@junejs/server 1.0.0-dev.42 → 1.0.0-dev.45

package/dist/agent-native.d.ts

@@ -19,11 +19,13 @@ export declare class NativeRuntime implements Runtime {
   private readonly db;
   private readonly announceRetry;
   private readonly maxSessions;
+  private closing;
   constructor(agents: Record<string, AgentDef>, db: SyncSqlite, opts?: NativeRuntimeOptions);
   agentDef(name: string): AgentDef | undefined;
   session(agent: string, id: string): AgentSession;
   get sessionCount(): number;
   recoverAnnouncements(): void;
+  close(): Promise<void>;
   private evictIdle;
 }
 export declare function createNativeRuntime(agents: Record<string, AgentDef>, path?: string, opts?: NativeRuntimeOptions): Promise<NativeRuntime>;
@@ -32,16 +34,21 @@ export declare class MemoryRuntime implements Runtime {
   private stores;
   private readonly agents;
   private readonly announceRetry;
+  private closed;
   constructor(agents: Record<string, AgentDef>);
   agentDef(name: string): AgentDef | undefined;
   session(agent: string, id: string): AgentSession;
+  close(): Promise<void>;
 }
 export type AgentBackend = "native" | "memory" | "durable";
+export type InProcessRuntime = Runtime & {
+  close(): Promise<void>;
+};
 export declare function createAgentRuntime(agents: Record<string, AgentDef>, opts?: {
   backend?: AgentBackend;
   path?: string;
   maxSessions?: number;
-}): Promise<Runtime>;
+}): Promise<InProcessRuntime>;
 export declare function mountAgent(agent: AgentDefinition, runtime: Runtime, opts?: {
   chatPath?: string;
   channels?: boolean;

package/dist/agent-native.js

@@ -93,6 +93,7 @@ var InProcEventSink = class {
 var AnnouncementRetry = class {
 	flush;
 	state = /* @__PURE__ */ new Map();
+	stopped = false;
 	constructor(flush) {
 		this.flush = flush;
 	}
@@ -102,6 +103,7 @@ var AnnouncementRetry = class {
 		this.state.delete(key);
 	}
 	failed(key, agent, id) {
+		if (this.stopped) return;
 		const s = this.state.get(key) ?? { failures: 0 };
 		this.state.set(key, s);
 		if (s.timer) return;
@@ -113,7 +115,13 @@ var AnnouncementRetry = class {
 		}, delay);
 		s.timer.unref?.();
 	}
+	stop() {
+		this.stopped = true;
+		for (const s of this.state.values()) if (s.timer) clearTimeout(s.timer);
+		this.state.clear();
+	}
 };
+const ownedDbs = /* @__PURE__ */ new WeakSet();
 function wireAnnouncements(session, def, retry) {
 	const hook = def.onInputAnnouncement;
 	if (hook) {
@@ -149,6 +157,7 @@ var NativeRuntime = class {
 		this.session(agent, id).flushAnnouncements();
 	});
 	maxSessions;
+	closing;
 	constructor(agents, db, opts = {}) {
 		assertCoreRuntimeVersion("NativeRuntime");
 		this.agents = agents;
@@ -164,6 +173,7 @@ var NativeRuntime = class {
 	session(agent, id) {
 		const key = `${agent}:${id}`;
 		const hit = this.actors.get(key);
+		if (!hit && this.closing) throw new Error(`NativeRuntime is closed: cannot open session "${key}"`);
 		if (hit) {
 			this.actors.delete(key);
 			this.actors.set(key, hit);
@@ -191,6 +201,18 @@ var NativeRuntime = class {
 			if (first && this.agents[first.agent]?.onInputAnnouncement) this.session(first.agent, first.session);
 		}
 	}
+	close() {
+		this.closing ??= (async () => {
+			this.announceRetry.stop();
+			while ([...this.actors.values()].some((a) => !a.session.idle())) await new Promise((r) => setTimeout(r, 10));
+			this.actors.clear();
+			if (ownedDbs.has(this.db)) {
+				ownedDbs.delete(this.db);
+				this.db.close();
+			}
+		})();
+		return this.closing;
+	}
 	evictIdle() {
 		if (this.actors.size < this.maxSessions) return;
 		for (const [key, a] of this.actors) {
@@ -200,9 +222,21 @@ var NativeRuntime = class {
 	}
 };
 async function createNativeRuntime(agents, path = ":memory:", opts = {}) {
-	const runtime = new NativeRuntime(agents, await openLocalSqliteSync(path), opts);
-	runtime.recoverAnnouncements();
-	return runtime;
+	const db = await openLocalSqliteSync(path);
+	ownedDbs.add(db);
+	let runtime;
+	try {
+		runtime = new NativeRuntime(agents, db, opts);
+		runtime.recoverAnnouncements();
+		return runtime;
+	} catch (err) {
+		if (runtime) await runtime.close();
+		else {
+			ownedDbs.delete(db);
+			db.close();
+		}
+		throw err;
+	}
 }
 var MemorySessionStore = class {
 	msgs = [];
@@ -259,6 +293,7 @@ var MemoryRuntime = class {
 	announceRetry = new AnnouncementRetry((agent, id) => {
 		this.session(agent, id).flushAnnouncements();
 	});
+	closed = false;
 	constructor(agents) {
 		assertCoreRuntimeVersion("MemoryRuntime");
 		this.agents = agents;
@@ -270,6 +305,7 @@ var MemoryRuntime = class {
 		const key = `${agent}:${id}`;
 		let a = this.actors.get(key);
 		if (!a) {
+			if (this.closed) throw new Error(`MemoryRuntime is closed: cannot open session "${key}"`);
 			const def = this.agents[agent];
 			if (!def) throw new Error(`unknown agent: ${agent}`);
 			const store = new MemorySessionStore();
@@ -280,6 +316,12 @@ var MemoryRuntime = class {
 		}
 		return a;
 	}
+	async close() {
+		this.closed = true;
+		this.announceRetry.stop();
+		this.actors.clear();
+		this.stores.clear();
+	}
 };
 async function createAgentRuntime(agents, opts = {}) {
 	const backend = opts.backend ?? "native";

