@cosmicdrift/kumiko-dev-server 1.0.0 → 2.0.0

package/bin/kumiko-schema-check.ts

@@ -68,6 +68,7 @@ async function readMountedFeatures(runConfigPath: string): Promise<Set<string>>
   const mod = (await import(runConfigPath)) as {
     APP_FEATURES?: ReadonlyArray<{ name: string }>;
     HAS_AUTH?: boolean;
+    HAS_SIGNUP?: boolean;
   };
   if (!mod.APP_FEATURES) {
     throw new Error(
@@ -85,6 +86,12 @@ async function readMountedFeatures(runConfigPath: string): Promise<Set<string>>
   if (mod.HAS_AUTH ?? true) {
     for (const name of implicitAuthModeFeatureNames()) set.add(name);
   }
+  // auth-self-registration is only prepended when authOptions.signup is set
+  // (composeFeatures) — opt-in via HAS_SIGNUP so apps without signup don't
+  // get a stale-registry false positive (#1521).
+  if (mod.HAS_SIGNUP === true) {
+    set.add("auth-self-registration");
+  }
   return set;
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "1.0.0",
-  "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
+  "version": "2.0.0",
+  "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Not shipped into production node_modules — see @cosmicdrift/kumiko-server-runtime for the prod boot path.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
@@ -26,9 +26,13 @@
       "types": "./src/build.ts",
       "default": "./src/build.ts"
     },
-    "./compose-features": {
-      "types": "./src/compose-features.ts",
-      "default": "./src/compose-features.ts"
+    "./compose-stacks": {
+      "types": "./src/compose-stacks.ts",
+      "default": "./src/compose-stacks.ts"
+    },
+    "./setup-test-stack-from-features": {
+      "types": "./src/setup-test-stack-from-features.ts",
+      "default": "./src/setup-test-stack-from-features.ts"
     },
     "./schema-apply": {
       "types": "./src/schema-apply.ts",
@@ -50,8 +54,9 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "1.0.0",
-    "@cosmicdrift/kumiko-framework": "1.0.0",
+    "@cosmicdrift/kumiko-bundled-features": "2.0.0",
+    "@cosmicdrift/kumiko-framework": "2.0.0",
+    "@cosmicdrift/kumiko-server-runtime": "2.0.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/build-prod-bundle.integration.test.ts

@@ -19,7 +19,7 @@ import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildProdBundle } from "../build-prod-bundle";
+import { buildProdBundle } from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);

package/src/__tests__/build-server-bundle.test.ts

@@ -55,10 +55,72 @@ describe("buildServerBundle (multi-entry + splitting)", () => {
       expect(pkg.scripts.start).toBe("bun run server.js");
       expect(Object.keys(pkg.dependencies)).not.toContain("drizzle-kit");
       expect(Object.keys(pkg.dependencies)).not.toContain("drizzle-orm");
+      // Positive counterpart to the negative checks above — a runtime
+      // external accidentally dropped from RUNTIME_EXTERNALS (into
+      // BUILD_ONLY_EXTERNALS instead) would slip through silently. This
+      // is the exact regression class behind the money-horse prod crash
+      // ("Cannot find package 'meilisearch'").
+      expect(Object.keys(pkg.dependencies)).toContain("meilisearch");
 
