Cloudflare setup

The Cloudflare host runs Lime Sync’s Rust/WASM engine inside a SQLite Durable Object. It replaces the zero-cache deployment. The browser still runs the real @rocicorp/zero client, and the application still exposes its ordinary Zero query and mutate endpoints.

Server boundary

The host package exports createSyncWorker and createSyncDurableObject. Application-specific server configuration supplies:

• the Zero schema and replica DDL;
• authentication and namespace resolution;
• authorization for wake sockets, upstream notifications, and admin routes;
• the existing application query and mutate endpoints;
• a change feed from the authoritative database.

real Zero client ── Zero protocol ──→ Lime Sync
                                         │
                         query and mutate│requests
                                         ▼
                                  application server
                                         │
                                  authoritative writes
                                         ▼
                              database change feed ──→ Lime Sync replica

Lime Sync forwards authenticated query and mutation work to the application rather than copying application logic into the sync host. Committed rows return through the database change feed.

Client connection

Install the orez-lite/client transport with the deployed Lime Sync address, then set the existing Zero client’s server to that address. Components keep using the same @rocicorp/zero queries, mutators, hooks, and optimistic local state. The standard transport polls every five minutes. Applications whose sync host implements the wake route opt in with wake: true, which carries Zero’s existing auth and triggers immediate pulls after changes.

Namespaces and authorization

A namespace is a storage and ordering boundary, commonly an organization or project. It is not an authorization mechanism. The outer Worker must authenticate requests before selecting a Durable Object, and the application must still authorize every query and mutation.

Wake sockets and upstream notifications are fail-closed. Consumers must provide authorizeWake and authorizeNotify; rejected requests do not instantiate a namespace Durable Object. These APIs are exported from orez-lite/cloudflare/sync; applications do not install the internal host package separately.

Deployment status

The public integration uses a service binding for application queries and mutations plus a change feed from the authoritative data service. Packaging the consumer adapter and stable configuration surface is still in progress, so the host remains preview.

Application code should not depend on Lime Sync’s internal query AST, replication cursor, Durable Object schema, or cache invalidation tables. Those are server implementation details.

Next steps

1. Read Architecture.
2. Review Operations.
3. Read Limitations before a production rollout.