package/dist/app.d.ts

@@ -9,6 +9,7 @@ export type JuneApp = {
   warmup(): Promise<void>;
   routePaths(): Promise<string[]>;
   earlyHints(): string[];
+  close(): Promise<void>;
 };
 export declare function createApp({ appDir: appDirInput, config }: CreateAppOptions): JuneApp;
 //#endregion

package/dist/app.js

@@ -1,6 +1,7 @@
 import { discoverAgent } from "./agent-discover.js";
 import { createAgentRuntime, mountAgent, toAgentDef } from "./agent-native.js";
 import { findMiddlewareFile, isResourceFile, listRoutes, matchRouteTree, resolveNotFound, routeFiles } from "./router.js";
+import { routeProblems, scanRoutes } from "./route-scan.js";
 import { createPipeline } from "./pipeline.js";
 import { resolveBoundary } from "./segment.js";
 import { memoizeResources } from "./resources.js";
@@ -115,6 +116,7 @@ function createApp({ appDir: appDirInput, config = {} }) {
 	config.dataLayer?.install();
 	let pipelinePromise;
 	const getPipeline = () => pipelinePromise ??= buildPipeline();
+	let agentRuntime;
 	async function buildPipeline() {
 		const { maps, css } = await getModuleCss();
 		await registerCssModules(maps);
@@ -138,6 +140,7 @@ function createApp({ appDir: appDirInput, config = {} }) {
 			const backend = agent.runtime.backend === "durable" ? "native" : agent.runtime.backend;
 			const model = anthropic({ model: def.model });
 			const rt = await createAgentRuntime({ [def.name]: toAgentDef(def, model) }, { backend });
+			agentRuntime = rt;
 			const mounted = mountAgent(def, rt, {
 				chatPath: agent.runtime.chat.path,
 				channels: agent.runtime.channels
@@ -257,6 +260,8 @@ function createApp({ appDir: appDirInput, config = {} }) {
 			return toPipeline();
 		},
 		async warmup() {
+			const problems = routeProblems([await scanRoutes(appDir), hasJuneRoutes ? await scanRoutes(juneRoutesDir) : []], dirname(appDir));
+			if (problems) console.error(problems);
 			const files = await routeFiles(appDir, { pageConvention: true });
 			if (hasJuneRoutes) files.push(...await routeFiles(juneRoutesDir, { pageConvention: true }));
 			for (const file of files) await import(pathToFileURL(file).href).catch((err) => {
@@ -264,7 +269,11 @@ function createApp({ appDir: appDirInput, config = {} }) {
 			});
 		},
 		routePaths,
-		earlyHints: () => config.earlyHints ?? []
+		earlyHints: () => config.earlyHints ?? [],
+		async close() {
+			await pipelinePromise?.catch(() => {});
+			await agentRuntime?.close();
+		}
 	};
 }
 //#endregion

