@junejs/server 0.1.2-dev.7 → 1.0.0-dev.10

package/dist/agent-durable.d.ts

@@ -1,5 +1,5 @@
 import { Channel, ChannelFactory } from "@junejs/core/agent-config";
-import { InboundEvent, Model, Msg, ProactiveTrigger, SessionStore, Tool, TurnEvent } from "@junejs/core/agent-runtime";
+import { InboundEvent, Model, Msg, ProactiveTrigger, SessionStore, Tool, TurnError, TurnEvent, TurnFailurePhase } from "@junejs/core/agent-runtime";
 import { Resources } from "@junejs/core/resources";
 //#region src/agent-durable.d.ts
 type SqlStorageValue = ArrayBuffer | string | number | null;
@@ -53,9 +53,9 @@ type DoAgentDef = {
   services?: unknown;
   onTurnError?: (failure: {
     turnId: string;
-    error: {
-      message: string;
-    };
+    error: TurnError;
+    phase?: TurnFailurePhase;
+    step?: string;
   }) => void | Promise<void>;
 };
 declare class AgentDurableObject {

package/dist/agent-durable.js

@@ -1,3 +1,4 @@
+import { assertCoreRuntimeVersion } from "./core-version.js";
 import { channelDispatch, resolveChannel } from "@junejs/core/agent-config";
 import { AgentSession, ResumeAuthorizationError, withSystem } from "@junejs/core/agent-runtime";
 import { ensureScope, runInScope } from "@junejs/db";
@@ -83,6 +84,7 @@ var AgentDurableObject = class {
 	resources;
 	services;
 	constructor(state, def) {
+		assertCoreRuntimeVersion(`AgentDurableObject(${def.name ?? "agent"})`);
 		const store = new DoSessionStore(state.storage);
 		const model = def.instructions ? withSystem(def.model, def.instructions) : def.model;
 		this.resources = def.resources ?? {};
@@ -91,11 +93,13 @@ var AgentDurableObject = class {
 		const sink = new InProcEventSink();
 		sink.subscribe((e) => {
 			if (e.type !== "turn.failed") return;
-			const defaultLog = () => console.error(`[june] agent "${name}" turn ${e.turnId} failed: ${e.error.message}`);
+			const defaultLog = () => console.error(`[june] agent "${name}" turn ${e.turnId} failed${e.step ? ` at ${e.step}` : ""}: ${e.error.stack ?? e.error.message}${e.error.causeChain?.length ? `\ncaused by: ${e.error.causeChain.join(" ← ")}` : ""}`);
 			if (def.onTurnError) try {
 				const out = def.onTurnError({
 					turnId: e.turnId,
-					error: e.error
+					error: e.error,
+					phase: e.phase,
+					step: e.step
 				});
 				if (out && typeof out.then === "function") out.then(void 0, (hookErr) => {
 					console.error(`[june] agent "${name}": onTurnError hook rejected:`, hookErr);
@@ -262,7 +266,7 @@ async function sseTurnFinalText(res) {
 			if (!line) continue;
 			const e = JSON.parse(line.slice(5).trim());
 			if (e.type === "turn.completed") return e.text;
-			if (e.type === "turn.failed") throw new Error(e.error.message);
+			if (e.type === "turn.failed") throw new Error(e.error.message, { cause: e.error });
 		}
 		if (done) break;
 	}

package/dist/agent-native.js

@@ -1,3 +1,4 @@
+import { assertCoreRuntimeVersion } from "./core-version.js";
 import { openLocalSqliteSync } from "./sqlite-driver.js";
 import { channelFetch } from "@junejs/core/agent-config";
 import { AgentSession, withSystem } from "@junejs/core/agent-runtime";
@@ -73,6 +74,7 @@ var NativeRuntime = class {
 	agents;
 	db;
 	constructor(agents, db) {
+		assertCoreRuntimeVersion("NativeRuntime");
 		this.agents = agents;
 		this.db = db;
 		initSchema(db);
@@ -131,6 +133,7 @@ var MemoryRuntime = class {
 	stores = /* @__PURE__ */ new Map();
 	agents;
 	constructor(agents) {
+		assertCoreRuntimeVersion("MemoryRuntime");
 		this.agents = agents;
 	}
 	session(agent, id) {

