck = 0;
-  private serverTypes: Set<string> | null = null;
-  private stopFns: Array<() => void> = [];
-  private alerted = false;
-  readonly state: EngineState = {
-    running: false,
-    pending: 0,
-    serverTypes: [],
-    lastPassAt: null,
-  };
-
-  start(): void {
-    if (this.safety) return;
-    registerCoreSyncEntities();
-    this.safety = setInterval(() => this.request(0), SAFETY_INTERVAL_MS);
-    this.safety.unref?.();
-    this.stopFns.push(onLocalWrite(() => this.request(2000)));
-    // A plugin that came up may bring entity types to backfill.
-    this.stopFns.push(onEntitiesChanged(() => this.request(3000)));
-    this.request(3000);
-  }
-
-  stop(): void {
-    if (this.safety) clearInterval(this.safety);
-    if (this.timer) clearTimeout(this.timer);
-    this.safety = this.timer = null;
-    this.closeEvents();
-    for (const stop of this.stopFns.splice(0)) stop();
-  }
-
-  /** Runs a pass after `delayMs`, folding requests that arrive meanwhile. */
-  request(delayMs = 0): void {
-    if (this.timer) {
-      if (delayMs > 0) return;
-      clearTimeout(this.timer);
-    }
-    this.timer = setTimeout(() => {
-      this.timer = null;
-      void this.run();
-    }, delayMs);
-    this.timer.unref?.();
-  }
-
-  /** Runs a pass now and waits for it. */
-  async syncNow(): Promise<void> {
-    if (this.running) {
-      this.again = true;
-      while (this.running) await new Promise((r) => setTimeout(r, 100));
-      return;
-    }
-    await this.run();
-  }
-
-  /** Forgets what the server runs, after a relink or unlink. */
-  reset(): void {
-    this.serverTypes = null;
-    this.state.serverTypes = [];
-    this.state.pending = 0;
-    this.alerted = false;
-    this.backoffMs = 0;
-    this.closeEvents();
-  }
-
-  private async run(): Promise<void> {
-    if (this.running) {
-      this.again = true;
-      return;
-    }
-    this.running = this.state.running = true;
-    try {
-      await this.pass();
-    } finally {
-      this.running = this.state.running = false;
-      this.state.lastPassAt = new Date().toISOString();
-      if (this.again) {
-        this.again = false;
-        this.request(0);
-      }
-    }
-  }
-
-  private async pass(): Promise<void> {
-    const link = await getLink();
-    if (!link?.sessionToken) {
-      this.closeEvents();
-      return;
-    }
-    await updateLink({ status: "syncing" });
-
-    try {
-      await this.refreshSession(link);
-      const fresh = (await getLink())!;
-      await mirrorPlugins(fresh);
-
-      // A first pass pulls before it pushes, so rows both sides already
-      // have are matched up instead of sent back as edits.
-      const firstPass = fresh.knownTypes.length === 0;
-      if (!firstPass) {
-        await this.push(fresh);
-        await this.pull(fresh);
-      }
-      await this.backfill((await getLink())!);
-      if (firstPass) await this.push((await getLink())!);
-
-      this.backoffMs = 0;
-      this.alerted = false;
-      await updateLink({
-        status: "idle",
-        lastError: null,
-        lastSyncAt: new Date().toISOString(),
-      });
-      const done = (await getLink())!;
-      await applyElectronProxyConfig(done).catch(() => {});
-      this.openEvents(done);
-    } catch (error) {
-      await this.fail(error);
-    }
-  }
-
-  private async fail(error: unknown): Promise<void> {
-    const remote = error instanceof RemoteError ? error : null;
-    const message = error instanceof Error ? error.message : String(error);
-    syncLogger.warn("Sync pass failed", {
-      operation: "sync_pass",
-      kind: remote?.kind ?? "internal",
-      error: message,
-    });
-
-    if (remote?.kind === "signed_out") {
-      const link = await updateLink({
-        status: "signed_out",
-        lastError: message,
-      });
-      await applyElectronProxyConfig(link).catch(() => {});
-      this.closeEvents();
-      if (!this.alerted) {
-        this.alerted = true;
-        await sendCoreAlert({
-          title: "Sync is paused",
-          body: "This device was signed out of the server it syncs with. Sign in again from Sync to keep going.",
-          severity: "warning",
-          category: "termix.sync.signed_out",
-          dedupeKey: "sync:signed_out",
-          audience: "admins",
-          link: { tab: "sync" },
-        });
-      }
-      return;
-    }
-
-    const offline = remote?.kind === "offline";
-    await updateLink({
-      status: offline ? "offline" : "error",
-      lastError: message,
-    });
-    this.backoffMs = Math.min(
-      this.backoffMs ? this.backoffMs * 2 : 15_000,
-      10 * 60_000,
-    );
-    this.request(this.backoffMs);
-  }
-
-  private async refreshSession(link: SyncLink): Promise<void> {
-    if (Date.now() - this.lastRefreshCheck < REFRESH_CHECK_MS) return;
-    const result = await remoteJson<{ token: string | null }>(
-      link,
-      "/sync/v2/session/refresh",
-      { method: "POST", body: {} },
-    );
-    this.lastRefreshCheck = Date.now();
-    if (result.token) await updateLink({ sessionToken: result.token });
-  }
-
-  /** Local rows the server does not have in this form yet. */
-  async outbox(link: SyncLink): Promise<{
-    ops: PushOp[];
-    hashes: Map<string, string>;
-  }> {
-    const records = await listRecords(link.userId);
-    const resolvers = createResolvers(link.userId);
-    const ops: PushOp[] = [];
-    const hashes = new Map<string, string>();
-
-    for (const entity of listEntities()) {
-      if (entity.readOnly) continue;
-      if (!link.knownTypes.includes(entity.type)) continue;
-      if (!syncable(entity, link, this.serverTypes)) continue;
-
-      const { rows, failed } = await loadWireRows(
-        entity,
-        link.userId,
-        resolvers,
-      );
-      for (const row of rows.values()) {
-        const key = recordKey(entity.type, row.syncId);
-        const record = records.get(key);
-        if (record && !record.deleted && record.hash === row.hash) continue;
-        // Unavailable server rows can recover without another local edit.
-        if (record?.errorHash === row.hash && record.error !== "unavailable") {
-          continue;
-        }
-        ops.push({
-          entityType: entity.type,
-          syncId: row.syncId,
-          baseRevision: record?.revision ?? 0,
-          op: "upsert",
-          row: row.wire,
-        });
-        hashes.set(key, row.hash);
-      }
-
-      for (const record of records.values()) {
-        if (record.entityType !== entity.type || record.deleted) continue;
-        if (record.revision === 0) continue;
-        if (rows.has(record.syncId) || failed.has(record.syncId)) continue;
-        if (entity.covers && !entity.covers(record.syncId)) continue;
-        if (
-          record.errorHash === DELETED_HASH &&
-          record.error !== "unavailable"
-        ) {
-          continue;
-        }
-        ops.push({
-          entityType: entity.type,
-          syncId: record.syncId,
-          baseRevision: record.revision,
-          op: "delete",
-        });
-      }
-    }
-    return { ops, hashes };
-  }
-
-  private async push(link: SyncLink): Promise<void> {
-    const { ops, hashes } = await this.outbox(link);
-    this.state.pending = ops.length;
-    if (ops.length === 0) return;
-
-    for (const batch of batches(ops)) {
-      const { results } = await remoteJson<{ results: PushResult[] }>(
-        link,
-        "/sync/v2/push",
-        { method: "POST", body: { ops: batch }, timeoutMs: 120_000 },
-      );
-      const byKey = new Map(
-        batch.map((op) => [recordKey(op.entityType, op.syncId), op]),
-      );
-      for (const result of results) {
-        const key = recordKey(result.entityType, result.syncId);
-        const op = byKey.get(key);
-        if (!op) continue;
-        await this.settle(link, op, result, hashes.get(key) ?? null);
-      }
-      this.state.pending = Math.max(0, this.state.pending - batch.length);
-    }
-  }
-
-  private async settle(
-    link: SyncLink,
-    op: PushOp,
-    result: PushResult,
-    hash: string | null,
-  ): Promise<void> {
-    const userId = link.userId;
-    const entity = getEntity(op.entityType);
-    if (!entity) return;
-
-    if (result.status === "ok") {
-      await putRecord(userId, op.entityType, op.syncId, {
-        revision: result.revision,
-        hash: op.op === "delete" ? null : hash,
-        deleted: op.op === "delete",
-      });
-      return;
-    }
-
-    if (result.status === "rejected") {
-      await setRecordError(
-        userId,
-        op.entityType,
-        op.syncId,
-        result.reason,
-        hash ?? DELETED_HASH,
-      );
-      return;
-    }
-
-    // A live row the server could not send says nothing; keep ours to retry.
-    if (!result.deleted && !result.row) return;
-
-    // Conflict: the server moved on since this device last saw the row. Its
-    // version wins here, and a local edit it replaced is kept for the user.
-    if (op.op === "upsert" && op.row) {
-      await saveConflict(
-        userId,
-        op.entityType,
-        op.syncId,
-        op.row,
-        result.revision,
-      );
-    }
-    const resolvers = createResolvers(userId);
-    if (result.deleted) {
-      await deleteStoredRow(entity, userId, op.syncId);
-      await putRecord(userId, op.entityType, op.syncId, {
-        revision: result.revision,
-        hash: null,
-        deleted: true,
-      });
-      return;
-    }
-    await writeWireRow(
-      entity,
-      userId,
-      { ...result.row, syncId: op.syncId },
-      resolvers,
-    );
-    const written = await loadWireRow(entity, userId, op.syncId, resolvers);
-    await putRecord(userId, op.entityType, op.syncId, {
-      revision: result.revision,
-      hash: written?.hash ?? null,
-      deleted: false,
-    });
-  }
-
-  private async fetchChanges(
-    link: SyncLink,
-    cursor: number,
-    types?: string[],
-  ): Promise<{ changes: RemoteChange[]; cursor: number }> {
-    const all: RemoteChange[] = [];
-    let next = cursor;
-    for (let page = 0; page < MAX_PAGES; page++) {
-      const query = new URLSearchParams({
-        cursor: String(next),
-        limit: "1000",
-      });
-      if (types?.length) query.set("types", types.join(","));
-      const result = await remoteJson<ChangesPage>(
-        link,
-        `/sync/v2/changes?${query.toString()}`,
-        { timeoutMs: 120_000 },
-      );
-      all.push(...result.changes);
-      next = result.nextCursor;
-      this.learnTypes(result);
-      if (!result.hasMore) break;
-    }
-    return { changes: all, cursor: next };
-  }
-
-  private learnTypes(page: ChangesPage): void {
-    this.serverTypes = new Set(page.entityTypes.map((entry) => entry.type));
-    this.state.serverTypes = page.entityTypes.map((entry) => ({
-      type: entry.type,
-      owner: entry.owner,
-      readOnly: entry.readOnly,
-    }));
-  }
-
-  private async pull(link: SyncLink): Promise<void> {
-    const { changes, cursor } = await this.fetchChanges(link, link.cursor);
-    const known = new Set(link.knownTypes);
-    await this.apply(
-      link,
-      changes.filter(
-        (change) =>
-          known.has(change.entityType) &&
-          !link.disabledTypes.includes(change.entityType),
-      ),
-      false,
-    );
-    await updateLink({ cursor });
-  }
-
-  /** Pulls every row of types this device has not pulled before. */
-  private async backfill(link: SyncLink): Promise<void> {
-    if (!this.serverTypes) {
-      // Only the entity types are wanted, so a one-row page is enough.
-      this.learnTypes(
-        await remoteJson<ChangesPage>(
-          link,
-          `/sync/v2/changes?cursor=${link.cursor}&limit=1`,
-          { timeoutMs: 120_000 },
-        ),
-      );
-    }
-    const fresh = listEntities()
-      .map((entity) => entity.type)
-      .filter(
-        (type) =>
-          !link.knownTypes.includes(type) &&
-          !link.disabledTypes.includes(type) &&
-          this.serverTypes?.has(type),
-      );
-    if (fresh.length === 0) return;
-
-    const { changes, cursor } = await this.fetchChanges(link, 0, fresh);
-    await this.apply(link, changes, true);
-    const current = (await getLink())!;
-    await updateLink({
-      knownTypes: [...new Set([...current.knownTypes, ...fresh])],
-      // On a first pass the backfill is the whole pull, so it sets the cursor.