package/dist/build.d.ts

@@ -1,7 +1,7 @@
-import { n as scanAppRoutes, r as scanRoutes, t as RouteEntry } from "./route-scan-DMlwoESy.js";
+import { a as scanAppRoutes, o as scanRoutes, t as RouteEntry } from "./route-scan-BMbBzPIB.js";
 import { t as generateContent } from "./content-freeze-CyiW2fRK.js";
-import { i as workerName, n as normalizeBase, r as resolveDeployAdapter, t as freezeConfig } from "./config-freeze-ZWC_Qd4h.js";
-import { n as buildManifest } from "./manifest-DSNX4I-G.js";
+import { i as workerName, n as normalizeBase, r as resolveDeployAdapter, t as freezeConfig } from "./config-freeze-CyXvNqi2.js";
+import { n as buildManifest } from "./manifest-CwTT1zVs.js";
 //#region src/build.d.ts
 export type BuildResult = {
   outFile: string;

package/dist/build.js

@@ -1,6 +1,7 @@
 import { jsxTransform } from "./tsconfig-jsx.js";
 import { generateAgentModule } from "./agent-compile.js";
 import { findMiddlewareFile } from "./router.js";
+import { scanAppRoutes, scanRoutes } from "./route-scan.js";
 import { resolveBoundary } from "./segment.js";
 import { buildModuleCss, registerCssModules, rolldownCssModulesPlugin } from "./css-modules.js";
 import { bundleClientToFile, findClientEntry } from "./client-bundle.js";
@@ -12,7 +13,6 @@ import { loadJuneConfig } from "./config-loader.js";
 import { freezeConfig, normalizeBase, resolveDeployAdapter, workerName } from "./config-freeze.js";
 import { generateContent } from "./content-freeze.js";
 import { createWorker } from "./worker.js";
-import { scanAppRoutes, scanRoutes } from "./route-scan.js";
 import { buildManifest, importLayout } from "./manifest.js";
 import { buildRsc, findRscRoutes } from "./rsc-build.js";
 import { existsSync, lstatSync } from "node:fs";
@@ -154,6 +154,8 @@ async function juneBuild(appRoot, options = {}) {
 		if (r.loading) loadings.push(`    ${JSON.stringify(r.path)}: ${loadingId(r.loading)},`);
 	});
 	const resourceRoutesField = resources.length ? `\n  resourceRoutes: [\n${resources.join("\n")}\n  ],` : "";
+	const generatedPaths = routes.filter((r) => r.generated).map((r) => r.path);
+	const generatedRoutesField = generatedPaths.length ? `\n  generatedRoutes: ${JSON.stringify(generatedPaths)},` : "";
 	const layoutBoundariesField = boundaries.length ? `\n  layoutBoundaries: {\n${boundaries.join("\n")}\n  },` : "";
 	const builtExtraFile = findMiddlewareFile(appDir);
 	if (builtExtraFile) imports.push(`import extra from ${JSON.stringify(importPath(genDir, builtExtraFile))};`);
@@ -224,7 +226,7 @@ ${statics.join("\n")}
   },
   dynamicRoutes: [
 ${dynamics.join("\n")}
-  ],${resourceRoutesField}
+  ],${resourceRoutesField}${generatedRoutesField}
   layoutChains: {
 ${chains.join("\n")}
   },${layoutBoundariesField}

package/dist/{config-freeze-ZWC_Qd4h.d.ts → config-freeze-CyXvNqi2.d.ts}

@@ -1,5 +1,5 @@
 import { i as JuneAdapter } from "./adapter-DcZ-W1-7.js";
-import { n as WorkerManifest } from "./worker-Dv4l6Ybs.js";
+import { n as WorkerManifest } from "./worker-2qbQjj2c.js";
 import { JuneConfig } from "@junejs/core/config";
 import { DocumentConfig } from "@junejs/core/document";
 //#region src/config-freeze.d.ts

