@celsian/vura-cli 0.7.0 → 0.8.1

package/README.md

@@ -52,10 +52,8 @@ and 12 GiB profiles.
 
 ## Documentation
 
-_vura.io docs site launches with v0.5 — until then, see the repo README and CHANGELOG._
-
 - [Quick start — /ladder/0-create/](https://vura.io/ladder/0-create/)
-- [Task routes — /reference/tasks/](https://vura.io/ladder/5-tasks/)
+- [Task routes — /ladder/5-tasks/](https://vura.io/ladder/5-tasks/)
 - [Self-host — /self-host/](https://vura.io/self-host/)
 
 ## License

package/dist/commands/admin.d.ts

@@ -23,6 +23,22 @@ export declare function isAllowedAdminRequest(headers: {
     host?: string | string[];
     origin?: string | string[];
 }, bindHost: string, port: number): boolean;
+/**
+ * Start the admin server and return once it is listening.
+ *
+ * Split out of `adminCommand` so tests can drive a real server: the command
+ * itself never returns, and the bug this exists to pin lived in the wiring
+ * rather than in any function a unit test could reach. `vura admin --port 0`
+ * built its same-origin allowlist from the *requested* port, so the allowlist
+ * held `localhost:0` while the browser sent the real one and every API request
+ * was refused as cross-origin with a valid token in hand.
+ */
+export declare function startAdminServer(opts: AdminOptions): Promise<{
+    server: import('node:http').Server;
+    port: number;
+    token: string;
+    close: () => Promise<void>;
+}>;
 export declare function adminCommand(args: string[]): Promise<void>;
 export declare function renderDashboardHtml(adminToken: string): string;
 export {};

