@celsian/vura-cli 0.7.0 → 0.8.0

package/dist/commands/admin.d.ts

@@ -23,6 +23,22 @@ export declare function isAllowedAdminRequest(headers: {
     host?: string | string[];
     origin?: string | string[];
 }, bindHost: string, port: number): boolean;
+/**
+ * Start the admin server and return once it is listening.
+ *
+ * Split out of `adminCommand` so tests can drive a real server: the command
+ * itself never returns, and the bug this exists to pin lived in the wiring
+ * rather than in any function a unit test could reach. `vura admin --port 0`
+ * built its same-origin allowlist from the *requested* port, so the allowlist
+ * held `localhost:0` while the browser sent the real one and every API request
+ * was refused as cross-origin with a valid token in hand.
+ */
+export declare function startAdminServer(opts: AdminOptions): Promise<{
+    server: import('node:http').Server;
+    port: number;
+    token: string;
+    close: () => Promise<void>;
+}>;
 export declare function adminCommand(args: string[]): Promise<void>;
 export declare function renderDashboardHtml(adminToken: string): string;
 export {};

package/dist/commands/admin.js

@@ -60,8 +60,17 @@ export function isAllowedAdminRequest(headers, bindHost, port) {
         return false;
     }
 }
-export async function adminCommand(args) {
-    const opts = parseAdminOptions(args);
+/**
+ * Start the admin server and return once it is listening.
+ *
+ * Split out of `adminCommand` so tests can drive a real server: the command
+ * itself never returns, and the bug this exists to pin lived in the wiring
+ * rather than in any function a unit test could reach. `vura admin --port 0`
+ * built its same-origin allowlist from the *requested* port, so the allowlist
+ * held `localhost:0` while the browser sent the real one and every API request
+ * was refused as cross-origin with a valid token in hand.
+ */
+export async function startAdminServer(opts) {
     assertSafeAdminBindHost(opts.host);
     const { createServer } = await import('node:http');
     const { randomBytes } = await import('node:crypto');
@@ -72,11 +81,17 @@ export async function adminCommand(args) {
     const config = await loadConfig(opts.projectRoot);
     const projectName = basename(opts.projectRoot);
     const adminToken = randomBytes(32).toString('base64url');
+    // The port the server actually bound. `--port 0` means "pick a free port",
+    // and the same-origin allowlist below is built from it: with the *requested*
+    // port the allowlist held `localhost:0` while the browser sent the real one,
+    // so every request to a `--port 0` dashboard was refused as cross-origin.
+    // Assigned in the listen callback, before any request can arrive.
+    let boundPort = opts.port;
     const server = createServer(async (req, res) => {
         const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
         const method = (req.method ?? 'GET').toUpperCase();
         const isAdminApi = url.pathname.startsWith('/__admin/api/');
-        const sameOrigin = isAllowedAdminRequest(req.headers, opts.host, opts.port);
+        const sameOrigin = isAllowedAdminRequest(req.headers, opts.host, boundPort);
         const apiHeaders = adminApiHeaders();
         if (method === 'OPTIONS') {
             res.writeHead(sameOrigin ? 204 : 403, {
@@ -311,25 +326,52 @@ export async function adminCommand(args) {
         res.writeHead(404, apiHeaders);
         res.end(JSON.stringify({ error: 'Not found' }));
     });
-    server.listen(opts.port, opts.host, () => {
+    const onListening = () => {
         const displayHost = opts.host === '127.0.0.1' ? 'localhost' : opts.host;
+        const addr = server.address();
+        boundPort = addr && typeof addr === 'object' ? addr.port : opts.port;
         const displayUrl = displayHost.includes(':')
-            ? `http://[${displayHost}]:${opts.port}`
-            : `http://${displayHost}:${opts.port}`;
-        console.log(`
-  ┌─────────────────────────────────────────┐
-  │                                         │
-  │   vura admin                            │
-  │                                         │
-  │   Dashboard: ${displayUrl.padEnd(22)} │
-  │   Token:     ${adminToken.slice(0, 8).padEnd(25)} │
-  │   Project:   ${projectName.slice(0, 25).padEnd(25)} │
-  │                                         │
-  │   ${manifest.api.length} API routes · ${manifest.pages.length} pages             │
-  │                                         │
-  └─────────────────────────────────────────┘
-`);
+            ? `http://[${displayHost}]:${boundPort}`
+            : `http://${displayHost}:${boundPort}`;
+        // Every line is padded to one width. They used to be padded to four
+        // different ones (36, 39, 39 and 38 inside a 41-wide box), so the box only
+        // ever looked square by accident of the default port's length.
+        const W = 41;
+        const line = (text = '') => `  │${text.padEnd(W).slice(0, W)}│`;
+        const rule = (l, r) => `  ${l}${'─'.repeat(W)}${r}`;
+        const field = (label, value) => line(`   ${label.padEnd(12)}${value}`);
+        console.log([
+            '',
+            rule('┌', '┐'),
+            line(),
+            line('   vura admin'),
+            line(),
+            field('Dashboard:', displayUrl),
+            field('Token:', `${adminToken.slice(0, 8)}...`),
+            field('Project:', projectName),
+            line(),
+            line(`   ${manifest.api.length} API routes · ${manifest.pages.length} pages`),
+            line(),
+            rule('└', '┘'),
+            '',
+        ].join('\n'));
+    };
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port, opts.host, () => {
+            onListening();
+            resolve();
+        });
     });
+    return {
+        server,
+        port: boundPort,
+        token: adminToken,
+        close: () => new Promise((resolve) => server.close(() => resolve())),
+    };
+}
+export async function adminCommand(args) {
+    await startAdminServer(parseAdminOptions(args));
     await new Promise(() => { });
 }
 // ─── Dashboard HTML ───