package/dist/config-freeze.d.ts

@@ -1,2 +1,2 @@
-import { i as workerName, n as normalizeBase, r as resolveDeployAdapter, t as freezeConfig } from "./config-freeze-ZWC_Qd4h.js";
+import { i as workerName, n as normalizeBase, r as resolveDeployAdapter, t as freezeConfig } from "./config-freeze-CyXvNqi2.js";
 export { freezeConfig, normalizeBase, resolveDeployAdapter, workerName };

package/dist/dev.d.ts

@@ -3,10 +3,14 @@ import { JuneHost, ServeHandle } from "./host.js";
 export type DevServerOptions = {
   appDir: string;
   port?: number;
+  hostname?: string;
   host?: JuneHost;
 };
-export type DevServer = ServeHandle & {
+export declare function devUrl(hostname: string, port: number): string;
+export declare function devAllowedHosts(configured: readonly string[] | undefined, hostname: string): string[];
+export type DevServer = Omit<ServeHandle, "stop"> & {
   url: string;
+  stop(force?: boolean): Promise<void>;
 };
-export declare function startDevServer({ appDir, port, host }: DevServerOptions): Promise<DevServer>;
+export declare function startDevServer({ appDir, port, hostname, host }: DevServerOptions): Promise<DevServer>;
 //#endregion

package/dist/dev.js

@@ -9,17 +9,42 @@ import { watch } from "node:fs";
 import { dirname } from "node:path";
 import { createServer } from "node:net";
 //#region src/dev.ts
-async function findFreePort(start, tries = 20) {
+function devUrl(hostname, port) {
+	if ([
+		"127.0.0.1",
+		"0.0.0.0",
+		"::",
+		"localhost"
+	].includes(hostname)) return `http://localhost:${port}`;
+	return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
+}
+function devAllowedHosts(configured, hostname) {
+	const hosts = /* @__PURE__ */ new Set([
+		"localhost",
+		".localhost",
+		...configured ?? []
+	]);
+	if (!/^[\d.]+$|:/.test(hostname)) hosts.add(hostname.toLowerCase());
+	return [...hosts];
+}
+async function findFreePort(start, hostname, tries = 20) {
 	for (let p = start; p < start + tries; p++) if (await new Promise((resolve) => {
 		const probe = createServer();
 		probe.once("error", () => resolve(false));
-		probe.listen(p, () => probe.close(() => resolve(true)));
+		probe.listen(p, hostname, () => probe.close(() => resolve(true)));
 	})) return p;
 	throw new Error(`june dev: no free port between ${start} and ${start + tries - 1}`);
 }
-async function startDevServer({ appDir, port = 3e3, host: host$1 = host }) {
+async function startDevServer({ appDir, port = 3e3, hostname = "127.0.0.1", host: host$1 = host }) {
 	await installAsyncContext();
-	const config = await loadJuneConfig(appDir);
+	const loaded = await loadJuneConfig(appDir);
+	const config = {
+		...loaded,
+		agent: {
+			...loaded.agent,
+			allowedHosts: devAllowedHosts(loaded.agent?.allowedHosts, hostname)
+		}
+	};
 	const m = await migrateApp(dirname(appDir), config);
 	if (m?.applied.length) console.log(`[june] migrated: ${m.applied.join(", ")}`);
 	if (m?.blocked) console.warn(`[june] ${blockedMessage(m.blocked)}`);
@@ -28,11 +53,12 @@ async function startDevServer({ appDir, port = 3e3, host: host$1 = host }) {
 		config
 	});
 	await app.warmup();
-	const freePort = await findFreePort(port);
+	const freePort = await findFreePort(port, hostname);
 	if (freePort !== port) console.log(`[june] port ${port} is taken → using ${freePort}`);
 	port = freePort;
 	const handle = host$1.serve(withLiveReload((req) => app.fetch(req)), {
 		port,
+		hostname,
 		earlyHints: () => app.earlyHints()
 	});
 	if (findGlobalCss(appDir)) {
@@ -44,12 +70,17 @@ async function startDevServer({ appDir, port = 3e3, host: host$1 = host }) {
 		});
 		processCssCached(appDir).catch(() => {});
 	}
-	const url = `http://localhost:${handle.port}`;
-	console.log(`june dev → ${url}  (host: ${host$1.name})`);
+	const url = devUrl(hostname, handle.port);
+	const lan = hostname === "127.0.0.1" ? "" : `  · listening on ${hostname}`;
+	console.log(`june dev → ${url}  (host: ${host$1.name})${lan}`);
 	return {
 		...handle,
-		url
+		url,
+		async stop(force) {
+			handle.stop(force);
+			await app.close();
+		}
 	};
 }
 //#endregion
-export { startDevServer };
+export { devAllowedHosts, devUrl, startDevServer };