package/dist/commands/admin.js

@@ -60,8 +60,17 @@ export function isAllowedAdminRequest(headers, bindHost, port) {
         return false;
     }
 }
-export async function adminCommand(args) {
-    const opts = parseAdminOptions(args);
+/**
+ * Start the admin server and return once it is listening.
+ *
+ * Split out of `adminCommand` so tests can drive a real server: the command
+ * itself never returns, and the bug this exists to pin lived in the wiring
+ * rather than in any function a unit test could reach. `vura admin --port 0`
+ * built its same-origin allowlist from the *requested* port, so the allowlist
+ * held `localhost:0` while the browser sent the real one and every API request
+ * was refused as cross-origin with a valid token in hand.
+ */
+export async function startAdminServer(opts) {
     assertSafeAdminBindHost(opts.host);
     const { createServer } = await import('node:http');
     const { randomBytes } = await import('node:crypto');
@@ -72,11 +81,17 @@ export async function adminCommand(args) {
     const config = await loadConfig(opts.projectRoot);
     const projectName = basename(opts.projectRoot);
     const adminToken = randomBytes(32).toString('base64url');
+    // The port the server actually bound. `--port 0` means "pick a free port",
+    // and the same-origin allowlist below is built from it: with the *requested*
+    // port the allowlist held `localhost:0` while the browser sent the real one,
+    // so every request to a `--port 0` dashboard was refused as cross-origin.
+    // Assigned in the listen callback, before any request can arrive.
+    let boundPort = opts.port;
     const server = createServer(async (req, res) => {
         const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
         const method = (req.method ?? 'GET').toUpperCase();
         const isAdminApi = url.pathname.startsWith('/__admin/api/');
-        const sameOrigin = isAllowedAdminRequest(req.headers, opts.host, opts.port);
+        const sameOrigin = isAllowedAdminRequest(req.headers, opts.host, boundPort);
         const apiHeaders = adminApiHeaders();
         if (method === 'OPTIONS') {
             res.writeHead(sameOrigin ? 204 : 403, {
@@ -311,25 +326,52 @@ export async function adminCommand(args) {
         res.writeHead(404, apiHeaders);
         res.end(JSON.stringify({ error: 'Not found' }));
     });
-    server.listen(opts.port, opts.host, () => {
+    const onListening = () => {
         const displayHost = opts.host === '127.0.0.1' ? 'localhost' : opts.host;
+        const addr = server.address();
+        boundPort = addr && typeof addr === 'object' ? addr.port : opts.port;
         const displayUrl = displayHost.includes(':')
-            ? `http://[${displayHost}]:${opts.port}`
-            : `http://${displayHost}:${opts.port}`;
-        console.log(`
-  ┌─────────────────────────────────────────┐
-  │                                         │
-  │   vura admin                            │
-  │                                         │
-  │   Dashboard: ${displayUrl.padEnd(22)} │
-  │   Token:     ${adminToken.slice(0, 8).padEnd(25)} │
-  │   Project:   ${projectName.slice(0, 25).padEnd(25)} │
-  │                                         │
-  │   ${manifest.api.length} API routes · ${manifest.pages.length} pages             │
-  │                                         │
-  └─────────────────────────────────────────┘
-`);
+            ? `http://[${displayHost}]:${boundPort}`
+            : `http://${displayHost}:${boundPort}`;
+        // Every line is padded to one width. They used to be padded to four
+        // different ones (36, 39, 39 and 38 inside a 41-wide box), so the box only
