@lunora/client 1.0.0-alpha.111 → 1.0.0-alpha.112

package/dist/auth/index.d.mts

@@ -1,4 +1,4 @@
-import { U as User, L as LunoraClient } from "../packem_shared/lunora-client.d-C5TLiIgW.mjs";
+import { U as User, L as LunoraClient } from "../packem_shared/lunora-client.d-ttQV7mmy.mjs";
 import '@lunora/errors';
 import "../packem_shared/function-reference.d-Br_hsKje.mjs";
 import '@lunora/runtime';

package/dist/auth/index.d.ts

@@ -1,4 +1,4 @@
-import { U as User, L as LunoraClient } from "../packem_shared/lunora-client.d-BwJZfgUs.js";
+import { U as User, L as LunoraClient } from "../packem_shared/lunora-client.d-3WSiNC8L.js";
 import '@lunora/errors';
 import "../packem_shared/function-reference.d-Br_hsKje.js";
 import '@lunora/runtime';

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { c as PersistenceAdapter, Q as QueryCacheAdapter, B as BookmarkStorage, C as ConnectionStatus, S as SubscriptionError, H as HttpStreamRef, d as HttpStreamArgsOf, e as HttpStreamChunkOf, f as StreamIterable, O as OfflineQueueOptions, R as ReconnectOptions, L as LunoraClient } from "./packem_shared/lunora-client.d-C5TLiIgW.mjs";
-export { type A as ActionCallOptions, type g as BatchSlot, type h as CachedQuery, type i as ClientDebugShard, type j as ClientDebugSnapshot, type k as ClientDebugSubscription, type l as ClientMessage, type m as ClientQueryRef, type n as ClientShapeSubscribeMessage, type o as ClientShapeUnsubscribeMessage, D as DEFAULT_MAX_BUFFER, type F as FunctionArgumentDescriptor, type p as FunctionDescriptor, type G as GlobalFacetResult, type q as GlobalFacetValue, type r as GlobalFilterClause, type s as GlobalTableInfo, type t as GlobalTablePage, type u as HttpStreamCallArgs, type v as LunoraClientError, type w as LunoraClientOptions, type M as MutationCallOptions, type x as MutationSettledEvent, type y as OptimisticLocalStore, type z as OptimisticUpdate, type E as OutboxMutation, type I as OutboxSink, type J as PersistedMutation, type P as Preloaded, type K as RowOp, type N as RpcEnvelope, type T as RpcResponseBody, type V as ScheduleRecord, type W as ScheduleRetryPolicy, type X as SchedulerPoolStatus, type Y as SchedulerStatus, type Z as ServerMessage, type _ as ServerPokeEndMessage, type $ as ServerPokePartMessage, type a0 as ServerPokeStartMessage, type a1 as ShardTrafficEntry, type a2 as ShardTrafficResult, type a3 as StorageListPage, type a4 as StorageObject, type a5 as StoredQuery, type a6 as StreamHandle, type a7 as SubscriptionCallback, type b as SubscriptionErrorCallback, a8 as SubscriptionRegistry, type a9 as SubscriptionState, type aa as SyncWatermark, type a as Unsubscribe, type U as User, type ab as WorkflowInstanceAction, type ac as WorkflowInstanceDetail, type ad as WorkflowInstancePage, type ae as WorkflowInstanceStatus, type af as WorkflowInstanceSummary, type ag as WorkflowStepDetail, type ah as WsTokenProvider, ai as createClientQuery, aj as createLocalStore, ak as createStream } from "./packem_shared/lunora-client.d-C5TLiIgW.mjs";