-      ...(link.knownTypes.length === 0 ? { cursor } : {}),
-    });
-  }
-
-  /**
-   * Writes pulled changes. `adopt` is for a first pull of a type: a local row
-   * with no record yet takes the server's version without a conflict.
-   */
-  private async apply(
-    link: SyncLink,
-    changes: RemoteChange[],
-    adopt: boolean,
-  ): Promise<void> {
-    if (changes.length === 0) return;
-    const userId = link.userId;
-    const records = await listRecords(userId);
-    let missed = false;
-    const resolvers = createResolvers(userId, () => {
-      missed = true;
-    });
-    const retry: RemoteChange[] = [];
-
-    for (const change of sortChanges(changes)) {
-      const entity = getEntity(change.entityType);
-      if (!entity) continue;
-      const key = recordKey(change.entityType, change.syncId);
-      const record = records.get(key);
-      if (record && record.revision >= change.revision) continue;
-
-      try {
-        if (!entity.readOnly) {
-          await this.keepLocalEdit(
-            entity,
-            userId,
-            change,
-            record,
-            adopt,
-            resolvers,
-          );
-        }
-        if (change.deleted) {
-          await deleteStoredRow(entity, userId, change.syncId);
-          await putRecord(userId, change.entityType, change.syncId, {
-            revision: change.revision,
-            hash: null,
-            deleted: true,
-          });
-          continue;
-        }
-        missed = false;
-        await writeWireRow(
-          entity,
-          userId,
-          { ...(change.row ?? {}), syncId: change.syncId },
-          resolvers,
-        );
-        if (missed) retry.push(change);
-        await this.recordApplied(entity, userId, change, resolvers);
-      } catch (error) {
-        syncLogger.warn("Could not apply a synced change", {
-          operation: "sync_apply",
-          entityType: change.entityType,
-          syncId: change.syncId,
-          error: error instanceof Error ? error.message : String(error),
-        });
-      }
-    }
-
-    // Rows that pointed at something written later in the same pull.
-    for (const change of retry) {
-      const entity = getEntity(change.entityType)!;
-      try {
-        await writeWireRow(
-          entity,
-          userId,
-          { ...(change.row ?? {}), syncId: change.syncId },
-          resolvers,
-        );
-        await this.recordApplied(entity, userId, change, resolvers);
-      } catch {
-        // The first write stands.
-      }
-    }
-  }
-
-  private async recordApplied(
-    entity: RegisteredSyncEntity,
-    userId: string,
-    change: RemoteChange,
-    resolvers: ReturnType<typeof createResolvers>,
-  ): Promise<void> {
-    const written = entity.readOnly
-      ? null
-      : await loadWireRow(entity, userId, change.syncId, resolvers);
-    await putRecord(userId, change.entityType, change.syncId, {
-      revision: change.revision,
-      hash: written?.hash ?? null,
-      deleted: false,
-    });
-  }
-
-  /** Saves a local edit the incoming change is about to replace. */
-  private async keepLocalEdit(
-    entity: RegisteredSyncEntity,
-    userId: string,
-    change: RemoteChange,
-    record: SyncRecord | undefined,
-    adopt: boolean,
-    resolvers: ReturnType<typeof createResolvers>,
-  ): Promise<void> {
-    if (!record && adopt) return;
-    const local = await loadWireRow(
-      entity,
-      userId,
-      change.syncId,
-      resolvers,
-    ).catch(() => null);
-    if (!local) return;
-    if (record && !record.deleted && record.hash === local.hash) return;
-    await saveConflict(
-      userId,
-      change.entityType,
-      change.syncId,
-      local.wire,
-      change.revision,
-    );
-  }
-
-  private openEvents(link: SyncLink): void {
-    const key = `${link.serverUrl}|${link.sessionToken}`;
-    if (this.events && this.eventsFor === key) return;
-    this.closeEvents();
-    const controller = new AbortController();
-    this.events = controller;
-    this.eventsFor = key;
-    void this.listen(link, controller);
-  }
-
-  private closeEvents(): void {
-    this.events?.abort();
-    this.events = null;
-    this.eventsFor = null;
-  }
-
-  private async listen(
-    link: SyncLink,
-    controller: AbortController,
-  ): Promise<void> {
-    try {
-      const response = await remoteFetch(link, "/sync/v2/events", {
-        signal: controller.signal,
-      });
-      if (!response.ok || !response.body)
-        throw new Error(`HTTP ${response.status}`);
-      const decoder = new TextDecoder();
-      let buffer = "";
-      for await (const chunk of response.body) {
-        buffer += decoder.decode(chunk as Uint8Array, { stream: true });
-        let index;
-        while ((index = buffer.indexOf("\n\n")) >= 0) {
-          const block = buffer.slice(0, index);
-          buffer = buffer.slice(index + 2);
-          if (/^event: change$/m.test(block)) this.request(500);
-        }
-      }
-    } catch {
-      // Dropped or refused: the safety interval still syncs, and the next
-      // successful pass reopens the stream.
-    }
-    if (this.events === controller) {
-      this.events = null;
-      this.eventsFor = null;
-      if (!controller.signal.aborted) {
-        setTimeout(() => this.request(0), 30_000).unref?.();
-      }
-    }
-  }
-
-  /** Where the link's proxy settings have to reach outside the backend. */
-  async applyProxyConfig(): Promise<void> {
-    await applyElectronProxyConfig(await getLink());
-  }
-}
-
-function* batches(ops: PushOp[]): Generator<PushOp[]> {
-  let batch: PushOp[] = [];
-  let bytes = 0;
-  for (const op of ops) {
-    const size = JSON.stringify(op).length;
-    if (
-      batch.length > 0 &&
-      (batch.length >= MAX_BATCH_OPS || bytes + size > MAX_BATCH_BYTES)
-    ) {
-      yield batch;
-      batch = [];
-      bytes = 0;
-    }
-    batch.push(op);
-    bytes += size;
-  }
-  if (batch.length > 0) yield batch;
-}
-
-let engine: SyncEngine | null = null;
-
-export function getSyncEngine(): SyncEngine {
-  if (!engine) engine = new SyncEngine();
-  return engine;
-}
-
-/** Starts syncing on a desktop. A server install never links. */
-export function startDesktopSync(): void {
-  if (process.env.ELECTRON_EMBEDDED !== "true") return;
-  const instance = getSyncEngine();
-  instance.start();
-  void instance.applyProxyConfig().catch(() => {});
-}
-
-export function defaultDeviceName(): string {
-  return os.hostname() || "Termix Desktop";
-}
diff --git a/src/backend/sync/client/routes.ts b/src/backend/sync/client/routes.ts
deleted file mode 100644
index e6d53ae58..000000000
--- a/src/backend/sync/client/routes.ts
+++ /dev/null
@@ -1,761 +0,0 @@
-/**
- * The desktop's own sync routes, under /sync/link. They only exist in the
- * embedded desktop backend; on a server they answer 404.
- */
-
-import express, {
-  type NextFunction,
-  type Request,
-  type Response,
-} from "express";
-import { and, eq, isNotNull } from "drizzle-orm";
-import type { SyncRow } from "@termix-ssh/plugin-sdk/backend";
-import type { AuthenticatedRequest } from "../../../types/index.js";
-import { AuthManager } from "../../utils/auth-manager.js";
-import { syncLogger } from "../../utils/logger.js";
-import { hosts, sshCredentials } from "../../database/db/schema.js";
-import { createCurrentRepositoryContext } from "../../database/repositories/factory.js";
-import { getPluginRuntime } from "../../plugins/index.js";
-import { getEntity, listEntities } from "../../plugins/sync-registry.js";
-import { registerCoreSyncEntities } from "../entities.js";
-import {
-  createResolvers,
-  deleteStoredRow,
-  listStoredRows,
-  regenerateSyncIds,
-  writeWireRow,
-} from "../store.js";
-import {
-  clearRecordErrors,
-  deleteConflict,
-  deleteRecordsForUser,
-  getConflict,
-  listConflicts,
-  listRecordErrors,
-} from "../records.js";
-import { SYNC_PROTOCOL_VERSION } from "../protocol.js";
-import {
-  createLink,
-  deleteLink,
-  getLink,
-  updateLink,
-  type BasicAuth,
-  type ProxyHeader,
-  type SyncLink,
-} from "./link-store.js";
-import {
-  normalizeServerUrl,
-  RemoteError,
-  remoteJson,
-  type RemoteTarget,
-} from "./http.js";
-import { defaultDeviceName, getSyncEngine } from "./engine.js";
-import { applyElectronProxyConfig } from "./electron-proxy.js";
-import { lastRemotePlugins } from "./plugins.js";
-
-const router = express.Router();
-const authManager = AuthManager.getInstance();
-const authenticateJWT = authManager.createAuthMiddleware();
-
-function desktopOnly(_req: Request, res: Response, next: NextFunction) {
-  if (process.env.ELECTRON_EMBEDDED !== "true") {
-    res.status(404).json({ error: "Not found" });
-    return;
-  }
-  next();
-}
-
-const guard = [desktopOnly, authenticateJWT];
-
-function userOf(req: Request): string {
-  return (req as AuthenticatedRequest).userId;
-}
-
-function readHeaders(value: unknown): ProxyHeader[] {
-  if (!Array.isArray(value)) return [];
-  return value
-    .filter(
-      (header): header is ProxyHeader =>
-        !!header &&
-        typeof header.name === "string" &&
-        typeof header.value === "string" &&
-        /^[A-Za-z0-9-]{1,100}$/.test(header.name.trim()),
-    )
-    .map((header) => ({ name: header.name.trim(), value: header.value }))
-    .slice(0, 20);
-}
-
-function readBasicAuth(value: unknown): BasicAuth | null {
-  if (!value || typeof value !== "object") return null;
-  const { username, password } = value as Record<string, unknown>;
-  if (typeof username !== "string" || !username) return null;
-  return {
-    username,
-    password: typeof password === "string" ? password : "",
-  };
-}
-
-function readTarget(body: Record<string, unknown>): RemoteTarget | null {
-  const serverUrl =
-    typeof body.serverUrl === "string"
-      ? normalizeServerUrl(body.serverUrl)
-      : null;
-  if (!serverUrl) return null;
-  return {
-    serverUrl,
-    customHeaders: readHeaders(body.customHeaders),
-    basicAuth: readBasicAuth(body.basicAuth),
-    allowInvalidCertificate: body.allowInvalidCertificate === true,
-  };
-}
-
-/** What the sync panel can show about each entity type. */
-function describeEntities(link: SyncLink | null) {
-  registerCoreSyncEntities();
-  const names = new Map<string, string>();
-  for (const plugin of getPluginRuntime().loader.list()) {
-    names.set(plugin.id, plugin.manifest.name);
-  }
-  for (const plugin of lastRemotePlugins()) {
-    if (!names.has(plugin.id)) names.set(plugin.id, plugin.name);
-  }
-  const serverTypes = getSyncEngine().state.serverTypes;
-  const seen = new Set<string>();
-  const entries = [
-    ...listEntities().map((entity) => ({
-      type: entity.type,
-      owner: entity.owner,
-      readOnly: !!entity.readOnly,
-    })),
-    ...serverTypes,
-  ];
-  return entries
-    .filter((entry) => {
-      if (seen.has(entry.type) || entry.type === "accountProfile") return false;
-      seen.add(entry.type);
-      return true;
-    })
-    .map((entry) => ({
-      type: entry.type,
-      owner: entry.owner,
-      ownerName:
-        entry.owner === "core" ? null : (names.get(entry.owner) ?? entry.owner),
-      readOnly: entry.readOnly,
-      onServer: serverTypes.some((server) => server.type === entry.type),
-      onDevice: !!getEntity(entry.type),
-      enabled: !link?.disabledTypes.includes(entry.type),
-    }));
-}
-
-async function statusBody() {
-  const link = await getLink();
-  const engine = getSyncEngine();
-  if (!link) {
-    return { linked: false, entities: describeEntities(null) };
-  }
-  return {
-    linked: true,
-    serverUrl: link.serverUrl,
-    serverName: link.serverName,
-    serverVersion: link.serverVersion,
-    account: link.account ?? {
-      username: link.remoteUsername ?? undefined,
-    },
-    status: engine.state.running ? "syncing" : link.status,
-    lastError: link.lastError,
-    linkedAt: link.linkedAt,
-    lastSyncAt: link.lastSyncAt,
-    pending: engine.state.pending,
-    conflicts: (await listConflicts(link.userId)).length,
-    errors: (await listRecordErrors(link.userId)).length,
-    firstSyncDone: link.knownTypes.length > 0,
-    allowInvalidCertificate: link.allowInvalidCertificate,
-    customHeaders: link.customHeaders.map((header) => ({
-      name: header.name,
-      value: "",
-      set: true,
-    })),
-    basicAuth: link.basicAuth
-      ? { username: link.basicAuth.username, password: "", set: true }
-      : null,
-    entities: describeEntities(link),
-  };
-}
-
-/** Removes read-only copies of what other users shared with the account. */
-async function removeSharedCopies(userId: string): Promise<void> {
-  const db = createCurrentRepositoryContext().drizzle;
-  const sharedHosts = await db
-    .select({ id: hosts.id })
-    .from(hosts)
-    .where(and(eq(hosts.userId, userId), isNotNull(hosts.sharedSource)));
-  const { deleteOwnedHost } = await import("../../hosts/delete-host.js");
-  for (const host of sharedHosts) await deleteOwnedHost(userId, host.id);
-
-  const sharedCredentials = await db
-    .select({ id: sshCredentials.id })
-    .from(sshCredentials)
-    .where(
-      and(
-        eq(sshCredentials.userId, userId),
-        isNotNull(sshCredentials.sharedSource),
-      ),
-    );
-  const { deleteOwnedCredential } =
-    await import("../../hosts/delete-credential.js");
-  for (const credential of sharedCredentials) {
-    await deleteOwnedCredential(userId, credential.id);
-  }
-}
-
-/** Deletes every row that syncs, keeping local-only ones. */
-async function wipeSyncedData(userId: string): Promise<void> {
-  const entities = [...listEntities()].reverse();
-  for (const entity of entities) {
-    if (entity.readOnly) continue;
-    try {
-      if (entity.load) {
-        for (const row of await entity.load(userId)) {
-          await entity.erase?.(userId, String(row.syncId));
-        }
-        continue;
-      }
-      if (!entity.table || entity.singleton) continue;
-      for (const row of await listStoredRows(entity, userId)) {
-        if (entity.shouldSync && entity.shouldSync(row) === false) continue;
-        if (typeof row.syncId !== "string") continue;
-        await deleteStoredRow(entity, userId, row.syncId);
-      }
-    } catch (error) {
-      syncLogger.warn("Could not clear synced data", {
-        operation: "sync_wipe",
-        entityType: entity.type,
-        error: error instanceof Error ? error.message : String(error),
-      });
-    }
-  }
-}
-
-function problemFor(error: unknown) {
-  if (!(error instanceof RemoteError)) {
-    return { problem: "unreachable", message: String(error) };
-  }
-  switch (error.kind) {
-    case "tls":
-      return { problem: "tls_untrusted", message: error.message };
-    case "basic_auth":
-      return { problem: "basic_auth_required", message: error.message };
-    case "proxy":
-      return error.status === 404
-        ? { problem: "not_termix", message: error.message }
-        : { problem: "proxy_login", message: error.message };
-    case "signed_out":
-    case "server":
-      // A Termix older than 2.9 has no /sync/v2 and answers with an error.