+        // ever looked square by accident of the default port's length.
+        const W = 41;
+        const line = (text = '') => `  │${text.padEnd(W).slice(0, W)}│`;
+        const rule = (l, r) => `  ${l}${'─'.repeat(W)}${r}`;
+        const field = (label, value) => line(`   ${label.padEnd(12)}${value}`);
+        console.log([
+            '',
+            rule('┌', '┐'),
+            line(),
+            line('   vura admin'),
+            line(),
+            field('Dashboard:', displayUrl),
+            field('Token:', `${adminToken.slice(0, 8)}...`),
+            field('Project:', projectName),
+            line(),
+            line(`   ${manifest.api.length} API routes · ${manifest.pages.length} pages`),
+            line(),
+            rule('└', '┘'),
+            '',
+        ].join('\n'));
+    };
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port, opts.host, () => {
+            onListening();
+            resolve();
+        });
     });
+    return {
+        server,
+        port: boundPort,
+        token: adminToken,
+        close: () => new Promise((resolve) => server.close(() => resolve())),
+    };
+}
+export async function adminCommand(args) {
+    await startAdminServer(parseAdminOptions(args));
     await new Promise(() => { });
 }
 // ─── Dashboard HTML ───

package/dist/commands/build.d.ts

@@ -2,14 +2,42 @@
  * `vura build` — Build the project for deployment.
  *
  * 1. Scan routes → build manifest
- * 2. Generate server entry (for hot server)
- * 3. Generate function entries (for serverless)
- * 4. Generate task entries (for task routes)
- * 5. Bundle server-mode pages with esbuild
- * 6. Render static pages (mode: 'static')
- * 7. Run adapter.buildEnd() if configured
- * 8. Write manifest.json
- * 9. Emit hot deploy templates (Dockerfile, fly.toml, package.json) when hot routes present
+ * 2. Bundle browser entries for client and hybrid pages
+ * 3. Render build-time pages (static, client shells, hybrid HTML) → dist/static
+ * 4. Copy public/ → dist/public
+ * 5. core build(): server entry, function entries, task entries, manifest.json,
+ *    then adapter.buildEnd()
+ * 6. Emit hot deploy templates (Dockerfile, fly.toml, package.json)
+ *
+ * The adapter runs last, and the two steps that write dist/static and
+ * dist/public run before it, because an adapter that serves prerendered pages
+ * has to be able to read them.
+ */
+/**
+ * Remove hashed page bundles that this build did not emit.
+ *
+ * Bundle filenames carry a content hash, so every edit to a client or hybrid
+ * page produces a new name and orphans the old one. Nothing removed those, so
+ * `dist/static/_then/pages` grew with every incremental build and the dead
+ * copies shipped to whatever the project deployed to.
+ *
+ * The sweep itself now lives in core as `pruneStaleOutputs`, because the same
+ * accretion happens to `dist/server`, `dist/functions` and each adapter's own
+ * output directory, and four copies of a recursive delete is four chances to
+ * fix one and not the others. This wrapper is the client-bundle name and the
+ * client-bundle reason; the behaviour is shared.
  */
+export declare function pruneStaleBundles(dir: string, keep: Set<string>, fs: {
+    readdir: (p: string, o: {
+        withFileTypes: true;
+    }) => Promise<Array<{
+        name: string;
+        isDirectory: () => boolean;
+    }>>;
+    rm: (p: string, o?: {
+        recursive?: boolean;
+        force?: boolean;
+    }) => Promise<void>;
+}): Promise<number>;
 export declare function buildCommand(_args: string[]): Promise<void>;
 //# sourceMappingURL=build.d.ts.map

