solid-objects 0.17.3 → 0.17.5

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.17.5 - 2026-10-09
+
+- Correct `docs/agents.md` and `docs/fit.md`: Solid Objects Pro ships for
+  Node.js as `@solidobjects/pro` from the private registry at
+  <https://solidobjects.pro>, beside the Rails gem. The docs said that its
+  Node build was in development.
+
+## 0.17.4 - 2026-10-08
+
+- Step 12 of `docs/agents.md` now says plainly that every authorization
+  callback denies by default in the browser too. A worker with no
+  `authorizeMessage` and no `authorizeQuery` answers no call. The install
+  step points to the browser policy and to `runtime.run(signal)`, and the
+  checks start with the policy. In an evaluation, two agent answers gave the
+  browser install with no policy after they read that a browser policy is
+  not a security boundary.
+- A new Chromium test proves that a browser worker with no authorization
+  callbacks rejects actor calls with `Unauthorized`.
+
 ## 0.17.3 - 2026-10-08
 
 - `docs/agents.md` has a new step 12 for the browser runtime. It covers when

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.17.3";
+export declare const VERSION = "0.17.5";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.17.3";
+export const VERSION = "0.17.5";
 //# sourceMappingURL=version.js.map

package/docs/agents.md

@@ -19,27 +19,27 @@ Use Solid Objects only if you can answer yes to most of these questions:
 
 Select a simpler tool in these cases:
 
-| Requirement                                    | Use instead                                                                                                 |
-| ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| The invariant fits in one request              | A transaction, a constraint, or `SELECT ... FOR UPDATE`                                                     |
-| CPU-intensive or parallel work                 | `worker_threads` or a worker pool. An actor serializes work                                                 |
-| Thousands of writes for each second to one key | A counter column or a cache. Solid Objects Pro covers this case for Rails; its Node build is in development |
-| One atomic change across two actor identities  | One SQL transaction on normal tables                                                                        |
-| Exactly-once calls to an external API          | Not available from any actor library. Use provider idempotency keys                                         |
-| Replay of named workflow steps from a step log | A durable execution engine, such as DBOS or Temporal                                                        |
+| Requirement                                    | Use instead                                                                        |
+| ---------------------------------------------- | ---------------------------------------------------------------------------------- |
+| The invariant fits in one request              | A transaction, a constraint, or `SELECT ... FOR UPDATE`                            |
+| CPU-intensive or parallel work                 | `worker_threads` or a worker pool. An actor serializes work                        |
+| Thousands of writes for each second to one key | A counter column, a cache, or Solid Objects Pro, which ships for Node.js and Rails |
+| One atomic change across two actor identities  | One SQL transaction on normal tables                                               |
+| Exactly-once calls to an external API          | Not available from any actor library. Use provider idempotency keys                |
+| Replay of named workflow steps from a step log | A durable execution engine, such as DBOS or Temporal                               |
 
 The full list is in [Choosing Solid Objects](fit.md). The category guide is
 [Virtual actors in TypeScript and Node.js](virtual-actors.md).
 
 ## 2. Package identity
 
-| Item               | Value                                                                                                 |
-| ------------------ | ----------------------------------------------------------------------------------------------------- |
-| npm package        | `solid-objects`                                                                                       |
-| Repository         | <https://github.com/cardmagic/solid-objects-js>                                                       |
-| Website            | <https://solidobjects.dev/js>                                                                         |
-| Ruby on Rails gem  | `solid_objects`, a separate implementation of the same model                                          |
-| Commercial package | `@solidobjects/pro`, a separate paid package in development. The open-source package does not need it |
+| Item               | Value                                                                                                                                          |
+| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| npm package        | `solid-objects`                                                                                                                                |
+| Repository         | <https://github.com/cardmagic/solid-objects-js>                                                                                                |
+| Website            | <https://solidobjects.dev/js>                                                                                                                  |
+| Ruby on Rails gem  | `solid_objects`, a separate implementation of the same model                                                                                   |
+| Commercial package | `@solidobjects/pro`, a separate paid package from the private registry at <https://solidobjects.pro>. The open-source package does not need it |
 
 Solid Objects is not SolidJS and has no relation to it. It is not affiliated
 with Cloudflare.
@@ -361,6 +361,11 @@ npm install solid-objects @sqlite.org/sqlite-wasm
 `@sqlite.org/sqlite-wasm` 3.50 or newer is an optional peer dependency. The
 browser runtime needs it.
 
+Every authorization callback denies by default in the browser too. Write the
+policy in [Authorize in the browser](#authorize-in-the-browser) before you call
+an actor. Reminders and effects run only while the worker calls
+`runtime.run(signal)`.
+
 ### Choose the entry point
 
 | Need                                            | Use                                                                                                               |
@@ -464,10 +469,16 @@ and calls time out before it expires.
 
 ### Authorize in the browser
 
-The page and the worker run on the user's device, and the user can change
-their code. A browser policy limits what your own page can call. It is not a
-security boundary. Authorize again on the server for each write that leaves the
-device.
+All authorization callbacks deny by default, in the browser as in Node.js. A
+worker that sets no `authorizeMessage` and no `authorizeQuery` answers no call.
+Each call fails with `Unauthorized`. Allow the actor types that your page uses,
+as `allowNoteDrafts` does in the example. Do not remove the deny-by-default
+behavior.
+
+The browser policy is still not a security boundary. The page and the worker
+run on the user's device, and the user can change their code. The policy limits
+what your own page can call. Authorize again on the server for each write that
+leaves the device.
 
 ### Rules for browser actors
 
@@ -552,10 +563,12 @@ The [public API](api.md#solid-objectstransmit) and the
 
 ### Verify a browser implementation
 
-1. Call an operation, reload the page, and confirm that the state is the same.
-2. Send concurrent calls to one identity from two tabs. Assert the final state.
-3. Close the tab that holds the database. Confirm that the other tab continues.
-4. On each target engine, confirm that persistent storage opens, or fails with
+1. Confirm that the worker sets `authorizeMessage` and `authorizeQuery`.
+   Without them, every call fails with `Unauthorized`.
+2. Call an operation, reload the page, and confirm that the state is the same.
+3. Send concurrent calls to one identity from two tabs. Assert the final state.
+4. Close the tab that holds the database. Confirm that the other tab continues.
+5. On each target engine, confirm that persistent storage opens, or fails with
    a clear error.
-5. If you send writes to a server, confirm that the server rejects a device
+6. If you send writes to a server, confirm that the server rejects a device
    that it cannot authenticate, and applies a repeated write once.

package/docs/fit.md

@@ -42,8 +42,8 @@ history, and no actor-state migration contract.
   fits, because each check is one durable ordered message. For the high-QPS
   limiter, see [Solid Objects Pro](https://solidobjects.pro/): grouped commits
   coalesce concurrent writes into one insert, and ephemeral operations keep
-  loss-tolerant calls out of the durable journal. It ships for the Rails gem
-  today, and the Node build is in development. Distributed per-actor rate
+  loss-tolerant calls out of the durable journal. It ships for Node.js as
+  `@solidobjects/pro` and for the Rails gem. Distributed per-actor rate
   limits, global admission control, and cache-capacity eviction are answered
   there rather than in this runtime, and are not open roadmap items here.
 - Durable workflow replay across named steps is more important than a mutable

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solid-objects",
-  "version": "0.17.3",
+  "version": "0.17.5",
   "description": "SQL-backed virtual actor library for TypeScript and Node.js, with durable state, ordered operations, and automatic activation on SQLite, PostgreSQL, or MySQL",
   "type": "module",
   "license": "MIT",