-      return { problem: "version_mismatch", message: error.message };
-    default:
-      return { problem: "unreachable", message: error.message };
-  }
-}
-
-/**
- * @openapi
- * /sync/link/status:
- *   get:
- *     summary: This desktop's link to a server
- *     description: Desktop only. Whether the app is linked, to which server and account, how syncing is going, and which kinds of data sync.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The link status.
- */
-router.get("/link/status", ...guard, async (_req: Request, res: Response) => {
-  try {
-    res.json(await statusBody());
-  } catch (error) {
-    syncLogger.error("Failed to read sync status", error, {
-      operation: "sync_status",
-    });
-    res.status(500).json({ error: "Failed to read sync status" });
-  }
-});
-
-/**
- * @openapi
- * /sync/link/probe:
- *   post:
- *     summary: Check a server address before linking
- *     description: Desktop only. Tries the server with the given proxy settings and says what is in the way, if anything. On success the proxy settings are also applied to the desktop's browser session so the sign-in page loads.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The server's name and version, or the problem found.
- */
-router.post("/link/probe", ...guard, async (req: Request, res: Response) => {
-  const target = readTarget(req.body ?? {});
-  if (!target) return res.json({ ok: false, problem: "invalid_url" });
-  try {
-    const info = await remoteJson<{
-      termix?: boolean;
-      name?: string;
-      version?: string;
-      protocol?: number;
-    }>(target, "/sync/v2/info", { timeoutMs: 15_000 });
-    if (!info?.termix) return res.json({ ok: false, problem: "not_termix" });
-    if (info.protocol !== SYNC_PROTOCOL_VERSION) {
-      return res.json({
-        ok: false,
-        problem: "version_mismatch",
-        version: info.version,
-      });
-    }
-    await applyElectronProxyConfig({
-      serverUrl: target.serverUrl,
-      customHeaders: target.customHeaders ?? [],
-      basicAuth: target.basicAuth ?? null,
-      allowInvalidCertificate: !!target.allowInvalidCertificate,
-    }).catch(() => {});
-    res.json({
-      ok: true,
-      serverUrl: target.serverUrl,
-      name: info.name ?? "Termix",
-      version: info.version ?? null,
-    });
-  } catch (error) {
-    res.json({ ok: false, ...problemFor(error) });
-  }
-});
-
-/**
- * @openapi
- * /sync/link/preview:
- *   get:
- *     summary: How much this desktop has that would sync
- *     description: Desktop only. Row counts per kind of data, shown before choosing whether to merge this desktop's data into the account or replace it.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: Counts per entity type.
- */
-router.get("/link/preview", ...guard, async (req: Request, res: Response) => {
-  const userId = userOf(req);
-  registerCoreSyncEntities();
-  const counts: Record<string, number> = {};
-  for (const entity of listEntities()) {
-    if (entity.readOnly) continue;
-    try {
-      if (entity.load) {
-        counts[entity.type] = (await entity.load(userId)).length;
-        continue;
-      }
-      if (!entity.table) continue;
-      counts[entity.type] = (await listStoredRows(entity, userId)).filter(
-        (row) => !entity.shouldSync || entity.shouldSync(row) !== false,
-      ).length;
-    } catch {
-      counts[entity.type] = 0;
-    }
-  }
-  res.json({ counts });
-});
-
-/**
- * @openapi
- * /sync/link/complete:
- *   post:
- *     summary: Link this desktop to a server account
- *     description: Desktop only. Takes the session from signing in to the server, trades it for a long-lived desktop session, and starts syncing. "merge" uploads this desktop's data into the account; "replace" deletes it here first and takes the account's.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: Linked; the new status.
- *       400:
- *         description: Missing server or session.
- *       502:
- *         description: The server refused the session.
- */
-router.post("/link/complete", ...guard, async (req: Request, res: Response) => {
-  const userId = userOf(req);
-  const body = req.body ?? {};
-  const target = readTarget(body);
-  const token = typeof body.token === "string" ? body.token : "";
-  const mode = body.mode === "replace" ? "replace" : "merge";
-  if (!target || !token) {
-    return res.status(400).json({ error: "Missing server or session" });
-  }
-
-  try {
-    const deviceName =
-      typeof body.deviceName === "string" && body.deviceName.trim()
-        ? body.deviceName.trim()
-        : defaultDeviceName();
-    const linked = await remoteJson<{
-      token: string;
-      user: { id: string; username: string };
-      server?: { version?: string | null };
-    }>({ ...target, sessionToken: token }, "/sync/v2/link", {
-      method: "POST",
-      body: { deviceName },
-    });
-
-    const previous = await getLink();
-    if (previous) {
-      await removeSharedCopies(previous.userId);
-      await deleteRecordsForUser(previous.userId);
-    }
-    if (mode === "replace") {
-      await wipeSyncedData(userId);
-    }
-    await deleteRecordsForUser(userId);
-
-    const link = await createLink({
-      userId,
-      serverUrl: target.serverUrl,
-      serverName: typeof body.serverName === "string" ? body.serverName : null,
-      serverVersion: linked.server?.version ?? null,
-      sessionToken: linked.token,
-      customHeaders: target.customHeaders,
-      basicAuth: target.basicAuth,
-      allowInvalidCertificate: target.allowInvalidCertificate,
-      remoteUserId: linked.user.id,
-      remoteUsername: linked.user.username,
-    });
-    const engine = getSyncEngine();
-    engine.reset();
-    await applyElectronProxyConfig(link).catch(() => {});
-    engine.request(0);
-    res.json(await statusBody());
-  } catch (error) {
-    syncLogger.warn("Linking to a server failed", {
-      operation: "sync_link_complete",
-      error: error instanceof Error ? error.message : String(error),
-    });
-    res.status(502).json({ ...problemFor(error) });
-  }
-});
-
-/**
- * @openapi
- * /sync/link/relogin:
- *   post:
- *     summary: Sign this desktop back in after its session ended
- *     description: Desktop only. Takes a new sign-in session for the same account and resumes syncing where it stopped.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: Signed in again; the new status.
- *       409:
- *         description: The sign-in was for a different account.
- */
-router.post("/link/relogin", ...guard, async (req: Request, res: Response) => {
-  const token = typeof req.body?.token === "string" ? req.body.token : "";
-  const link = await getLink();
-  if (!link || !token) return res.status(400).json({ error: "Not linked" });
-  try {
-    const linked = await remoteJson<{
-      token: string;
-      user: { id: string; username: string };
-    }>({ ...link, sessionToken: token }, "/sync/v2/link", {
-      method: "POST",
-      body: { deviceName: defaultDeviceName() },
-    });
-    if (link.remoteUserId && linked.user.id !== link.remoteUserId) {
-      return res.status(409).json({ error: "different_account" });
-    }
-    await updateLink({
-      sessionToken: linked.token,
-      status: "idle",
-      lastError: null,
-    });
-    getSyncEngine().request(0);
-    res.json(await statusBody());
-  } catch (error) {
-    res.status(502).json({ ...problemFor(error) });
-  }
-});
-
-/**
- * @openapi
- * /sync/link/unlink:
- *   post:
- *     summary: Unlink this desktop from its server
- *     description: Desktop only. Ends the desktop's session on the server when it can be reached. With keepData the synced data stays on this device as its own; otherwise it is deleted. Copies of what others shared with the account are always removed.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: Unlinked.
- */
-router.post("/link/unlink", ...guard, async (req: Request, res: Response) => {
-  const keepData = req.body?.keepData !== false;
-  const link = await getLink();
-  if (!link) return res.json(await statusBody());
-  const userId = link.userId;
-  try {
-    await remoteJson(link, "/sync/v2/unlink", {
-      method: "POST",
-      body: {},
-      timeoutMs: 10_000,
-    }).catch(() => {});
-
-    const engine = getSyncEngine();
-    engine.reset();
-    await removeSharedCopies(userId);
-    if (keepData) {
-      // New syncIds so this data reads as new if it is ever linked again.
-      for (const entity of listEntities()) {
-        if (!entity.readOnly) await regenerateSyncIds(entity, userId);
-      }
-    } else {
-      await wipeSyncedData(userId);
-    }
-    await deleteRecordsForUser(userId);
-    await deleteLink();
-    await applyElectronProxyConfig(null).catch(() => {});
-    res.json(await statusBody());
-  } catch (error) {
-    syncLogger.error("Unlinking failed", error, { operation: "sync_unlink" });
-    res.status(500).json({ error: "Failed to unlink" });
-  }
-});
-
-/**
- * @openapi
- * /sync/link/sync:
- *   post:
- *     summary: Sync now
- *     description: Desktop only. Runs a sync pass and waits for it.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The status after the pass.
- */
-router.post("/link/sync", ...guard, async (_req: Request, res: Response) => {
-  await getSyncEngine().syncNow();
-  res.json(await statusBody());
-});
-
-/**
- * @openapi
- * /sync/link/settings:
- *   put:
- *     summary: Change what syncs and how the server is reached
- *     description: Desktop only. disabledTypes lists the kinds of data that stay on this device. Proxy headers and basic auth left blank keep their saved values.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The new status.
- *       400:
- *         description: Not linked.
