@sveltebase/sync 1.2.0 → 1.3.0

package/README.md

@@ -92,15 +92,17 @@ export const sync = new SyncClient<AppDatabaseSchema>({
 });
 ```
 
-Use it in your Svelte 5 components (using your preferred Dexie reactivity hook, such as `liveQuery` from `dexie` or `dexie-svelte-query`):
+Use it in your Svelte 5 components with `createLiveQuery`. It wraps Dexie's `liveQuery` in Svelte 5 rune-based reactive state and exposes `data`, `isLoading`, and `error`.
+
 ```svelte
 <script lang="ts">
   import { sync } from "$lib/sync-client";
-  import { liveQuery } from "dexie";
+  import { createLiveQuery } from "@sveltebase/sync/client";
   import { Check, Trash } from "lucide-svelte";
 
-  // Standard Dexie liveQuery updates instantly on mutations & remote syncs
-  const todos = liveQuery(() => sync.todos.orderBy("createdAt").reverse().toArray());
+  const todosQuery = createLiveQuery(() =>
+    sync.todos.orderBy("createdAt").reverse().toArray()
+  );
 
   let title = "";
 
@@ -119,7 +121,12 @@ Use it in your Svelte 5 components (using your preferred Dexie reactivity hook,
 
 <input bind:value={title} onkeydown={(e) => e.key === 'Enter' && addTodo()} />
 
-{#each ($todos || []) as todo (todo.id)}
+{#if todosQuery.isLoading}
+  <p>Loading...</p>
+{:else if todosQuery.error}
+  <p>Failed to load todos.</p>
+{:else}
+  {#each (todosQuery.data || []) as todo (todo.id)}
   <div>
     <button onclick={() => sync.todos.update(todo.id, { completed: !todo.completed })}>
       <Check class={todo.completed ? "text-emerald-500" : ""} />
@@ -127,9 +134,25 @@ Use it in your Svelte 5 components (using your preferred Dexie reactivity hook,
     <span>{todo.title}</span>
     <button onclick={() => sync.todos.delete(todo.id)}><Trash /></button>
   </div>
-{/each}
+  {/each}
+{/if}
+```
+
+`createLiveQuery` accepts a Dexie query function and an optional dependency getter. When any dependency changes, the live query is recreated with the latest reactive values:
+
+```typescript
+const query = createLiveQuery(
+  () => sync.todos.where("completed").equals(false).toArray(),
+  () => [filterValue]
+);
+
+query.data;
+query.isLoading;
+query.error;
 ```
 
+You can import it from either `@sveltebase/sync/client` or the root `@sveltebase/sync` entrypoint.
+
 ### Synced Database Operations
 
 Under the hood, `@sveltebase/sync` intercepts native Dexie table writes to capture and propagate mutations to the backend. The following methods automatically sync with the server:
@@ -324,6 +347,41 @@ async function getSession(ctx: SyncContext) {
 }
 ```
 
+### Connection Auth (`ctx.auth`)
+Sveltebase Sync can resolve and store an authenticated app payload during the WebSocket handshake. The resolved payload is passed to every sync handler as `ctx.auth`.
+
+```typescript
+// src/routes/api/sync/+server.ts
+import { JWT_SECRET } from "$env/static/private";
+import { getVerifiedUserFromRequest } from "@sveltebase/auth";
+import { handleUpgrade } from "@sveltebase/sync";
+import type { User } from "$lib/server/db/schema";
+import type { RequestHandler } from "@sveltejs/kit";
+
+export const GET: RequestHandler = (event) => {
+  return handleUpgrade(event.request, event.platform, {
+    auth: async (request) => {
+      const user = await getVerifiedUserFromRequest<User>(
+        request,
+        JWT_SECRET
+      );
+
+      return user ? { user } : null;
+    },
+    identity: (auth) => auth.user.id,
+    allowUnauthenticated: false
+  });
+};
+```
+
+After this, every handler can access the user object:
+
+```typescript
+ctx.auth?.user;
+```
+
+The `identity` function returns the stable string/number key used by scoped broadcasts. If omitted, Sync defaults to `auth.user.id` when present. Existing `userId` query parameter and `x-user-id` header identity are still supported as legacy fallback, but should not be used as the primary auth mechanism for private data.