+import { c as PersistenceAdapter, Q as QueryCacheAdapter, B as BookmarkStorage, C as ConnectionStatus, S as SubscriptionError, H as HttpStreamRef, d as HttpStreamArgsOf, e as HttpStreamChunkOf, f as StreamIterable, O as OfflineQueueOptions, R as ReconnectOptions, L as LunoraClient } from "./packem_shared/lunora-client.d-ttQV7mmy.mjs";
+export { type A as ActionCallOptions, type g as BatchSlot, type h as CachedQuery, type i as ClientDebugShard, type j as ClientDebugSnapshot, type k as ClientDebugSubscription, type l as ClientMessage, type m as ClientQueryRef, type n as ClientShapeSubscribeMessage, type o as ClientShapeUnsubscribeMessage, D as DEFAULT_MAX_BUFFER, type F as FunctionArgumentDescriptor, type p as FunctionDescriptor, type G as GlobalFacetResult, type q as GlobalFacetValue, type r as GlobalFilterClause, type s as GlobalTableInfo, type t as GlobalTablePage, type u as HttpStreamCallArgs, type v as LunoraClientError, type w as LunoraClientOptions, type M as MutationCallOptions, type x as MutationSettledEvent, type y as OptimisticLocalStore, type z as OptimisticUpdate, type E as OutboxMutation, type I as OutboxSink, type J as PersistedMutation, type P as Preloaded, type K as RowOp, type N as RpcEnvelope, type T as RpcResponseBody, type V as ScheduleRecord, type W as ScheduleRetryPolicy, type X as SchedulerPoolStatus, type Y as SchedulerStatus, type Z as ServerMessage, type _ as ServerPokeEndMessage, type $ as ServerPokePartMessage, type a0 as ServerPokeStartMessage, type a1 as ShardTrafficEntry, type a2 as ShardTrafficResult, type a3 as StorageListPage, type a4 as StorageObject, type a5 as StoredQuery, type a6 as StreamHandle, type a7 as SubscriptionCallback, type b as SubscriptionErrorCallback, a8 as SubscriptionRegistry, type a9 as SubscriptionState, type aa as SyncWatermark, type a as Unsubscribe, type U as User, type ab as WorkflowInstanceAction, type ac as WorkflowInstanceDetail, type ad as WorkflowInstancePage, type ae as WorkflowInstanceStatus, type af as WorkflowInstanceSummary, type ag as WorkflowStepDetail, type ah as WsTokenProvider, ai as createClientQuery, aj as createLocalStore, ak as createStream } from "./packem_shared/lunora-client.d-ttQV7mmy.mjs";
 import { LunoraError, LunoraErrorCode } from '@lunora/errors';
 export type { LunoraErrorCode } from '@lunora/errors';
-export { p as preloadQuery, a as preloadedQueryResult } from "./packem_shared/preload.d-DIGIWl4r.mjs";
+export { p as preloadQuery, a as preloadedQueryResult } from "./packem_shared/preload.d-DgOIn4HV.mjs";
 import { F as FunctionReference } from "./packem_shared/function-reference.d-Br_hsKje.mjs";
 export type { A as ArgsOf, R as ReturnOf } from "./packem_shared/function-reference.d-Br_hsKje.mjs";
 export type { AuthCapabilities, AuthConfigInfo, AuthImpersonation, AuthPage, AuthSession, AuthUser, AuthUserFieldSpec, CronJobInfo, KvKeyEntry, KvKeyListResult, KvNamespaceSummary, KvValueResult, PipelineLogColumnMap, PipelineLogCursor, PipelineLogField, PipelineLogPage, PipelineLogQuery, PipelineLogRow, VectorIndexSummary, VectorQueryMatch } from '@lunora/runtime';

