@livestore/sync-cf 0.4.0-dev.9 → 0.5.0-dev.0

package/dist/cf-worker/shared.d.ts

@@ -1,24 +1,79 @@
-import type { InvalidPullError, InvalidPushError } from '@livestore/common';
+import type { UnknownError } from '@livestore/common';
 import type { CfTypes } from '@livestore/common-cf';
-import { Effect, Schema } from '@livestore/utils/effect';
+import type { Effect } from '@livestore/utils/effect';
+import { Schema } from '@livestore/utils/effect';
 import type { SearchParams } from '../common/mod.ts';
 import { SyncMessage } from '../common/mod.ts';
-export interface Env {
-    /** Eventlog database */
-    DB: CfTypes.D1Database;
-    ADMIN_SECRET: string;
-}
+export type Env = {};
+/** Headers forwarded from the request to callbacks */
+export type ForwardedHeaders = ReadonlyMap<string, string>;
+/**
+ * Configuration for forwarding request headers to DO callbacks.
+ * - `string[]`: List of header names to forward (case-insensitive)
+ * - `(request) => Record<string, string>`: Custom extraction function (sync)
+ */
+export type ForwardHeadersOption = readonly string[] | ((request: CfTypes.Request) => Record<string, string>);
+/** Context passed to onPush/onPull callbacks */
+export type CallbackContext = {
+    storeId: StoreId;
+    payload?: Schema.Json;
+    /** Headers forwarded from the request (only present if `forwardHeaders` is configured) */
+    headers?: ForwardedHeaders;
+};
 export type MakeDurableObjectClassOptions = {
-    onPush?: (message: SyncMessage.PushRequest, context: {
-        storeId: StoreId;
-        payload?: Schema.JsonValue;
-    }) => Effect.SyncOrPromiseOrEffect<void>;
-    onPushRes?: (message: SyncMessage.PushAck | InvalidPushError) => Effect.SyncOrPromiseOrEffect<void>;
-    onPull?: (message: SyncMessage.PullRequest, context: {
-        storeId: StoreId;
-        payload?: Schema.JsonValue;
-    }) => Effect.SyncOrPromiseOrEffect<void>;
-    onPullRes?: (message: SyncMessage.PullResponse | InvalidPullError) => Effect.SyncOrPromiseOrEffect<void>;
+    onPush?: (message: SyncMessage.PushRequest, context: CallbackContext) => Effect.SyncOrPromiseOrEffect<void>;
+    onPushRes?: (message: SyncMessage.PushAck | UnknownError) => Effect.SyncOrPromiseOrEffect<void>;
+    onPull?: (message: SyncMessage.PullRequest, context: CallbackContext) => Effect.SyncOrPromiseOrEffect<void>;
+    onPullRes?: (message: SyncMessage.PullResponse | UnknownError) => Effect.SyncOrPromiseOrEffect<void>;
+    /**
+     * Forward request headers to `onPush`/`onPull` callbacks for authentication.
+     *
+     * This enables cookie-based or header-based authentication patterns where
+     * you need access to request headers inside the Durable Object.
+     *
+     * @example Forward specific headers by name (case-insensitive)
+     * ```ts
+     * makeDurableObject({
+     *   forwardHeaders: ['cookie', 'authorization'],
+     *   onPush: async (message, { headers }) => {
+     *     const cookie = headers?.get('cookie')
+     *     const session = await validateSession(cookie)
+     *   },
+     * })
+     * ```
+     *
+     * @example Custom extraction function for derived values
+     * ```ts
+     * makeDurableObject({
+     *   forwardHeaders: (request) => ({
+     *     'x-user-id': request.headers.get('x-user-id') ?? '',
+     *     'x-session': request.headers.get('cookie')?.split('session=')[1]?.split(';')[0] ?? '',
+     *   }),
+     *   onPush: async (message, { headers }) => {
+     *     const userId = headers?.get('x-user-id')
+     *   },
+     * })
+     * ```
+     */
+    forwardHeaders?: ForwardHeadersOption;
+    /**
+     * Storage engine for event persistence.
+     * - Default: `{ _tag: 'do-sqlite' }` (Durable Object SQLite)
+     * - D1: `{ _tag: 'd1', binding: string }` where `binding` is the D1 binding name in wrangler.toml.
+     *
+     * If omitted, the runtime defaults to DO SQLite. For backwards-compatibility, if an env binding named
+     * `DB` exists and looks like a D1Database, D1 will be used.