+
 ---
 
 ### The `authorize` Hook
@@ -350,7 +408,8 @@ Use the handshake HTTP request (`ctx.request`) to dynamically filter the records
 ```typescript
 fetch: async (ctx, since) => {
   const db = getDB(ctx.platform);
-  const user = await getSession(ctx);
+  const user = ctx.auth?.user;
+  if (!user) return [];
 
   let query = db.select().from(todos);
   const conditions = [];
@@ -393,12 +452,16 @@ create: async (ctx, data) => {
 },
 
 update: async (ctx, key, changes) => {
-  const user = await getSession(ctx);
+  const user = ctx.auth?.user;
+  if (!user) {
+    throw new Error("Unauthorized");
+  }
+
   const db = getDB(ctx.platform);
 
   // Fetch target record to verify ownership
   const [record] = await db.select().from(todos).where(eq(todos.id, key));
-  if (record.ownerId !== user.userId && user.role !== "admin") {
+  if (record.ownerId !== user.id && user.role !== "admin") {
     throw new Error("You cannot update a record owned by someone else.");
   }
 
@@ -456,35 +519,35 @@ export const todoSync = defineSync<Todo>({
 ```
 
 #### How Connection Identities are Registered
-The broker matches the user IDs returned by `scope` to each active client's socket state. The server registers the connection's identity during the handshake using query parameters or the `x-user-id` header:
-```typescript
-const userId = url.searchParams.get("userId") || request.headers.get("x-user-id");
-```
+The broker matches the IDs returned by `scope` to each active connection's registered identity. That identity is resolved during the WebSocket handshake with the `identity` option on `handleUpgrade`.
 
 ##### Authenticating using SvelteKit Sessions & Cookies (Recommended)
-Instead of exposing user IDs in client-side WebSocket URLs, you can resolve the user session on the server inside your SvelteKit route (`+server.ts`) and inject the verified `x-user-id` header before calling `handleUpgrade()`:
+Resolve the user session on the server inside your SvelteKit route (`+server.ts`) and return the full user object as connection auth:
 
 ```typescript
 // src/routes/api/sync/+server.ts
+import { JWT_SECRET } from "$env/static/private";
+import { getVerifiedUserFromRequest } from "@sveltebase/auth";
 import { handleUpgrade } from "@sveltebase/sync";
+import type { User } from "$lib/server/db/schema";
 import type { RequestEvent, RequestHandler } from "@sveltejs/kit";
 
-export const GET: RequestHandler = (event: RequestEvent) => {
-  // 1. Get user identity from your custom server-side session/cookies
-  const user = event.locals.user; // e.g., set by your auth hook middleware
-  if (!user) {
-    return new Response("Unauthorized", { status: 401 });
-  }
-
-  // 2. Clone the request and inject the verified user ID header
-  const request = new Request(event.request);
-  request.headers.set("x-user-id", user.id);
+export const GET: RequestHandler = async (event: RequestEvent) => {
+  return handleUpgrade(event.request, event.platform, {
+    auth: async (request) => {
+      const user = await getVerifiedUserFromRequest<User>(
+        request,
+        JWT_SECRET
+      );
 
-  // 3. Hand off to the sync engine
-  return handleUpgrade(request, event.platform);
+      return user ? { user } : null;
+    },
+    identity: (auth) => auth.user.id,
+    allowUnauthenticated: false
+  });
 };
 ```
-This approach keeps WebSocket URLs clean of private IDs and ensures all active sockets are automatically authenticated with their verified session roles/IDs.
+This approach keeps WebSocket URLs clean of private IDs, makes `ctx.auth.user` available to your sync handlers, and gives the broker a stable identity for `scope` filtering.