package/dist/core-version.d.ts

@@ -0,0 +1,5 @@
+//#region src/core-version.d.ts
+declare function assertCoreRuntimeVersion(surface: string): void;
+declare function checkCoreRuntimeVersion(surface: string, actual: number | undefined, expected?: number): void;
+//#endregion
+export { assertCoreRuntimeVersion, checkCoreRuntimeVersion };

package/dist/core-version.js

@@ -0,0 +1,12 @@
+import * as coreRuntime from "@junejs/core/agent-runtime";
+//#region src/core-version.ts
+const EXPECTED_CORE_RUNTIME_API = 1;
+function assertCoreRuntimeVersion(surface) {
+	checkCoreRuntimeVersion(surface, coreRuntime.RUNTIME_API_VERSION);
+}
+function checkCoreRuntimeVersion(surface, actual, expected = EXPECTED_CORE_RUNTIME_API) {
+	if (actual === expected) return;
+	throw new Error(`${surface}: @junejs/server is built against @junejs/core runtime API v${expected}, but the @junejs/core it resolved provides ${actual === void 0 ? "no RUNTIME_API_VERSION (a pre-0.1.1-dev.16 core)" : `v${actual}`} — two copies of @junejs/core are likely installed (one nested under @junejs/server). Align the app's @junejs/core with @junejs/server's peer range, then reinstall/dedupe so one copy remains.`);
+}
+//#endregion
+export { assertCoreRuntimeVersion, checkCoreRuntimeVersion };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { AdapterCapabilities, AdapterEmitContext, AdapterEntry, JuneAdapter, ResourcePlan, deno, staticSite, vercel, workers } from "./adapter.js";
 import { CreateAppOptions, JuneApp, createApp } from "./app.js";
 import { R2Bucket, localBlob, r2 } from "./blob.js";
-import { a as Pipeline, d as createPipeline, n as LayoutComponent, o as PipelineConfig, s as Resolved, u as RouteResolver } from "./pipeline-CCp9idQ4.js";
+import { a as Pipeline, d as createPipeline, n as LayoutComponent, o as PipelineConfig, s as Resolved, u as RouteResolver } from "./pipeline-cCR6MGNK.js";
 import { WorkerManifest, createWorker } from "./worker.js";
 import { BuildResult, buildManifest, freezeConfig, generateContent, juneBuild, scanRoutes } from "./build.js";
 import { loadJuneConfig } from "./config-loader.js";

package/dist/{pipeline-CCp9idQ4.d.ts → pipeline-cCR6MGNK.d.ts}

@@ -4,6 +4,7 @@ import React from "react";
 import { DocumentConfig } from "@junejs/core/document";
 import { I18nConfig } from "@junejs/core/i18n";
 import { Resources } from "@junejs/core/resources";
+import { Principal, Session } from "@junejs/core/context";
 //#region src/pipeline.d.ts
 type LayoutComponent = React.ComponentType<{
   children: React.ReactNode;
@@ -32,6 +33,13 @@ type PipelineConfig = {
   resolve: RouteResolver;
   resources?: () => Promise<Resources> | Resources;
   services?: () => Promise<unknown> | unknown;
+  identity?: (request: Request) => Promise<{
+    user?: Principal;
+    session?: Session;
+  }> | {
+    user?: Principal;
+    session?: Session;
+  };
   earlyHints?: string[];
   htmlCacheControl?: string;
   notFoundComponent?: React.ComponentType<{

package/dist/pipeline.d.ts

@@ -1,2 +1,2 @@
-import { a as Pipeline, c as ResolvedResource, d as createPipeline, i as MiddlewareHandler, l as ResourceHandler, n as LayoutComponent, o as PipelineConfig, r as LoadingComponent, s as Resolved, t as ExtraHandler, u as RouteResolver } from "./pipeline-CCp9idQ4.js";
+import { a as Pipeline, c as ResolvedResource, d as createPipeline, i as MiddlewareHandler, l as ResourceHandler, n as LayoutComponent, o as PipelineConfig, r as LoadingComponent, s as Resolved, t as ExtraHandler, u as RouteResolver } from "./pipeline-cCR6MGNK.js";
 export { ExtraHandler, LayoutComponent, LoadingComponent, MiddlewareHandler, Pipeline, PipelineConfig, Resolved, ResolvedResource, ResourceHandler, RouteResolver, createPipeline };