+     *
+     * Trade-offs:
+     * - DO SQLite: simpler deploy, data co-located with DO, not externally queryable
+     * - D1: centralized DB, inspectable with DB tools, extra network hop and JSON size limits
+     */
+    storage?: {
+        _tag: 'do-sqlite';
+    } | {
+        _tag: 'd1';
+        binding: string;
+    };
     /**
      * Enabled transports for sync backend
      * - `http`: HTTP JSON-RPC
@@ -28,6 +83,25 @@ export type MakeDurableObjectClassOptions = {
      * @default Set(['http', 'ws', 'do-rpc'])
      */
     enabledTransports?: Set<'http' | 'ws' | 'do-rpc'>;
+    /**
+     * Custom HTTP response headers for HTTP transport
+     * These headers will be added to all HTTP RPC responses (Pull, Push, Ping)
+     *
+     * @example
+     * ```ts
+     * {
+     *   http: {
+     *     responseHeaders: {
+     *       'Access-Control-Allow-Origin': '*',
+     *       'Cache-Control': 'no-cache'
+     *     }
+     *   }
+     * }
+     * ```
+     */
+    http?: {
+        responseHeaders?: Record<string, string>;
+    };
     otel?: {
         baseUrl?: string;
         serviceName?: string;
@@ -36,18 +110,29 @@ export type MakeDurableObjectClassOptions = {
 export type StoreId = string;
 export type DurableObjectId = string;
 /**
- * Needs to be bumped when the storage format changes (e.g. eventlogTable schema changes)
+ * CRITICAL: Increment this version whenever you modify the database schema structure.
+ *
+ * Bump required when:
+ * - Adding/removing/renaming columns in eventlogTable or contextTable (see sqlite.ts)
+ * - Changing column types or constraints
+ * - Modifying primary keys or indexes
+ *
+ * Bump NOT required when:
+ * - Changing query patterns, pagination logic, or streaming behavior
+ * - Adding new tables (as long as existing table schemas remain unchanged)
+ * - Updating implementation details in sync-storage.ts
  *
- * Changing this version number will lead to a "soft reset".
+ * Impact: Changing this version triggers a "soft reset" - new table names are created
+ * and old data becomes inaccessible (but remains in storage).
  */
 export declare const PERSISTENCE_FORMAT_VERSION = 7;
-export declare const encodeOutgoingMessage: (a: {
+export declare const encodeOutgoingMessage: (input: {
     readonly batch: readonly {
         readonly eventEncoded: {
             readonly name: string;
             readonly args: any;
-            readonly seqNum: any;
-            readonly parentSeqNum: any;
+            readonly seqNum: number & import("effect/Brand").Brand<"GlobalEventSequenceNumber">;
+            readonly parentSeqNum: number & import("effect/Brand").Brand<"GlobalEventSequenceNumber">;
             readonly clientId: string;
             readonly sessionId: string;
         };
@@ -74,8 +159,8 @@ export declare const encodeOutgoingMessage: (a: {
     readonly info: {
         readonly durableObjectId: string;
     };
-}, overrideOptions?: import("effect/SchemaAST").ParseOptions) => string;
-export declare const encodeIncomingMessage: (a: {
+}, options?: import("effect/SchemaAST").ParseOptions) => string;
+export declare const encodeIncomingMessage: (input: {
     readonly cursor: import("effect/Option").Option<{
         readonly backendId: string;
         readonly eventSequenceNumber: number & import("effect/Brand").Brand<"GlobalEventSequenceNumber">;
@@ -84,8 +169,8 @@ export declare const encodeIncomingMessage: (a: {
     readonly batch: readonly {
         readonly name: string;
         readonly args: any;
-        readonly seqNum: any;
-        readonly parentSeqNum: any;
+        readonly seqNum: number & import("effect/Brand").Brand<"GlobalEventSequenceNumber">;
+        readonly parentSeqNum: number & import("effect/Brand").Brand<"GlobalEventSequenceNumber">;
         readonly clientId: string;
         readonly sessionId: string;
     }[];
@@ -98,18 +183,16 @@ export declare const encodeIncomingMessage: (a: {
 } | {
     readonly _tag: "SyncMessage.AdminInfoRequest";
     readonly adminSecret: string;
-}, overrideOptions?: import("effect/SchemaAST").ParseOptions) => string;
+}, options?: import("effect/SchemaAST").ParseOptions) => string;
 /**
  * Extracts the LiveStore sync search parameters from a request. Returns
  * `undefined` when the request does not carry valid sync metadata so callers
  * can fall back to custom routing.