 
 ---
 
@@ -520,6 +583,3 @@ await publish("todos", "delete", todo.id, undefined);
 // 4. Supports scoped/dynamic channels (e.g. "channelName:scopeId")
 await publish("todos:user_123", "update", todo.id, { title: "New Title" });
 ```
-
-
-

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { SyncClient, createLiveQuery } from "./client/index.js";
 export type { LiveQueryState } from "./client/index.js";
 export { defineSync } from "./server/index.js";
 export { handleUpgrade, publishEvent, publishBulkEvent, createPublisher, createBulkPublisher } from "./server/handler.js";
-export type { PublishEventData, InferSchemaFromHandlers } from "./server/handler.js";
-export type { SyncContext, SyncHandler } from "./server/index.js";
+export type { PublishEventData, InferSchemaFromHandlers, SyncAuthResult, SyncUpgradeOptions } from "./server/handler.js";
+export type { SyncConnectionAuth, SyncContext, SyncHandler } from "./server/index.js";
 export type { SyncMessage } from "./protocol.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1H,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACrF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAClE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1H,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzH,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACtF,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC"}

package/dist/server/broker.d.ts

@@ -4,6 +4,8 @@ export interface ISyncConnection {
     close(code?: number, reason?: string): void;
     getAuth(): any;
     setAuth(auth: any): void;
+    getIdentity(): string | null;
+    setIdentity(identity: string | null): void;
     getSubscribedChannels(): Set<string>;
     readonly headers: Headers;
     readonly url: string;
@@ -11,8 +13,7 @@ export interface ISyncConnection {
 export declare class SyncBroker {
     private handlers;
     private connections;
-    private authorizeConnection?;
-    constructor(handlers: SyncHandler[], authorizeConnection?: (request: Request, platform: App.Platform | undefined) => Promise<any>);
+    constructor(handlers: SyncHandler[]);
     setHandlers(handlers: SyncHandler[]): void;
     registerConnection(conn: ISyncConnection): void;
     removeConnection(conn: ISyncConnection): void;

package/dist/server/broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../src/server/broker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,YAAY,CAAC;AAG3D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,OAAO,IAAI,GAAG,CAAC;IACf,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,qBAAqB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,mBAAmB,CAAC,CAGV;gBAGhB,QAAQ,EAAE,WAAW,EAAE,EACvB,mBAAmB,CAAC,EAAE,CACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,SAAS,KAC/B,OAAO,CAAC,GAAG,CAAC;IAOZ,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE;IAanC,kBAAkB,CAAC,IAAI,EAAE,eAAe;IAIxC,gBAAgB,CAAC,IAAI,EAAE,eAAe;IAI7C;;OAEG;IACH,OAAO,CAAC,WAAW;IAqCN,aAAa,CACxB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,SAAS,EAClC,OAAO,EAAE,OAAO;YA0IJ,eAAe;IAoDhB,oBAAoB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACtC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,GAAG;IAqBE,yBAAyB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;CAkBvF"}
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../src/server/broker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,YAAY,CAAC;AAG3D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,OAAO,IAAI,GAAG,CAAC;IACf,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAC3C,qBAAqB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,WAAW,CAAmC;gBAE1C,QAAQ,EAAE,WAAW,EAAE;IAK5B,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE;IAanC,kBAAkB,CAAC,IAAI,EAAE,eAAe;IAIxC,gBAAgB,CAAC,IAAI,EAAE,eAAe;IAI7C;;OAEG;IACH,OAAO,CAAC,WAAW;IAqCN,aAAa,CACxB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,SAAS,EAClC,OAAO,EAAE,OAAO;YA0IJ,eAAe;IAmDhB,oBAAoB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACtC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,GAAG;IAqBE,yBAAyB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;CAkBvF"}

package/dist/server/broker.js

@@ -2,11 +2,9 @@ import { parseSyncMessage } from "../protocol.js";
 export class SyncBroker {
     handlers;
     connections = new Set();
-    authorizeConnection;
-    constructor(handlers, authorizeConnection) {
+    constructor(handlers) {
         this.handlers = new Map();
         this.setHandlers(handlers);
-        this.authorizeConnection = authorizeConnection;
     }
     setHandlers(handlers) {
         this.handlers.clear();
@@ -194,8 +192,7 @@ export class SyncBroker {
             }
             // Filter based on scope
             if (allowedUserIds !== "all") {