package/dist/host.d.ts

@@ -13,6 +13,7 @@ export interface JuneHost {
   readonly name: "bun" | "node";
   serve(handler: (req: Request) => Promise<Response>, opts: {
     port: number;
+    hostname?: string;
     earlyHints?: () => string[];
   }): ServeHandle;
   spawnModule(entry: string, args: string[], opts: {

package/dist/host.js

@@ -9,6 +9,7 @@ function bunHost() {
 		serve(handler, opts) {
 			const server = Bun.serve({
 				port: opts.port,
+				hostname: opts.hostname,
 				fetch: handler,
 				idleTimeout: 0
 			});
@@ -64,7 +65,7 @@ function nodeHost() {
 					res.end("Internal Server Error");
 				}
 			});
-			server.listen(opts.port);
+			server.listen(opts.port, opts.hostname);
 			return {
 				get port() {
 					const addr = server.address();

package/dist/index.d.ts

@@ -2,12 +2,12 @@ import { a as ResourcePlan, c as staticSite, i as JuneAdapter, l as vercel, n as
 import { AGENT_MODULE_FILE, AgentDirScan, emitAgentModule, findAgentDir, generateAgentModule, scanAgentDir } from "./agent-compile.js";
 import { CreateAppOptions, JuneApp, createApp } from "./app.js";
 import { R2Bucket, localBlob, r2 } from "./blob.js";
-import { r as scanRoutes } from "./route-scan-DMlwoESy.js";
+import { o as scanRoutes } from "./route-scan-BMbBzPIB.js";
 import { t as generateContent } from "./content-freeze-CyiW2fRK.js";
 import { a as Pipeline, d as createPipeline, n as LayoutComponent, o as PipelineConfig, s as Resolved, u as RouteResolver } from "./pipeline-BHUjBO0G.js";
-import { n as WorkerManifest, r as createWorker } from "./worker-Dv4l6Ybs.js";
-import { t as freezeConfig } from "./config-freeze-ZWC_Qd4h.js";
-import { n as buildManifest } from "./manifest-DSNX4I-G.js";
+import { n as WorkerManifest, r as createWorker } from "./worker-2qbQjj2c.js";
+import { t as freezeConfig } from "./config-freeze-CyXvNqi2.js";
+import { n as buildManifest } from "./manifest-CwTT1zVs.js";
 import { BuildResult, juneBuild } from "./build.js";
 import { loadJuneConfig } from "./config-loader.js";
 import { AccountTokenStore, BetterAuthLike, ConnectionAuth, LinkedAccountAuthOptions, betterAuthAccessToken, betterAuthAccountTokenStore, linkedAccountAuth } from "./connection-auth.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 import { deno, staticSite, vercel, workers } from "./adapter.js";
 import { AGENT_MODULE_FILE, emitAgentModule, findAgentDir, generateAgentModule, scanAgentDir } from "./agent-compile.js";
 import { listRoutes, matchRoute, matchRouteTree, resolveNotFound } from "./router.js";
+import { scanRoutes } from "./route-scan.js";
 import { negotiate } from "./negotiate.js";
 import { createPipeline } from "./pipeline.js";
 import { d1 } from "./d1.js";
@@ -12,7 +13,6 @@ import { freezeConfig } from "./config-freeze.js";
 import { collection, entry } from "./content.js";
 import { generateContent } from "./content-freeze.js";
 import { createWorker } from "./worker.js";
-import { scanRoutes } from "./route-scan.js";
 import { buildManifest } from "./manifest.js";
 import { juneBuild } from "./build.js";
 import { betterAuthAccessToken, betterAuthAccountTokenStore, linkedAccountAuth } from "./connection-auth.js";