  */
 export declare const matchSyncRequest: (request: CfTypes.Request) => SearchParams | undefined;
-export declare const MAX_PULL_EVENTS_PER_MESSAGE = 100;
-export declare const MAX_WS_MESSAGE_BYTES = 900000;
 export type RpcSubscription = {
     storeId: StoreId;
-    payload?: Schema.JsonValue;
+    payload?: Schema.Json;
     subscribedAt: number;
     /** Effect RPC request ID */
     requestId: string;
@@ -118,6 +201,8 @@ export type RpcSubscription = {
         durableObjectId: string;
     };
 };
+/** Key prefix for DO-RPC subscriptions persisted in the DO's synchronous KV storage. */
+export declare const rpcSubscriptionKeyPrefix = "rpc-sub:";
 /**
  * Durable Object interface supporting the DO RPC protocol for DO <> DO syncing.
  */
@@ -125,9 +210,14 @@ export interface SyncBackendRpcInterface {
     __DURABLE_OBJECT_BRAND: never;
     rpc(payload: Uint8Array): Promise<Uint8Array | CfTypes.ReadableStream>;
 }
-export declare const WebSocketAttachmentSchema: Schema.transform<Schema.SchemaClass<unknown, string, never>, Schema.Struct<{
-    storeId: typeof Schema.String;
-    payload: Schema.optional<Schema.Schema<Schema.JsonValue, Schema.JsonValue, never>>;
-    pullRequestIds: Schema.Array$<typeof Schema.String>;
+export declare const WebSocketAttachmentSchema: Schema.fromJsonString<Schema.Struct<{
+    readonly storeId: Schema.String;
+    readonly payload: Schema.optional<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly pullRequestIds: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Finite]>>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
 }>>;
+/** Helper to extract headers from a request based on the forwardHeaders option */
+export declare const extractForwardedHeaders: (request: CfTypes.Request, forwardHeaders: ForwardHeadersOption | undefined) => Record<string, string> | undefined;
+/** Convert a headers record to a ReadonlyMap */
+export declare const headersRecordToMap: (headers: Record<string, string> | undefined) => ForwardedHeaders | undefined;
 //# sourceMappingURL=shared.d.ts.map

package/dist/cf-worker/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/cf-worker/shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAa,MAAM,yBAAyB,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAsB,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAElE,MAAM,WAAW,GAAG;IAClB,wBAAwB;IACxB,EAAE,EAAE,OAAO,CAAC,UAAU,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,WAAW,CAAC,WAAW,EAChC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,CAAA;KAAE,KACtD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACvC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,gBAAgB,KAAK,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACnG,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,WAAW,CAAC,WAAW,EAChC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,CAAA;KAAE,KACtD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACvC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,GAAG,gBAAgB,KAAK,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAGxG;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC,CAAA;IAEjD,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,CAAA;AAC5B,MAAM,MAAM,eAAe,GAAG,MAAM,CAAA;AAEpC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAA;AAE3C,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uEAA0E,CAAA;AAC5G,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;uEAA0E,CAAA;AAE5G;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,CAAC,OAAO,KAAG,YAAY,GAAG,SAU1E,CAAA;AAED,eAAO,MAAM,2BAA2B,MAAM,CAAA;AAK9C,eAAO,MAAM,oBAAoB,SAAU,CAAA;AAG3C,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,sBAAsB,EAAE,KAAK,CAAA;IAC7B,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;CACvE;AAED,eAAO,MAAM,yBAAyB;;;;GAQrC,CAAA"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/cf-worker/shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAU,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAsB,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAElE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAA;AAEpB,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAE1D;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAE7G,gDAAgD;AAChD,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAA;IACrB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,KAAK,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAC3G,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,YAAY,KAAK,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAC/F,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,KAAK,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAC3G,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,GAAG,YAAY,KAAK,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAEjE;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC,CAAA;IAEjD;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,EAAE;QACL,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACzC,CAAA;IAED,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,CAAA;AAC5B,MAAM,MAAM,eAAe,GAAG,MAAM,CAAA;AAEpC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAA;AAE3C,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+DAA+E,CAAA;AACjH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;+DAA+E,CAAA;AAIjH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,CAAC,OAAO,KAAG,YAAY,GAAG,SAS1E,CAAA;AAGD,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,wFAAwF;AACxF,eAAO,MAAM,wBAAwB,aAAa,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,sBAAsB,EAAE,KAAK,CAAA;IAC7B,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;CACvE;AAED,eAAO,MAAM,yBAAyB;;;;;GAUrC,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,GAClC,SAAS,OAAO,CAAC,OAAO,EACxB,gBAAgB,oBAAoB,GAAG,SAAS,KAC/C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAkB3B,CAAA;AAED,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,KAAG,gBAAgB,GAAG,SAKnG,CAAA"}

package/dist/cf-worker/shared.js

@@ -1,13 +1,25 @@
-import { Effect, Schema, UrlParams } from '@livestore/utils/effect';
+import { Result, Schema } from '@livestore/utils/effect';
 import { SearchParamsSchema, SyncMessage } from "../common/mod.js";
 /**
- * Needs to be bumped when the storage format changes (e.g. eventlogTable schema changes)
+ * CRITICAL: Increment this version whenever you modify the database schema structure.