-                const connAuth = conn.getAuth();
-                const userId = connAuth?.userId;
+                const userId = conn.getIdentity();
                 if (!userId || !allowedUserIds.includes(userId)) {
                     continue;
                 }

package/dist/server/dev-engine.d.ts

@@ -1,11 +1,12 @@
 import type { SyncHandler } from "./index.js";
+import type { SyncUpgradeOptions } from "./handler.js";
 import type { IncomingMessage } from "node:http";
 export declare function setHandlers(handlers: SyncHandler[]): void;
 export declare function addClient(ws: {
     send: (data: string) => void;
     close: (code?: number, reason?: string) => void;
     on: (event: string, listener: (...args: any[]) => void) => void;
-}, req: IncomingMessage): void;
+}, req: IncomingMessage, options?: SyncUpgradeOptions): Promise<boolean>;
 export declare function broadcastExternalChange(channel: string, action: "create" | "update" | "delete", key: string | undefined, data: any): Promise<void>;
 export declare function broadcastExternalBatchChange(channel: string, changes: Array<{
     action: "create" | "update" | "delete";

package/dist/server/dev-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-engine.d.ts","sourceRoot":"","sources":["../../src/server/dev-engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAUjD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,QASlD;AAcD,wBAAgB,SAAS,CACvB,EAAE,EAAE;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,KAAK,IAAI,CAAC;CACjE,EACD,GAAG,EAAE,eAAe,QA+ErB;AAyBD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACtC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,GAAG,iBAIV;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC,iBAIH"}
+{"version":3,"file":"dev-engine.d.ts","sourceRoot":"","sources":["../../src/server/dev-engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAUjD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,QASlD;AAcD,wBAAsB,SAAS,CAC7B,EAAE,EAAE;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,KAAK,IAAI,CAAC;CACjE,EACD,GAAG,EAAE,eAAe,EACpB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAwHlB;AAyBD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACtC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,GAAG,iBAIV;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC,iBAIH"}

package/dist/server/dev-engine.js

@@ -22,10 +22,11 @@ function getDevBroker() {
     }
     throw new Error("Sync dev broker not initialized. Call setHandlers first.");
 }
-export function addClient(ws, req) {
+export async function addClient(ws, req, options) {
     const broker = getDevBroker();
     const subscribedChannels = new Set();
     let auth = null;
+    let identity = null;
     // Convert Node IncomingMessage headers to web-standard Headers
     const headers = new Headers();
     for (const [key, value] of Object.entries(req.headers)) {
@@ -41,11 +42,29 @@ export function addClient(ws, req) {
         }
     }
     const urlObj = new URL(req.url ?? "", `http://${req.headers.host || "localhost"}`);
-    // Align with DO behavior to set local dev auth
-    const userId = urlObj.searchParams.get("userId") || headers.get("x-user-id");
-    if (userId) {
-        auth = { userId };
-    }
+    const initConnection = async () => {
+        const request = new Request(urlObj.toString(), { headers });
+        if (options?.auth) {
+            auth = (await options.auth(request, undefined)) ?? null;
+            if (!auth && options.allowUnauthenticated === false) {
+                ws.close(1008, "Unauthorized");
+                return false;
+            }
+            if (auth) {
+                const identityValue = options.identity
+                    ? options.identity(auth)
+                    : (auth?.user?.id ?? auth?.userId);
+                identity = identityValue == null ? null : String(identityValue);
+            }
+        }
+        // Legacy fallback for existing demos/apps that pass identity in URL/header.
+        const userId = urlObj.searchParams.get("userId") || headers.get("x-user-id");
+        if (userId && !auth) {
+            auth = { userId };
+            identity = userId;
+        }
+        return true;
+    };
     const conn = {
         send(data) {
             ws.send(data);
@@ -59,14 +78,33 @@ export function addClient(ws, req) {
         setAuth(newAuth) {
             auth = newAuth;
         },
+        getIdentity() {
+            return identity;
+        },
+        setIdentity(newIdentity) {
+            identity = newIdentity;
+        },
         getSubscribedChannels() {
             return subscribedChannels;
         },
         headers,
         url: urlObj.toString(),
     };