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { c as PersistenceAdapter, Q as QueryCacheAdapter, B as BookmarkStorage, C as ConnectionStatus, S as SubscriptionError, H as HttpStreamRef, d as HttpStreamArgsOf, e as HttpStreamChunkOf, f as StreamIterable, O as OfflineQueueOptions, R as ReconnectOptions, L as LunoraClient } from "./packem_shared/lunora-client.d-BwJZfgUs.js";
-export { type A as ActionCallOptions, type g as BatchSlot, type h as CachedQuery, type i as ClientDebugShard, type j as ClientDebugSnapshot, type k as ClientDebugSubscription, type l as ClientMessage, type m as ClientQueryRef, type n as ClientShapeSubscribeMessage, type o as ClientShapeUnsubscribeMessage, D as DEFAULT_MAX_BUFFER, type F as FunctionArgumentDescriptor, type p as FunctionDescriptor, type G as GlobalFacetResult, type q as GlobalFacetValue, type r as GlobalFilterClause, type s as GlobalTableInfo, type t as GlobalTablePage, type u as HttpStreamCallArgs, type v as LunoraClientError, type w as LunoraClientOptions, type M as MutationCallOptions, type x as MutationSettledEvent, type y as OptimisticLocalStore, type z as OptimisticUpdate, type E as OutboxMutation, type I as OutboxSink, type J as PersistedMutation, type P as Preloaded, type K as RowOp, type N as RpcEnvelope, type T as RpcResponseBody, type V as ScheduleRecord, type W as ScheduleRetryPolicy, type X as SchedulerPoolStatus, type Y as SchedulerStatus, type Z as ServerMessage, type _ as ServerPokeEndMessage, type $ as ServerPokePartMessage, type a0 as ServerPokeStartMessage, type a1 as ShardTrafficEntry, type a2 as ShardTrafficResult, type a3 as StorageListPage, type a4 as StorageObject, type a5 as StoredQuery, type a6 as StreamHandle, type a7 as SubscriptionCallback, type b as SubscriptionErrorCallback, a8 as SubscriptionRegistry, type a9 as SubscriptionState, type aa as SyncWatermark, type a as Unsubscribe, type U as User, type ab as WorkflowInstanceAction, type ac as WorkflowInstanceDetail, type ad as WorkflowInstancePage, type ae as WorkflowInstanceStatus, type af as WorkflowInstanceSummary, type ag as WorkflowStepDetail, type ah as WsTokenProvider, ai as createClientQuery, aj as createLocalStore, ak as createStream } from "./packem_shared/lunora-client.d-BwJZfgUs.js";
+import { c as PersistenceAdapter, Q as QueryCacheAdapter, B as BookmarkStorage, C as ConnectionStatus, S as SubscriptionError, H as HttpStreamRef, d as HttpStreamArgsOf, e as HttpStreamChunkOf, f as StreamIterable, O as OfflineQueueOptions, R as ReconnectOptions, L as LunoraClient } from "./packem_shared/lunora-client.d-3WSiNC8L.js";
+export { type A as ActionCallOptions, type g as BatchSlot, type h as CachedQuery, type i as ClientDebugShard, type j as ClientDebugSnapshot, type k as ClientDebugSubscription, type l as ClientMessage, type m as ClientQueryRef, type n as ClientShapeSubscribeMessage, type o as ClientShapeUnsubscribeMessage, D as DEFAULT_MAX_BUFFER, type F as FunctionArgumentDescriptor, type p as FunctionDescriptor, type G as GlobalFacetResult, type q as GlobalFacetValue, type r as GlobalFilterClause, type s as GlobalTableInfo, type t as GlobalTablePage, type u as HttpStreamCallArgs, type v as LunoraClientError, type w as LunoraClientOptions, type M as MutationCallOptions, type x as MutationSettledEvent, type y as OptimisticLocalStore, type z as OptimisticUpdate, type E as OutboxMutation, type I as OutboxSink, type J as PersistedMutation, type P as Preloaded, type K as RowOp, type N as RpcEnvelope, type T as RpcResponseBody, type V as ScheduleRecord, type W as ScheduleRetryPolicy, type X as SchedulerPoolStatus, type Y as SchedulerStatus, type Z as ServerMessage, type _ as ServerPokeEndMessage, type $ as ServerPokePartMessage, type a0 as ServerPokeStartMessage, type a1 as ShardTrafficEntry, type a2 as ShardTrafficResult, type a3 as StorageListPage, type a4 as StorageObject, type a5 as StoredQuery, type a6 as StreamHandle, type a7 as SubscriptionCallback, type b as SubscriptionErrorCallback, a8 as SubscriptionRegistry, type a9 as SubscriptionState, type aa as SyncWatermark, type a as Unsubscribe, type U as User, type ab as WorkflowInstanceAction, type ac as WorkflowInstanceDetail, type ad as WorkflowInstancePage, type ae as WorkflowInstanceStatus, type af as WorkflowInstanceSummary, type ag as WorkflowStepDetail, type ah as WsTokenProvider, ai as createClientQuery, aj as createLocalStore, ak as createStream } from "./packem_shared/lunora-client.d-3WSiNC8L.js";
 import { LunoraError, LunoraErrorCode } from '@lunora/errors';
 export type { LunoraErrorCode } from '@lunora/errors';
-export { p as preloadQuery, a as preloadedQueryResult } from "./packem_shared/preload.d-CRo2vOh3.js";
+export { p as preloadQuery, a as preloadedQueryResult } from "./packem_shared/preload.d-BN-4Mxb6.js";
 import { F as FunctionReference } from "./packem_shared/function-reference.d-Br_hsKje.js";
 export type { A as ArgsOf, R as ReturnOf } from "./packem_shared/function-reference.d-Br_hsKje.js";
 export type { AuthCapabilities, AuthConfigInfo, AuthImpersonation, AuthPage, AuthSession, AuthUser, AuthUserFieldSpec, CronJobInfo, KvKeyEntry, KvKeyListResult, KvNamespaceSummary, KvValueResult, PipelineLogColumnMap, PipelineLogCursor, PipelineLogField, PipelineLogPage, PipelineLogQuery, PipelineLogRow, VectorIndexSummary, VectorQueryMatch } from '@lunora/runtime';