package/dist/commands/build.d.ts

@@ -11,5 +11,29 @@
  * 8. Write manifest.json
  * 9. Emit hot deploy templates (Dockerfile, fly.toml, package.json) when hot routes present
  */
+/**
+ * Remove hashed page bundles that this build did not emit.
+ *
+ * Bundle filenames carry a content hash, so every edit to a client or hybrid
+ * page produces a new name and orphans the old one. Nothing removed those, so
+ * `dist/static/_then/pages` grew with every incremental build and the dead
+ * copies shipped to whatever the project deployed to.
+ *
+ * Recursive, because pages nest (`loaders/island.js`). Empty directories left
+ * behind by a deleted page are removed too. `fs` is injected so this can be
+ * tested without touching a disk.
+ */
+export declare function pruneStaleBundles(dir: string, keep: Set<string>, fs: {
+    readdir: (p: string, o: {
+        withFileTypes: true;
+    }) => Promise<Array<{
+        name: string;
+        isDirectory: () => boolean;
+    }>>;
+    rm: (p: string, o?: {
+        recursive?: boolean;
+        force?: boolean;
+    }) => Promise<void>;
+}): Promise<number>;
 export declare function buildCommand(_args: string[]): Promise<void>;
 //# sourceMappingURL=build.d.ts.map