  *
- * Changing this version number will lead to a "soft reset".
+ * Bump required when:
+ * - Adding/removing/renaming columns in eventlogTable or contextTable (see sqlite.ts)
+ * - Changing column types or constraints
+ * - Modifying primary keys or indexes
+ *
+ * Bump NOT required when:
+ * - Changing query patterns, pagination logic, or streaming behavior
+ * - Adding new tables (as long as existing table schemas remain unchanged)
+ * - Updating implementation details in sync-storage.ts
+ *
+ * Impact: Changing this version triggers a "soft reset" - new table names are created
+ * and old data becomes inaccessible (but remains in storage).
  */
 export const PERSISTENCE_FORMAT_VERSION = 7;
-export const encodeOutgoingMessage = Schema.encodeSync(Schema.parseJson(SyncMessage.BackendToClientMessage));
-export const encodeIncomingMessage = Schema.encodeSync(Schema.parseJson(SyncMessage.ClientToBackendMessage));
+export const encodeOutgoingMessage = Schema.encodeSync(Schema.fromJsonString(SyncMessage.BackendToClientMessage));
+export const encodeIncomingMessage = Schema.encodeSync(Schema.fromJsonString(SyncMessage.ClientToBackendMessage));
+const SearchParamsFromUrlSearchParams = Schema.fromURLSearchParams(SearchParamsSchema);
 /**
  * Extracts the LiveStore sync search parameters from a request. Returns
  * `undefined` when the request does not carry valid sync metadata so callers
@@ -15,23 +27,46 @@ export const encodeIncomingMessage = Schema.encodeSync(Schema.parseJson(SyncMess
  */
 export const matchSyncRequest = (request) => {
     const url = new URL(request.url);
-    const urlParams = UrlParams.fromInput(url.searchParams);
-    const paramsResult = UrlParams.schemaStruct(SearchParamsSchema)(urlParams).pipe(Effect.option, Effect.runSync);
-    if (paramsResult._tag === 'None') {
+    const paramsResult = Schema.decodeUnknownResult(SearchParamsFromUrlSearchParams)(url.searchParams);
+    if (Result.isFailure(paramsResult) === true) {
         return undefined;
     }
-    return paramsResult.value;
+    return paramsResult.success;
 };
-export const MAX_PULL_EVENTS_PER_MESSAGE = 100;
-// Cloudflare hibernated WebSocket frames begin failing just below 1MB. Keep our
-// payloads comfortably beneath that ceiling so we don't rely on implementation
-// quirks of local dev servers.
-export const MAX_WS_MESSAGE_BYTES = 900_000;
-export const WebSocketAttachmentSchema = Schema.parseJson(Schema.Struct({
+/** Key prefix for DO-RPC subscriptions persisted in the DO's synchronous KV storage. */
+export const rpcSubscriptionKeyPrefix = 'rpc-sub:';
+export const WebSocketAttachmentSchema = Schema.fromJsonString(Schema.Struct({
     // Same across all websocket connections
     storeId: Schema.String,
     // Different for each websocket connection
-    payload: Schema.optional(Schema.JsonValue),
-    pullRequestIds: Schema.Array(Schema.String),
+    payload: Schema.optional(Schema.Json),
+    pullRequestIds: Schema.Array(Schema.Union([Schema.String, Schema.Finite])),
+    // Headers forwarded from the initial request (via forwardHeaders option)
+    headers: Schema.optional(Schema.Record(Schema.String, Schema.String)),
 }));
+/** Helper to extract headers from a request based on the forwardHeaders option */
+export const extractForwardedHeaders = (request, forwardHeaders) => {
+    if (forwardHeaders === undefined) {
+        return undefined;
+    }
+    if (typeof forwardHeaders === 'function') {
+        return forwardHeaders(request);
+    }
+    // Array of header names - extract them case-insensitively
+    const result = {};
+    for (const name of forwardHeaders) {
+        const value = request.headers.get(name);
+        if (value !== null) {
+            result[name.toLowerCase()] = value;
+        }
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+};
+/** Convert a headers record to a ReadonlyMap */
+export const headersRecordToMap = (headers) => {
+    if (headers === undefined) {
+        return undefined;
+    }
+    return new Map(Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]));
+};
 //# sourceMappingURL=shared.js.map

package/dist/cf-worker/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/cf-worker/shared.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAwClE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAA;AAE3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAC5G,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAwB,EAA4B,EAAE;IACrF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAE9G,IAAI,YAAY,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAA;AAE9C,gFAAgF;AAChF,+EAA+E;AAC/E,+BAA+B;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAA;AAuB3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,SAAS,CACvD,MAAM,CAAC,MAAM,CAAC;IACZ,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CAC5C,CAAC,CACH,CAAA"}