package/dist/commands/build.js

@@ -2,21 +2,40 @@
  * `vura build` — Build the project for deployment.
  *
  * 1. Scan routes → build manifest
- * 2. Generate server entry (for hot server)
- * 3. Generate function entries (for serverless)
- * 4. Generate task entries (for task routes)
- * 5. Bundle server-mode pages with esbuild
- * 6. Render static pages (mode: 'static')
- * 7. Run adapter.buildEnd() if configured
- * 8. Write manifest.json
- * 9. Emit hot deploy templates (Dockerfile, fly.toml, package.json) when hot routes present
+ * 2. Bundle browser entries for client and hybrid pages
+ * 3. Render build-time pages (static, client shells, hybrid HTML) → dist/static
+ * 4. Copy public/ → dist/public
+ * 5. core build(): server entry, function entries, task entries, manifest.json,
+ *    then adapter.buildEnd()
+ * 6. Emit hot deploy templates (Dockerfile, fly.toml, package.json)
+ *
+ * The adapter runs last, and the two steps that write dist/static and
+ * dist/public run before it, because an adapter that serves prerendered pages
+ * has to be able to read them.
  */
-import { buildManifest, build, renderStaticPages, generateClientPageEntry, vuraBrowserResolvePlugin, vuraActionsStubPlugin } from '@celsian/vura-core';
+import { buildManifest, build, renderStaticPages, generateClientPageEntry, vuraBrowserResolvePlugin, vuraActionsStubPlugin, pruneStaleOutputs } from '@celsian/vura-core';
 import { createRequire } from 'node:module';
 import { existsSync, readFileSync } from 'node:fs';
 import { join as pathJoin, resolve as pathResolve, relative } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { loadConfig } from '../config-loader.js';
+/**
+ * Remove hashed page bundles that this build did not emit.
+ *
+ * Bundle filenames carry a content hash, so every edit to a client or hybrid
+ * page produces a new name and orphans the old one. Nothing removed those, so
+ * `dist/static/_then/pages` grew with every incremental build and the dead
+ * copies shipped to whatever the project deployed to.
+ *
+ * The sweep itself now lives in core as `pruneStaleOutputs`, because the same
+ * accretion happens to `dist/server`, `dist/functions` and each adapter's own
+ * output directory, and four copies of a recursive delete is four chances to
+ * fix one and not the others. This wrapper is the client-bundle name and the
+ * client-bundle reason; the behaviour is shared.
+ */
+export async function pruneStaleBundles(dir, keep, fs) {
+    return pruneStaleOutputs(dir, keep, fs);
+}
 // ---------------------------------------------------------------------------
 // Deploy template strings — inlined so they survive tsc compilation (tsc does
 // not copy non-TS assets).  Emitted by emitHotDeployTemplates() when hot
@@ -188,7 +207,7 @@ export async function buildCommand(_args) {
     // Shared esbuild helpers
     const { build: esbuild } = await import('esbuild');
     const { join, resolve } = await import('node:path');
-    const { mkdir, readFile, rename } = await import('node:fs/promises');
+    const { mkdir, readFile, rename, rm, readdir } = await import('node:fs/promises');
     const { existsSync } = await import('node:fs');
     const { createHash } = await import('node:crypto');
     const cliRequire = createRequire(import.meta.url);
@@ -285,76 +304,22 @@ export async function buildCommand(_args) {
         },
     });
     /** Externals every server-side bundle shares: one framework copy per process. */
-    const serverRuntimeExternals = ['what-framework', 'what-framework/*', 'what-core', 'what-core/*'];
     /** Browser bundles: what-framework is inlined, because a browser has no resolver. */
     const browserEsmResolvePlugin = makeEsmResolvePlugin({ inlineWhatFramework: true });
     /** Server bundles: what-framework stays external, so the process holds one copy. */
     const serverEsmResolvePlugin = makeEsmResolvePlugin({ inlineWhatFramework: false });
-    // 3. Bundle server-mode pages
-    const serverPages = manifest.pages.filter(p => p.mode === 'server' || p.mode === 'hybrid');
-    if (serverPages.length > 0) {
-        console.log(`  Bundling ${serverPages.length} server-mode pages...`);
-        const serverPagesDir = join(root, 'dist', 'server', 'pages');
-        await mkdir(serverPagesDir, { recursive: true });
-        for (const page of serverPages) {
-            const absPath = resolve(root, page.filePath);
-            const outFile = page.filePath.replace(/^src\/pages\//, '').replace(/\.tsx?$/, '.js');
-            const outPath = join(serverPagesDir, outFile);
-            await mkdir(join(outPath, '..'), { recursive: true });
-            await esbuild({
-                entryPoints: [absPath],
-                bundle: true,
-                format: 'esm',
-                target: 'es2022',