       expect(result.totalBytes).toBeGreaterThan(0);
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+
+  test("pins runtime-deps from node_modules/@cosmicdrift/* for consumer apps without a packages/ dir", async () => {
+    // Reproduziert #1217: findRepoRoot liefert für eine Consumer-App die
+    // App-Wurzel selbst (kein packages/-Ordner) — die Version muss aus den
+    // installierten node_modules/@cosmicdrift/*-Packages kommen, nicht "*".
+    const dir = makeFixture();
+    try {
+      const frameworkPkgDir = join(dir, "node_modules/@cosmicdrift/kumiko-framework");
+      mkdirSync(frameworkPkgDir, { recursive: true });
+      writeFileSync(
+        join(frameworkPkgDir, "package.json"),
+        `${JSON.stringify({ name: "@cosmicdrift/kumiko-framework", dependencies: { meilisearch: "^0.58.0" } })}\n`,
+      );
+      const bundledFeaturesPkgDir = join(dir, "node_modules/@cosmicdrift/kumiko-bundled-features");
+      mkdirSync(bundledFeaturesPkgDir, { recursive: true });
+      writeFileSync(
+        join(bundledFeaturesPkgDir, "package.json"),
+        `${JSON.stringify({ name: "@cosmicdrift/kumiko-bundled-features", dependencies: { ioredis: "^5.4.1" } })}\n`,
+      );
+
+      const result = await buildServerBundle({ cwd: dir, outDir: join(dir, "dist-server") });
+
+      expect(result.runtimeDeps["meilisearch"]).toBe("^0.58.0");
+      expect(result.runtimeDeps["ioredis"]).toBe("^5.4.1");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("prefers node_modules/@cosmicdrift/* over packages/* when both declare a version", async () => {
+    // Framework-monorepo checkout: both the installed node_modules package
+    // (symlinked in real life, diverging here) and packages/framework exist.
+    // node_modules must win — it reflects what actually gets shipped/installed
+    // for the consumer, packages/framework is only a repo-root fallback.
+    const dir = makeFixture();
+    try {
+      const frameworkPkgDir = join(dir, "node_modules/@cosmicdrift/kumiko-framework");
+      mkdirSync(frameworkPkgDir, { recursive: true });
+      writeFileSync(
+        join(frameworkPkgDir, "package.json"),
+        `${JSON.stringify({ name: "@cosmicdrift/kumiko-framework", dependencies: { meilisearch: "^0.58.0" } })}\n`,
+      );
+
+      mkdirSync(join(dir, "packages/framework"), { recursive: true });
+      writeFileSync(
+        join(dir, "packages/framework/package.json"),
+        `${JSON.stringify({ name: "@cosmicdrift/kumiko-framework", dependencies: { meilisearch: "^0.30.0" } })}\n`,
+      );
+
+      const result = await buildServerBundle({ cwd: dir, outDir: join(dir, "dist-server") });
+
+      expect(result.runtimeDeps["meilisearch"]).toBe("^0.58.0");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });