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/cf-worker/shared.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAGxD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAgHlE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAA;AAE3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AACjH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAEjH,MAAM,+BAA+B,GAAG,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAA;AAEtF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAwB,EAA4B,EAAE;IACrF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAElG,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,CAAA;AAC7B,CAAC,CAAA;AAeD,wFAAwF;AACxF,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAA;AAUlD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,cAAc,CAC5D,MAAM,CAAC,MAAM,CAAC;IACZ,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;CACtE,CAAC,CACH,CAAA;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAwB,EACxB,cAAgD,EACZ,EAAE;IACtC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,OAAO,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;IAED,0DAA0D;IAC1D,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACvC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAA;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC,CAAA;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAA2C,EAAgC,EAAE;IAC9G,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;AAC3F,CAAC,CAAA"}

package/dist/cf-worker/worker.d.ts

@@ -1,27 +1,49 @@
 import type { HelperTypes } from '@livestore/common-cf';
-import type { Schema } from '@livestore/utils/effect';
+import { Schema } from '@livestore/utils/effect';
 import type { CfTypes, SearchParams } from '../common/mod.ts';
-import { type Env } from './shared.ts';
+import { type Env, type ForwardedHeaders } from './shared.ts';
 export type CFWorker<TEnv extends Env = Env, _T extends CfTypes.Rpc.DurableObjectBranded | undefined = undefined> = {
     fetch: <CFHostMetada = unknown>(request: CfTypes.Request<CFHostMetada>, env: TEnv, ctx: CfTypes.ExecutionContext) => Promise<CfTypes.Response>;
 };
+/** Context passed to validatePayload callback */
+export type ValidatePayloadContext = {
+    storeId: string;
+    /** Request headers (raw, not filtered by forwardHeaders) */
+    headers: ForwardedHeaders;
+};
 /**
  * Options accepted by {@link makeWorker}. The Durable Object binding has to be
  * supplied explicitly so we never fall back to deprecated defaults when Cloudflare config changes.
  */
-export type MakeWorkerOptions<TEnv extends Env = Env> = {
+export type MakeWorkerOptions<TEnv extends Env = Env, TSyncPayload = Schema.Json> = {
     /**
      * Binding name of the sync Durable Object declared in wrangler config.
      */
     syncBackendBinding: HelperTypes.ExtractDurableObjectKeys<TEnv>;
     /**
-     * Validates the payload during WebSocket connection establishment.
+     * Optionally pass a schema to decode the client-provided payload into a typed object
+     * before calling {@link validatePayload}. If omitted, the raw JSON value is forwarded.
+     */
+    syncPayloadSchema?: Schema.Decoder<TSyncPayload>;
+    /**
+     * Validates the (optionally decoded) payload during WebSocket connection establishment.
+     * If {@link syncPayloadSchema} is provided, `payload` will be of the schema's inferred type.
+     *
+     * The context includes request headers for cookie-based or header-based authentication.
+     *
+     * @example Cookie-based authentication
+     * ```ts
+     * validatePayload: async (payload, { storeId, headers }) => {
+     *   const cookie = headers.get('cookie')
+     *   const session = await validateSessionFromCookie(cookie)
+     *   if (!session) throw new Error('Unauthorized')
+     * }
+     * ```
+     *
      * Note: This runs only at connection time, not for individual push events.
-     * For push event validation, use the `onPush` callback in the durable object.
+     * For push event validation, use the `onPush` callback in the Durable Object.
      */
-    validatePayload?: (payload: Schema.JsonValue | undefined, context: {
-        storeId: string;
-    }) => void | Promise<void>;
+    validatePayload?: (payload: TSyncPayload, context: ValidatePayloadContext) => void | Promise<void>;
     /** @default false */
     enableCORS?: boolean;
 };
@@ -32,54 +54,40 @@ export type MakeWorkerOptions<TEnv extends Env = Env> = {
  * For more complex setups prefer implementing a custom `fetch` and call {@link handleSyncRequest}
  * from the branch that handles LiveStore sync requests.