package/dist/{manifest-DSNX4I-G.d.ts → manifest-CwTT1zVs.d.ts}

@@ -1,5 +1,5 @@
 import { n as LayoutComponent } from "./pipeline-BHUjBO0G.js";
-import { n as WorkerManifest } from "./worker-Dv4l6Ybs.js";
+import { n as WorkerManifest } from "./worker-2qbQjj2c.js";
 //#region src/manifest.d.ts
 type ImportedLayout = {
   component: LayoutComponent;

package/dist/manifest.d.ts

@@ -1,2 +1,2 @@
-import { n as buildManifest, r as importLayout, t as ImportedLayout } from "./manifest-DSNX4I-G.js";
+import { n as buildManifest, r as importLayout, t as ImportedLayout } from "./manifest-CwTT1zVs.js";
 export { ImportedLayout, buildManifest, importLayout };

package/dist/manifest.js

@@ -1,7 +1,7 @@
 import { findMiddlewareFile } from "./router.js";
+import { scanAppRoutes } from "./route-scan.js";
 import { resolveBoundary } from "./segment.js";
 import { freezeConfig } from "./config-freeze.js";
-import { scanAppRoutes } from "./route-scan.js";
 import { existsSync } from "node:fs";
 import { basename, join } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -47,6 +47,7 @@ async function buildManifest(appRoot) {
 	const routes = {};
 	const dynamicRoutes = [];
 	const resourceRoutes = [];
+	const generatedRoutes = scanned.filter((r) => r.generated).map((r) => r.path);
 	const layoutChains = {};
 	const layoutBoundaries = {};
 	const loadings = {};
@@ -96,6 +97,7 @@ async function buildManifest(appRoot) {
 		routes,
 		dynamicRoutes,
 		resourceRoutes,
+		...generatedRoutes.length ? { generatedRoutes } : {},
 		layoutChains,
 		layoutBoundaries,
 		loadings,

package/dist/pipeline.js

@@ -9,8 +9,8 @@ import React, { Suspense, use } from "react";
 import { renderToReadableStream } from "react-dom/server";
 import { Document, PRERENDER_ORIGIN, documentTitle, pageCanonical } from "@junejs/core/document";
 import { AGENT_SKILLS_INDEX_PATH, AI_CATALOG_PATH, API_CATALOG_CONTENT_TYPE, ARD_PATH, MCP_SERVER_CARD_TYPE, agentSkillsIndex, aiCatalog, apiCatalog, buildLinkHeader, llmsTxt, mcpServerCard, robotsTxt, siteSkill, sitemapXml } from "@junejs/core/discovery";
-import { mcpHandler, mcpServerIdentity, mcpTools } from "@junejs/core/mcp";
-import { OPENAPI_MEDIA_TYPE, apiActionId, apiHandler, apiNamespaceResponse, isApiNamespace, openApiDocument } from "@junejs/core/api";
+import { mcpForbidden, mcpHandler, mcpServerIdentity, mcpTools, originRejection } from "@junejs/core/mcp";
+import { OPENAPI_MEDIA_TYPE, apiActionId, apiForbidden, apiHandler, apiNamespaceResponse, isApiNamespace, openApiDocument } from "@junejs/core/api";
 import { LOCALE_COOKIE, localeAlternates, localeDir, matchPinnedLocale, negotiateLocale } from "@junejs/core/i18n";
 //#region src/pipeline.ts
 function readCookie(request, name) {
@@ -368,18 +368,25 @@ function createPipeline(cfg) {
 			default: return null;
 		}
 	}
+	const originPolicy = {
+		allowedOrigins: agent.allowedOrigins,
+		allowedHosts: agent.allowedHosts
+	};
+	const callerIdentity = async (request) => request.method === "POST" && cfg.identity ? await cfg.identity(request) : void 0;
 	async function handleRequest(request) {
 		const url = new URL(request.url);
 		if (url.pathname === "/mcp") {
 			if (!agent.mcp) return notFoundResponse("view", url.pathname);
-			const identity = cfg.identity ? await cfg.identity(request) : void 0;
+			const refused = originRejection(request, originPolicy);
+			if (refused !== void 0) return mcpForbidden(refused);
+			const identity = await callerIdentity(request);
 			return mcpHandler(request, {
 				request,
 				...identity
 			}, mcpServerIdentity(url.origin, {
 				site: docConfig.site,
 				agent
-			}));
+			}), originPolicy);
 		}
 		if (agent.api) {
 			if (url.pathname === "/openapi.json" && (request.method === "GET" || request.method === "HEAD")) {
@@ -394,11 +401,13 @@ function createPipeline(cfg) {
 			}
 			const actionId = apiActionId(url.pathname);
 			if (actionId) {
-				const identity = cfg.identity ? await cfg.identity(request) : void 0;
+				const refused = originRejection(request, originPolicy);
+				if (refused !== void 0) return apiForbidden(request, refused);
+				const identity = await callerIdentity(request);
 				return apiHandler(request, actionId, {
 					request,
 					...identity
-				});
+				}, originPolicy);
 			}
 		}
 		if (request.method === "OPTIONS" && agent.discovery && agent.mcp && url.pathname === SERVER_CARD_PATH) return new Response(null, {