package/dist/packem_shared/{lunora-client.d-BwJZfgUs.d.ts → lunora-client.d-3WSiNC8L.d.ts}

@@ -2103,12 +2103,17 @@ declare class LunoraClient {
    * (the default shard when omitted) — use the same shard you target with the
    * matching queries/mutations so members land on the same Durable Object.
    *
-   * Security: whisper topics are NOT access-controlled beyond the shard
-   * boundary — any client that can open a socket to the shard can join, read,
-   * and inject on any topic name. `from` is server-stamped and unforgeable, but
-   * do not put data on a whisper topic that some shard members shouldn't see,
-   * and don't trust a whisper's `data` as authorization. Use a query/mutation
-   * (with RLS) for anything privileged; whispers are for transient awareness.
+   * Security: a whisper topic is access-controlled only if the app declares an
+   * `onWhisper` authorizer server-side (`@lunora/server`). Without one, the
+   * topic's only boundary is the shard — any client that can open a socket to it
+   * can join, read, and inject on any topic name. `from` is server-stamped and
+   * unforgeable either way, but never trust a whisper's `data` as authorization,
+   * and remember that even an authorized topic is transient awareness with no
+   * durable trace: anything privileged belongs behind a query/mutation with RLS.
+   *
+   * A denied join is silent — whispers are never acked, so nothing distinguishes
+   * "denied" from "nobody is whispering". Gate the UI on a query you can read a
+   * verdict from, not on whether whispers arrive.
    *
    * Not available on a `crossTabSync` FOLLOWER tab — whisper frames are not
    * relayed over the cross-tab channel, so this throws `NOT_IMPLEMENTED`
@@ -2130,6 +2135,10 @@ declare class LunoraClient {
    * `crossTabSync` FOLLOWER tab has no socket and never will (see
    * {@link LunoraClientOptions.crossTabSync}), so every whisper from it would
    * be dropped forever — it throws `NOT_IMPLEMENTED` instead.
+   *
+   * A send the app's `onWhisper` authorizer denies is dropped the same silent
+   * way, for the same reason: there is no ack frame to report it on. See
+   * {@link whisperSubscribe} for the security model.
    */
   whisper(topic: string, data?: unknown, options?: {
     shardKey?: string;

package/dist/packem_shared/{lunora-client.d-C5TLiIgW.d.mts → lunora-client.d-ttQV7mmy.d.mts}

@@ -2103,12 +2103,17 @@ declare class LunoraClient {
    * (the default shard when omitted) — use the same shard you target with the
    * matching queries/mutations so members land on the same Durable Object.
    *
-   * Security: whisper topics are NOT access-controlled beyond the shard
-   * boundary — any client that can open a socket to the shard can join, read,
-   * and inject on any topic name. `from` is server-stamped and unforgeable, but
-   * do not put data on a whisper topic that some shard members shouldn't see,
-   * and don't trust a whisper's `data` as authorization. Use a query/mutation
-   * (with RLS) for anything privileged; whispers are for transient awareness.
+   * Security: a whisper topic is access-controlled only if the app declares an
+   * `onWhisper` authorizer server-side (`@lunora/server`). Without one, the
+   * topic's only boundary is the shard — any client that can open a socket to it
+   * can join, read, and inject on any topic name. `from` is server-stamped and
+   * unforgeable either way, but never trust a whisper's `data` as authorization,
+   * and remember that even an authorized topic is transient awareness with no
+   * durable trace: anything privileged belongs behind a query/mutation with RLS.
+   *
+   * A denied join is silent — whispers are never acked, so nothing distinguishes
+   * "denied" from "nobody is whispering". Gate the UI on a query you can read a
+   * verdict from, not on whether whispers arrive.
    *
    * Not available on a `crossTabSync` FOLLOWER tab — whisper frames are not
    * relayed over the cross-tab channel, so this throws `NOT_IMPLEMENTED`
@@ -2130,6 +2135,10 @@ declare class LunoraClient {
    * `crossTabSync` FOLLOWER tab has no socket and never will (see
    * {@link LunoraClientOptions.crossTabSync}), so every whisper from it would
    * be dropped forever — it throws `NOT_IMPLEMENTED` instead.
+   *
+   * A send the app's `onWhisper` authorizer denies is dropped the same silent
+   * way, for the same reason: there is no ack frame to report it on. See
+   * {@link whisperSubscribe} for the security model.
    */
   whisper(topic: string, data?: unknown, options?: {
     shardKey?: string;

package/dist/packem_shared/{preload.d-CRo2vOh3.d.ts → preload.d-BN-4Mxb6.d.ts}

@@ -1,4 +1,4 @@
-import { L as LunoraClient, P as Preloaded } from "./lunora-client.d-BwJZfgUs.js";
+import { L as LunoraClient, P as Preloaded } from "./lunora-client.d-3WSiNC8L.js";
 import { F as FunctionReference, A as ArgsOf, R as ReturnOf } from "./function-reference.d-Br_hsKje.js";
 /**
  * Run a query once on the server (during SSR) and capture its result in a