package/src/__tests__/compose-stacks.test.ts

@@ -0,0 +1,271 @@
+import { describe, expect, test } from "bun:test";
+import { createPersonalAccessTokensFeature } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import {
+  composeFileStack,
+  composeGdprStack,
+  composeIdentityStack,
+  composeMailStack,
+  composeOpsStack,
+  composePagesStack,
+  composeRendererStack,
+  composeUserDataRightsStack,
+  stackFeatureNames,
+} from "../compose-stacks";
+
+const TEST_MFA = {
+  setupTokenSecret: "compose-stacks-mfa-setup-secret-at-least-32b!!",
+  challengeTokenSecret: "compose-stacks-mfa-challenge-secret-32b!!",
+  issuer: "Kumiko ComposeStacks",
+} as const;
+
+describe("composeStacks", () => {
+  test("composeRendererStack → template-resolver, renderer-foundation, renderer-simple", () => {
+    expect(stackFeatureNames(composeRendererStack())).toEqual([
+      "template-resolver",
+      "renderer-foundation",
+      "renderer-simple",
+    ]);
+  });
+
+  test("composePagesStack → text-content + legal-pages", () => {
+    expect(stackFeatureNames(composePagesStack())).toEqual(["text-content", "legal-pages"]);
+  });
+
+  test("composeMailStack mounts foundation + selected transports", () => {
+    expect(stackFeatureNames(composeMailStack({ transports: ["inmemory", "smtp"] }))).toEqual([
+      "mail-foundation",
+      "mail-transport-inmemory",
+      "mail-transport-smtp",
+    ]);
+  });
+
+  test("composeFileStack mounts foundation + providers + files entity", () => {
+    expect(stackFeatureNames(composeFileStack({ providers: ["inmemory", "s3"] }))).toEqual([
+      "file-foundation",
+      "file-provider-inmemory",
+      "file-provider-s3",
+      "files",
+    ]);
+  });
+
+  test("composeGdprStack retention-first (money-horse / publicstatus pattern)", () => {
+    expect(stackFeatureNames(composeGdprStack({ tenantLifecycle: true, sessions: true }))).toEqual([
+      "data-retention",
+      "compliance-profiles",
+      "tenant-lifecycle",
+      "auth-foundation",
+      "sessions",
+    ]);
+  });
+
+  test("composeGdprStack compliance-first (studio pattern)", () => {
+    expect(stackFeatureNames(composeGdprStack({ order: "compliance-first" }))).toEqual([
+      "compliance-profiles",
+      "data-retention",
+    ]);
+  });
+
+  test("composeUserDataRightsStack → udr + defaults", () => {
+    expect(stackFeatureNames(composeUserDataRightsStack())).toEqual([
+      "user-data-rights",
+      "user-data-rights-defaults",
+    ]);
+  });
+
+  test("composeOpsStack defaults delivery + audit + jobs", () => {
+    expect(stackFeatureNames(composeOpsStack())).toEqual(["delivery", "audit", "jobs"]);
+  });
+
+  test("composeOpsStack rateLimiting opt-in", () => {
+    expect(stackFeatureNames(composeOpsStack({ rateLimiting: true }))).toEqual([
+      "delivery",
+      "audit",
+      "jobs",
+      "rate-limiting",
+    ]);
+  });
+
+  test("composeIdentityStack defaults auth-foundation + sessions", () => {
+    expect(stackFeatureNames(composeIdentityStack())).toEqual(["auth-foundation", "sessions"]);
+  });
+
+  test("composeIdentityStack mounts auth-mfa when mfa options given", () => {
+    expect(stackFeatureNames(composeIdentityStack({ mfa: TEST_MFA }))).toEqual([
+      "auth-foundation",
+      "sessions",
+      "auth-mfa",
+    ]);
+  });
+
+  test("composeIdentityStack sessions:false + mfa → auth-mfa only", () => {
+    expect(stackFeatureNames(composeIdentityStack({ sessions: false, mfa: TEST_MFA }))).toEqual([
+      "auth-mfa",
+    ]);
+  });
+
+  test("composeIdentityStack + composeGdprStack(sessions) → duplicate feature rejected at boot", () => {
+    const names = stackFeatureNames([
+      ...composeIdentityStack(),
+      ...composeGdprStack({ sessions: true }),
+    ]);
+    expect(names.filter((n) => n === "sessions")).toHaveLength(2);
+    expect(() =>
+      validateBoot(
+        composeFeatures(
+          [
+            createPersonalAccessTokensFeature({ scopes: {} }),
+            ...composeIdentityStack(),
+            ...composeGdprStack({ sessions: true }),
+          ],
+          { includeBundled: true },
+        ),
+      ),
+    ).toThrow(/duplicate feature/i);
+  });
+});
+
+/** Snapshot, not a live parity check: intended block combinations, mirrored by hand from studio/money-horse/publicstatus run-configs. A drifted run-config stays green here. */
+describe("composeStacks boots for real", () => {
+  test("studio-shaped combined stack passes validateBoot (not just name-list comparison)", () => {
+    const features = composeFeatures(
+      [
+        createPersonalAccessTokensFeature({ scopes: {} }),