- */
-router.put("/link/settings", ...guard, async (req: Request, res: Response) => {
-  const link = await getLink();
-  if (!link) return res.status(400).json({ error: "Not linked" });
-  const body = req.body ?? {};
-  const patch: Parameters<typeof updateLink>[0] = {};
-
-  if (Array.isArray(body.disabledTypes)) {
-    const disabled = body.disabledTypes.filter(
-      (type: unknown): type is string =>
-        typeof type === "string" && type !== "accountProfile",
-    );
-    const changed = new Set([
-      ...disabled.filter((type: string) => !link.disabledTypes.includes(type)),
-      ...link.disabledTypes.filter((type) => !disabled.includes(type)),
-    ]);
-    patch.disabledTypes = disabled;
-    // A type switched back on is pulled again in full.
-    patch.knownTypes = link.knownTypes.filter((type) => !changed.has(type));
-  }
-  if (Array.isArray(body.customHeaders)) {
-    const saved = new Map(link.customHeaders.map((h) => [h.name, h.value]));
-    patch.customHeaders = (body.customHeaders as unknown[])
-      .filter(
-        (header): header is { name: string; value?: string } =>
-          !!header && typeof (header as { name?: unknown }).name === "string",
-      )
-      .map((header) => ({
-        name: header.name,
-        value: header.value || saved.get(header.name) || "",
-      }))
-      .filter((header) => header.value);
-    patch.customHeaders = readHeaders(patch.customHeaders);
-  }
-  if (body.basicAuth === null) {
-    patch.basicAuth = null;
-  } else if (body.basicAuth && typeof body.basicAuth === "object") {
-    const next = readBasicAuth(body.basicAuth);
-    if (next && !next.password && link.basicAuth) {
-      next.password = link.basicAuth.password;
-    }
-    patch.basicAuth = next;
-  }
-  if (typeof body.allowInvalidCertificate === "boolean") {
-    patch.allowInvalidCertificate = body.allowInvalidCertificate;
-  }
-
-  const updated = await updateLink(patch);
-  await applyElectronProxyConfig(updated).catch(() => {});
-  getSyncEngine().request(0);
-  res.json(await statusBody());
-});
-
-/**
- * @openapi
- * /sync/link/conflicts:
- *   get:
- *     summary: Local edits that lost to a newer edit on the server
- *     description: Desktop only. The server's version was kept; each entry holds this device's version so it can be restored.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The conflicts, oldest first.
- */
-router.get("/link/conflicts", ...guard, async (req: Request, res: Response) => {
-  const conflicts = await listConflicts(userOf(req));
-  res.json({
-    conflicts: conflicts.map((conflict) => {
-      let row: SyncRow = {};
-      try {
-        row = JSON.parse(conflict.localRow);
-      } catch {
-        row = {};
-      }
-      return {
-        id: conflict.id,
-        entityType: conflict.entityType,
-        syncId: conflict.syncId,
-        name: row.name ?? row.title ?? row.label ?? row.ip ?? conflict.syncId,
-        createdAt: conflict.createdAt,
-      };
-    }),
-  });
-});
-
-/**
- * @openapi
- * /sync/link/conflicts/{id}:
- *   post:
- *     summary: Settle a conflict
- *     description: Desktop only. keep "mine" puts this device's version back, and the next sync sends it to the server. keep "server" drops it.
- *     tags:
- *       - Sync
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema:
- *           type: integer
- *     responses:
- *       200:
- *         description: Settled.
- *       404:
- *         description: No such conflict.
- */
-router.post(
-  "/link/conflicts/:id",
-  ...guard,
-  async (req: Request, res: Response) => {
-    const userId = userOf(req);
-    const conflict = await getConflict(userId, Number(req.params.id));
-    if (!conflict) return res.status(404).json({ error: "Not found" });
-    try {
-      if (req.body?.keep === "mine") {
-        const entity = getEntity(conflict.entityType);
-        if (entity && !entity.readOnly) {
-          const row = JSON.parse(conflict.localRow) as SyncRow;
-          await writeWireRow(
-            entity,
-            userId,
-            { ...row, syncId: conflict.syncId },
-            createResolvers(userId),
-          );
-        }
-      }
-      await deleteConflict(userId, conflict.id);
-      getSyncEngine().request(0);
-      res.json({ success: true });
-    } catch (error) {
-      syncLogger.warn("Could not settle a sync conflict", {
-        operation: "sync_conflict",
-        error: error instanceof Error ? error.message : String(error),
-      });
-      res.status(500).json({ error: "Failed to settle conflict" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /sync/link/errors:
- *   get:
- *     summary: Changes the server refused
- *     description: Desktop only. Each entry names the record and why the server refused it. A refused change is not sent again until it changes or is retried.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The refused changes.
- */
-router.get("/link/errors", ...guard, async (req: Request, res: Response) => {
-  const errors = await listRecordErrors(userOf(req));
-  res.json({
-    errors: errors.map((record) => ({
-      entityType: record.entityType,
-      syncId: record.syncId,
-      reason: record.error,
-    })),
-  });
-});
-
-/**
- * @openapi
- * /sync/link/errors/retry:
- *   post:
- *     summary: Send refused changes again
- *     description: Desktop only. Clears every refusal and syncs.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The status after the pass.
- */
-router.post(
-  "/link/errors/retry",
-  ...guard,
-  async (req: Request, res: Response) => {
-    await clearRecordErrors(userOf(req));
-    await getSyncEngine().syncNow();
-    res.json(await statusBody());
-  },
-);
-
-/**
- * @openapi
- * /sync/link/session:
- *   get:
- *     summary: The linked server and session, for connecting to it directly
- *     description: Desktop only. Used when a host is set to connect through the server rather than from this device.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The server address and session token, or nulls when not linked.
- */
-router.get("/link/session", ...guard, async (_req: Request, res: Response) => {
-  const link = await getLink();
-  if (!link?.sessionToken || link.status === "signed_out") {
-    return res.json({ serverUrl: null, token: null });
-  }
-  res.json({ serverUrl: link.serverUrl, token: link.sessionToken });
-});
-
-export default router;
diff --git a/src/backend/sync/protocol.ts b/src/backend/sync/protocol.ts
deleted file mode 100644
index 86b3fa486..000000000
--- a/src/backend/sync/protocol.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-/** Bumped when a desktop and server can no longer understand each other. */
-export const SYNC_PROTOCOL_VERSION = 1;
diff --git a/src/backend/sync/server/routes.ts b/src/backend/sync/server/routes.ts
deleted file mode 100644
index c3aba2349..000000000
--- a/src/backend/sync/server/routes.ts
+++ /dev/null
@@ -1,605 +0,0 @@
-import express, { type Request, type Response } from "express";
-import fs from "fs";
-import path from "path";
-import os from "os";
-import * as tar from "tar";
-import type { AuthenticatedRequest } from "../../../types/index.js";
-import { AuthManager } from "../../utils/auth-manager.js";
-import { syncLogger } from "../../utils/logger.js";
-import { getLocalVersion } from "../../utils/app-version.js";
-import { getEntity, listEntities } from "../../plugins/sync-registry.js";
-import { getPluginRuntime } from "../../plugins/index.js";
-import { resolvePluginDesktopMode } from "@termix-ssh/plugin-sdk/manifest";
-import {
-  createCurrentSessionRepository,
-  createCurrentSettingsRepository,
-  createCurrentUserRepository,
-  createCurrentPluginRepository,
-  createCurrentPluginPermissionGrantRepository,
-} from "../../database/repositories/factory.js";
-import { resolveBrandingSettings } from "../../database/routes/branding-settings.js";
-import { registerCoreSyncEntities } from "../entities.js";
-import { listChanges, recordKey } from "../records.js";
-import { addListener, reconcileUser, withUserLock } from "./feed.js";
-import { applyPush, parsePushOps } from "./push.js";
-import { SYNC_PROTOCOL_VERSION } from "../protocol.js";
-
-const SESSION_DAYS = 365;
-const REFRESH_WITHIN_MS = 60 * 24 * 60 * 60 * 1000;
-const MAX_PAGE = 1000;
-
-const router = express.Router();
-const authManager = AuthManager.getInstance();
-const authenticateJWT = authManager.createAuthMiddleware();
-
-registerCoreSyncEntities();
-
-function userOf(req: Request): string {
-  return (req as AuthenticatedRequest).userId;
-}
-
-/** A non-negative integer query value, the fallback when absent, null when malformed. */
-function queryInt(value: unknown, fallback: number): number | null {
-  if (value === undefined) return fallback;
-  const parsed = Number(value);
-  return typeof value === "string" &&
-    /^\d+$/.test(value) &&
-    Number.isSafeInteger(parsed)
-    ? parsed
-    : null;
-}
-
-/**
- * @openapi
- * /sync/v2/info:
- *   get:
- *     summary: Describe this server to a desktop that wants to link to it
- *     description: Public. Lets the desktop app confirm it reached Termix and not a proxy's login page, and that the sync protocol matches.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: Server name, version and sync protocol version.
- */
-router.get("/v2/info", async (_req: Request, res: Response) => {
-  let name = "Termix";
-  try {
-    name = (await resolveBrandingSettings(createCurrentSettingsRepository()))
-      .appName;
-  } catch {
-    // The default name is fine.
-  }
-  res.setHeader("X-Termix-Sync", String(SYNC_PROTOCOL_VERSION));
-  res.json({
-    termix: true,
-    name,
-    version: getLocalVersion(),
-    protocol: SYNC_PROTOCOL_VERSION,
-  });
-});
-
-/**
- * @openapi
- * /sync/v2/link:
- *   post:
- *     summary: Link a desktop to this account
- *     description: Trades the short login session the desktop just signed in with for a long-lived desktop session, which shows in the account's sessions list and is revoked like any other. The login session is ended.
- *     tags:
- *       - Sync
- *     requestBody:
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             properties:
- *               deviceName:
- *                 type: string
- *     responses:
- *       200:
- *         description: The desktop session token and the account it belongs to.
- *       401:
- *         description: Not signed in.
- *       403:
- *         description: API keys cannot link a desktop.
- */
-router.post(
-  "/v2/link",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = userOf(req);
-    if ((req as AuthenticatedRequest).apiKeyId) {
-      return res.status(403).json({ error: "API keys cannot link a desktop" });
-    }
-    try {
-      const user = await createCurrentUserRepository().findById(userId);
-      if (!user) return res.status(401).json({ error: "User not found" });
-      const rawName =
-        typeof req.body?.deviceName === "string" ? req.body.deviceName : "";
-      const deviceName = rawName.trim().slice(0, 100) || "Termix Desktop";
-      const token = await authManager.generateJWTToken(userId, {
-        expiresIn: `${SESSION_DAYS}d`,
-        deviceType: "desktop",
-        deviceInfo: `${deviceName} (sync)`,
-      });
-      const loginSession = (req as AuthenticatedRequest).sessionId;
-      if (loginSession) await authManager.revokeSession(loginSession);
-      res.json({
-        token,
-        user: { id: user.id, username: user.username },
-        server: { version: getLocalVersion() },
-      });
-    } catch (error) {
-      syncLogger.error("Failed to link a desktop", error, {
-        operation: "sync_link",
-        userId,
-      });
-      res.status(500).json({ error: "Failed to link" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /sync/v2/session/refresh:
- *   post:
- *     summary: Keep a linked desktop's session from expiring
- *     description: Returns a fresh desktop session when the current one ends within 60 days, and ends the old one. Otherwise returns null and the desktop keeps its token.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The new token, or null.
- *       401:
- *         description: Session revoked or expired.
- */
-router.post(
-  "/v2/session/refresh",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = userOf(req);
-    const sessionId = (req as AuthenticatedRequest).sessionId;
-    try {
-      if (!sessionId) return res.json({ token: null });
-      const session =
-        await createCurrentSessionRepository().findById(sessionId);
-      if (!session) return res.status(401).json({ error: "Session not found" });
-      const remaining = new Date(session.expiresAt).getTime() - Date.now();
-      if (remaining > REFRESH_WITHIN_MS) return res.json({ token: null });
-      const token = await authManager.generateJWTToken(userId, {
-        expiresIn: `${SESSION_DAYS}d`,
-        deviceType: "desktop",
-        deviceInfo: session.deviceInfo,
-      });
-      await authManager.revokeSession(sessionId);
-      res.json({ token });
-    } catch (error) {
-      syncLogger.error("Failed to refresh a desktop session", error, {
-        operation: "sync_session_refresh",
-        userId,
-      });
-      res.status(500).json({ error: "Failed to refresh session" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /sync/v2/unlink:
- *   post:
- *     summary: End a linked desktop's session
- *     description: Called by a desktop when it unlinks, so its session stops working here right away.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The session was ended.