-                platform: 'node',
-                outfile: outPath,
-                jsx: 'automatic',
-                jsxImportSource,
-                plugins: [serverEsmResolvePlugin],
-                // Server bundles keep the framework external so the process holds one
-                // copy; core's builder rewrites these files with the same externals.
-                external: serverRuntimeExternals,
-            });
-            console.log(`    ◈ ${page.urlPattern} → dist/server/pages/${outFile}`);
-        }
-    }
-    // 3b. Bundle layout files used by server-mode pages
-    if (manifest.layouts.length > 0 && serverPages.length > 0) {
-        // Only compile layouts that are actually referenced by server-mode pages
-        const usedLayoutPaths = new Set();
-        for (const page of serverPages) {
-            if (page.layouts) {
-                for (const lp of page.layouts)
-                    usedLayoutPaths.add(lp);
-            }
-        }
-        const layoutsToCompile = manifest.layouts.filter(l => usedLayoutPaths.has(l.filePath));
-        if (layoutsToCompile.length > 0) {
-            console.log(`  Bundling ${layoutsToCompile.length} layout files...`);
-            const serverPagesDir = join(root, 'dist', 'server', 'pages');
-            await mkdir(serverPagesDir, { recursive: true });
-            for (const layout of layoutsToCompile) {
-                const absPath = resolve(root, layout.filePath);
-                const outFile = layout.filePath.replace(/^src\/pages\//, '').replace(/\.tsx?$/, '.js');
-                const outPath = join(serverPagesDir, outFile);
-                await mkdir(join(outPath, '..'), { recursive: true });
-                await esbuild({
-                    entryPoints: [absPath],
-                    bundle: true,
-                    format: 'esm',
-                    target: 'es2022',
-                    platform: 'node',
-                    outfile: outPath,
-                    jsx: 'automatic',
-                    jsxImportSource,
-                    plugins: [serverEsmResolvePlugin],
-                    external: serverRuntimeExternals,
-                });
-                console.log(`    ⊟ layout ${layout.dirPattern || '(root)'} → dist/server/pages/${outFile}`);
-            }
-        }
-    }
-    // 3c. Bundle browser entries for client and hybrid pages.
+    // Steps 3a and 3b used to live here: the CLI bundled every server-mode page
+    // and every layout into `dist/server/pages/`, and then core's `build()` ran
+    // `bundleServerPageModules()` over the same inputs and overwrote every one of
+    // those files. The output was byte-identical, so the only thing the CLI's
+    // copy produced was a second esbuild pass per page and per layout on every
+    // build, plus a second copy of the resolve configuration to keep in sync with
+    // core's. The `useSignal` bug shipped through exactly that kind of duplicate:
+    // one copy was fixed and the other was not.
+    //
+    // Page and layout bundling now happens once, in core. `serverEsmResolvePlugin`
+    // below is still used for the standalone entry.
+    // 2. Bundle browser entries for client and hybrid pages.
     // Each bundle is a generated wrapper (generateClientPageEntry) that imports
     // the page module and calls mount() (client) / hydrate() (hybrid) — bundling
     // the raw page module alone leaves the shell at "Loading..." forever because
@@ -365,6 +330,10 @@ export async function buildCommand(_args) {
         console.log(`  Bundling ${browserPages.length} browser page entries...`);
         const clientPagesDir = join(root, 'dist', 'static', '_then', 'pages');
         await mkdir(clientPagesDir, { recursive: true });
+        // Every bundle this build writes. Anything else under the directory is a
+        // bundle from an earlier build whose content hash has since changed, and
+        // nothing references it any more.
+        const emittedBundles = new Set();
         const { dirname, basename } = await import('node:path');
         for (const page of browserPages) {
             const absPath = resolve(root, page.filePath);
@@ -389,6 +358,7 @@ export async function buildCommand(_args) {
                 outfile: outPath,
                 jsx: 'automatic',
                 jsxImportSource,
+                absWorkingDir: root,
                 // Browser-resolve first: a page that imports `@celsian/vura-core` for
                 // useLoaderData must get the pure client module here, not the package
                 // root, which reaches node:fs and cannot be bundled for a browser.
@@ -409,20 +379,25 @@ export async function buildCommand(_args) {
                 .slice(0, 12);
             const hashedOutFile = outFile.replace(/\.js$/, `.${bundleHash}.js`);