package/dist/pipeline.js

@@ -171,7 +171,10 @@ function createPipeline(cfg) {
 		const url = new URL(request.url);
 		if (url.pathname === "/mcp") {
 			if (!agent.mcp) return notFoundResponse("view", url.pathname);
-			return mcpHandler(request, { request });
+			return mcpHandler(request, {
+				request,
+				...cfg.identity ? await cfg.identity(request) : void 0
+			});
 		}
 		if (request.method === "GET" && agent.discovery) {
 			const d = await discovery(url);

package/dist/worker.d.ts

@@ -1,4 +1,4 @@
-import { l as ResourceHandler, n as LayoutComponent, r as LoadingComponent, t as ExtraHandler } from "./pipeline-CCp9idQ4.js";
+import { l as ResourceHandler, n as LayoutComponent, r as LoadingComponent, t as ExtraHandler } from "./pipeline-cCR6MGNK.js";
 import { BrandedRoute } from "@junejs/core/route";
 import { AgentConfig } from "@junejs/core/config";
 import React from "react";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@junejs/server",
-  "version": "0.1.2-dev.7",
+  "version": "1.0.0-dev.10",
   "description": "June host adapters + dev server. Host-coupled; depends on the pure @junejs/core contract layer.",
   "type": "module",
   "license": "MIT",
@@ -125,14 +125,14 @@
     "build": "tsdown"
   },
   "dependencies": {
-    "@junejs/core": ">=0.1.1-dev.14",
-    "@junejs/db": ">=0.0.34-dev.0",
+    "@junejs/db": ">=0.0.34-dev.1",
     "@momiji-rs/sparkdown": "^0.0.4",
     "lightningcss": "^1.27.0",
     "oxc-parser": "^0.137.0",
     "rolldown": "^1.1.0"
   },
   "peerDependencies": {
+    "@junejs/core": ">=0.2.0-dev.26",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "react-server-dom-webpack": "19.2.7",
@@ -156,7 +156,8 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/junebuild/june"
+    "url": "git+https://github.com/junebuild/june.git",
+    "directory": "packages/june"
   },
   "devDependencies": {
     "@libsql/client": "^0.17.3",

package/src/agent-durable.ts

@@ -28,6 +28,8 @@ import {
   type SessionStore,
   type ProactiveTrigger,
   type Tool,
+  type TurnError,
+  type TurnFailurePhase,
 } from "@junejs/core/agent-runtime";
 import type { Resources } from "@junejs/core/resources";
 import {
@@ -39,6 +41,7 @@ import {
   type ChannelFactory,
 } from "@junejs/core/agent-config";
 import { ensureScope, runInScope } from "@junejs/db";
+import { assertCoreRuntimeVersion } from "./core-version";
 
 // ── minimal structural Cloudflare surface (no @cloudflare/workers-types dep) ──
 // SqlStorage row values are exactly what workerd's SQLite returns. Mirroring
@@ -185,11 +188,14 @@ export type DoAgentDef = {
   // Called on every turn.failed for this session — the app's seam for routing turn
   // failures to its own telemetry (Sentry, a ledger, …). Providing it REPLACES the
   // default console.error; if the hook throws (or an async hook rejects), the default
-  // log fires anyway (both errors), so a failure is never silent. It happens to run
-  // inside the failed turn's request scope today (turn.failed is emitted mid-turn and
-  // ALS propagates), but that is NOT contract — don't rely on ambient db/services;
-  // close over what you need.
-  onTurnError?: (failure: { turnId: string; error: { message: string } }) => void | Promise<void>;
+  // log fires anyway (both errors), so a failure is never silent. `error` carries the
+  // full serialized failure (stack, cause chain — see TurnError, #96), and phase/step
+  // name the engine step that was in flight — for a DETACHED turn this hook is the
+  // only failure-surfacing path, so nothing may be flattened before it fires. It
+  // happens to run inside the failed turn's request scope today (turn.failed is
+  // emitted mid-turn and ALS propagates), but that is NOT contract — don't rely on
+  // ambient db/services; close over what you need.
+  onTurnError?: (failure: { turnId: string; error: TurnError; phase?: TurnFailurePhase; step?: string }) => void | Promise<void>;
 };
 