+        ...composeOpsStack({ rateLimiting: true }),
+        ...composePagesStack(),
+        ...composeMailStack({ transports: ["inmemory"] }),
+        ...composeFileStack({ providers: ["inmemory"] }),
+        ...composeGdprStack({ order: "compliance-first", sessions: true }),
+        ...composeUserDataRightsStack(),
+      ],
+      { includeBundled: true },
+    );
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("money-horse-shaped composeGdprStack({sessions:true}) without a tokenVerifier provider passes boot", () => {
+    // Session-only stacks (#1570): composeGdprStack({sessions:true}) mounts
+    // auth-foundation + sessions (sessionStore). Cookie auth does not need a
+    // tokenVerifier; money-horse/solon run-configs pass none and must boot.
+    const features = composeFeatures([...composeGdprStack({ sessions: true })], {
+      includeBundled: true,
+    });
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("composeGdprStack({sessions:true, providers:[...]}) passes boot with a tokenVerifier mounted", () => {
+    const features = composeFeatures(
+      [
+        ...composeGdprStack({
+          sessions: true,
+          providers: [createPersonalAccessTokensFeature({ scopes: {} })],
+        }),
+      ],
+      { includeBundled: true },
+    );
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  // auth-mfa's encrypted fields need a runtime KEK (env or configureEntityFieldEncryption
+  // + secrets). Name-list + saas-identity-wire.integration.test.ts cover identity boot.
+  test("identity stack names compose with ops + renderer under includeBundled", () => {
+    const features = composeFeatures(
+      [
+        ...composeIdentityStack({ mfa: TEST_MFA }),
+        ...composeOpsStack(),
+        ...composeRendererStack(),
+        ...composeMailStack({ transports: ["inmemory"] }),
+      ],
+      { includeBundled: true },
+    );
+    const names = stackFeatureNames(features);
+    expect(names).toContain("auth-email-password");
+    expect(names).toContain("sessions");
+    expect(names).toContain("auth-mfa");
+    expect(names).toContain("delivery");
+  });
+});
+
+describe("composeStacks intended block names (snapshot, not live parity)", () => {
+  test("studio SaaS blocks are covered by presets", () => {
+    const names = stackFeatureNames([
+      ...composeOpsStack({ rateLimiting: true }),
+      ...composePagesStack(),
+      ...composeMailStack({ transports: ["inmemory", "smtp"] }),
+      ...composeFileStack({ providers: ["inmemory", "s3"] }),
+      ...composeGdprStack({ order: "compliance-first" }),
+      ...composeUserDataRightsStack(),
+    ]);
+    for (const expected of [
+      "delivery",
+      "audit",
+      "jobs",
+      "rate-limiting",
+      "text-content",
+      "legal-pages",
+      "mail-foundation",
+      "file-foundation",
+      "files",
+      "compliance-profiles",
+      "data-retention",
+      "user-data-rights",
+      "user-data-rights-defaults",
+    ]) {
+      expect(names).toContain(expected);
+    }
+  });
+
+  test("money-horse GDPR + file block names", () => {
+    const names = stackFeatureNames([
+      ...composePagesStack(),
+      ...composeRendererStack(),
+      ...composeOpsStack({ delivery: true, audit: false, jobs: false }),
+      ...composeGdprStack({ sessions: true }),
+      ...composeFileStack({ providers: ["s3-env"] }),
+      ...composeUserDataRightsStack(),
+    ]);
+    for (const expected of [
+      "text-content",
+      "legal-pages",
+      "data-retention",
+      "compliance-profiles",
+      "sessions",
+      "file-foundation",
+      "file-provider-s3-env",
+      "files",
+      "user-data-rights",
+    ]) {
+      expect(names).toContain(expected);
+    }
+  });
+
+  test("publicstatus core stack block names", () => {
+    const names = stackFeatureNames([
+      ...composePagesStack(),
+      ...composeGdprStack({ tenantLifecycle: true }),
+      ...composeOpsStack({ delivery: true, audit: true, jobs: true }),
+      ...composeRendererStack(),
+      ...composeFileStack({ providers: ["inmemory"] }),
+      ...composeUserDataRightsStack(),
+    ]);
+    for (const expected of [
+      "text-content",
+      "legal-pages",
+      "tenant-lifecycle",
+      "audit",
+      "delivery",
+      "jobs",
+      "renderer-simple",
+      "files",
+    ]) {
+      expect(names).toContain(expected);
+    }
+  });
+
+  test("identity stack covers sessions + auth-mfa", () => {
+    const names = stackFeatureNames(composeIdentityStack({ mfa: TEST_MFA }));
+    expect(names).toContain("sessions");
+    expect(names).toContain("auth-mfa");
+  });
+});