             await rename(outPath, join(clientPagesDir, hashedOutFile));
+            emittedBundles.add(join(clientPagesDir, hashedOutFile));
             const scriptPath = `/_then/pages/${hashedOutFile.replace(/\\/g, '/')}`;
             clientScripts[page.filePath] = scriptPath;
             console.log(`    ◇ ${page.urlPattern} → dist/static${scriptPath}`);
         }
+        // Drop bundles left behind by earlier builds. The filename carries a
+        // content hash, so editing a page emits a new name and orphans the old
+        // one, which nothing then removes: `dist/` grew with every incremental
+        // build and shipped the dead copies to whatever you deployed to.
+        //
+        // Pruning *after* the writes rather than wiping the directory first is
+        // deliberate. A build that fails partway leaves the previous bundles
+        // intact instead of leaving nothing to serve.
+        const pruned = await pruneStaleBundles(clientPagesDir, emittedBundles, { readdir, rm });
+        if (pruned > 0) {
+            console.log(`    ✓ removed ${pruned} stale bundle${pruned === 1 ? '' : 's'} from earlier builds`);
+        }
     }
-    // 4. Build API routes + task entries
-    console.log('  Building...');
-    const result = await build(manifest, config, root);
-    console.log(`  Server entry: ${result.serverEntry}`);
-    console.log(`  Functions: ${result.functions.length} serverless bundles`);
-    if (result.taskEntries.length > 0) {
-        console.log(`  Tasks: ${result.taskEntries.length} task entries`);
-    }
-    // 5. Render build-time pages (static, client shells, and hybrid prerendered HTML)
+    // 3. Render build-time pages (static, client shells, and hybrid prerendered HTML)
     const staticPages = manifest.pages.filter(p => p.mode !== 'server');
     if (staticPages.length > 0) {
         console.log(`  Rendering ${staticPages.length} build-time pages...`);
@@ -462,6 +437,12 @@ export async function buildCommand(_args) {
                 outfile: tmpFile,
                 jsx: 'automatic',
                 jsxImportSource,
+                // esbuild anchors resolution to the working directory its service
+                // captured, which is not necessarily the cwd at call time. Core's
+                // bundlers pass this for the same reason; this one did not, and a
+                // second build in one process resolved against the first build's
+                // directory — which fails outright once that directory is gone.
+                absWorkingDir: root,
                 plugins: [serverEsmResolvePlugin],
                 external: sharedRuntimeExternals,
             });
@@ -476,7 +457,7 @@ export async function buildCommand(_args) {
         const { rm } = await import('node:fs/promises');
         await rm(tmpDir, { recursive: true, force: true }).catch(() => { });
     }
-    // 6. Copy public assets to dist/public/ for production static serving.
+    // 4. Copy public assets to dist/public/ for production static serving.
     // Prefer the framework-standard root public/ directory, but support the
     // historical starter/runbook layout src/public/ when root public/ is absent.
     const publicDir = join(root, 'public');
@@ -493,10 +474,25 @@ export async function buildCommand(_args) {
         const label = publicSourceDir === publicDir ? 'public/' : 'src/public/';
         console.log(`  Copied ${label} → dist/public/`);
     }
+    // 5. Build API routes, task entries and the adapter artifacts.
+    //
+    // This runs AFTER the page render and the public copy, not before. The
+    // adapter's buildEnd is the last step by design — this file's own header has
+    // said so since it was written — and an adapter that reads dist/static, which
+    // is what serving prerendered pages on Cloudflare and Lambda requires, saw
+    // either nothing on a clean build or the PREVIOUS build's HTML on a dirty
+    // one. It ran fourth of nine only because the page render was added later.
+    console.log('  Building...');
+    const result = await build(manifest, config, root);
+    console.log(`  Server entry: ${result.serverEntry}`);
+    console.log(`  Functions: ${result.functions.length} serverless bundles`);
+    if (result.taskEntries.length > 0) {
+        console.log(`  Tasks: ${result.taskEntries.length} task entries`);
+    }
     if (config.adapter) {
         console.log(`  Adapter: ${config.adapter.name}`);
     }
-    // 9. Emit hot deploy templates when the project has hot routes
+    // 6. Emit hot deploy templates when the project has hot routes
     const hotRoutes = manifest.api.filter(r => r.kind === 'hot');
     const hasWsRoutes = hotRoutes.some(r => r.hasWebsocket === true);
     const distDir = join(root, 'dist');