  */
-export declare const makeWorker: <TEnv extends Env = Env, TDurableObjectRpc extends CfTypes.Rpc.DurableObjectBranded | undefined = undefined>(options: MakeWorkerOptions<TEnv>) => CFWorker<TEnv, TDurableObjectRpc>;
+export declare const makeWorker: <TEnv extends Env = Env, TDurableObjectRpc extends CfTypes.Rpc.DurableObjectBranded | undefined = undefined, TSyncPayload = Schema.Json>(options: MakeWorkerOptions<TEnv, TSyncPayload>) => CFWorker<TEnv, TDurableObjectRpc>;
 /**
- * Handles `/sync` endpoint.
+ * Handles LiveStore sync requests (e.g. with search params `?storeId=...&transport=...`).
  *
- * @example
+ * @example Token-based authentication
  * ```ts
- * const validatePayload = (payload: Schema.JsonValue | undefined, context: { storeId: string }) => {
- *   console.log(`Validating connection for store: ${context.storeId}`)
+ * const validatePayload = (payload: Schema.Json | undefined, context: { storeId: string }) => {
  *   if (payload?.authToken !== 'insecure-token-change-me') {
  *     throw new Error('Invalid auth token')
  *   }
  * }
+ * ```
  *
- * export default {
- *   fetch: async (request, env, ctx) => {
- *     const searchParams = matchSyncRequest(request)
- *
- *     // Is LiveStore sync request
- *     if (searchParams !== undefined) {
- *       return handleSyncRequest({
- *         request,
- *         searchParams,
- *         env,
- *         ctx,
- *         syncBackendBinding: 'SYNC_BACKEND_DO',
- *         headers: {},
- *         validatePayload,
- *       })
- *     }
- *
- *     return new Response('Invalid path', { status: 400 })
- *   }
+ * @example Cookie-based authentication
+ * ```ts
+ * const validatePayload = async (payload: Schema.Json | undefined, { storeId, headers }) => {
+ *   const cookie = headers.get('cookie')
+ *   const session = await validateSessionFromCookie(cookie)
+ *   if (!session) throw new Error('Unauthorized')
  * }
  * ```
  *
- * @throws {UnexpectedError} If the payload is invalid
+ * @throws {UnknownError} If the payload is invalid
  */
-export declare const handleSyncRequest: <TEnv extends Env = Env, TDurableObjectRpc extends CfTypes.Rpc.DurableObjectBranded | undefined = undefined, CFHostMetada = unknown>({ request, searchParams: { storeId, payload, transport }, env, syncBackendBinding, headers, validatePayload, }: {
+export declare const handleSyncRequest: <TEnv extends Env = Env, TDurableObjectRpc extends CfTypes.Rpc.DurableObjectBranded | undefined = undefined, CFHostMetada = unknown, TSyncPayload = Schema.Json>({ request, searchParams: { storeId, payload, transport }, env: explicitlyProvidedEnv, syncBackendBinding, headers, validatePayload, syncPayloadSchema, }: {
     request: CfTypes.Request<CFHostMetada>;
     searchParams: SearchParams;
-    env: TEnv;
+    env?: TEnv | undefined;
     /** Only there for type-level reasons */
     ctx: CfTypes.ExecutionContext;
     /** Binding name of the sync backend Durable Object */
-    syncBackendBinding: MakeWorkerOptions<TEnv>["syncBackendBinding"];
+    syncBackendBinding: MakeWorkerOptions<TEnv, TSyncPayload>["syncBackendBinding"];
     headers?: CfTypes.HeadersInit | undefined;
-    validatePayload?: (payload: Schema.JsonValue | undefined, context: {
-        storeId: string;
-    }) => void | Promise<void>;
+    validatePayload?: MakeWorkerOptions<TEnv, TSyncPayload>["validatePayload"];
+    syncPayloadSchema?: MakeWorkerOptions<TEnv, TSyncPayload>["syncPayloadSchema"];
 }) => Promise<CfTypes.Response>;
 //# sourceMappingURL=worker.d.ts.map

package/dist/cf-worker/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/cf-worker/worker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAErD,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE7D,OAAO,EAAE,KAAK,GAAG,EAAoB,MAAM,aAAa,CAAA;AAMxD,MAAM,MAAM,QAAQ,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG,EAAE,EAAE,SAAS,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,GAAG,SAAS,IAAI;IAClH,KAAK,EAAE,CAAC,YAAY,GAAG,OAAO,EAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EACtC,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,OAAO,CAAC,gBAAgB,KAC1B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC/B,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG,IAAI;IACtD;;OAEG;IACH,kBAAkB,EAAE,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC9D;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,GAAG,SAAS,EAAE,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/G,qBAAqB;IACrB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GACrB,IAAI,SAAS,GAAG,GAAG,GAAG,EACtB,iBAAiB,SAAS,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,GAAG,SAAS,EAElF,SAAS,iBAAiB,CAAC,IAAI,CAAC,KAC/B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAuDlC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,iBAAiB,GAC5B,IAAI,SAAS,GAAG,GAAG,GAAG,EACtB,iBAAiB,SAAS,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,GAAG,SAAS,EAClF,YAAY,GAAG,OAAO,EACtB,gHAOC;IACD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,YAAY,EAAE,YAAY,CAAA;IAC1B,GAAG,EAAE,IAAI,CAAA;IACT,wCAAwC;IACxC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAA;IAC7B,sDAAsD;IACtD,kBAAkB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAA;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,GAAG,SAAS,CAAA;IACzC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,GAAG,SAAS,EAAE,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChH,KAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAyC0B,CAAA"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/cf-worker/worker.