-    broker.registerConnection(conn);
-    console.log("dev-engine: addClient registered connection");
+    try {
+        const ok = await initConnection();
+        if (!ok)
+            return false;
+        broker.registerConnection(conn);
+        console.log("dev-engine: addClient registered connection");
+    }
+    catch (err) {
+        console.error("dev-engine: Error initializing connection:", err);
+        try {
+            ws.close(1011, "Internal server error");
+        }
+        catch { }
+        return false;
+    }
     ws.on("message", async (data) => {
         const messageString = String(data);
         console.log("dev-engine: WebSocket message received:", messageString.slice(0, 100));
@@ -92,6 +130,7 @@ export function addClient(ws, req) {
         console.error("dev-engine: WebSocket connection error:", err);
         broker.removeConnection(conn);
     });
+    return true;
 }
 const GLOBAL_PLATFORM_KEY = "__sync_dev_platform__";
 async function getPlatform() {

package/dist/server/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/server/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AA4C/D,qBAAa,cAAe,SAAQ,aAAa,CAAC,GAAG,CAAC;IACpD,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC;IAC7B,OAAO,CAAC,OAAO,CAAkD;gBAErD,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;IAKxD,KAAK,CAAC,OAAO,EAAE,OAAO;IAoC5B,OAAO,CAAC,gBAAgB;IA2BlB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW;IAiBnE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAa1D,cAAc,CAAC,EAAE,EAAE,SAAS;CAO7B"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/server/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AAqE/D,qBAAa,cAAe,SAAQ,aAAa,CAAC,GAAG,CAAC;IACpD,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC;IAC7B,OAAO,CAAC,OAAO,CAAkD;gBAErD,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;IAKxD,KAAK,CAAC,OAAO,EAAE,OAAO;IAoC5B,OAAO,CAAC,gBAAgB;IAoClB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW;IAiBnE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAa1D,cAAc,CAAC,EAAE,EAAE,SAAS;CAO7B"}

package/dist/server/engine.js

@@ -1,8 +1,20 @@
 import { DurableObject } from "cloudflare:workers";
 import { SyncBroker } from "./broker.js";
+import { INTERNAL_AUTH_HEADER } from "./handler.js";
+function deserializeConnectionAuth(value) {
+    if (!value)
+        return null;
+    try {
+        return JSON.parse(decodeURIComponent(escape(atob(value))));
+    }
+    catch {
+        return null;
+    }
+}
 class CloudflareSyncConnection {
     ws;
     auth = null;
+    identity = null;
     subscribedChannels = new Set();
     headers;
     url;
@@ -33,6 +45,12 @@ class CloudflareSyncConnection {
     setAuth(newAuth) {
         this.auth = newAuth;
     }
+    getIdentity() {
+        return this.identity;
+    }
+    setIdentity(identity) {
+        this.identity = identity;
+    }
     getSubscribedChannels() {
         return this.subscribedChannels;
     }
@@ -84,10 +102,16 @@ export class SyncEngineBase extends DurableObject {
         const [client, server] = Object.values(new WebSocketPair());
         this.ctx.acceptWebSocket(server);
         const conn = new CloudflareSyncConnection(server, request);
+        const forwardedAuth = deserializeConnectionAuth(request.headers.get(INTERNAL_AUTH_HEADER));
+        if (forwardedAuth) {
+            conn.setAuth(forwardedAuth.auth);
+            conn.setIdentity(forwardedAuth.identity);
+        }
         const url = new URL(request.url);
         const userId = url.searchParams.get("userId") || request.headers.get("x-user-id");
-        if (userId) {
+        if (userId && !conn.getAuth()) {
             conn.setAuth({ userId });
+            conn.setIdentity(userId);
         }
         this.connMap.set(server, conn);
         this.broker.registerConnection(conn);

package/dist/server/handler.d.ts

@@ -1,4 +1,23 @@
 import type { SyncHandler } from "./index.js";
+export type SyncAuthResult<TAuth> = TAuth | null | undefined;
+export type SyncUpgradeOptions<TAuth = any> = {
+    /**
+     * Resolves the authenticated app payload for this WebSocket connection.
+     * Return null/undefined when no session is present.
+     */
+    auth?: (request: Request, platform: App.Platform | undefined) => Promise<SyncAuthResult<TAuth>> | SyncAuthResult<TAuth>;
+    /**
+     * Returns the stable identity key used by scope filtering.
+     * Defaults to auth.user.id when available, then auth.userId for legacy payloads.
+     */
+    identity?: (auth: TAuth) => string | number | bigint | null | undefined;
+    /**
+     * Defaults to true so existing public channels continue to work.
+     * Set false to reject WebSocket upgrades without a resolved auth payload.