package/src/__tests__/create-kumiko-server-errors.test.ts

@@ -0,0 +1,54 @@
+// createKumikoServer error / graceful-degradation paths — boot rejects,
+// stylesheet pipeline failures, missing CSS route.
+
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createKumikoServer } from "../create-kumiko-server";
+
+const emptyFeature = defineFeature("dev-server-errors-probe", () => {});
+
+describe("createKumikoServer — client bundle failure", () => {
+  test("broken clientEntry rejects at boot with client bundle failed", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-bundle-fail-"));
+    const entry = join(tmpDir, "client.tsx");
+    writeFileSync(entry, "const x = {{{\n");
+    try {
+      await expect(
+        createKumikoServer({
+          features: [emptyFeature],
+          port: 0,
+          installSignalHandlers: false,
+          clientEntry: entry,
+          stylesheet: false,
+        }),
+      ).rejects.toThrow(/client bundle failed|Bundle failed/);
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  test("_buildBundle throw propagates at boot", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-stub-fail-"));
+    const entry = join(tmpDir, "client.tsx");
+    writeFileSync(entry, "// noop\n");
+    try {
+      await expect(
+        createKumikoServer({
+          features: [emptyFeature],
+          port: 0,
+          installSignalHandlers: false,
+          clientEntry: entry,
+          stylesheet: false,
+          _buildBundle: async () => {
+            throw new Error("stub build blew up");
+          },
+        }),
+      ).rejects.toThrow(/stub build blew up/);
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/__tests__/create-kumiko-server-options.test.ts

@@ -0,0 +1,33 @@
+// Option/error matrix for createKumikoServer — pins boot-time rejects
+// that happen before Postgres/Redis wiring (normalizeEntries).
+
+import { describe, expect, test } from "bun:test";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createKumikoServer } from "../create-kumiko-server";
+
+const emptyFeature = defineFeature("prod-packaging-options-probe", () => {});
+
+describe("createKumikoServer — option matrix", () => {
+  test("clientEntry + clientEntries → mutually exclusive error", async () => {
+    await expect(
+      createKumikoServer({
+        features: [emptyFeature],
+        clientEntry: "src/client.tsx",
+        clientEntries: [{ name: "admin", sourceFile: "src/client-admin.tsx" }],
+        installSignalHandlers: false,
+        port: 0,
+      }),
+    ).rejects.toThrow(/mutually exclusive/);
+  });
+
+  test("clientEntries without hostDispatch → error", async () => {
+    await expect(
+      createKumikoServer({
+        features: [emptyFeature],
+        clientEntries: [{ name: "admin", sourceFile: "src/client-admin.tsx" }],
+        installSignalHandlers: false,
+        port: 0,
+      }),
+    ).rejects.toThrow(/hostDispatch/);
+  });
+});