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,EAAkB,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,gBAAgB,EAAoB,MAAM,aAAa,CAAA;AAK/E,MAAM,MAAM,QAAQ,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG,EAAE,EAAE,SAAS,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,GAAG,SAAS,IAAI;IAClH,KAAK,EAAE,CAAC,YAAY,GAAG,OAAO,EAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EACtC,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,OAAO,CAAC,gBAAgB,KAC1B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC/B,CAAA;AAED,iDAAiD;AACjD,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,OAAO,EAAE,gBAAgB,CAAA;CAC1B,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG,EAAE,YAAY,GAAG,MAAM,CAAC,IAAI,IAAI;IAClF;;OAEG;IACH,kBAAkB,EAAE,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC9D;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAChD;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClG,qBAAqB;IACrB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GACrB,IAAI,SAAS,GAAG,GAAG,GAAG,EACtB,iBAAiB,SAAS,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,GAAG,SAAS,EAClF,YAAY,GAAG,MAAM,CAAC,IAAI,EAE1B,SAAS,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,KAC7C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAyDlC,CAAA;AAWD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,iBAAiB,GAC5B,IAAI,SAAS,GAAG,GAAG,GAAG,EACtB,iBAAiB,SAAS,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,GAAG,SAAS,EAClF,YAAY,GAAG,OAAO,EACtB,YAAY,GAAG,MAAM,CAAC,IAAI,EAC1B,0JAQC;IACD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,YAAY,EAAE,YAAY,CAAA;IAC1B,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IACtB,wCAAwC;IACxC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAA;IAC7B,sDAAsD;IACtD,kBAAkB,EAAE,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,oBAAoB,CAAC,CAAA;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,GAAG,SAAS,CAAA;IACzC,eAAe,CAAC,EAAE,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC1E,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,mBAAmB,CAAC,CAAA;CAC/E,KAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAiE0B,CAAA"}

package/dist/cf-worker/worker.js

@@ -1,6 +1,9 @@
-import { UnexpectedError } from '@livestore/common';
-import { Effect } from '@livestore/utils/effect';
+import { env as importedEnv } from 'cloudflare:workers';
+import { UnknownError } from '@livestore/common';
+import { CfDeclare } from '@livestore/common-cf/declare';
+import { Effect, Result, Schema } from '@livestore/utils/effect';
 import { matchSyncRequest } from "./shared.js";
+const Response = CfDeclare.Response;
 /**
  * Produces a Cloudflare Worker `fetch` handler that delegates sync traffic to the
  * Durable Object identified by `syncBackendBinding`.
@@ -12,14 +15,14 @@ export const makeWorker = (options) => {
     return {
         fetch: async (request, env, _ctx) => {
             const url = new URL(request.url);
-            const corsHeaders = options.enableCORS
+            const corsHeaders = options.enableCORS === true
                 ? {
                     'Access-Control-Allow-Origin': '*',
                     'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
                     'Access-Control-Allow-Headers': request.headers.get('Access-Control-Request-Headers') ?? '*',
                 }
                 : {};
-            if (request.method === 'OPTIONS' && options.enableCORS) {
+            if (request.method === 'OPTIONS' && options.enableCORS === true) {
                 return new Response(null, {
                     status: 204,
                     headers: corsHeaders,
@@ -36,6 +39,7 @@ export const makeWorker = (options) => {
                     syncBackendBinding: options.syncBackendBinding,
                     headers: corsHeaders,
                     validatePayload: options.validatePayload,
+                    syncPayloadSchema: options.syncPayloadSchema,
                 });
             }
             // Only show info message for GET requests to / without sync parameters
@@ -57,54 +61,69 @@ export const makeWorker = (options) => {
         },
     };
 };
+/** Convert CF Request headers to a ForwardedHeaders map */
+const requestHeadersToMap = (request) => {
+    const result = new Map();
+    request.headers.forEach((value, key) => {
+        result.set(key.toLowerCase(), value);
+    });
+    return result;
+};
 /**
- * Handles `/sync` endpoint.