+     */
+    allowUnauthenticated?: boolean;
+};
+declare const INTERNAL_AUTH_HEADER = "x-sveltebase-sync-auth";
 export type PublishEventData<TRecord, TAction extends "create" | "update" | "delete"> = TAction extends "create" ? TRecord : TAction extends "update" ? Partial<TRecord> : {
     updatedAt?: string;
 } | undefined;
@@ -23,5 +42,6 @@ export declare function publishBulkEvent(channel: string, changes: Array<{
     key?: string;
     data?: any;
 }>): Promise<void>;
-export declare function handleUpgrade(request: Request, platform: App.Platform | undefined): Promise<Response>;
+export declare function handleUpgrade<TAuth = any>(request: Request, platform: App.Platform | undefined, options?: SyncUpgradeOptions<TAuth>): Promise<Response>;
+export { INTERNAL_AUTH_HEADER };
 //# sourceMappingURL=handler.d.ts.map

package/dist/server/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/server/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,SAAS,QAAQ,GAAG,QAAQ,GAAG,QAAQ,IAClF,OAAO,SAAS,QAAQ,GACpB,OAAO,GACP,OAAO,SAAS,QAAQ,GACtB,OAAO,CAAC,OAAO,CAAC,GAChB;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAE3C,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,WAAW,EAAE,IAAI;KAC5D,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,MAAM,GACpD,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,GACtB,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,MAAM,CAAC,GACxD,CAAC,SAAS,MAAM,GACd,CAAC,GACD,MAAM,GACR,MAAM,GAAG,CAAC,SAAS,WAAW,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK;CAChE,CAAC;AAEF,wBAAgB,eAAe,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CACtE,QAAQ,SAAS,MAAM,OAAO,GAAG,MAAM,EACvC,OAAO,SAAS,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAE9C,OAAO,EAAE,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,EAC3C,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,KAC/C,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAgB,eAAe,CAAC,SAAS,SAAS,WAAW,EAAE,EAC7D,QAAQ,EAAE,SAAS,GAClB,CACD,QAAQ,SAAS,MAAM,uBAAuB,CAAC,SAAS,CAAC,GAAG,MAAM,EAClE,OAAO,SAAS,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAE9C,OAAO,EAAE,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,EAC3C,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,KAC1E,OAAO,CAAC,IAAI,CAAC,CAAC;AAcnB,wBAAgB,mBAAmB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAC1E,QAAQ,SAAS,MAAM,OAAO,GAAG,MAAM,EAEvC,OAAO,EAAE,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,EAC3C,OAAO,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC,KACC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAgB,mBAAmB,CAAC,SAAS,SAAS,WAAW,EAAE,EACjE,QAAQ,EAAE,SAAS,GAClB,CACD,QAAQ,SAAS,MAAM,uBAAuB,CAAC,SAAS,CAAC,GAAG,MAAM,EAElE,OAAO,EAAE,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,EAC3C,OAAO,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC,KACC,OAAO,CAAC,IAAI,CAAC,CAAC;AAgBnB,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACtC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,GAAG,iBA4CV;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC,iBA4CH;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,SAAS,GACjC,OAAO,CAAC,QAAQ,CAAC,CAqBnB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/server/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,cAAc,CAAC,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,SAAS,CAAC;AAE7D,MAAM,MAAM,kBAAkB,CAAC,KAAK,GAAG,GAAG,IAAI;IAC5C;;;OAGG;IACH,IAAI,CAAC,EAAE,CACL,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,SAAS,KAC/B,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5D;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxE;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,QAAA,MAAM,oBAAoB,2BAA2B,CAAC;AAiBtD,MAAM,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,SAAS,QAAQ,GAAG,QAAQ,GAAG,QAAQ,IAClF,OAAO,SAAS,QAAQ,GACpB,OAAO,GACP,OAAO,SAAS,QAAQ,GACtB,OAAO,CAAC,OAAO,CAAC,GAChB;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAE3C,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,WAAW,EAAE,IAAI;KAC5D,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,MAAM,GACpD,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,GACtB,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,MAAM,CAAC,GACxD,CAAC,SAAS,MAAM,GACd,CAAC,GACD,MAAM,GACR,MAAM,GAAG,CAAC,SAAS,WAAW,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK;CAChE,CAAC;AAEF,wBAAgB,eAAe,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CACtE,QAAQ,SAAS,MAAM,OAAO,GAAG,MAAM,EACvC,OAAO,SAAS,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAE9C,OAAO,EAAE,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,EAC3C,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,KAC/C,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAgB,eAAe,CAAC,SAAS,SAAS,WAAW,EAAE,EAC7D,QAAQ,EAAE,SAAS,GAClB,CACD,QAAQ,SAAS,MAAM,uBAAuB,CAAC,SAAS,CAAC,GAAG,MAAM,EAClE,OAAO,SAAS,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAE9C,OAAO,EAAE,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,EAC3C,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,KAC1E,OAAO,