package/dist/commands/build.js

@@ -17,6 +17,49 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join as pathJoin, resolve as pathResolve, relative } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { loadConfig } from '../config-loader.js';
+/**
+ * Remove hashed page bundles that this build did not emit.
+ *
+ * Bundle filenames carry a content hash, so every edit to a client or hybrid
+ * page produces a new name and orphans the old one. Nothing removed those, so
+ * `dist/static/_then/pages` grew with every incremental build and the dead
+ * copies shipped to whatever the project deployed to.
+ *
+ * Recursive, because pages nest (`loaders/island.js`). Empty directories left
+ * behind by a deleted page are removed too. `fs` is injected so this can be
+ * tested without touching a disk.
+ */
+export async function pruneStaleBundles(dir, keep, fs) {
+    let removed = 0;
+    let entries;
+    try {
+        entries = await fs.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return 0; // nothing was written here
+    }
+    for (const entry of entries) {
+        const full = pathJoin(dir, entry.name);
+        if (entry.isDirectory()) {
+            removed += await pruneStaleBundles(full, keep, fs);
+            // The page that lived here is gone; do not leave the empty shell.
+            try {
+                const rest = await fs.readdir(full, { withFileTypes: true });
+                if (rest.length === 0)
+                    await fs.rm(full, { recursive: true, force: true });
+            }
+            catch {
+                /* raced or unreadable: leaving it is harmless */
+            }
+            continue;
+        }
+        if (keep.has(full))
+            continue;
+        await fs.rm(full, { force: true });
+        removed++;
+    }
+    return removed;
+}
 // ---------------------------------------------------------------------------
 // Deploy template strings — inlined so they survive tsc compilation (tsc does
 // not copy non-TS assets).  Emitted by emitHotDeployTemplates() when hot
@@ -188,7 +231,7 @@ export async function buildCommand(_args) {
     // Shared esbuild helpers
     const { build: esbuild } = await import('esbuild');
     const { join, resolve } = await import('node:path');
-    const { mkdir, readFile, rename } = await import('node:fs/promises');
+    const { mkdir, readFile, rename, rm, readdir } = await import('node:fs/promises');
     const { existsSync } = await import('node:fs');
     const { createHash } = await import('node:crypto');
     const cliRequire = createRequire(import.meta.url);
@@ -285,75 +328,21 @@ export async function buildCommand(_args) {
         },
     });
     /** Externals every server-side bundle shares: one framework copy per process. */
-    const serverRuntimeExternals = ['what-framework', 'what-framework/*', 'what-core', 'what-core/*'];
     /** Browser bundles: what-framework is inlined, because a browser has no resolver. */
     const browserEsmResolvePlugin = makeEsmResolvePlugin({ inlineWhatFramework: true });
     /** Server bundles: what-framework stays external, so the process holds one copy. */
     const serverEsmResolvePlugin = makeEsmResolvePlugin({ inlineWhatFramework: false });
-    // 3. Bundle server-mode pages
-    const serverPages = manifest.pages.filter(p => p.mode === 'server' || p.mode === 'hybrid');
-    if (serverPages.length > 0) {
-        console.log(`  Bundling ${serverPages.length} server-mode pages...`);
-        const serverPagesDir = join(root, 'dist', 'server', 'pages');
-        await mkdir(serverPagesDir, { recursive: true });
-        for (const page of serverPages) {
-            const absPath = resolve(root, page.filePath);
-            const outFile = page.filePath.replace(/^src\/pages\//, '').replace(/\.tsx?$/, '.js');
-            const outPath = join(serverPagesDir, outFile);
-            await mkdir(join(outPath, '..'), { recursive: true });
-            await esbuild({
-                entryPoints: [absPath],
-                bundle: true,
-                format: 'esm',
-                target: 'es2022',
-                platform: 'node',
-                outfile: outPath,
-                jsx: 'automatic',
-                jsxImportSource,
-                plugins: [serverEsmResolvePlugin],
-                // Server bundles keep the framework external so the process holds one
-                // copy; core's builder rewrites these files with the same externals.
-                external: serverRuntimeExternals,
-            });
-            console.log(`    ◈ ${page.urlPattern} → dist/server/pages/${outFile}`);
-        }
-    }
-    // 3b. Bundle layout files used by server-mode pages
-    if (manifest.layouts.length > 0 && serverPages.length > 0) {