+ * Handles LiveStore sync requests (e.g. with search params `?storeId=...&transport=...`).
  *
- * @example
+ * @example Token-based authentication
  * ```ts
- * const validatePayload = (payload: Schema.JsonValue | undefined, context: { storeId: string }) => {
- *   console.log(`Validating connection for store: ${context.storeId}`)
+ * const validatePayload = (payload: Schema.Json | undefined, context: { storeId: string }) => {
  *   if (payload?.authToken !== 'insecure-token-change-me') {
  *     throw new Error('Invalid auth token')
  *   }
  * }
+ * ```
  *
- * export default {
- *   fetch: async (request, env, ctx) => {
- *     const searchParams = matchSyncRequest(request)
- *
- *     // Is LiveStore sync request
- *     if (searchParams !== undefined) {
- *       return handleSyncRequest({
- *         request,
- *         searchParams,
- *         env,
- *         ctx,
- *         syncBackendBinding: 'SYNC_BACKEND_DO',
- *         headers: {},
- *         validatePayload,
- *       })
- *     }
- *
- *     return new Response('Invalid path', { status: 400 })
- *   }
+ * @example Cookie-based authentication
+ * ```ts
+ * const validatePayload = async (payload: Schema.Json | undefined, { storeId, headers }) => {
+ *   const cookie = headers.get('cookie')
+ *   const session = await validateSessionFromCookie(cookie)
+ *   if (!session) throw new Error('Unauthorized')
  * }
  * ```
  *
- * @throws {UnexpectedError} If the payload is invalid
+ * @throws {UnknownError} If the payload is invalid
  */
-export const handleSyncRequest = ({ request, searchParams: { storeId, payload, transport }, env, syncBackendBinding, headers, validatePayload, }) => Effect.gen(function* () {
+export const handleSyncRequest = ({ request, searchParams: { storeId, payload, transport }, env: explicitlyProvidedEnv, syncBackendBinding, headers, validatePayload, syncPayloadSchema, }) => Effect.gen(function* () {
     if (validatePayload !== undefined) {
-        const result = yield* Effect.promise(async () => validatePayload(payload, { storeId })).pipe(UnexpectedError.mapToUnexpectedError, Effect.either);
-        if (result._tag === 'Left') {
-            console.error('Invalid payload', result.left);
-            return new Response(result.left.toString(), { status: 400, headers });
+        // Convert request headers to a Map for the validation context
+        const requestHeaders = requestHeadersToMap(request);
+        // Always decode with the supplied schema when present, even if payload is undefined.
+        // This ensures required payloads are enforced by the schema.
+        if (syncPayloadSchema !== undefined) {
+            const decodedResult = Schema.decodeUnknownResult(syncPayloadSchema)(payload);
+            if (Result.isFailure(decodedResult) === true) {
+                const message = decodedResult.failure.toString();
+                console.error('Invalid payload (decode failed)', message);
+                return new Response(message, { status: 400, ...(headers !== undefined ? { headers } : {}) });
+            }
+            const result = yield* Effect.promise(async () => validatePayload(decodedResult.success, { storeId, headers: requestHeaders })).pipe(UnknownError.mapToUnknownError, Effect.result);
+            if (Result.isFailure(result) === true) {
+                console.error('Invalid payload (validation failed)', result.failure);
+                return new Response(result.failure.toString(), { status: 400, ...(headers !== undefined ? { headers } : {}) });
+            }
+        }
+        else {
+            const result = yield* Effect.promise(async () => validatePayload(payload, { storeId, headers: requestHeaders })).pipe(UnknownError.mapToUnknownError, Effect.result);
+            if (Result.isFailure(result) === true) {
+                console.error('Invalid payload (validation failed)', result.failure);
+                return new Response(result.failure.toString(), { status: 400, ...(headers !== undefined ? { headers } : {}) });
+            }
         }
     }
+    const env = explicitlyProvidedEnv ?? importedEnv;
     if (!(syncBackendBinding in env)) {
         return new Response(`Failed dependency: Required Durable Object binding '${syncBackendBinding}' not available`, {
             status: 424,
-            headers,
+            ...(headers !== undefined ? { headers } : {}),
         });
     }
     const durableObjectNamespace = env[syncBackendBinding];
@@ -115,7 +134,7 @@ export const handleSyncRequest = ({ request, searchParams: { storeId, payload, t
     if (transport === 'ws' && (upgradeHeader === null || upgradeHeader !== 'websocket')) {
         return new Response('Durable Object expected Upgrade: websocket', {
             status: 426,
-            headers,
+            ...(headers !== undefined ? { headers } : {}),
         });
     }
     return yield* Effect.promise(() => durableObject.fetch(request));