 // The agent runtime INSIDE a Durable Object. A plain class (constructor takes the
@@ -226,6 +232,7 @@ export class AgentDurableObject {
   private readonly resources: Resources;
   private readonly services: unknown;
   constructor(state: DurableObjectState, def: DoAgentDef) {
+    assertCoreRuntimeVersion(`AgentDurableObject(${def.name ?? "agent"})`); // #94: fail power-on, not mid-turn
     const store = new DoSessionStore(state.storage);
     const model = def.instructions ? withSystem(def.model, def.instructions) : def.model;
     this.resources = def.resources ?? {};
@@ -241,10 +248,13 @@ export class AgentDurableObject {
     const sink = new InProcEventSink();
     sink.subscribe((e) => {
       if (e.type !== "turn.failed") return;
-      const defaultLog = () => console.error(`[june] agent "${name}" turn ${e.turnId} failed: ${e.error.message}`);
+      // The stack already opens with the message; log it INSTEAD of the message line
+      // when present so wrangler tail shows one coherent trace, not the message twice.
+      const defaultLog = () =>
+        console.error(`[june] agent "${name}" turn ${e.turnId} failed${e.step ? ` at ${e.step}` : ""}: ${e.error.stack ?? e.error.message}${e.error.causeChain?.length ? `\ncaused by: ${e.error.causeChain.join(" ← ")}` : ""}`);
       if (def.onTurnError) {
         try {
-          const out = def.onTurnError({ turnId: e.turnId, error: e.error });
+          const out = def.onTurnError({ turnId: e.turnId, error: e.error, phase: e.phase, step: e.step });
           // An async hook (e.g. `await sendToSentry(...)`) types as void but returns a
           // Promise — a rejection there must hit the same fallback as a sync throw, or
           // the failure goes silent again (plus an unhandled rejection). No waitUntil
@@ -469,7 +479,7 @@ export async function sseTurnFinalText(res: Response): Promise<string> {
       if (!line) continue;
       const e = JSON.parse(line.slice(5).trim()) as TurnEvent;
       if (e.type === "turn.completed") return e.text;
-      if (e.type === "turn.failed") throw new Error(e.error.message);
+      if (e.type === "turn.failed") throw new Error(e.error.message, { cause: e.error }); // full TurnError rides along
     }
     if (done) break;
   }

package/src/agent-native.ts

@@ -20,6 +20,7 @@ import {
 } from "@junejs/core/agent-runtime";
 import { channelFetch, type AgentDefinition, type ChannelContext } from "@junejs/core/agent-config";
 import { openLocalSqliteSync, type SyncSqlite } from "./sqlite-driver";
+import { assertCoreRuntimeVersion } from "./core-version";
 
 function initSchema(db: SyncSqlite) {
   db.exec(`CREATE TABLE IF NOT EXISTS agent_sessions (session_id TEXT PRIMARY KEY, status TEXT)`);
@@ -99,6 +100,7 @@ export class NativeRuntime implements Runtime {
   private readonly db: SyncSqlite;
 
   constructor(agents: Record<string, AgentDef>, db: SyncSqlite) {
+    assertCoreRuntimeVersion("NativeRuntime"); // #94: fail power-on, not mid-turn
     this.agents = agents;
     this.db = db;
     initSchema(db);
@@ -154,6 +156,7 @@ export class MemoryRuntime implements Runtime {
   private stores = new Map<string, MemorySessionStore>();
   private readonly agents: Record<string, AgentDef>;
   constructor(agents: Record<string, AgentDef>) {
+    assertCoreRuntimeVersion("MemoryRuntime"); // #94: fail power-on, not mid-turn
     this.agents = agents;
   }
   session(agent: string, id: string): AgentSession {