- */
-router.post(
-  "/v2/unlink",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const sessionId = (req as AuthenticatedRequest).sessionId;
-    try {
-      if (sessionId) await authManager.revokeSession(sessionId);
-      res.json({ success: true });
-    } catch (error) {
-      syncLogger.error("Failed to end a desktop session", error, {
-        operation: "sync_unlink",
-      });
-      res.status(500).json({ error: "Failed to unlink" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /sync/v2/changes:
- *   get:
- *     summary: Pull what changed for this account after a cursor
- *     description: Returns records in change order. Each has the entity type, syncId, revision, whether it is deleted, and the row when it is not. Records of entity types this server does not currently run are skipped but still move the cursor.
- *     tags:
- *       - Sync
- *     parameters:
- *       - in: query
- *         name: cursor
- *         schema:
- *           type: integer
- *       - in: query
- *         name: limit
- *         schema:
- *           type: integer
- *       - in: query
- *         name: types
- *         description: Comma-separated entity types, to backfill only those.
- *         schema:
- *           type: string
- *     responses:
- *       200:
- *         description: A page of changes, the next cursor and whether more remain.
- *       400:
- *         description: The cursor or limit is not a non-negative integer.
- *       500:
- *         description: Failed to read changes.
- */
-router.get(
-  "/v2/changes",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = userOf(req);
-    const cursor = queryInt(req.query.cursor, 0);
-    const pageSize = queryInt(req.query.limit, MAX_PAGE);
-    if (cursor === null || pageSize === null) {
-      return res.status(400).json({ error: "Invalid cursor or limit" });
-    }
-    const limit = Math.min(MAX_PAGE, Math.max(1, pageSize));
-    const types =
-      typeof req.query.types === "string" && req.query.types
-        ? req.query.types.split(",").filter(Boolean)
-        : undefined;
-
-    try {
-      const page = await withUserLock(userId, async () => {
-        const { wire } = await reconcileUser(userId);
-        const records = await listChanges(userId, cursor, limit + 1, types);
-        return { wire, records };
-      });
-      const hasMore = page.records.length > limit;
-      const records = page.records.slice(0, limit);
-      const changes = [];
-      for (const record of records) {
-        if (!getEntity(record.entityType)) continue;
-        const row = record.deleted
-          ? null
-          : (page.wire.get(recordKey(record.entityType, record.syncId)) ??
-            null);
-        // A live record with no row failed to serialize; it comes again once it
-        // changes, rather than arriving as a delete.
-        if (!record.deleted && !row) continue;
-        changes.push({
-          seq: record.seq,
-          entityType: record.entityType,
-          syncId: record.syncId,
-          revision: record.revision,
-          deleted: !!record.deleted,
-          row,
-        });
-      }
-      res.json({
-        changes,
-        nextCursor: records.length ? records[records.length - 1].seq : cursor,
-        hasMore,
-        entityTypes: listEntities().map((entity) => ({
-          type: entity.type,
-          owner: entity.owner,
-          order: entity.order,
-          readOnly: !!entity.readOnly,
-        })),
-      });
-    } catch (error) {
-      syncLogger.error("Failed to read sync changes", error, {
-        operation: "sync_changes",
-        userId,
-      });
-      res.status(500).json({ error: "Failed to read changes" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /sync/v2/push:
- *   post:
- *     summary: Push a desktop's changes
- *     description: Each op carries the revision the desktop last saw. Ops are applied in dependency order and each gets its own result, ok with the new revision, conflict with the server's version, or rejected with a reason.
- *     tags:
- *       - Sync
- *     requestBody:
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             properties:
- *               ops:
- *                 type: array
- *                 items:
- *                   type: object
- *     responses:
- *       200:
- *         description: One result per op, in the order sent.
- *       400:
- *         description: Malformed ops, or more than 500.
- *       500:
- *         description: Failed to apply changes.
- */
-router.post(
-  "/v2/push",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = userOf(req);
-    const ops = parsePushOps(req.body);
-    if (!ops) return res.status(400).json({ error: "Invalid ops" });
-    try {
-      const results = await withUserLock(userId, () => applyPush(userId, ops));
-      res.json({ results });
-    } catch (error) {
-      syncLogger.error("Failed to apply pushed changes", error, {
-        operation: "sync_push",
-        userId,
-      });
-      res.status(500).json({ error: "Failed to apply changes" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /sync/v2/events:
- *   get:
- *     summary: Stream a notice whenever this account's data changes
- *     description: Server-sent events. A "change" event means there is something new to pull. Comments are sent every 25 seconds to keep proxies from closing the stream.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: An event stream.
- */
-router.get("/v2/events", authenticateJWT, (req: Request, res: Response) => {
-  const userId = userOf(req);
-  res.setHeader("Content-Type", "text/event-stream");
-  res.setHeader("Cache-Control", "no-cache, no-transform");
-  res.setHeader("Connection", "keep-alive");
-  res.setHeader("X-Accel-Buffering", "no");
-  res.flushHeaders?.();
-  res.write(`event: ready\ndata: {}\n\n`);
-  const remove = addListener(userId, res);
-  req.on("close", remove);
-});
-
-/**
- * @openapi
- * /sync/v2/hosts/{syncId}:
- *   get:
- *     summary: This server's id for a host, by its sync id
- *     description: For a linked desktop that asks the server to act on a host (a tunnel through it), which needs the server's own id. Only for hosts the caller can connect to.
- *     tags:
- *       - Sync
- *     parameters:
- *       - in: path
- *         name: syncId
- *         required: true
- *         schema:
- *           type: string
- *     responses:
- *       200:
- *         description: The host's id and name.
- *       404:
- *         description: No such host the caller can connect to.
- */
-router.get(
-  "/v2/hosts/:syncId",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = userOf(req);
-    try {
-      const { createCurrentHostResolutionRepository } =
-        await import("../../database/repositories/factory.js");
-      const hostId =
-        await createCurrentHostResolutionRepository().findHostIdBySyncId(
-          String(req.params.syncId),
-        );
-      if (hostId === null) return res.status(404).json({ error: "Not found" });
-      const { PermissionManager } =
-        await import("../../utils/permission-manager.js");
-      const access = await PermissionManager.getInstance().canAccessHost(
-        userId,
-        hostId,
-        "connect",
-      );
-      if (!access.hasAccess)
-        return res.status(404).json({ error: "Not found" });
-      const { createCurrentHostRepository } =
-        await import("../../database/repositories/factory.js");
-      const row = await createCurrentHostRepository().findById(hostId);
-      res.json({ id: hostId, name: row?.name ?? row?.ip ?? null });
-    } catch (error) {
-      syncLogger.error("Failed to look up a host by sync id", error, {
-        operation: "sync_host_lookup",
-      });
-      res.status(500).json({ error: "Failed to look up host" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /sync/v2/host-status:
- *   get:
- *     summary: Status of the hosts this account can see, keyed by sync id
- *     description: For a linked desktop whose hosts connect through this server, so it can show their status against its own copies.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: Status entries by host sync id.
- */
-router.get(
-  "/v2/host-status",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = userOf(req);
-    try {
-      const { hostStatus } =
-        await import("../../plugins/host-status-provider.js");
-      const { PermissionManager } =
-        await import("../../utils/permission-manager.js");
-      const { createCurrentHostRepository } =
-        await import("../../database/repositories/factory.js");
-      const statuses = await hostStatus.statusesFor(userId, null);
-      const entries = [...statuses.entries()];
-      const allowed =
-        await PermissionManager.getInstance().filterAccessibleHostIds(
-          userId,
-          entries.map(([id]) => id),
-        );
-      const hostRepository = createCurrentHostRepository();
-      const result: Record<string, unknown> = {};
-      for (const [id, entry] of entries) {
-        if (!allowed.has(id)) continue;
-        const row = await hostRepository.findById(id);
-        if (row?.syncId) result[row.syncId] = entry;
-      }
-      res.json(result);
-    } catch (error) {
-      syncLogger.error("Failed to read host status for sync", error, {
-        operation: "sync_host_status",
-      });
-      res.status(500).json({ error: "Failed to read host status" });
-    }
-  },
-);
-
-async function listPluginsForDesktop() {
-  return getPluginRuntime().loader.list();
-}
-
-/**
- * @openapi
- * /sync/v2/plugins:
- *   get:
- *     summary: The features this server runs, for a linked desktop to mirror
- *     description: Every installed plugin with its version, where it came from, whether it is on, how a desktop should treat it and which sync entities it owns. registryKeys lists the signing keys of the custom registries an admin added, so plugins from them load on the desktop.
- *     tags:
- *       - Sync
- *     responses:
- *       200:
- *         description: The plugin list.
- */
-router.get(
-  "/v2/plugins",
-  authenticateJWT,
-  async (_req: Request, res: Response) => {
-    try {
-      const records = new Map(
-        (await createCurrentPluginRepository().listAll()).map((record) => [
-          record.id,
-          record,
-        ]),
-      );
-      const grants = createCurrentPluginPermissionGrantRepository();
-      const plugins = [];
-      for (const plugin of await listPluginsForDesktop()) {
-        plugins.push({
-          id: plugin.id,
-          name: plugin.manifest.name,
-          version: plugin.manifest.version,
-          source: plugin.source,
-          // A bundled plugin updated from a signed .tmxplug can be mirrored.
-          artifact: !!plugin.artifact,
-          enabled: records.get(plugin.id)?.state === "enabled",
-          active: plugin.state === "active",
-          desktop: resolvePluginDesktopMode(plugin.manifest),
-          syncEntities: plugin.manifest.contributes?.syncEntities ?? [],
-          granted: (await grants.listByPlugin(plugin.id)).map(
-            (grant) => grant.capability,
-          ),
-        });
-      }
-      const { customRegistryKeys } =
-        await import("../../plugins/registries.js");
-      res.json({ plugins, registryKeys: await customRegistryKeys() });
-    } catch (error) {
-      syncLogger.error("Failed to list plugins for sync", error, {
-        operation: "sync_plugins",
-      });
-      res.status(500).json({ error: "Failed to list plugins" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /sync/v2/plugins/{id}/package:
- *   get:
- *     summary: Download an installed plugin so a linked desktop can install it
- *     description: Only for plugins installed on this server, or bundled ones replaced by a signed update. Sends the original .tmxplug when there is one, with its signature in the X-Termix-Signature header, otherwise a fresh archive of the plugin folder.
- *     tags:
- *       - Sync
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema:
- *           type: string
- *     responses:
- *       200:
- *         description: The plugin archive.
- *       404:
- *         description: No installed plugin with that id.