package/src/__tests__/create-kumiko-server.integration.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -336,3 +336,130 @@ describe("createKumikoServer extraRoutes-deps", () => {
     expect(body.data?.roles).toContain("SystemAdmin");
   });
 });
+
+describe("createKumikoServer — stylesheet tailwind failure (graceful)", () => {
+  test("missing stylesheet entry boots without CSS — GET /styles.css → 404", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-css-fail-"));
+    const entry = join(tmpDir, "client.tsx");
+    writeFileSync(entry, "export const x = 1;\n");
+    try {
+      handle = await createKumikoServer({
+        features: [probeFeature],
+        port: 0,
+        installSignalHandlers: false,
+        clientEntry: entry,
+        stylesheet: join(tmpDir, "does-not-exist.css"),
+        _buildBundle: async () => ({ js: "// stub", map: "" }),
+      });
+      const cssRes = await handle.fetch(new Request("http://localhost/styles.css"));
+      expect(cssRes.status).toBe(404);
+      expect(await cssRes.text()).toBe("no stylesheet");
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("createKumikoServer — real Bun.build (buildClient)", () => {
+  test("clientEntry without _buildBundle produces a JS bundle via Bun.build", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-real-build-"));
+    const entry = join(tmpDir, "client.tsx");
+    // Minimal entry Bun.build can emit — no JSX, no imports.
+    writeFileSync(entry, "export const ping = 1;\n");
+    // Empty dirs matching a glob — exercises expandWatchPatterns without
+    // writing files (avoids process.exit(75) from bare .tsx events).
+    mkdirSync(join(tmpDir, "pkg-a"));
+    mkdirSync(join(tmpDir, "pkg-b"));
+    try {
+      handle = await createKumikoServer({
+        features: [probeFeature],
+        port: 0,
+        installSignalHandlers: false,
+        clientEntry: entry,
+        stylesheet: false,
+        watchDirs: [join(tmpDir, "pkg-*")],
+      });
+      const res = await handle.fetch(new Request("http://localhost/client.js"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toMatch(/application\/javascript/);
+      const body = await res.text();
+      expect(body.length).toBeGreaterThan(0);
+      expect(body).toMatch(/ping/);
+
+      // Stop the watcher before teardown rmSync deletes clientEntry out from
+      // under it — a bare "client.tsx" delete event classifies as "restart"
+      // (classifyChange only special-cases endsWith("/client.tsx")) and
+      // process.exit(75) kills the whole bun test runner mid-suite.
+      await handle.stop();
+      handle = undefined;
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("createKumikoServer — hot-reload broadcast", () => {
+  test("file change under web/ rebuilds and broadcasts SSE reload", async () => {
+    const tmpDir = mkdtempSync(join(tmpdir(), "kumiko-watch-"));
+    const entry = join(tmpDir, "client.tsx");
+    const webDir = join(tmpDir, "web");
+    mkdirSync(webDir);
+    writeFileSync(entry, "export const ping = 1;\n");
+
+    let builds = 0;
+    try {
+      handle = await createKumikoServer({
+        features: [probeFeature],
+        port: 0,
+        installSignalHandlers: false,
+        clientEntry: entry,
+        stylesheet: false,
+        // Only the entry dir is watched (no extra watchDirs) — a nested
+        // web/page.tsx event arrives as "web/page.tsx" → hot-reload.
+        // Watching web/ separately would fire bare "page.tsx" → restart
+        // → process.exit(75) and kill the test runner.
+        _buildBundle: async () => {
+          builds += 1;
+          return { js: `// build-${builds}`, map: "" };
+        },
+      });
+
+      const sseRes = await handle.fetch(new Request("http://localhost/_reload"));
+      expect(sseRes.status).toBe(200);
+      const reader = sseRes.body?.getReader();
+      expect(reader).toBeDefined();
+      if (!reader) return;
+
+      await reader.read(); // drain connected comment
+
+      const initialBuilds = builds;
+      writeFileSync(join(webDir, "page.tsx"), "export const x = 1;\n");
+
+      const deadline = Date.now() + 3000;
+      let sawReload = false;
+      while (Date.now() < deadline && !sawReload) {
+        const readPromise = reader.read();
+        const timeout = new Promise<{ done: true; value: undefined }>((resolve) =>
+          setTimeout(() => resolve({ done: true, value: undefined }), 200),
+        );
+        const { value, done } = await Promise.race([readPromise, timeout]);
+        if (done || value === undefined) continue;
+        const chunk = new TextDecoder().decode(value);
+        if (chunk.includes("event: reload")) sawReload = true;
+      }
+      await reader.cancel();
+
+      expect(builds).toBeGreaterThan(initialBuilds);
+      expect(sawReload).toBe(true);
+
+      const js = await handle.fetch(new Request("http://localhost/client.js"));
+      expect(await js.text()).toMatch(/build-/);
+
+      // Abort watchers before teardown rmSync can fire a restart event.
+      await handle.stop();
+      handle = undefined;
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/__tests__/discover-format.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { formatBuildResult } from "../build-prod-bundle";
+import { formatBuildResult } from "@cosmicdrift/kumiko-server-runtime/build-prod-bundle";
 import { discoverServerEntry } from "../build-server-bundle";
 
 describe("discoverServerEntry", () => {

package/src/__tests__/env-schema.integration.test.ts

@@ -7,10 +7,10 @@
 import { describe, expect, it } from "bun:test";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { composeEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
+import { runProdApp } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 import { z } from "zod";
 import { frameworkCoreEnvSchema } from "../env-schema";
 import * as devServerPublicApi from "../index";
-import { runProdApp } from "../run-prod-app";
 
 const secretsFeature = defineFeature("secrets", (r) => {
   r.envSchema(