package/src/core-version.ts

@@ -0,0 +1,34 @@
+// core-version.ts — the #94 belt-and-braces: fail at POWER-ON when the @junejs/core
+// copy this server resolved is not the one it was built for.
+//
+// The primary fix is @junejs/core being a peerDependency (the app's single resolution
+// always wins), but a nested second copy can still appear (npm legacy peer handling,
+// a stale lockfile, a transitive pin). When it does, the failure without this check
+// is far from the cause and mid-turn ("sink.emit is not a function", first seen in
+// crisp-agent production); with it, construction throws with both versions named.
+//
+// Namespace import + optional read on purpose: a PRE-#94 core has no
+// RUNTIME_API_VERSION export, and a named import of a missing export would die at
+// module link time with an unhelpful SyntaxError — exactly the confusion this
+// module exists to remove.
+import * as coreRuntime from "@junejs/core/agent-runtime";
+
+// The contract number this server tree is built against. Bump in lockstep with
+// core's RUNTIME_API_VERSION whenever the server↔core runtime contract changes.
+const EXPECTED_CORE_RUNTIME_API = 1;
+
+export function assertCoreRuntimeVersion(surface: string): void {
+  checkCoreRuntimeVersion(surface, (coreRuntime as { RUNTIME_API_VERSION?: number }).RUNTIME_API_VERSION);
+}
+
+// The pure check, split out so the mismatch paths are unit-testable (the ambient
+// read above can only ever see the workspace's own — matching — core).
+export function checkCoreRuntimeVersion(surface: string, actual: number | undefined, expected: number = EXPECTED_CORE_RUNTIME_API): void {
+  if (actual === expected) return;
+  throw new Error(
+    `${surface}: @junejs/server is built against @junejs/core runtime API v${expected}, ` +
+      `but the @junejs/core it resolved provides ${actual === undefined ? "no RUNTIME_API_VERSION (a pre-0.1.1-dev.16 core)" : `v${actual}`} — ` +
+      `two copies of @junejs/core are likely installed (one nested under @junejs/server). ` +
+      `Align the app's @junejs/core with @junejs/server's peer range, then reinstall/dedupe so one copy remains.`,
+  );
+}

package/src/pipeline.ts

@@ -34,6 +34,7 @@ import {
   sitemapXml,
 } from "@junejs/core/discovery";
 import { mcpHandler, mcpTools } from "@junejs/core/mcp";
+import type { Principal, Session } from "@junejs/core/context";
 
 import { ensureScope, runInScope, setRequestLocale } from "@junejs/db";
 import type { AgentConfig } from "@junejs/core/config";
@@ -126,6 +127,14 @@ export type PipelineConfig = {
   // `currentServices()` resolves in loaders/views/actions. Absent → currentServices()
   // is undefined. This is the Worker-side twin of a Durable Object seeding services.
   services?: () => Promise<unknown> | unknown;
+  // Resolve the request's authenticated identity (the auth integration's job —
+  // e.g. Better Auth reading the session cookie). The result rides every
+  // ActionContext the pipeline builds, starting with the /mcp mount, so
+  // requiresPrincipal actions and per-call connection auth see the SAME
+  // principal a UI dispatch would. Absent → anonymous (identity-gated actions
+  // reject); a THROWING resolver propagates as a server error — it must never
+  // silently degrade to anonymous.
+  identity?: (request: Request) => Promise<{ user?: Principal; session?: Session }> | { user?: Principal; session?: Session };
   earlyHints?: string[];
   htmlCacheControl?: string;
   notFoundComponent?: React.ComponentType<{ pathname: string }>;
@@ -473,9 +482,11 @@ export function createPipeline(cfg: PipelineConfig): Pipeline {
       if (url.pathname === "/mcp") {
         if (!agent.mcp) return notFoundResponse("view", url.pathname);
         // The agent's tool calls run inside the same request scope, so an action's
-        // ambient `db` is the SAME resource the UI uses (and, once auth is wired,
-        // the same principal via ctx). ctx carries identity only — not resources.
-        return mcpHandler(request, { request });
+        // ambient `db` is the SAME resource the UI uses, and — via cfg.identity —
+        // the same principal: requiresPrincipal actions and per-call connection
+        // auth are live on this surface. ctx carries identity only — not resources.
+        const identity = cfg.identity ? await cfg.identity(request) : undefined;
+        return mcpHandler(request, { request, ...identity });
       }
       if (request.method === "GET" && agent.discovery) {
         const d = await discovery(url);