@hiyve/cli 1.0.18 → 1.0.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiyve/cli",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "description": "Hiyve SDK CLI - Configure npm for private @hiyve packages",
   "type": "module",
   "bin": {

package/src/commands/init.js

@@ -14,7 +14,10 @@ const TEMPLATES = {
   basic: {
     name: 'Basic',
     description: 'Video conferencing with controls and participant list',
-    packages: ['@hiyve/react', '@hiyve/react-ui', '@hiyve/core', '@hiyve/rtc-client', '@hiyve/utilities'],
+    packages: [
+      '@hiyve/react', '@hiyve/react-ui', '@hiyve/core', '@hiyve/rtc-client', '@hiyve/utilities',
+      '@hiyve/admin',
+    ],
     features: { intelligence: false, collaboration: false, capture: false },
   },
   ai: {
@@ -23,21 +26,65 @@ const TEMPLATES = {
     packages: [
       '@hiyve/react', '@hiyve/react-ui', '@hiyve/react-intelligence', '@hiyve/react-capture',
       '@hiyve/core', '@hiyve/cloud', '@hiyve/rtc-client', '@hiyve/utilities',
+      '@hiyve/admin',
     ],
     features: { intelligence: true, collaboration: false, capture: true },
   },
   full: {
     name: 'Full Suite',
     description: 'Video + AI + chat, polls, Q&A, file sharing, notes',
+    // react-room's REQUIRED peers are all here: react-intelligence and
+    // react-semantic-relay are imported statically, not optionally.
     packages: [
-      '@hiyve/react', '@hiyve/react-ui', '@hiyve/react-intelligence', '@hiyve/react-capture',
-      '@hiyve/react-collaboration', '@hiyve/react-notes', '@hiyve/react-room',
+      '@hiyve/react', '@hiyve/react-ui', '@hiyve/react-intelligence', '@hiyve/react-semantic-relay',
+      '@hiyve/react-capture', '@hiyve/react-collaboration', '@hiyve/react-notes', '@hiyve/react-room',
       '@hiyve/core', '@hiyve/cloud', '@hiyve/rtc-client', '@hiyve/utilities',
+      '@hiyve/admin',
     ],
     features: { intelligence: true, collaboration: true, capture: true },
   },
 };
 
+/**
+ * The signaling region every generated project pins. It appears in BOTH
+ * `.env.example` (SERVER_REGION — what the token server mints for) and the
+ * client (`region` on HiyveProvider / HiyveRoom). They must agree: a token
+ * presented to a stack that did not sign it is rejected with a generic
+ * "Internal server error".
+ */
+export const DEFAULT_REGION = 'us-east-2';
+
+/** Port the generated token server listens on; vite proxies /api to it. */
+const SERVER_PORT = 3001;
+
+/**
+ * Pinned versions. Taken from what `npm create vite@latest -- --template
+ * react-ts` emits (2026-09-01) plus the peer ranges the published @hiyve
+ * packages declare: React 18 or 19, MUI ^9. Bumping MUI below 9 or React
+ * below 18 makes `npm install` fail with ERESOLVE against the registry.
+ */
+export const PINS = {
+  react: '^19.2.8',
+  'react-dom': '^19.2.8',
+  '@mui/material': '^9.4.0',
+  '@mui/icons-material': '^9.4.0',
+  '@emotion/react': '^11.14.0',
+  '@emotion/styled': '^11.14.1',
+  express: '^5.2.1',
+  cors: '^2.8.6',
+  dotenv: '^17.4.2',
+  '@types/react': '^19.2.18',
+  '@types/react-dom': '^19.2.4',
+  '@types/express': '^5.0.6',
+  '@types/cors': '^2.8.19',
+  '@types/node': '^24.13.3',
+  '@vitejs/plugin-react': '^6.1.0',
+  concurrently: '^10.0.5',
+  tsx: '^4.23.13',
+  typescript: '~6.0.2',
+  vite: '^8.2.2',
+};
+
 export async function init(projectName, options) {
   console.log('');
   console.log(chalk.cyan('  Hiyve Project Scaffolding'));
@@ -102,8 +149,11 @@ export async function init(projectName, options) {
     writeFile(projectDir, 'vite.config.ts', generateViteConfig());
     writeFile(projectDir, '.env.example', generateEnvExample(template));
     writeFile(projectDir, '.gitignore', generateGitignore());
-    writeFile(projectDir, 'src/main.tsx', generateMain());
+    writeFile(projectDir, 'src/main.tsx', generateMain(template));
     writeFile(projectDir, 'src/App.tsx', generateApp(template));
+    if (!usesPrebuiltRoom(template)) {
+      writeFile(projectDir, 'src/VideoRoom.tsx', generateVideoRoom());
+    }
     writeFile(projectDir, 'index.html', generateIndexHtml(projectName));
     writeFile(projectDir, 'server/index.ts', generateServer(template));
 