- */
-router.get(
-  "/v2/plugins/:id/package",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const pluginId = String(req.params.id);
-    try {
-      const plugin = (await listPluginsForDesktop()).find(
-        (candidate) => candidate.id === pluginId,
-      );
-      if (!plugin || (plugin.source !== "user" && !plugin.artifact)) {
-        return res.status(404).json({ error: "Plugin not found" });
-      }
-      const artifact = plugin.artifact ?? "";
-      res.setHeader("Content-Type", "application/gzip");
-      if (fs.existsSync(artifact)) {
-        const sig = `${artifact}.sig`;
-        if (fs.existsSync(sig)) {
-          res.setHeader(
-            "X-Termix-Signature",
-            Buffer.from(await fs.promises.readFile(sig, "utf8")).toString(
-              "base64",
-            ),
-          );
-        }
-        return fs.createReadStream(artifact).pipe(res);
-      }
-      const temp = path.join(
-        os.tmpdir(),
-        `termix-plugin-${pluginId}-${Date.now()}.tmxplug`,
-      );
-      await tar.c({ gzip: true, cwd: plugin.dir, file: temp }, ["."]);
-      const stream = fs.createReadStream(temp);
-      stream.on("close", () => void fs.promises.rm(temp, { force: true }));
-      stream.pipe(res);
-    } catch (error) {
-      syncLogger.error("Failed to package a plugin for sync", error, {
-        operation: "sync_plugin_package",
-        pluginId,
-      });
-      if (!res.headersSent) {
-        res.status(500).json({ error: "Failed to package plugin" });
-      }
-    }
-  },
-);
-
-export default router;
diff --git a/src/backend/tests/database/routes/user-socket-ticket-routes.test.ts b/src/backend/tests/database/routes/user-socket-ticket-routes.test.ts
index 0b7312053..d6b9c6d69 100644
--- a/src/backend/tests/database/routes/user-socket-ticket-routes.test.ts
+++ b/src/backend/tests/database/routes/user-socket-ticket-routes.test.ts
@@ -25,6 +25,10 @@ const issueSocketTicket = vi.fn(
   async (userId: string, sessionId: string) => `ticket:${userId}:${sessionId}`,
 );
 
+const issueApiKeySocketTicket = vi.fn(
+  async (userId: string, keyId: string) => `key-ticket:${userId}:${keyId}`,
+);
+
 const authenticate: RequestHandler = (req, _res, next) => {
   Object.assign(req, {
     userId: "u1",
@@ -38,7 +42,10 @@ function app() {
   const router = express.Router();
   registerUserSocketTicketRoutes(router, {
     authenticateJWT: authenticate,
-    authManager: { issueSocketTicket } as unknown as AuthManager,
+    authManager: {
+      issueSocketTicket,
+      issueApiKeySocketTicket,
+    } as unknown as AuthManager,
   });
   const server = express();
   server.use(cookieParser());
@@ -50,6 +57,7 @@ beforeEach(() => {
   state.sessionId = "s1";
   state.apiKeyId = undefined;
   issueSocketTicket.mockClear();
+  issueApiKeySocketTicket.mockClear();
 });
 
 describe("POST /users/ws-ticket", () => {
@@ -98,3 +106,23 @@ describe("POST /users/ws-ticket", () => {
     expect(issueSocketTicket).not.toHaveBeenCalled();
   });
 });
+
+describe("POST /users/ws-ticket/api-key", () => {
+  it("gives an API key a ticket as its user", async () => {
+    state.sessionId = undefined;
+    state.apiKeyId = "key-1";
+
+    const res = await request(app()).post("/users/ws-ticket/api-key");
+
+    expect(res.status).toBe(200);
+    expect(res.body.ticket).toBe("key-ticket:u1:key-1");
+    expect(res.headers["cache-control"]).toBe("no-store");
+  });
+
+  it("refuses a login session, which has its own ticket", async () => {
+    const res = await request(app()).post("/users/ws-ticket/api-key");
+
+    expect(res.status).toBe(401);
+    expect(issueApiKeySocketTicket).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/backend/tests/sync/server/changes.test.ts b/src/backend/tests/sync/server/changes.test.ts
deleted file mode 100644
index 75199a71a..000000000
--- a/src/backend/tests/sync/server/changes.test.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-import { beforeEach, expect, it, vi } from "vitest";
-
-const { listChanges } = vi.hoisted(() => ({ listChanges: vi.fn() }));
-vi.mock("../../../utils/auth-manager.js", () => ({
-  AuthManager: { getInstance: () => ({ createAuthMiddleware: () => vi.fn() }) },
-}));
-vi.mock("../../../utils/logger.js", () => ({ syncLogger: { error: vi.fn() } }));
-vi.mock("../../../utils/app-version.js", () => ({ getLocalVersion: vi.fn() }));
-vi.mock("../../../plugins/index.js", () => ({ getPluginRuntime: vi.fn() }));
-vi.mock("../../../plugins/sync-registry.js", () => ({
-  getEntity: vi.fn(),
-  listEntities: () => [{ type: "hosts", owner: "core", order: 10 }],
-}));
-vi.mock("../../../database/repositories/factory.js", () => ({}));
-vi.mock("../../../sync/entities.js", () => ({
-  registerCoreSyncEntities: vi.fn(),
-}));
-vi.mock("../../../sync/records.js", () => ({
-  listChanges,
-  recordKey: vi.fn(),
-}));
-vi.mock("../../../sync/server/feed.js", () => ({
-  withUserLock: (_userId: string, fn: () => unknown) => fn(),
-  reconcileUser: async () => ({ wire: new Map() }),
-}));
-vi.mock("../../../sync/server/push.js", () => ({}));
-vi.mock("../../../database/routes/branding-settings.js", () => ({}));
-
-import router from "../../../sync/server/routes.js";
-
-const route = router.stack.find(
-  (layer) => layer.route?.path === "/v2/changes",
-)!.route!;
-const handler = route.stack[route.stack.length - 1].handle;
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  listChanges.mockResolvedValue([]);
-});
-
-async function changes(query: Record<string, string>) {
-  const res = { status: vi.fn().mockReturnThis(), json: vi.fn() };
-  await handler({ userId: "user-1", query } as never, res as never, vi.fn());
-  return res;
-}
-
-it("answers an empty page with the entity types past the newest change", async () => {
-  const cursor = String(Number.MAX_SAFE_INTEGER);
-  const res = await changes({ cursor, limit: "1000" });
-  expect(res.status).not.toHaveBeenCalled();
-  expect(res.json).toHaveBeenCalledWith({
-    changes: [],
-    nextCursor: Number.MAX_SAFE_INTEGER,
-    hasMore: false,
-    entityTypes: [{ type: "hosts", owner: "core", order: 10, readOnly: false }],
-  });
-});
-
-it("defaults a missing cursor and limit", async () => {
-  await changes({});
-  expect(listChanges).toHaveBeenCalledWith("user-1", 0, 1001, undefined);
-});
-
-it.each([
-  { cursor: "abc" },
-  { cursor: "-1" },
-  { cursor: "1.5" },
-  { cursor: "Infinity" },
-  { limit: "1.5" },
-  { limit: "-5" },
-])("rejects a malformed query %o", async (query) => {
-  const res = await changes(query);
-  expect(res.status).toHaveBeenCalledWith(400);
-  expect(listChanges).not.toHaveBeenCalled();
-});
diff --git a/src/backend/tests/sync/server/host-lookup.test.ts b/src/backend/tests/sync/server/host-lookup.test.ts
deleted file mode 100644
index f410f6d0f..000000000
--- a/src/backend/tests/sync/server/host-lookup.test.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { beforeEach, expect, it, vi } from "vitest";
-
-const { findHostIdBySyncId, canAccessHost } = vi.hoisted(() => ({
-  findHostIdBySyncId: vi.fn(),
-  canAccessHost: vi.fn(),
-}));
-vi.mock("../../../utils/auth-manager.js", () => ({
-  AuthManager: { getInstance: () => ({ createAuthMiddleware: () => vi.fn() }) },
-}));
-vi.mock("../../../utils/logger.js", () => ({ syncLogger: { error: vi.fn() } }));
-vi.mock("../../../utils/app-version.js", () => ({ getLocalVersion: vi.fn() }));
-vi.mock("../../../plugins/index.js", () => ({ getPluginRuntime: vi.fn() }));
-vi.mock("../../../database/repositories/factory.js", () => ({
-  createCurrentHostResolutionRepository: () => ({ findHostIdBySyncId }),
-  createCurrentHostRepository: () => ({
-    findById: async () => ({ name: "Shared host" }),
-  }),
-}));
-vi.mock("../../../utils/permission-manager.js", () => ({
-  PermissionManager: { getInstance: () => ({ canAccessHost }) },
-}));
-vi.mock("../../../sync/entities.js", () => ({
-  registerCoreSyncEntities: vi.fn(),
-}));
-vi.mock("../../../sync/records.js", () => ({}));
-vi.mock("../../../sync/server/feed.js", () => ({}));
-vi.mock("../../../sync/server/push.js", () => ({}));
-vi.mock("../../../database/routes/branding-settings.js", () => ({}));
-
-import router from "../../../sync/server/routes.js";
-
-const route = router.stack.find(
-  (layer) => layer.route?.path === "/v2/hosts/:syncId",
-)!.route!;
-const handler = route.stack[route.stack.length - 1].handle;
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  findHostIdBySyncId.mockResolvedValue(41);
-  canAccessHost.mockImplementation(async (_user, _host, action) => ({
-    hasAccess: action === "connect",
-  }));
-});
-
-async function lookup() {
-  const res = { status: vi.fn().mockReturnThis(), json: vi.fn() };
-  await handler(
-    { userId: "recipient", params: { syncId: "host-sync-id" } } as never,
-    res as never,
-    vi.fn(),
-  );
-  return res;
-}
-
-it("resolves the server ID for a connect-only recipient", async () => {
-  const res = await lookup();
-  expect(findHostIdBySyncId).toHaveBeenCalledWith("host-sync-id");
-  expect(canAccessHost).toHaveBeenCalledWith("recipient", 41, "connect");
-  expect(res.json).toHaveBeenCalledWith({ id: 41, name: "Shared host" });
-});
-
-it("does not disclose a host the caller cannot connect to", async () => {
-  canAccessHost.mockResolvedValue({ hasAccess: false });
-  const res = await lookup();
-  expect(res.status).toHaveBeenCalledWith(404);
-  expect(res.json).toHaveBeenCalledWith({ error: "Not found" });
-});
-
-it("returns 404 for a missing sync ID", async () => {
-  findHostIdBySyncId.mockResolvedValue(null);
-  const res = await lookup();
-  expect(res.status).toHaveBeenCalledWith(404);
-  expect(canAccessHost).not.toHaveBeenCalled();
-});
diff --git a/src/backend/tests/sync/two-way.test.ts b/src/backend/tests/sync/two-way.test.ts
deleted file mode 100644
index 35c7915e6..000000000
--- a/src/backend/tests/sync/two-way.test.ts
+++ /dev/null
@@ -1,768 +0,0 @@
-/**
- * A server and linked desktops, each with its own database, syncing through
- * the real engine and the real /sync/v2 routes. Only the network, auth and
- * the crypto keys are faked.
- */
-
-import express from "express";
-import request from "supertest";
-import { and, eq, sql } from "drizzle-orm";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { DatabaseContext } from "../../database/repositories/database-context.js";
-
-const state = vi.hoisted(() => ({
-  current: null as null | { drizzle: unknown },
-  server: null as null | { drizzle: unknown },
-  allow: true,
-  sharedHostIds: new Set<number>(),
-  paths: [] as string[],
-}));
-
-const SERVER_USER = "srv-user";
-
-vi.mock("../../database/db/index.js", () => ({
-  getDb: () => state.current!.drizzle,
-  getSqlite: () => null,
-}));
-vi.mock("../../utils/database-save-trigger.js", () => ({
-  DatabaseSaveTrigger: {
-    triggerSave: vi.fn(),
-    forceSave: vi.fn(async () => {}),
-    batched: <T>(work: T) => work,
-  },
-}));
-vi.mock("../../utils/system-crypto.js", () => ({
-  SystemCrypto: {
-    getInstance: () => ({
-      getEncryptionKey: async () => Buffer.alloc(32, 7),
-      getJWTSecret: async () => "secret",
-    }),
-  },
-}));
-vi.mock("../../utils/data-crypto.js", () => ({
-  DataCrypto: {
-    getUserDataKey: () => Buffer.alloc(32, 3),
-    decryptRecord: (_table: string, record: unknown) => record,
-  },
-}));
-vi.mock("../../utils/permission-manager.js", () => ({
-  PermissionManager: {
-    getInstance: () => ({
-      hasPermission: async () => state.allow,
-      canAccessHost: async (_userId: string, hostId: number) => ({
-        hasAccess: state.sharedHostIds.has(hostId),
-      }),
-      getUserPermissions: async () => [],
-    }),
-  },
-}));
-vi.mock("../../utils/shared-host-secrets-manager.js", () => ({
-  SharedHostSecretsManager: {
-    getInstance: () => ({
-      resyncHost: async () => {},
-      resyncHostsForCredential: async () => {},
-    }),
-  },
-}));
-vi.mock("../../utils/shared-credential-secrets-manager.js", () => ({
-  SharedCredentialSecretsManager: {
-    getInstance: () => ({ resyncCredential: async () => {} }),
-  },
-}));
-vi.mock("../../hosts/delete-host.js", async () => {
-  const { hosts } = await import("../../database/db/schema.js");
-  const { eq: equals } = await import("drizzle-orm");
-  return {
-    deleteOwnedHost: async (_userId: string, id: number) => {
-      await (state.current!.drizzle as DatabaseContext["drizzle"])
-        .delete(hosts)
-        .where(equals(hosts.id, id));
-      return { id, name: "" };
-    },
-  };
-});
-vi.mock("../../hosts/delete-credential.js", async () => {
-  const { sshCredentials } = await import("../../database/db/schema.js");
-  const { eq: equals } = await import("drizzle-orm");
-  return {
-    deleteOwnedCredential: async (_userId: string, id: number) => {
-      await (state.current!.drizzle as DatabaseContext["drizzle"])
-        .delete(sshCredentials)
-        .where(equals(sshCredentials.id, id));
-      return { name: null };
-    },
-  };
-});
-vi.mock("../../utils/auth-manager.js", () => ({
-  AuthManager: {
-    getInstance: () => ({
-      createAuthMiddleware:
-        () => (req: { userId?: string }, _res: unknown, next: () => void) => {
-          req.userId = SERVER_USER;
-          next();
-        },
-      generateJWTToken: async () => "desktop-session",
-      revokeSession: async () => true,
-    }),
-  },
-}));
-vi.mock("../../notify/core-notify.js", () => ({ sendCoreAlert: vi.fn() }));
-vi.mock("../../sync/client/plugins.js", () => ({
-  mirrorPlugins: async () => {},
-  lastRemotePlugins: () => [],
-  isServerManaged: () => false,
-}));
-vi.mock("../../sync/client/http.js", async (importOriginal) => {
-  const actual =
-    await importOriginal<typeof import("../../sync/client/http.js")>();
-  return {
-    ...actual,
-    // The event stream is not under test.