package/dist/route-rank.d.ts

@@ -0,0 +1,10 @@
+//#region src/route-rank.d.ts
+export type SegmentKind = "static" | "param" | "optional" | "catchAll" | "optionalCatchAll";
+export declare function parseSegment(segment: string): {
+  kind: SegmentKind;
+  name?: string;
+};
+export declare function segmentRank(segment: string): number;
+export declare function compareSegments(a: string, b: string): number;
+export declare function compareRoutePatterns(a: string, b: string): number;
+//#endregion

package/dist/route-rank.js

@@ -0,0 +1,38 @@
+//#region src/route-rank.ts
+const DYNAMIC = /^\[(\[)?(\.\.\.)?([A-Za-z_][A-Za-z0-9_]*)\](\])?$/;
+function parseSegment(segment) {
+	const m = segment.match(DYNAMIC);
+	if (!m || !!m[1] !== !!m[4]) return { kind: "static" };
+	const optional = !!m[1];
+	return {
+		kind: !!m[2] ? optional ? "optionalCatchAll" : "catchAll" : optional ? "optional" : "param",
+		name: m[3]
+	};
+}
+const RANK = {
+	static: 0,
+	param: 1,
+	optional: 2,
+	catchAll: 3,
+	optionalCatchAll: 4
+};
+function segmentRank(segment) {
+	return RANK[parseSegment(segment).kind];
+}
+function compareSegments(a, b) {
+	return segmentRank(a) - segmentRank(b) || (a < b ? -1 : a > b ? 1 : 0);
+}
+function compareRoutePatterns(a, b) {
+	const as = a.split("/").filter(Boolean);
+	const bs = b.split("/").filter(Boolean);
+	for (let i = 0; i < Math.max(as.length, bs.length); i++) {
+		const x = as[i];
+		const y = bs[i];
+		if (x === void 0) return -1;
+		if (y === void 0) return 1;
+		if (x !== y) return compareSegments(x, y);
+	}
+	return 0;
+}
+//#endregion
+export { compareRoutePatterns, compareSegments, parseSegment, segmentRank };

package/dist/route-scan-BMbBzPIB.d.ts

@@ -0,0 +1,20 @@
+//#region src/route-scan.d.ts
+type RouteEntry = {
+  path: string;
+  file: string;
+  dynamic: boolean;
+  resource?: boolean;
+  generated?: boolean;
+  layouts: string[];
+  loading?: string;
+};
+declare function scanRoutes(appDir: string, dir?: string, layouts?: string[], out?: RouteEntry[], loading?: string): Promise<RouteEntry[]>;
+declare function scanAppRoutes(appRoot: string): Promise<RouteEntry[]>;
+declare function routeConflicts(routes: RouteEntry[]): Array<{
+  path: string;
+  files: string[];
+}>;
+declare function misplacedSegments(routes: RouteEntry[]): RouteEntry[];
+declare function routeProblems(trees: RouteEntry[][], appRoot: string): string | null;
+//#endregion
+export { scanAppRoutes as a, routeProblems as i, misplacedSegments as n, scanRoutes as o, routeConflicts as r, RouteEntry as t };