@@ -113,7 +163,7 @@ export async function init(projectName, options) {
     console.log(chalk.gray('  Next steps:'));
     console.log('');
     console.log(`  ${chalk.cyan('cd')} ${projectName}`);
-    console.log(`  ${chalk.cyan('cp')} .env.example .env   ${chalk.gray('# Add your API key')}`);
+    console.log(`  ${chalk.cyan('cp')} .env.example .env   ${chalk.gray('# Add your API key + client secret (console.hiyve.dev)')}`);
     console.log(`  ${chalk.cyan('npm install')}`);
     console.log(`  ${chalk.cyan('npm run dev')}`);
     console.log('');
@@ -136,17 +186,23 @@ function writeFile(dir, filePath, content) {
   writeFileSync(fullPath, content, 'utf-8');
 }
 
-function generatePackageJson(name, template) {
+function usesPrebuiltRoom(template) {
+  return template.features.intelligence && template.features.collaboration;
+}
+
+export function generatePackageJson(name, template) {
   const deps = {};
   for (const pkg of template.packages) {
     deps[pkg] = 'latest';
   }
-  deps['react'] = '^18.2.0';
-  deps['react-dom'] = '^18.2.0';
-  deps['@mui/material'] = '^5.15.0';
-  deps['@mui/icons-material'] = '^5.15.0';
-  deps['@emotion/react'] = '^11.11.0';
-  deps['@emotion/styled'] = '^11.11.0';
+  for (const k of ['react', 'react-dom', '@mui/material', '@mui/icons-material', '@emotion/react', '@emotion/styled', 'express', 'cors', 'dotenv']) {
+    deps[k] = PINS[k];
+  }
+
+  const devDependencies = {};
+  for (const k of ['@types/react', '@types/react-dom', '@types/express', '@types/cors', '@types/node', '@vitejs/plugin-react', 'concurrently', 'tsx', 'typescript', 'vite']) {
+    devDependencies[k] = PINS[k];
+  }
 
   const pkg = {
     name,
@@ -154,39 +210,32 @@ function generatePackageJson(name, template) {
     private: true,
     type: 'module',
     scripts: {
-      dev: 'concurrently "vite" "tsx watch server/index.ts"',
+      dev: 'concurrently "tsx watch server/index.ts" "vite"',
       build: 'vite build',
       preview: 'vite preview',
-      'server': 'tsx server/index.ts',
+      server: 'tsx server/index.ts',
     },
     dependencies: deps,
-    devDependencies: {
-      '@types/react': '^18.2.0',
-      '@types/react-dom': '^18.2.0',
-      '@vitejs/plugin-react': '^4.2.0',
-      'concurrently': '^8.2.0',
-      'dotenv': '^16.3.0',
-      'express': '^4.18.0',
-      'tsx': '^4.7.0',
-      'typescript': '^5.3.0',
-      'vite': '^5.0.0',
-    },
+    devDependencies,
   };
 
   return JSON.stringify(pkg, null, 2) + '\n';
 }
 
-function generateTsConfig() {
+export function generateTsConfig() {
+  // Mirrors the react-ts template `npm create vite@latest` emits, with one
+  // tsconfig covering both src/ (browser) and server/ (tsx).
   const config = {
     compilerOptions: {
-      target: 'ES2020',
-      useDefineForClassFields: true,
-      lib: ['ES2020', 'DOM', 'DOM.Iterable'],
+      target: 'ES2023',
+      lib: ['ES2023', 'DOM', 'DOM.Iterable'],
       module: 'ESNext',
-      skipLibCheck: true,
       moduleResolution: 'bundler',
+      types: ['vite/client', 'node'],
+      skipLibCheck: true,
       allowImportingTsExtensions: true,
-      resolveJsonModule: true,
+      verbatimModuleSyntax: true,
+      moduleDetection: 'force',
       isolatedModules: true,
       noEmit: true,
       jsx: 'react-jsx',
@@ -195,46 +244,57 @@ function generateTsConfig() {
       noUnusedParameters: true,
       noFallthroughCasesInSwitch: true,
     },
-    include: ['src'],
+    include: ['src', 'server', 'vite.config.ts'],
   };
   return JSON.stringify(config, null, 2) + '\n';
 }
 