-        // Only compile layouts that are actually referenced by server-mode pages
-        const usedLayoutPaths = new Set();
-        for (const page of serverPages) {
-            if (page.layouts) {
-                for (const lp of page.layouts)
-                    usedLayoutPaths.add(lp);
-            }
-        }
-        const layoutsToCompile = manifest.layouts.filter(l => usedLayoutPaths.has(l.filePath));
-        if (layoutsToCompile.length > 0) {
-            console.log(`  Bundling ${layoutsToCompile.length} layout files...`);
-            const serverPagesDir = join(root, 'dist', 'server', 'pages');
-            await mkdir(serverPagesDir, { recursive: true });
-            for (const layout of layoutsToCompile) {
-                const absPath = resolve(root, layout.filePath);
-                const outFile = layout.filePath.replace(/^src\/pages\//, '').replace(/\.tsx?$/, '.js');
-                const outPath = join(serverPagesDir, outFile);
-                await mkdir(join(outPath, '..'), { recursive: true });
-                await esbuild({
-                    entryPoints: [absPath],
-                    bundle: true,
-                    format: 'esm',
-                    target: 'es2022',
-                    platform: 'node',
-                    outfile: outPath,
-                    jsx: 'automatic',
-                    jsxImportSource,
-                    plugins: [serverEsmResolvePlugin],
-                    external: serverRuntimeExternals,
-                });
-                console.log(`    ⊟ layout ${layout.dirPattern || '(root)'} → dist/server/pages/${outFile}`);
-            }
-        }
-    }
+    // Steps 3a and 3b used to live here: the CLI bundled every server-mode page
+    // and every layout into `dist/server/pages/`, and then core's `build()` ran
+    // `bundleServerPageModules()` over the same inputs and overwrote every one of
+    // those files. The output was byte-identical, so the only thing the CLI's
+    // copy produced was a second esbuild pass per page and per layout on every
+    // build, plus a second copy of the resolve configuration to keep in sync with
+    // core's. The `useSignal` bug shipped through exactly that kind of duplicate:
+    // one copy was fixed and the other was not.
+    //
+    // Page and layout bundling now happens once, in core. `serverEsmResolvePlugin`
+    // below is still used for the standalone entry.
     // 3c. Bundle browser entries for client and hybrid pages.
     // Each bundle is a generated wrapper (generateClientPageEntry) that imports
     // the page module and calls mount() (client) / hydrate() (hybrid) — bundling
@@ -365,6 +354,10 @@ export async function buildCommand(_args) {
         console.log(`  Bundling ${browserPages.length} browser page entries...`);
         const clientPagesDir = join(root, 'dist', 'static', '_then', 'pages');
         await mkdir(clientPagesDir, { recursive: true });
+        // Every bundle this build writes. Anything else under the directory is a
+        // bundle from an earlier build whose content hash has since changed, and
+        // nothing references it any more.
+        const emittedBundles = new Set();
         const { dirname, basename } = await import('node:path');
         for (const page of browserPages) {
             const absPath = resolve(root, page.filePath);
@@ -409,10 +402,23 @@ export async function buildCommand(_args) {
                 .slice(0, 12);
             const hashedOutFile = outFile.replace(/\.js$/, `.${bundleHash}.js`);
             await rename(outPath, join(clientPagesDir, hashedOutFile));
+            emittedBundles.add(join(clientPagesDir, hashedOutFile));
             const scriptPath = `/_then/pages/${hashedOutFile.replace(/\\/g, '/')}`;
             clientScripts[page.filePath] = scriptPath;
             console.log(`    ◇ ${page.urlPattern} → dist/static${scriptPath}`);
         }
+        // Drop bundles left behind by earlier builds. The filename carries a
+        // content hash, so editing a page emits a new name and orphans the old
+        // one, which nothing then removes: `dist/` grew with every incremental
+        // build and shipped the dead copies to whatever you deployed to.
+        //
+        // Pruning *after* the writes rather than wiping the directory first is
+        // deliberate. A build that fails partway leaves the previous bundles
+        // intact instead of leaving nothing to serve.
+        const pruned = await pruneStaleBundles(clientPagesDir, emittedBundles, { readdir, rm });
+        if (pruned > 0) {
+            console.log(`    ✓ removed ${pruned} stale bundle${pruned === 1 ? '' : 's'} from earlier builds`);
+        }
     }
     // 4. Build API routes + task entries
     console.log('  Building...');