CAAC,IAAI,CAAC,CAAC;AAcnB,wBAAgB,mBAAmB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAC1E,QAAQ,SAAS,MAAM,OAAO,GAAG,MAAM,EAEvC,OAAO,EAAE,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,EAC3C,OAAO,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC,KACC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAgB,mBAAmB,CAAC,SAAS,SAAS,WAAW,EAAE,EACjE,QAAQ,EAAE,SAAS,GAClB,CACD,QAAQ,SAAS,MAAM,uBAAuB,CAAC,SAAS,CAAC,GAAG,MAAM,EAElE,OAAO,EAAE,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,EAC3C,OAAO,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC,KACC,OAAO,CAAC,IAAI,CAAC,CAAC;AAgBnB,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACtC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,GAAG,iBA4CV;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC,iBA4CH;AAED,wBAAsB,aAAa,CAAC,KAAK,GAAG,GAAG,EAC7C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,SAAS,EAClC,OAAO,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CAoDnB;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/server/handler.js

@@ -1,3 +1,12 @@
+const INTERNAL_AUTH_HEADER = "x-sveltebase-sync-auth";
+function defaultIdentity(auth) {
+    const value = auth?.user?.id ?? auth?.userId;
+    return value == null ? null : String(value);
+}
+function serializeConnectionAuth(auth, identity) {
+    const payload = { auth, identity };
+    return btoa(unescape(encodeURIComponent(JSON.stringify(payload))));
+}
 export function createPublisher(handlers) {
     return async (channel, action, key, data) => {
         const resolvedChannel = String(channel);
@@ -92,7 +101,7 @@ export async function publishBulkEvent(channel, changes) {
         console.error("Failed to publish bulk sync event to Durable Object:", err);
     }
 }
-export async function handleUpgrade(request, platform) {
+export async function handleUpgrade(request, platform, options) {
     if (request.headers.get("Upgrade") !== "websocket") {
         return new Response("Expected Upgrade: websocket", { status: 426 });
     }
@@ -101,9 +110,31 @@ export async function handleUpgrade(request, platform) {
         return new Response("SyncEngine binding is not available", { status: 500 });
     }
     try {
+        let resolvedAuth = null;
+        let identity = null;
+        if (options?.auth) {
+            resolvedAuth = (await options.auth(request, platform)) ?? null;
+            if (!resolvedAuth && options.allowUnauthenticated === false) {
+                return new Response("Unauthorized", { status: 401 });
+            }
+            if (resolvedAuth) {
+                const identityValue = options.identity
+                    ? options.identity(resolvedAuth)
+                    : defaultIdentity(resolvedAuth);
+                identity = identityValue == null ? null : String(identityValue);
+            }
+        }
+        const forwardedRequest = new Request("https://realtime.internal/websocket", request);
+        forwardedRequest.headers.delete(INTERNAL_AUTH_HEADER);
+        if (resolvedAuth) {
+            forwardedRequest.headers.set(INTERNAL_AUTH_HEADER, serializeConnectionAuth(resolvedAuth, identity));
+        }
+        else if (options?.auth) {
+            forwardedRequest.headers.delete(INTERNAL_AUTH_HEADER);
+        }
         const id = namespace.idFromName("global");
         const stub = namespace.get(id);
-        return await stub.fetch(new Request("https://realtime.internal/websocket", request));
+        return await stub.fetch(forwardedRequest);
     }
     catch (err) {
         return new Response(err.message || "SyncEngine binding is not available", {
@@ -111,3 +142,4 @@ export async function handleUpgrade(request, platform) {
         });
     }
 }
+export { INTERNAL_AUTH_HEADER };

package/dist/server/index.d.ts

@@ -1,25 +1,28 @@
 import type { ZodSchema } from "zod";
-export type SyncContext = {
+export type SyncConnectionAuth<TUser = unknown> = {
+    user: TUser;
+};
+export type SyncContext<TAuth = any> = {
     platform: App.Platform | undefined;
     request: Request;
-    auth?: any;
+    auth: TAuth | null;
 };
-export type SyncHandlerConfig<TRow = any> = {
-    channel: string | ((ctx: SyncContext) => string);
-    fetch: (ctx: SyncContext, since?: string) => Promise<TRow[]>;
-    create?: (ctx: SyncContext, data: TRow) => Promise<TRow>;
-    update?: (ctx: SyncContext, key: string, changes: Partial<TRow>) => Promise<TRow>;
-    delete?: (ctx: SyncContext, key: string) => Promise<void>;
-    authorize?: (ctx: SyncContext) => Promise<void>;
+export type SyncHandlerConfig<TRow = any, TAuth = any> = {
+    channel: string | ((ctx: SyncContext<TAuth>) => string);
+    fetch: (ctx: SyncContext<TAuth>, since?: string) => Promise<TRow[]>;
+    create?: (ctx: SyncContext<TAuth>, data: TRow) => Promise<TRow>;
+    update?: (ctx: SyncContext<TAuth>, key: string, changes: Partial<TRow>) => Promise<TRow>;
+    delete?: (ctx: SyncContext<TAuth>, key: string) => Promise<void>;