-function generateViteConfig() {
+export function generateViteConfig() {
   return `import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 
 export default defineConfig({
   plugins: [react()],
   server: {
-    port: 3000,
     proxy: {
-      '/api': 'http://localhost:4000',
+      // The token server (server/index.ts). @hiyve/react fetches
+      // /api/generate-room-token and /api/generate-cloud-token from here.
+      '/api': 'http://localhost:${SERVER_PORT}',
     },
   },
 });
 `;
 }
 
-function generateEnvExample(template) {
-  let env = `# Hiyve API Key (from cloud.hiyve.io)
-HIYVE_API_KEY=pk_live_your_api_key_here
+export function generateEnvExample(template) {
+  let env = `# Both keys come from https://console.hiyve.dev (API Keys)
+
+# API Key (required — identifies your app)
+APIKEY=pk_live_your_api_key_here
+
+# Client Secret (required for video conferencing — mints room tokens; server-side only)
+CLIENT_SECRET=sk_live_your_client_secret_here
 
-# Room configuration
-HIYVE_SIGNALING_URL=https://signal.hiyve.dev
+# Signaling region the token server mints for. MUST match the \`region\`
+# passed to HiyveProvider / HiyveRoom in src/ (${DEFAULT_REGION} in both).
+SERVER_REGION=${DEFAULT_REGION}
+SERVER_REGION_URL=.rtc.muziemedia.com
+# production and development resolve to the SAME cloud (there is currently no
+# separate development stack); development only adds a boot warning. Leave as-is.
+ENVIRONMENT=production
 `;
 
   if (template.features.intelligence) {
     env += `
-# Cloud API (for AI features)
-HIYVE_CLOUD_URL=https://cloud.hiyve.io
+# Cloud API for AI features. Defaults to https://cloud.hiyve.io — leave unset.
+# HIYVE_CLOUD_API_URL=https://cloud.hiyve.io
 `;
   }
 
   return env;
 }
 
-function generateGitignore() {
+export function generateGitignore() {
   return `node_modules
 dist
 .env
@@ -242,53 +302,70 @@ dist
 `;
 }
 
-function generateMain() {
-  return `import React from 'react';
-import ReactDOM from 'react-dom/client';
+export function generateMain(template) {
+  if (usesPrebuiltRoom(template)) {
+    // HiyveRoom (in App.tsx) provides the HiyveProvider, theme and region.
+    return `import ReactDOM from 'react-dom/client';
 import App from './App';
 
+ReactDOM.createRoot(document.getElementById('root')!).render(<App />);
+`;
+  }
+
+  return `import ReactDOM from 'react-dom/client';
+import { HiyveProvider } from '@hiyve/react';
+import App from './App';
+
+// region MUST match SERVER_REGION in .env — see .env.example.
 ReactDOM.createRoot(document.getElementById('root')!).render(
-  <React.StrictMode>
+  <HiyveProvider region="${DEFAULT_REGION}">
     <App />
-  </React.StrictMode>,
+  </HiyveProvider>,
 );
 `;
 }
 
-function generateApp(template) {
-  if (template.features.intelligence && template.features.collaboration) {
-    // Full template — use @hiyve/react-room PrebuiltRoom
-    return `import React, { useState, useCallback } from 'react';
+export function generateApp(template) {
+  if (usesPrebuiltRoom(template)) {
+    return `import { useState, useCallback } from 'react';
 import { HiyveRoom, PrebuiltRoom, PrebuiltLobby } from '@hiyve/react-room';
 
+// Must match SERVER_REGION in .env — see .env.example.
+const REGION = '${DEFAULT_REGION}';
+
+/** Fetch a room token from server/index.ts (mountHiyveRoutes). */
+async function fetchRoomToken(): Promise<string> {
+  const res = await fetch('/api/generate-room-token', { method: 'POST' });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.message || 'Failed to generate room token');
+  return data.roomToken;
+}
+
+/** Fetch a cloud token for AI features from the same server. */
+async function fetchCloudToken(): Promise<string> {
+  const res = await fetch('/api/generate-cloud-token', { method: 'POST' });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.message || 'Failed to generate cloud token');
+  return data.cloudToken;
+}
+
 export default function App() {
   const [roomToken, setRoomToken] = useState<string | null>(null);
-  const [cloudToken, setCloudToken] = useState<string | null>(null);
   const [displayName, setDisplayName] = useState('');
 
   const handleJoin = useCallback(async (name: string) => {
     setDisplayName(name);
-    const res = await fetch('/api/token', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ roomName: 'my-room', userId: name, displayName: name }),
-    });
-    const data = await res.json();
-    setRoomToken(data.roomToken);
-    if (data.cloudToken) setCloudToken(data.cloudToken);
+    setRoomToken(await fetchRoomToken());
   }, []);
 