-    remoteFetch: () => new Promise(() => {}),
-    remoteJson: async (
-      _target: unknown,
-      path: string,
-      init: { method?: string; body?: unknown } = {},
-    ) => {
-      state.paths.push(path);
-      const previous = state.current;
-      state.current = state.server;
-      try {
-        const agent = request(app);
-        const method = (init.method ?? "GET").toLowerCase() as "get" | "post";
-        const response = await agent[method](path).send(
-          init.body as object | undefined,
-        );
-        if (response.status >= 400) {
-          throw new actual.RemoteError(
-            "server",
-            response.body?.error ?? "error",
-            response.status,
-          );
-        }
-        return response.body;
-      } finally {
-        state.current = previous;
-      }
-    },
-  };
-});
-
-const { TestSqliteDatabase } =
-  await import("../database/repositories/test-support.js");
-const schema = await import("../../database/db/schema.js");
-const { default: syncRouter } = await import("../../sync/server/routes.js");
-const { SyncEngine } = await import("../../sync/client/engine.js");
-const { createLink, getLink, updateLink } =
-  await import("../../sync/client/link-store.js");
-const { markChanged, reconcileUser, resetFeed } =
-  await import("../../sync/server/feed.js");
-const { resetSeqAllocator, listConflicts, getConflict, deleteConflict } =
-  await import("../../sync/records.js");
-const { createResolvers, writeWireRow } = await import("../../sync/store.js");
-const { getEntity } = await import("../../plugins/sync-registry.js");
-const { FieldCrypto } = await import("../../utils/field-crypto.js");
-const { syncLogger } = await import("../../utils/logger.js");
-const { pluginEvents, TOPICS } = await import("../../plugins/events.js");
-
-const app = express();
-app.use(express.json({ limit: "5mb" }));
-app.use("/sync", syncRouter);
-
-type Db = InstanceType<typeof TestSqliteDatabase>;
-interface Side {
-  db: Db;
-  ctx: DatabaseContext;
-  userId: string;
-}
-
-let server: Side;
-let desktops: Side[] = [];
-
-async function side(userId: string): Promise<Side> {
-  const db = new TestSqliteDatabase("sqlite");
-  const ctx = await db.connect();
-  await db.run(
-    sql`INSERT INTO users (id, username, password_hash, is_admin) VALUES (${userId}, ${userId}, '', 1)`,
-  );
-  return { db, ctx, userId };
-}
-
-async function on<T>(where: Side, fn: () => Promise<T>): Promise<T> {
-  const previous = state.current;
-  state.current = where.ctx;
-  try {
-    return await fn();
-  } finally {
-    state.current = previous;
-  }
-}
-
-function db(where: Side) {
-  return where.ctx.drizzle;
-}
-
-async function addHost(
-  where: Side,
-  values: Partial<typeof schema.hosts.$inferInsert> & { name: string },
-) {
-  await db(where)
-    .insert(schema.hosts)
-    .values({
-      userId: where.userId,
-      ip: "10.0.0.1",
-      port: 22,
-      username: "root",
-      authType: "password",
-      syncId: `host-${values.name}`,
-      ...values,
-    });
-  // Stands in for the change watcher a write request would trip.
-  if (where === server) markChanged();
-}
-
-async function hostsOf(where: Side) {
-  return db(where)
-    .select()
-    .from(schema.hosts)
-    .where(eq(schema.hosts.userId, where.userId));
-}
-
-async function linkDesktop(
-  desktop: Side,
-): Promise<InstanceType<typeof SyncEngine>> {
-  await on(desktop, () =>
-    createLink({
-      userId: desktop.userId,
-      serverUrl: "https://termix.example",
-      sessionToken: "desktop-session",
-    }),
-  );
-  return new SyncEngine();
-}
-
-async function pass(desktop: Side, engine: InstanceType<typeof SyncEngine>) {
-  await on(desktop, () => engine.syncNow());
-  const link = await on(desktop, () => getLink());
-  expect(link?.lastError ?? null).toBeNull();
-}
-
-beforeEach(async () => {
-  resetFeed();
-  resetSeqAllocator();
-  state.allow = true;
-  state.sharedHostIds.clear();
-  state.paths = [];
-  server = await side(SERVER_USER);
-  state.server = server.ctx;
-  desktops = [await side("desk-a"), await side("desk-b")];
-});
-
-afterEach(async () => {
-  for (const s of [server, ...desktops]) await s.db.close();
-});
-
-describe("linking a desktop", () => {
-  it("merges both sides, translating references and keeping secrets", async () => {
-    const [desk] = desktops;
-    await on(desk, async () => {
-      await db(desk).insert(schema.sshCredentials).values({
-        userId: desk.userId,
-        name: "deploy key",
-        authType: "password",
-        username: "deploy",
-        syncId: "cred-1",
-      });
-      const [cred] = await db(desk).select().from(schema.sshCredentials);
-      await writeWireRow(
-        getEntity("hosts")!,
-        desk.userId,
-        {
-          syncId: "host-desk",
-          name: "desk",
-          ip: "10.0.0.2",
-          port: 22,
-          username: "root",
-          authType: "credential",
-          password: "s3cret",
-          credentialSyncId: cred.syncId,
-        },
-        createResolvers(desk.userId),
-      );
-    });
-    await on(server, () => addHost(server, { name: "srv" }));
-
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    const serverHosts = await on(server, () => hostsOf(server));
-    expect(serverHosts.map((h) => h.name).sort()).toEqual(["desk", "srv"]);
-    const pushed = serverHosts.find((h) => h.name === "desk")!;
-    const [serverCred] = await db(server).select().from(schema.sshCredentials);
-    expect(serverCred.syncId).toBe("cred-1");
-    expect(pushed.credentialId).toBe(serverCred.id);
-    // Stored encrypted, never as plaintext.
-    expect(pushed.password).not.toBe("s3cret");
-    expect(pushed.password).toContain('"iv"');
-
-    const deskHosts = await on(desk, () => hostsOf(desk));
-    expect(deskHosts.map((h) => h.name).sort()).toEqual(["desk", "srv"]);
-  });
-
-  it("adopts the server's version of rows both sides already have", async () => {
-    const [desk] = desktops;
-    await on(desk, () => addHost(desk, { name: "same", ip: "old" }));
-    await on(server, () => addHost(server, { name: "same", ip: "new" }));
-
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    const [host] = await on(desk, () => hostsOf(desk));
-    expect(host.ip).toBe("new");
-    expect(await on(desk, () => listConflicts(desk.userId))).toEqual([]);
-  });
-
-  it("never asks for a cursor past what the server's seq column holds", async () => {
-    const [desk] = desktops;
-    await on(server, () => addHost(server, { name: "srv" }));
-
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    const cursors = state.paths
-      .filter((path) => path.startsWith("/sync/v2/changes?"))
-      .map((path) =>
-        Number(new URLSearchParams(path.split("?")[1]).get("cursor")),
-      );
-    expect(cursors.length).toBeGreaterThan(0);
-    expect(Math.max(...cursors)).toBeLessThanOrEqual(2_147_483_647);
-  });
-});
-
-describe("a synced host", () => {
-  it("publishes host.created when it is written for the first time only", async () => {
-    const [desk] = desktops;
-    const seen: unknown[] = [];
-    const off = pluginEvents.on(TOPICS.hostCreated, (payload) => {
-      seen.push(payload);
-    });
-    const wire = {
-      syncId: "host-new",
-      name: "new",
-      ip: "10.0.0.2",
-      port: 22,
-      username: "root",
-      authType: "password",
-    };
-    try {
-      await on(desk, async () => {
-        const resolvers = createResolvers(desk.userId);
-        const first = await writeWireRow(
-          getEntity("hosts")!,
-          desk.userId,
-          wire,
-          resolvers,
-        );
-        await writeWireRow(
-          getEntity("hosts")!,
-          desk.userId,
-          { ...wire, name: "renamed" },
-          resolvers,
-        );
-        expect(seen).toEqual([{ hostId: first.id, userId: desk.userId }]);
-      });
-    } finally {
-      off();
-    }
-  });
-});
-
-describe("after linking", () => {
-  it("sends edits and deletes both ways", async () => {
-    const [desk] = desktops;
-    await on(server, () => addHost(server, { name: "a" }));
-    await on(server, () => addHost(server, { name: "b" }));
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    await on(desk, async () => {
-      await db(desk)
-        .update(schema.hosts)
-        .set({ ip: "10.9.9.9" })
-        .where(eq(schema.hosts.syncId, "host-a"));
-    });
-    await on(server, async () => {
-      await db(server)
-        .delete(schema.hosts)
-        .where(eq(schema.hosts.syncId, "host-b"));
-      markChanged();
-    });
-    await pass(desk, engine);
-
-    const serverHosts = await on(server, () => hostsOf(server));
-    expect(serverHosts.map((h) => [h.name, h.ip])).toEqual([["a", "10.9.9.9"]]);
-    const deskHosts = await on(desk, () => hostsOf(desk));
-    expect(deskHosts.map((h) => h.name)).toEqual(["a"]);
-
-    await on(desk, async () => {
-      await db(desk)
-        .delete(schema.hosts)
-        .where(eq(schema.hosts.syncId, "host-a"));
-    });
-    await pass(desk, engine);
-    expect(await on(server, () => hostsOf(server))).toEqual([]);
-  });
-
-  it("never sends a host kept on this device only", async () => {
-    const [desk] = desktops;
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-    await on(desk, () => addHost(desk, { name: "mine", localOnly: true }));
-    await pass(desk, engine);
-
-    expect(await on(server, () => hostsOf(server))).toEqual([]);
-    expect((await on(desk, () => hostsOf(desk))).map((h) => h.name)).toEqual([
-      "mine",
-    ]);
-  });
-
-  it("keeps a local edit that lost to a newer server edit, and can restore it", async () => {
-    const [desk] = desktops;
-    await on(server, () => addHost(server, { name: "a" }));
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    await on(desk, () =>
-      db(desk)
-        .update(schema.hosts)
-        .set({ ip: "desk-edit" })
-        .where(eq(schema.hosts.syncId, "host-a")),
-    );
-    await on(server, async () => {
-      await db(server)
-        .update(schema.hosts)
-        .set({ ip: "server-edit" })
-        .where(eq(schema.hosts.syncId, "host-a"));
-      markChanged();
-    });
-    await pass(desk, engine);
-
-    const [local] = await on(desk, () => hostsOf(desk));
-    expect(local.ip).toBe("server-edit");
-    const conflicts = await on(desk, () => listConflicts(desk.userId));
-    expect(conflicts).toHaveLength(1);
-    expect(JSON.parse(conflicts[0].localRow).ip).toBe("desk-edit");
-
-    // Keep mine: put it back, and the next pass sends it.
-    await on(desk, async () => {
-      const conflict = (await getConflict(desk.userId, conflicts[0].id))!;
-      await writeWireRow(
-        getEntity("hosts")!,
-        desk.userId,
-        { ...JSON.parse(conflict.localRow), syncId: conflict.syncId },
-        createResolvers(desk.userId),
-      );
-      await deleteConflict(desk.userId, conflict.id);
-    });
-    await pass(desk, engine);
-    const [serverHost] = await on(server, () => hostsOf(server));
-    expect(serverHost.ip).toBe("desk-edit");
-  });
-
-  it("does not let one refused change hold up the rest", async () => {
-    const [desk] = desktops;
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    await on(desk, async () => {
-      await addHost(desk, { name: "one" });
-      await db(desk).insert(schema.sshCredentials).values({
-        userId: desk.userId,
-        name: "cred",
-        authType: "password",
-        syncId: "cred-x",
-      });
-    });
-    // The server refuses host changes only.
