@aventara/next 1.0.0-rc.12 → 1.0.0-rc.13

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @aventara/next
 
+## 1.0.0-rc.13
+
+### Patch Changes
+
+- e4e8abd: The same rule now holds for in-process calls. When `state` rejects with an object whose `status` or `statusCode` is
+  the number 401 or 403, an `avClient` call in a Next.js Server Component or Server Action rejects with an `AvAuthError`
+  of code `A4000` or `A4001`, and so does `framework.serverClient.$access.can` given `headers`. Its message is core's own
+  (`"Unauthenticated."` or `"Forbidden."`) and nothing of the rejection reaches the caller. Before, the call rejected
+  with the library's own error. A thrown `AvError` and any other rejection still reject the call unchanged.
+
+  An object whose `status` and `statusCode` are both numbers that disagree, such as `status: 500` beside
+  `statusCode: 401`, is no longer read as a refusal: a route answers it `500 A3000`. A number beside a non-number, such
+  as Better Auth's `status: "UNAUTHORIZED"` beside `statusCode: 401`, is still read by the number.
+
+- e662048: A request whose `state` (the host's `state` option, or the `access` provider's `state`) rejects with an object whose
+  `status` or `statusCode` is the number 401 or 403 is now answered `401 A4000` or `403 A4001`, not `500 A3000`. This is
+  how authentication libraries refuse a bad credential: Better Auth's `APIError` for a wrong API key carries
+  `statusCode: 401`. The answer is core's own envelope (`"Unauthenticated."` or `"Forbidden."`); nothing of the
+  rejection, neither its message nor its code, reaches the caller, and it is not reported to `diagnostics`, as a thrown
+  `AvError("A4000", …)` is not. It applies on every protocol route that seeds state: operations, cached reads,
+  `/_transactions`, `/_all`, `/_access/can`, and MCP tool calls. A thrown `AvError` is still its own outcome, and any
+  other rejection, a 401 beside a 403 included, is still `500 A3000`.
+- Updated dependencies [6c3e25c]
+- Updated dependencies [2aaa27d]
+- Updated dependencies [f3b291f]
+- Updated dependencies [2aaa27d]
+- Updated dependencies [e4e8abd]
+- Updated dependencies [e662048]
+- Updated dependencies [f3b291f]
+- Updated dependencies [f3b291f]
+- Updated dependencies [6c3e25c]
+- Updated dependencies [6c3e25c]
+- Updated dependencies [a708188]
+- Updated dependencies [a9260d2]
+  - @aventara/core@1.0.0-rc.13
+  - @aventara/mcp@1.0.0-rc.13
+
 ## 1.0.0-rc.12
 
 ### Patch Changes

package/README.md

@@ -287,6 +287,17 @@ With SWR, pass `avDehydrate({ [key]: data })` from the Server Component and `avH
 Importing `@/aventara/client` instead of `@/aventara/universal` in shared code opts out of running on the server: its
 calls are refused there.
 
+### The client's hooks
+
+`onCall`, `onSuccess` and `onError` for `@/aventara/client` and `@/aventara/universal` go in
+`src/aventara/client-options.ts` (or `.js`), whose default export `aventara-build --client` gives every client it writes
+(`@aventara/build`'s README). The file ships to the browser too: no server-only import, no secret, and
+`typeof window` when a hook must act differently on the server. On the server, `onCall`'s headers reach the in-process
+request but not its state, which comes from the request being served. `@/aventara/server` is the Framework's own
+client, not an `AvClient`, and takes no hooks. Calls group in the browser only when their `onCall` settles together
+with equal additions: an `onCall` reading a token over I/O for each call sends each call alone, so read it through
+one shared in-flight promise, cleared once it settles (`@aventara/client`'s README has the recipe).
+
 ## Routes
 
 `handlers` answers the protocol's routes under `api`: each operation route (`POST /api/_resources/...`),

package/dist/aventara.factory.d.ts

@@ -12,10 +12,15 @@ type HostOptions<M extends AvAdapterModel> = {
     readonly adapter: AvAdapter<M> | (() => AvAdapter<M> | PromiseLike<AvAdapter<M>>);
     /**
      * Seeds a request's `ctx.$state`, once per request, from its headers and,
-     * on a route call, the route handler's request. A throw is answered like
-     * any developer failure: a thrown `AvError` as its own outcome, anything
-     * else as an internal failure. Omitted, the state is `{}`, or what the
-     * `access` provider's `state` seeds; not together with `access`.
+     * on a route call, the route handler's request. A thrown `AvError` is its
+     * own outcome. A rejection carrying `status` or `statusCode` 401 or 403
+     * (two numbers that disagree are neither) is `A4000` or `A4001`, with
+     * core's own message and nothing of the rejection's, unreported: a route
+     * answers `401` or `403`, and an `avClient` call in a Server Component or
+     * Server Action rejects with that code's `AvAuthError`. Anything else is
+     * `500 A3000` on a route, and rejects an `avClient` call unchanged.
+     * Omitted, the state is `{}`, or what the `access` provider's `state`
+     * seeds; not together with `access`.
      */
     state?(context: AvNextStateContext): AvState | Promise<AvState>;
 };

package/dist/request-state.cache.js

@@ -1,4 +1,4 @@
-import { holdRequestPrincipal } from "@aventara/core/internal";
+import { holdRequestPrincipal, inProcessStateRejection, } from "@aventara/core/internal";
 import { headers } from "next/headers.js";
 import { cache } from "react";
 export function createRequestState(state) {
@@ -6,7 +6,14 @@ export function createRequestState(state) {
         return async () => undefined;
     }
     return cache(async () => {
-        const seeded = await state({ headers: await headers() });
+        const given = await headers();
+        let seeded;
+        try {
+            seeded = await state({ headers: given });
+        }
+        catch (error) {
+            throw inProcessStateRejection(error);
+        }
         holdRequestPrincipal(seeded);
         return seeded;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aventara/next",
-  "version": "1.0.0-rc.12",
+  "version": "1.0.0-rc.13",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Next.js App Router host integration for Aventara.",
   "type": "module",
@@ -22,11 +22,11 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@aventara/core": "1.0.0-rc.12",
+    "@aventara/core": "1.0.0-rc.13",
     "server-only": "0.0.1"
   },
   "peerDependencies": {
-    "@aventara/mcp": "1.0.0-rc.12",
+    "@aventara/mcp": "1.0.0-rc.13",
     "next": ">=16.4 <17",
     "react": "^19.0.0"
   },
@@ -53,10 +53,10 @@
     "access": "public"
   },
   "devDependencies": {
-    "@aventara/build": "1.0.0-rc.12",
-    "@aventara/client": "1.0.0-rc.12",
-    "@aventara/mcp": "1.0.0-rc.12",
-    "@aventara/testing": "1.0.0-rc.12",
+    "@aventara/build": "1.0.0-rc.13",
+    "@aventara/client": "1.0.0-rc.13",
+    "@aventara/mcp": "1.0.0-rc.13",
+    "@aventara/testing": "1.0.0-rc.13",
     "@modelcontextprotocol/sdk": "1.32.2",
     "@tanstack/react-query": "5.104.2",
     "@types/react": "19.3.0",