I am developing a centralized web application using Node.js/Express to manage ZKTeco biometric attendance devices across multiple physical sites/branches.

My Requirements:

1. Real-time Attendance Sync: Receive check-in/check-out logs centrally as soon as employees scan at any location.

2. Biometric User Management (Read/Write): Add or remove employees from a central admin website and push user credentials directly to specific devices at remote sites.

3. Multi-Tenant / Multi-Site Control: Track device connection statuses and map attendance logs to their respective branch locations.

Because devices are located across different local networks (behind NAT/routers), standard direct TCP socket connections (like zklib over local IP on port 4370) won't work easily without complex VPNs or port forwarding.

Questions:

1. What is the recommended standard protocol for ZKTeco devices to push data to a cloud-hosted Node.js server across different local networks?

2. How does the communication flow work when pushing commands (e.g., creating/writing a user) back to a remote device asynchronously from a server?

3. Are there open-source SDKs or standard HTTP/HTTPS endpoints (/iclock/cdata, /iclock/getrequest) that I can implement in Express.js to build a custom ADMS/Push server?