package/dist/route-scan.d.ts

@@ -1,2 +1,2 @@
-import { n as scanAppRoutes, r as scanRoutes, t as RouteEntry } from "./route-scan-DMlwoESy.js";
-export { RouteEntry, scanAppRoutes, scanRoutes };
+import { a as scanAppRoutes, i as routeProblems, n as misplacedSegments, o as scanRoutes, r as routeConflicts, t as RouteEntry } from "./route-scan-BMbBzPIB.js";
+export { RouteEntry, misplacedSegments, routeConflicts, routeProblems, scanAppRoutes, scanRoutes };

package/dist/route-scan.js

@@ -1,3 +1,4 @@
+import { parseSegment } from "./route-rank.js";
 import { existsSync } from "node:fs";
 import { readdir } from "node:fs/promises";
 import { basename, join, relative, sep } from "node:path";
@@ -48,8 +49,52 @@ async function scanAppRoutes(appRoot) {
 	const juneRoutesDir = join(appRoot, ".june", "routes");
 	const appRoutes = await scanRoutes(appDir);
 	const frameworkRoutes = existsSync(juneRoutesDir) ? await scanRoutes(juneRoutesDir) : [];
+	const problems = routeProblems([appRoutes, frameworkRoutes], appRoot);
+	if (problems) throw new Error(problems);
 	const appPaths = new Set(appRoutes.map((r) => r.path));
-	return [...appRoutes, ...frameworkRoutes.filter((r) => !appPaths.has(r.path))].sort((a, b) => a.path.localeCompare(b.path));
+	const generated = frameworkRoutes.filter((r) => !appPaths.has(r.path)).map((r) => ({
+		...r,
+		generated: true
+	}));
+	return [...appRoutes, ...generated].sort((a, b) => a.path.localeCompare(b.path));
+}
+function routeConflicts(routes) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const r of routes) {
+		const key = `${r.resource ? "route" : "page"} ${r.path}`;
+		const hit = byKey.get(key);
+		if (hit) hit.files.push(r.file);
+		else byKey.set(key, {
+			path: r.path,
+			files: [r.file]
+		});
+	}
+	return [...byKey.values()].filter((c) => c.files.length > 1).map((c) => ({
+		path: c.path,
+		files: c.files.sort()
+	})).sort((a, b) => a.path.localeCompare(b.path));
+}
+const ENDS_PATH = /* @__PURE__ */ new Set([
+	"optional",
+	"catchAll",
+	"optionalCatchAll"
+]);
+const beforeLast = (path) => path.split("/").filter(Boolean).slice(0, -1).map((s) => parseSegment(s).kind);
+function misplacedSegments(routes) {
+	return routes.filter((r) => beforeLast(r.path).some((k) => ENDS_PATH.has(k))).sort((a, b) => a.path.localeCompare(b.path) || a.file.localeCompare(b.file));
+}
+function routeProblems(trees, appRoot) {
+	const rel = (f) => relative(appRoot, f).split(sep).join("/");
+	const sections = [];
+	const conflicts = trees.flatMap(routeConflicts);
+	if (conflicts.length) sections.push("[june] more than one route file resolves to the same path — keep one per path:\n" + conflicts.map((c) => `  ${c.path}: ${c.files.map(rel).join(", ")}`).join("\n"));
+	const misplaced = trees.flatMap(misplacedSegments);
+	if (misplaced.length) {
+		const lines = misplaced.map((r) => `  ${r.path}: ${rel(r.file)}`);
+		if (misplaced.some((r) => beforeLast(r.path).includes("optional"))) lines.push("  Unlike SvelteKit, June does not skip a [[param]] mid-path. For a locale prefix, set i18n.locales in june.config.ts instead of a [[lang]] directory.");
+		sections.push("[june] an optional or catch-all segment must be the last segment of a route path — nothing may follow it:\n" + lines.join("\n"));
+	}
+	return sections.length ? sections.join("\n") : null;
 }
 //#endregion
-export { scanAppRoutes, scanRoutes };
+export { misplacedSegments, routeConflicts, routeProblems, scanAppRoutes, scanRoutes };