package/dist/commands/dev.js

@@ -14,7 +14,7 @@
  */
 import { importRouteModule } from './shared.js';
 import { resolve as nodeResolve, relative as nodeRelative } from 'node:path';
-import { buildManifest, compilePageRoutes, matchPageRoute, compileRoutes, matchApiPath, getLogger, wrapDocument, escapeHtml, parseNodeBody, reportError, getMimeType, runTaskOnce, buildTaskEnvelope, createApiApp, createWsUpgradeHandler, createNoServerWebSocketServer, GLOBAL_HOOKS_FILENAMES, nodeToWebRequest, writeWebResponse, generateClientPageEntry, vuraBrowserResolvePlugin, vuraActionsStubPlugin, registerActionModules, ACTION_ENDPOINT, createMiddlewareRunner, createVuraRenderRoute, } from '@celsian/vura-core';
+import { buildManifest, compilePageRoutes, matchPageRoute, compileRoutes, matchApiPath, getLogger, wrapDocument, escapeHtml, parseNodeBody, reportError, getMimeType, runTaskOnce, buildTaskEnvelope, createApiApp, createWsUpgradeHandler, createNoServerWebSocketServer, GLOBAL_HOOKS_FILENAMES, nodeToWebRequest, writeWebResponse, generateClientPageEntry, vuraBrowserResolvePlugin, vuraActionsStubPlugin, registerActionModules, ACTION_ENDPOINT, createMiddlewareRunner, createVuraRenderRoute, createVuraStreamRoute, isStreamingPage, } from '@celsian/vura-core';
 export function parseDevOptions(args, projectRoot = process.cwd()) {
     const portArg = args.find((_, i) => args[i - 1] === '--port');
     const hostArg = args.find((_, i) => args[i - 1] === '--host');
@@ -207,6 +207,13 @@ export async function startStandaloneServer(manifest, opts) {
     const devRenderRouteFor = (page) => createVuraRenderRoute({
         extraScripts: () => (page.mode === 'hybrid' ? [browserScriptPath(page)] : []),
     });
+    /**
+     * The streaming counterpart, built from the same options as the string
+     * renderer above so the two cannot disagree about which scripts a page gets.
+     */
+    const devStreamRouteFor = (page) => createVuraStreamRoute({
+        extraScripts: () => (page.mode === 'hybrid' ? [browserScriptPath(page)] : []),
+    });
     const { existsSync } = await import('node:fs');
     // ── Middleware ──
     // Loaded through the same cached loader as routes so an edit is picked up on
@@ -670,6 +677,21 @@ export async function startStandaloneServer(manifest, opts) {
                             method,
                             headers: req.headers,
                         });
+                        // Streaming pages take the same route in dev as in production,
+                        // through the same helper and the same response writer. A dev
+                        // server that renders a streamed page as a string would hide
+                        // exactly the bugs streaming introduces.
+                        if (method === 'GET' && isStreamingPage(runtimePage)) {
+                            const streamed = await devStreamRouteFor(pageMatch.page)({
+                                path: url.pathname,
+                                query: Object.fromEntries(url.searchParams.entries()),
+                                route: { path: url.pathname, page: { mode: 'server' }, vura: runtimePage },
+                                params: pageMatch.params,
+                                request: webReq,
+                            });
+                            await writeWebResponse(res, streamed);
+                            return;
+                        }
                         const result = await devRenderRouteFor(pageMatch.page)({
                             path: url.pathname,
                             query: Object.fromEntries(url.searchParams.entries()),
@@ -802,7 +824,13 @@ export async function startStandaloneServer(manifest, opts) {
     process.on('SIGINT', onSigint);
     await new Promise((resolve) => {
         server.listen(opts.port, opts.host, () => {
-            console.log(`  Server listening on http://${opts.host}:${opts.port}\n`);
+            // The *bound* port, not the requested one. `--port 0` means "pick a free
+            // port", and printing the request back gave a URL of `:0`, which cannot
+            // be connected to. The address is also what tells you which port you got
+            // when the requested one was taken.
+            const addr = server.address();
+            const boundPort = addr && typeof addr === 'object' ? addr.port : opts.port;
+            console.log(`  Server listening on http://${opts.host}:${boundPort}\n`);
             // Warn once at startup when the user explicitly exposes the dev server beyond loopback.
             if (isLanDevHost(opts.host)) {
                 console.warn(`  [vura] Dev server exposed on ${opts.host}. Only use --host for trusted LAN testing.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celsian/vura-cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Vura CLI — build and deploy full-stack apps",
   "type": "module",
   "bin": {
@@ -15,12 +15,12 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@celsian/vura-core": "0.7.0",
-    "esbuild": "^0.28.1",
-    "what-framework": "^0.13.2"
+    "@celsian/vura-core": "0.8.0",
+    "esbuild": "^0.28.2",
+    "what-framework": "^0.13.4"
   },
   "peerDependencies": {
-    "@celsian/vura-adapter-vura": "0.7.0",
+    "@celsian/vura-adapter-vura": "0.8.0",
     "ws": "^8.0.0"
   },
   "peerDependenciesMeta": {
@@ -32,9 +32,9 @@
     }
   },
   "devDependencies": {
-    "@celsian/vura-adapter-vura": "0.7.0",
+    "@celsian/vura-adapter-vura": "0.8.0",
     "@types/ws": "^8.18.1",
-    "ws": "^8.21.0"
+    "ws": "^8.21.3"
   },
   "license": "MIT",
   "publishConfig": {