Fix production dynamic-page modules and trusted email previews

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.8.72",
+  "version": "0.8.73",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/cli/src/build.ts

@@ -202,7 +202,10 @@ export async function runBuild(appRoot: string): Promise<void> {
       .update(source)
       .digest("hex")
       .slice(0, 16);
-    const clientOut = join(clientModulesDir, `${basename(file, ".wrn")}-${clientHash}.mjs`);
+    // Dynamic route names contain brackets, which the production asset handler
+    // deliberately rejects. Keep public artifact names within its safe alphabet.
+    const clientStem = basename(file, ".wrn").replace(/[^A-Za-z0-9._-]/g, "_");
+    const clientOut = join(clientModulesDir, `${clientStem}-${clientHash}.mjs`);
     const clientUrl = `/__wrnexus/client/${basename(clientOut)}`;
     const clientEntry = join(compiledDir, `client${artifactId}.entry.mjs`);
 

packages/cli/test/plugin-runtime-production.test.ts

@@ -38,6 +38,8 @@ export default {
     join(root, "app", "pages", "index.wrn"),
     `import RuntimeProbe from "../components/RuntimeProbe.wrn"\npage Home { view { <RuntimeProbe /> } }\n`,
   );
+  writeFileSync(join(root, "app", "pages", "[id].wrn"),
+    `page Dynamic { functions { client function selectPanel() { console.log('panel-ready') } } view { <button @click="selectPanel()">Panel</button> } }`);
 
   await runBuild(root);
 
@@ -76,6 +78,11 @@ export default {
 
     const page = await fetch(`http://127.0.0.1:${port}/`);
     expect(page.status).toBe(200);
+    const dynamic = await fetch(`http://127.0.0.1:${port}/example`);
+    const dynamicHtml = await dynamic.text();
+    const modulePath = dynamicHtml.match(/\/__wrnexus\/client\/[^"\s<>]+\.mjs/)?.[0];
+    expect(modulePath).toMatch(/^\/__wrnexus\/client\/[A-Za-z0-9._-]+\.mjs$/);
+    expect((await fetch(`http://127.0.0.1:${port}${modulePath}`)).status).toBe(200);
     const html = await page.text();
     const assetPath = html.match(/(\/__wrnexus\/assets\/runtime-fixture\.[a-f0-9]+\.js)/)?.[1];
     expect(assetPath).toBeTruthy();