package/dist/packem_shared/{preload.d-DIGIWl4r.d.mts → preload.d-DgOIn4HV.d.mts}

@@ -1,4 +1,4 @@
-import { L as LunoraClient, P as Preloaded } from "./lunora-client.d-C5TLiIgW.mjs";
+import { L as LunoraClient, P as Preloaded } from "./lunora-client.d-ttQV7mmy.mjs";
 import { F as FunctionReference, A as ArgsOf, R as ReturnOf } from "./function-reference.d-Br_hsKje.mjs";
 /**
  * Run a query once on the server (during SSR) and capture its result in a

package/dist/query/index.d.mts

@@ -1,4 +1,4 @@
-import { S as SubscriptionError, L as LunoraClient, a as Unsubscribe } from "../packem_shared/lunora-client.d-C5TLiIgW.mjs";
+import { S as SubscriptionError, L as LunoraClient, a as Unsubscribe } from "../packem_shared/lunora-client.d-ttQV7mmy.mjs";
 export type {
 /**
  * `@lunora/client/query` — the framework-neutral live-query state machine shared
@@ -10,7 +10,7 @@ export type {
  * framework — each adapter supplies thin sinks that write into its own ref /
  * store / signal / cache.
  */
-b as SubscriptionErrorCallback } from "../packem_shared/lunora-client.d-C5TLiIgW.mjs";
+b as SubscriptionErrorCallback } from "../packem_shared/lunora-client.d-ttQV7mmy.mjs";
 import { F as FunctionReference, A as ArgsOf, R as ReturnOf } from "../packem_shared/function-reference.d-Br_hsKje.mjs";
 import '@lunora/errors';
 import '@lunora/runtime';

package/dist/query/index.d.ts

@@ -1,4 +1,4 @@
-import { S as SubscriptionError, L as LunoraClient, a as Unsubscribe } from "../packem_shared/lunora-client.d-BwJZfgUs.js";
+import { S as SubscriptionError, L as LunoraClient, a as Unsubscribe } from "../packem_shared/lunora-client.d-3WSiNC8L.js";
 export type {
 /**
  * `@lunora/client/query` — the framework-neutral live-query state machine shared
@@ -10,7 +10,7 @@ export type {
  * framework — each adapter supplies thin sinks that write into its own ref /
  * store / signal / cache.
  */
-b as SubscriptionErrorCallback } from "../packem_shared/lunora-client.d-BwJZfgUs.js";
+b as SubscriptionErrorCallback } from "../packem_shared/lunora-client.d-3WSiNC8L.js";
 import { F as FunctionReference, A as ArgsOf, R as ReturnOf } from "../packem_shared/function-reference.d-Br_hsKje.js";
 import '@lunora/errors';
 import '@lunora/runtime';

package/dist/ssr/index.d.mts

@@ -1,4 +1,4 @@
-import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-C5TLiIgW.mjs";
+import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-ttQV7mmy.mjs";
 export type { A as ArgsOf, F as FunctionReference, R as ReturnOf } from "../packem_shared/function-reference.d-Br_hsKje.mjs";
 export {
 /**
@@ -20,7 +20,7 @@ p as preloadQuery,
  * WebSocket or touches a UI framework, so it is safe to import from any SSR
  * loader.
  */
-a as preloadedQueryResult } from "../packem_shared/preload.d-DIGIWl4r.mjs";
+a as preloadedQueryResult } from "../packem_shared/preload.d-DgOIn4HV.mjs";
 import '@lunora/errors';
 import '@lunora/runtime';
 /**

package/dist/ssr/index.d.ts

@@ -1,4 +1,4 @@
-import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-BwJZfgUs.js";
+import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-3WSiNC8L.js";
 export type { A as ArgsOf, F as FunctionReference, R as ReturnOf } from "../packem_shared/function-reference.d-Br_hsKje.js";
 export {
 /**
@@ -20,7 +20,7 @@ p as preloadQuery,
  * WebSocket or touches a UI framework, so it is safe to import from any SSR
  * loader.
  */
-a as preloadedQueryResult } from "../packem_shared/preload.d-CRo2vOh3.js";
+a as preloadedQueryResult } from "../packem_shared/preload.d-BN-4Mxb6.js";
 import '@lunora/errors';
 import '@lunora/runtime';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/client",
-  "version": "1.0.0-alpha.111",
+  "version": "1.0.0-alpha.112",
   "description": "Lunora browser SDK: WebSocket transport, optimistic updates, and an offline mutation queue",
   "keywords": [
     "cloudflare",