+    authorize?: (ctx: SyncContext<TAuth>) => Promise<void>;
     validate?: {
         create?: ZodSchema<any>;
         update?: ZodSchema<any>;
     };
-    scope?: (ctx: SyncContext, action: "create" | "update" | "delete", data: TRow) => Promise<string[] | "all"> | string[] | "all";
+    scope?: (ctx: SyncContext<TAuth>, action: "create" | "update" | "delete", data: TRow) => Promise<string[] | "all"> | string[] | "all";
 };
-export interface SyncHandler<TRow = any> {
-    config: SyncHandlerConfig<TRow>;
-    resolveChannel(ctx: SyncContext): string;
+export interface SyncHandler<TRow = any, TAuth = any> {
+    config: SyncHandlerConfig<TRow, TAuth>;
+    resolveChannel(ctx: SyncContext<TAuth>): string;
 }
-export declare function defineSync<TRow = any>(config: SyncHandlerConfig<TRow>): SyncHandler<TRow>;
+export declare function defineSync<TRow = any, TAuth = any>(config: SyncHandlerConfig<TRow, TAuth>): SyncHandler<TRow, TAuth>;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAErC,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,IAAI,GAAG,GAAG,IAAI;IAC1C,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,MAAM,CAAC,CAAC;IACjD,KAAK,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;KACzB,CAAC;IACF,KAAK,CAAC,EAAE,CACN,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACtC,IAAI,EAAE,IAAI,KACP,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;CACnD,CAAC;AAEF,MAAM,WAAW,WAAW,CAAC,IAAI,GAAG,GAAG;IACrC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAChC,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC;CAC1C;AAED,wBAAgB,UAAU,CAAC,IAAI,GAAG,GAAG,EACnC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAC9B,WAAW,CAAC,IAAI,CAAC,CASnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAErC,MAAM,MAAM,kBAAkB,CAAC,KAAK,GAAG,OAAO,IAAI;IAChD,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,KAAK,GAAG,GAAG,IAAI;IACrC,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,IAAI,GAAG,GAAG,EAAE,KAAK,GAAG,GAAG,IAAI;IACvD,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC;IACxD,KAAK,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,EACvB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;KACzB,CAAC;IACF,KAAK,CAAC,EAAE,CACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,EACvB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACtC,IAAI,EAAE,IAAI,KACP,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;CACnD,CAAC;AAEF,MAAM,WAAW,WAAW,CAAC,IAAI,GAAG,GAAG,EAAE,KAAK,GAAG,GAAG;IAClD,MAAM,EAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;CACjD;AAED,wBAAgB,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,KAAK,GAAG,GAAG,EAChD,MAAM,EAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,GACrC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAS1B"}

package/dist/vite.d.ts

@@ -1,6 +1,10 @@
 import type { Plugin } from "vite";
+import type { SyncUpgradeOptions } from "./server/handler.js";
 export type SyncDevPluginOptions = {
     handlersPath?: string;
+    auth?: SyncUpgradeOptions["auth"];
+    identity?: SyncUpgradeOptions["identity"];
+    allowUnauthenticated?: SyncUpgradeOptions["allowUnauthenticated"];
 };
 export declare function syncDevPlugin(options?: SyncDevPluginOptions): Plugin;
 //# sourceMappingURL=vite.d.ts.map

package/dist/vite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite.d.ts","sourceRoot":"","sources":["../src/vite.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAanC,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM,CA4EpE"}
+{"version":3,"file":"vite.d.ts","sourceRoot":"","sources":["../src/vite.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAa9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;CACnE,CAAC;AAEF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAwFpE"}

package/dist/vite.js

@@ -32,7 +32,14 @@ export function syncDevPlugin(options) {
                             // Remove temporary buffering listener
                             client.off("message", onMessage);
                             // Register client in the dev engine
-                            devEngine.addClient(client, request);
+                            const connected = await devEngine.addClient(client, request, {
+                                auth: options?.auth,
+                                identity: options?.identity,
+                                allowUnauthenticated: options?.allowUnauthenticated,
+                            });
+                            if (!connected) {
+                                return;
+                            }
                             console.log("sync-dev-plugin: WebSocket upgrade handler completed, replaying buffered messages:", messageQueue.length);
                             // Replay any buffered messages
                             for (const msg of messageQueue) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sveltebase/sync",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "type": "module",
   "publishConfig": {
     "access": "public"