-  const handleLeave = useCallback(() => {
-    setRoomToken(null);
-    setCloudToken(null);
-  }, []);
+  const handleLeave = useCallback(() => setRoomToken(null), []);
 
   if (!roomToken) {
     return <PrebuiltLobby onJoin={handleJoin} />;
   }
 
   return (
-    <HiyveRoom roomToken={roomToken} cloudToken={cloudToken} intelligence>
+    <HiyveRoom roomToken={roomToken} region={REGION} generateToken={fetchCloudToken} userId={displayName} intelligence>
       <PrebuiltRoom userId={displayName} onLeave={handleLeave} />
     </HiyveRoom>
   );
@@ -296,67 +373,62 @@ export default function App() {
 `;
   }
 
-  // Basic / AI template — compose directly
-  const imports = [`import { HiyveProvider, useRoom, useConnection } from '@hiyve/react';`];
-  imports.push(`import { VideoGrid, ControlBar } from '@hiyve/react-ui';`);
-
-  let providerOpen = '      <HiyveProvider generateRoomToken={generateRoomToken}>';
-  let providerClose = '      </HiyveProvider>';
-  let extraComponents = '';
-
-  if (template.features.intelligence) {
-    extraComponents += `\n          {/* AI features available via @hiyve/react-intelligence hooks */}`;
+  // Basic / AI — the getting-started guide's App, verbatim. HiyveProvider
+  // (src/main.tsx) fetches the room token itself; JoinForm drives the flow.
+  const aiNote = template.features.intelligence
+    ? `\n// AI: add hooks from @hiyve/react-intelligence inside VideoRoom (HiyveProvider\n// already fetches the cloud token from /api/generate-cloud-token).\n`
+    : '';
+  return `import { useRoomFlow } from '@hiyve/react';
+import { JoinForm, ConnectingScreen } from '@hiyve/react-ui';
+import VideoRoom from './VideoRoom';
+${aiNote}
+function App() {
+  const { screen } = useRoomFlow();
+
+  switch (screen) {
+    case 'connecting':
+      return <ConnectingScreen />;
+    case 'in-room':
+      return <VideoRoom />;
+    default:
+      return <JoinForm autoConnect devicePreviewMode="inline" />;
   }
-
-  return `import React, { useState, useCallback } from 'react';
-${imports.join('\n')}
-
-function Room({ onLeave }: { onLeave: () => void }) {
-  return (
-    <div style={{ display: 'flex', flexDirection: 'column', height: '100vh', background: '#121212' }}>
-      <div style={{ flex: 1, overflow: 'hidden' }}>
-        <VideoGrid localVideoElementId="local-video" />
-      </div>${extraComponents}
-      <ControlBar onLeave={onLeave} />
-    </div>
-  );
 }
 
-export default function App() {
-  const [roomToken, setRoomToken] = useState<string | null>(null);
-
-  const handleJoin = useCallback(async () => {
-    const res = await fetch('/api/token', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ roomName: 'my-room', userId: 'user-' + Date.now() }),
-    });
-    const data = await res.json();
-    setRoomToken(data.roomToken);
-  }, []);
+export default App;
+`;
+}
 
-  const generateRoomToken = useCallback(() => Promise.resolve(roomToken!), [roomToken]);
+export function generateVideoRoom() {
+  return `import { useState } from 'react';
+import { useRoom, useConnection } from '@hiyve/react';
+import { VideoGrid, ControlBar } from '@hiyve/react-ui';
 