-    const hostPermissions = getEntity("hosts")!.permissions;
-    const credentialPermissions = getEntity("sshCredentials")!.permissions;
-    getEntity("sshCredentials")!.permissions = undefined;
-    state.allow = false;
-    try {
-      await pass(desk, engine);
-    } finally {
-      getEntity("hosts")!.permissions = hostPermissions;
-      getEntity("sshCredentials")!.permissions = credentialPermissions;
-    }
-
-    expect(await on(server, () => hostsOf(server))).toEqual([]);
-    const creds = await db(server).select().from(schema.sshCredentials);
-    expect(creds.map((c) => c.name)).toEqual(["cred"]);
-    const [record] = await on(desk, () =>
-      db(desk)
-        .select()
-        .from(schema.syncRecords)
-        .where(
-          and(
-            eq(schema.syncRecords.entityType, "hosts"),
-            eq(schema.syncRecords.syncId, "host-one"),
-          ),
-        ),
-    );
-    expect(record.error).toBe("permission");
-  });
-
-  it("leaves a switched-off kind of data alone, and catches up when it is back on", async () => {
-    const [desk] = desktops;
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    const link = (await on(desk, () => getLink()))!;
-    await on(desk, () =>
-      updateLink({
-        disabledTypes: ["hosts"],
-        knownTypes: link.knownTypes.filter((type) => type !== "hosts"),
-      }),
-    );
-    await on(server, () => addHost(server, { name: "later" }));
-    await on(desk, () => addHost(desk, { name: "private" }));
-    await pass(desk, engine);
-
-    expect((await on(desk, () => hostsOf(desk))).map((h) => h.name)).toEqual([
-      "private",
-    ]);
-    expect(
-      (await on(server, () => hostsOf(server))).map((h) => h.name),
-    ).toEqual(["later"]);
-
-    await on(desk, () => updateLink({ disabledTypes: [] }));
-    await pass(desk, engine);
-    await pass(desk, engine);
-    const names = (await on(desk, () => hostsOf(desk)))
-      .map((h) => h.name)
-      .sort();
-    expect(names).toEqual(["later", "private"]);
-    expect(
-      (await on(server, () => hostsOf(server))).map((h) => h.name).sort(),
-    ).toEqual(["later", "private"]);
-  });
-});
-
-describe("a server row that cannot be read", () => {
-  async function recordOf(where: Side, syncId: string) {
-    const [record] = await on(where, () =>
-      db(where)
-        .select()
-        .from(schema.syncRecords)
-        .where(
-          and(
-            eq(schema.syncRecords.entityType, "hosts"),
-            eq(schema.syncRecords.syncId, syncId),
-          ),
-        ),
-    );
-    return record;
-  }
-
-  it.each(["upsert", "delete"] as const)(
-    "retries a local %s after the server row becomes readable",
-    async (op) => {
-      const [desk] = desktops;
-      await on(server, () => addHost(server, { name: "a" }));
-      const engine = await linkDesktop(desk);
-      await pass(desk, engine);
-
-      await on(desk, () =>
-        (op === "delete"
-          ? db(desk).delete(schema.hosts)
-          : db(desk).update(schema.hosts).set({ ip: "desk-edit" })
-        ).where(eq(schema.hosts.syncId, "host-a")),
-      );
-      await on(server, async () => {
-        await db(server)
-          .update(schema.hosts)
-          .set({ ip: "server-edit" })
-          .where(eq(schema.hosts.syncId, "host-a"));
-        await reconcileUser(SERVER_USER, { force: true });
-        // Then its secret stops decrypting, as under a different key.
-        const [host] = await hostsOf(server);
-        await db(server)
-          .update(schema.hosts)
-          .set({
-            password: FieldCrypto.encryptField(
-              "s3cret",
-              Buffer.alloc(32, 9),
-              String(host.id),
-              "password",
-            ),
-          })
-          .where(eq(schema.hosts.id, host.id));
-      });
-
-      const warn = vi.spyOn(syncLogger, "warn");
-      try {
-        await pass(desk, engine);
-        expect(warn).toHaveBeenCalledWith(
-          expect.any(String),
-          expect.objectContaining({
-            entityType: "hosts",
-            syncId: "host-a",
-            error: expect.any(String),
-          }),
-        );
-      } finally {
-        warn.mockRestore();
-      }
-
-      const [local] = await on(desk, () => hostsOf(desk));
-      expect(local?.ip).toBe(op === "upsert" ? "desk-edit" : undefined);
-      expect(await on(desk, () => listConflicts(desk.userId))).toEqual([]);
-      expect((await recordOf(desk, "host-a")).error).toBe("unavailable");
-
-      // Restore the same server content without another local edit or a new
-      // server revision. The failed operation must still be retried.
-      await on(server, () =>
-        db(server)
-          .update(schema.hosts)
-          .set({ password: null })
-          .where(eq(schema.hosts.syncId, "host-a")),
-      );
-      await on(server, () => reconcileUser(SERVER_USER, { force: true }));
-      await pass(desk, engine);
-      const [after] = await on(desk, () => hostsOf(desk));
-      expect(after?.ip).toBe("server-edit");
-      expect((await recordOf(desk, "host-a")).error).toBeNull();
-      const conflicts = await on(desk, () => listConflicts(desk.userId));
-      expect(conflicts.map((c) => JSON.parse(c.localRow).ip)).toEqual(
-        op === "upsert" ? ["desk-edit"] : [],
-      );
-    },
-  );
-
-  it("keeps the local row when a conflict carries no row", async () => {
-    const [desk] = desktops;
-    await on(server, () => addHost(server, { name: "a" }));
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    await on(desk, async () => {
-      const link = (await getLink())!;
-      const settle = (
-        engine as unknown as {
-          settle: (...args: unknown[]) => Promise<void>;
-        }
-      ).settle.bind(engine);
-      await settle(
-        link,
-        {
-          entityType: "hosts",
-          syncId: "host-a",
-          baseRevision: 1,
-          op: "upsert",
-          row: { syncId: "host-a", name: "a" },
-        },
-        {
-          entityType: "hosts",
-          syncId: "host-a",
-          status: "conflict",
-          revision: 2,
-          deleted: false,
-          row: null,
-        },
-        "hash",
-      );
-    });
-
-    expect((await on(desk, () => hostsOf(desk))).map((h) => h.name)).toEqual([
-      "a",
-    ]);
-    const record = await recordOf(desk, "host-a");
-    expect(record.deleted).toBe(false);
-    expect(record.revision).toBe(1);
-  });
-});
-
-describe("hosts shared with the account", () => {
-  it("arrive on the desktop with their text columns as stored", async () => {
-    const [desk] = desktops;
-    await on(server, async () => {
-      await server.db.run(
-        sql`INSERT INTO users (id, username, password_hash, is_admin) VALUES ('owner', 'owner', '', 0)`,
-      );
-      await db(server).insert(schema.hosts).values({
-        userId: "owner",
-        name: "theirs",
-        ip: "10.0.0.5",
-        port: 22,
-        username: "root",
-        authType: "none",
-        forceKeyboardInteractive: "true",
-        syncId: "host-theirs",
-      });
-      const [host] = await db(server).select().from(schema.hosts);
-      await db(server).insert(schema.hostAccess).values({
-        hostId: host.id,
-        userId: SERVER_USER,
-        grantedBy: "owner",
-        permissionLevel: "view",
-      });
-      state.sharedHostIds.add(host.id);
-      markChanged();
-    });
-
-    const engine = await linkDesktop(desk);
-    await pass(desk, engine);
-
-    const [copy] = await on(desk, () => hostsOf(desk));
-    expect(copy?.name).toBe("theirs");
-    expect(copy.forceKeyboardInteractive).toBe("true");
-    expect(JSON.parse(copy.sharedSource!)).toMatchObject({
-      owner: "owner",
-      permissionLevel: "view",
-    });
-  });
-});
-
-describe("two desktops on one account", () => {
-  it("converge on edits, creates and deletes made offline on each", async () => {
-    const [a, b] = desktops;
-    await on(server, () => addHost(server, { name: "shared-one" }));
-    await on(server, () => addHost(server, { name: "shared-two" }));
-    const engineA = await linkDesktop(a);
-    const engineB = await linkDesktop(b);
-    await pass(a, engineA);
-    await pass(b, engineB);
-
-    // Offline on both.
-    await on(a, () => addHost(a, { name: "from-a" }));
-    await on(a, () =>
-      db(a)
-        .update(schema.hosts)
-        .set({ ip: "10.1.1.1" })
-        .where(eq(schema.hosts.syncId, "host-shared-one")),
-    );
-    await on(b, () =>
-      db(b)
-        .delete(schema.hosts)
-        .where(eq(schema.hosts.syncId, "host-shared-two")),
-    );
-    await on(b, () => addHost(b, { name: "from-b" }));
-
-    await pass(a, engineA);
-    await pass(b, engineB);
-    await pass(a, engineA);
-
-    const view = async (where: Side) =>
-      (await on(where, () => hostsOf(where)))
-        .map((h) => `${h.name}:${h.ip}`)
-        .sort();
-    const expected = [
-      "from-a:10.0.0.1",
-      "from-b:10.0.0.1",
-      "shared-one:10.1.1.1",
-    ];
-    expect(await view(server)).toEqual(expected);
-    expect(await view(a)).toEqual(expected);
-    expect(await view(b)).toEqual(expected);
-  });
-});
diff --git a/src/backend/tests/utils/auth-manager-token.test.ts b/src/backend/tests/utils/auth-manager-token.test.ts
index e5758689b..7758e95ef 100644
--- a/src/backend/tests/utils/auth-manager-token.test.ts
+++ b/src/backend/tests/utils/auth-manager-token.test.ts
@@ -214,6 +214,30 @@ describe("AuthManager token handling", () => {
     expect(payload?.userId).toBe("user-1");
   });
 
+  it("gives an API key a ticket on a short session that only a socket takes", async () => {
+    mocks.created.length = 0;
+    const ticket = await authManager.issueApiKeySocketTicket(
+      "user-1",
+      "key-12345678",
+    );
+    const payload = jwt.decode(ticket) as Record<string, number | string>;
+
+    expect(payload.userId).toBe("user-1");
+    expect(payload.purpose).toBe("ws");
+    expect(Number(payload.exp) - Number(payload.iat)).toBe(60);
+
+    const [session] = mocks.created;
+    expect(session.userId).toBe("user-1");
+    expect(session.id).toBe(payload.sessionId);
+    expect(session.deviceInfo).toBe("api-key: socket key-1234");
+    const lifetime =
+      new Date(String(session.expiresAt)).getTime() -
+      new Date(String(session.createdAt)).getTime();
+    expect(lifetime).toBe(120_000);
+
+    expect(await authManager.verifyJWTToken(ticket)).toBeNull();
+  });
+
   it("rejects a socket ticket whose session has expired", async () => {
     const ticket = await authManager.issueSocketTicket("user-1", "expired");
     expect(
diff --git a/src/backend/utils/auth-manager.ts b/src/backend/utils/auth-manager.ts
index aaa933ef1..7516ea26f 100644
--- a/src/backend/utils/auth-manager.ts
+++ b/src/backend/utils/auth-manager.ts
@@ -472,6 +472,24 @@ class AuthManager {
     } as jwt.SignOptions);
   }
 
+  /**
+   * A one minute socket ticket for an API key. The key has no login session,
+   * so a two minute session a plugin could have minted carries the ticket. It
+   * can open plugin sockets and call nothing else.
+   */
+  async issueApiKeySocketTicket(
+    userId: string,
+    keyId: string,
+  ): Promise<string> {
+    const { token } = await this.issuePluginSession(userId, {
+      pluginId: "api-key",
+      purpose: `socket ${keyId.slice(0, 8)}`,
+      ttlSeconds: 120,
+    });
+    const sessionId = (jwt.decode(token) as JWTPayload).sessionId!;
+    return this.issueSocketTicket(userId, sessionId);
+  }
+
   /**
    * A session a plugin mints for a user, to call core's API as them. It is
    * an ordinary session row, so it verifies, expires and shows up like a