package/dist/commands/dev.js

@@ -14,7 +14,7 @@
  */
 import { importRouteModule } from './shared.js';
 import { resolve as nodeResolve, relative as nodeRelative } from 'node:path';
-import { buildManifest, compilePageRoutes, matchPageRoute, compileRoutes, matchApiPath, getLogger, wrapDocument, escapeHtml, parseNodeBody, reportError, getMimeType, runTaskOnce, buildTaskEnvelope, createApiApp, createWsUpgradeHandler, createNoServerWebSocketServer, GLOBAL_HOOKS_FILENAMES, nodeToWebRequest, writeWebResponse, generateClientPageEntry, vuraBrowserResolvePlugin, vuraActionsStubPlugin, registerActionModules, ACTION_ENDPOINT, createMiddlewareRunner, createVuraRenderRoute, } from '@celsian/vura-core';
+import { buildManifest, compilePageRoutes, matchPageRoute, compileRoutes, matchApiPath, getLogger, wrapDocument, escapeHtml, parseNodeBody, reportError, getMimeType, runTaskOnce, buildTaskEnvelope, createApiApp, createWsUpgradeHandler, createNoServerWebSocketServer, GLOBAL_HOOKS_FILENAMES, nodeToWebRequest, writeWebResponse, generateClientPageEntry, vuraBrowserResolvePlugin, vuraActionsStubPlugin, registerActionModules, ACTION_ENDPOINT, createMiddlewareRunner, createVuraRenderRoute, createVuraStreamRoute, isStreamingPage, } from '@celsian/vura-core';
 export function parseDevOptions(args, projectRoot = process.cwd()) {
     const portArg = args.find((_, i) => args[i - 1] === '--port');
     const hostArg = args.find((_, i) => args[i - 1] === '--host');
@@ -207,6 +207,13 @@ export async function startStandaloneServer(manifest, opts) {
     const devRenderRouteFor = (page) => createVuraRenderRoute({
         extraScripts: () => (page.mode === 'hybrid' ? [browserScriptPath(page)] : []),
     });
+    /**
+     * The streaming counterpart, built from the same options as the string
+     * renderer above so the two cannot disagree about which scripts a page gets.
+     */
+    const devStreamRouteFor = (page) => createVuraStreamRoute({
+        extraScripts: () => (page.mode === 'hybrid' ? [browserScriptPath(page)] : []),
+    });
     const { existsSync } = await import('node:fs');
     // ── Middleware ──
     // Loaded through the same cached loader as routes so an edit is picked up on
@@ -670,6 +677,21 @@ export async function startStandaloneServer(manifest, opts) {
                             method,
                             headers: req.headers,
                         });
+                        // Streaming pages take the same route in dev as in production,
+                        // through the same helper and the same response writer. A dev
+                        // server that renders a streamed page as a string would hide
+                        // exactly the bugs streaming introduces.
+                        if (method === 'GET' && isStreamingPage(runtimePage)) {
+                            const streamed = await devStreamRouteFor(pageMatch.page)({
+                                path: url.pathname,
+                                query: Object.fromEntries(url.searchParams.entries()),
+                                route: { path: url.pathname, page: { mode: 'server' }, vura: runtimePage },
+                                params: pageMatch.params,
+                                request: webReq,
+                            });
+                            await writeWebResponse(res, streamed);
+                            return;
+                        }
                         const result = await devRenderRouteFor(pageMatch.page)({
                             path: url.pathname,
                             query: Object.fromEntries(url.searchParams.entries()),
@@ -802,7 +824,13 @@ export async function startStandaloneServer(manifest, opts) {
     process.on('SIGINT', onSigint);
     await new Promise((resolve) => {
         server.listen(opts.port, opts.host, () => {
-            console.log(`  Server listening on http://${opts.host}:${opts.port}\n`);
+            // The *bound* port, not the requested one. `--port 0` means "pick a free
+            // port", and printing the request back gave a URL of `:0`, which cannot
+            // be connected to. The address is also what tells you which port you got
+            // when the requested one was taken.
+            const addr = server.address();
+            const boundPort = addr && typeof addr === 'object' ? addr.port : opts.port;
+            console.log(`  Server listening on http://${opts.host}:${boundPort}\n`);
             // Warn once at startup when the user explicitly exposes the dev server beyond loopback.
             if (isLanDevHost(opts.host)) {
                 console.warn(`  [vura] Dev server exposed on ${opts.host}. Only use --host for trusted LAN testing.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celsian/vura-cli",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Vura CLI — build and deploy full-stack apps",
   "type": "module",
   "bin": {
@@ -15,12 +15,12 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@celsian/vura-core": "0.7.0",
-    "esbuild": "^0.28.1",
-    "what-framework": "^0.13.2"
+    "@celsian/vura-core": "0.8.1",
+    "esbuild": "^0.28.2",
+    "what-framework": "^0.13.6"
   },
   "peerDependencies": {
-    "@celsian/vura-adapter-vura": "0.7.0",
+    "@celsian/vura-adapter-vura": "0.8.1",
     "ws": "^8.0.0"
   },
   "peerDependenciesMeta": {
@@ -32,9 +32,9 @@
     }
   },
   "devDependencies": {
-    "@celsian/vura-adapter-vura": "0.7.0",
+    "@celsian/vura-adapter-vura": "0.8.1",
     "@types/ws": "^8.18.1",
-    "ws": "^8.21.0"
+    "ws": "^8.21.3"
   },
   "license": "MIT",
   "publishConfig": {