-  if (!roomToken) {
-    return (
-      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', height: '100vh', background: '#121212' }}>
-        <button onClick={handleJoin} style={{ padding: '12px 32px', fontSize: 18, borderRadius: 8, border: 'none', background: '#6c63ff', color: '#fff', cursor: 'pointer' }}>
-          Join Room
-        </button>
-      </div>
-    );
-  }
+function VideoRoom() {
+  const { room } = useRoom();
+  const { leaveRoom } = useConnection();
+  const [layout, setLayout] = useState('grid');
 
   return (
-${providerOpen}
-      <Room onLeave={() => setRoomToken(null)} />
-${providerClose}
+    <div style={{ height: '100vh', display: 'flex', flexDirection: 'column' }}>
+      {room?.name && <h2 style={{ margin: '8px 16px' }}>{room.name}</h2>}
+      <VideoGrid localVideoElementId="local-video" layout={layout} showNames showLocalFlip />
+      <ControlBar
+        onLeave={leaveRoom}
+        showScreenShare
+        showLayoutSelector
+        layout={layout}
+        onLayoutChange={setLayout}
+      />
+    </div>
   );
 }
+
+export default VideoRoom;
 `;
 }
 
-function generateIndexHtml(name) {
+export function generateIndexHtml(name) {
   return `<!DOCTYPE html>
 <html lang="en">
   <head>
@@ -372,71 +444,25 @@ function generateIndexHtml(name) {
 `;
 }
 
-function generateServer(template) {
-  const hasCloud = template.features.intelligence;
-
-  return `import express from 'express';
-import 'dotenv/config';
+export function generateServer() {
+  // The getting-started guide's server. mountHiyveRoutes exposes
+  // /generate-room-token, /generate-cloud-token, /create-join-token and
+  // /health under /api; loadHiyveConfig reads APIKEY, CLIENT_SECRET and
+  // SERVER_REGION from .env. Nothing here talks to signaling directly.
+  return `import 'dotenv/config';
+import express from 'express';
+import cors from 'cors';
+import { mountHiyveRoutes, loadHiyveConfig } from '@hiyve/admin';
 
 const app = express();
+app.use(cors({ origin: ['http://localhost:5173'] }));
 app.use(express.json());
 
-const API_KEY = process.env.HIYVE_API_KEY;
-const SIGNALING_URL = process.env.HIYVE_SIGNALING_URL || 'https://signal.hiyve.dev';
-${hasCloud ? `const CLOUD_URL = process.env.HIYVE_CLOUD_URL || 'https://cloud.hiyve.io';\n` : ''}
-/**
- * Generate a room token for the client.
- * In production, add your own authentication before issuing tokens.
- */
-app.post('/api/token', async (req, res) => {
-  const { roomName, userId, displayName } = req.body;
-
-  try {
-    const response = await fetch(\`\${SIGNALING_URL}/api/rooms/token\`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': \`Bearer \${API_KEY}\`,
-      },
-      body: JSON.stringify({ roomName, userId, displayName: displayName || userId }),
-    });
-
-    if (!response.ok) {
-      throw new Error(\`Token request failed: \${response.status}\`);
-    }
-
-    const data = await response.json();
-${hasCloud ? `
-    // Also generate a cloud token for AI features
-    let cloudToken: string | undefined;
-    try {
-      const cloudRes = await fetch(\`\${CLOUD_URL}/auth/tokens/cloud\`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'x-api-key': API_KEY!,
-        },
-        body: JSON.stringify({ userId }),
-      });
-      if (cloudRes.ok) {
-        const cloudData = await cloudRes.json();
-        cloudToken = cloudData.token;
-      }
-    } catch {
-      // Cloud token optional — continue without it
-    }
-
-    res.json({ roomToken: data.token, cloudToken });
-` : `    res.json({ roomToken: data.token });
-`}  } catch (err: any) {
-    console.error('Token error:', err.message);
-    res.status(500).json({ error: 'Failed to generate token' });
-  }
-});
+const apiRouter = express.Router();
+mountHiyveRoutes(apiRouter, loadHiyveConfig());
+app.use('/api', apiRouter);
 
-const PORT = process.env.PORT || 4000;
-app.listen(PORT, () => {
-  console.log(\`Server running on http://localhost:\${PORT}\`);
-});
+const PORT = Number(process.env.PORT) || ${SERVER_PORT};
+app.listen(PORT, () => console.log(\`Server running on http://localhost:\${PORT}\`));
 `;
 }

package/src/commands/init.test.js

@@ -0,0 +1,157 @@
+/**
+ * The scaffolder must produce a project that installs and runs against the
+ * PUBLISHED packages and matches the getting-started guide. It drifted
+ * badly once (2026-09-01): MUI ^5 against a ^9 peer (ERESOLVE on install), a
+ * hand-rolled token route posting to a host with no DNS record, no region
+ * pin, and env var names the SDK does not read. These tests check the
+ * generated output against the real peer ranges in this workspace so the
+ * next drift fails here, not on a developer's first `npm install`.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import {
+  PINS,
+  DEFAULT_REGION,
+  generatePackageJson,
+  generateEnvExample,
+  generateMain,
+  generateApp,
+  generateVideoRoom,
+  generateServer,
+  generateViteConfig,
+  generateTsConfig,
+} from './init.js';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const workspacePkg = (name) =>
+  JSON.parse(readFileSync(join(here, '../../../..', name, 'package.json'), 'utf8'));
+
+const TEMPLATES = {
+  basic: { packages: ['@hiyve/react', '@hiyve/react-ui', '@hiyve/admin'], features: { intelligence: false, collaboration: false } },
+  ai: { packages: ['@hiyve/react', '@hiyve/react-ui', '@hiyve/react-intelligence', '@hiyve/admin'], features: { intelligence: true, collaboration: false } },
+  full: { packages: ['@hiyve/react-room', '@hiyve/react-intelligence', '@hiyve/react-semantic-relay', '@hiyve/admin'], features: { intelligence: true, collaboration: true } },
+};
+
+/** Major of a ^x.y.z / ~x.y.z pin. */
+const majorOf = (range) => Number.parseInt(range.replace(/^[\^~]/, ''), 10);
+/** Majors a caret-only peer range admits, e.g. "^18.0.0 || ^19.0.0" -> [18, 19]. */
+const peerMajors = (peer) => peer.split('||').map((r) => majorOf(r.trim()));
+/** Does a caret pin fall inside a caret-only peer range? */
+const rangeFitsPeer = (pin, peer) => peerMajors(peer).includes(majorOf(pin));
+
+describe('generated package.json', () => {
+  const pkg = JSON.parse(generatePackageJson('demo', TEMPLATES.basic));
+
+  it('pins MUI inside the range @hiyve/react-ui and @hiyve/react-room actually require', () => {
+    for (const p of ['react-ui', 'react-room']) {
+      const peer = workspacePkg(`packages/${p}`).peerDependencies['@mui/material'];
+      expect(rangeFitsPeer(pkg.dependencies['@mui/material'], peer), `${p} wants ${peer}`).toBe(true);
+    }
+    expect(pkg.dependencies['@mui/icons-material']).toBe(pkg.dependencies['@mui/material']);
+  });
+
+  it('pins React inside the range @hiyve/react requires', () => {
+    const peer = workspacePkg('packages/react').peerDependencies.react;
+    expect(rangeFitsPeer(pkg.dependencies.react, peer)).toBe(true);
+    expect(pkg.dependencies['react-dom']).toBe(pkg.dependencies.react);
+  });
+
+  it('never pins MUI 5 or React 18 — the drift that broke install', () => {
+    expect(majorOf(pkg.dependencies['@mui/material'])).toBeGreaterThanOrEqual(9);
+    expect(majorOf(pkg.dependencies.react)).toBeGreaterThanOrEqual(19);
+  });
+
+  it('includes @hiyve/admin — the token server is the SDK, not hand-rolled', () => {
+    expect(pkg.dependencies['@hiyve/admin']).toBeDefined();
+    expect(pkg.dependencies.express).toBeDefined();
+    expect(pkg.dependencies.cors).toBeDefined();
+  });
+
+  it('every dev dependency the tsconfig relies on is present', () => {
+    for (const k of ['@types/node', 'typescript', 'vite', '@vitejs/plugin-react', 'tsx', 'concurrently']) {
+      expect(pkg.devDependencies[k], k).toBe(PINS[k]);
+    }
+  });
+});
+
+describe('generated server', () => {
+  const server = generateServer();
+
+  it('mounts the SDK routes instead of posting to a signaling host by hand', () => {
+    expect(server).toContain("from '@hiyve/admin'");
+    expect(server).toContain('mountHiyveRoutes(apiRouter, loadHiyveConfig())');
+    expect(server).toContain("app.use('/api', apiRouter)");
+    expect(server).not.toContain('signal.hiyve.dev');
+    expect(server).not.toContain('/api/rooms/token');
+    expect(server).not.toContain('HIYVE_API_KEY');
+  });
+
+  it('listens where vite proxies /api to', () => {
+    const port = server.match(/\|\| (\d+);/)[1];
+    expect(generateViteConfig()).toContain(`http://localhost:${port}`);
+  });
+});
+
+describe('generated .env.example', () => {
+  it('uses the variable names loadHiyveConfig reads, and the region the client pins', () => {
+    const env = generateEnvExample(TEMPLATES.basic);
+    expect(env).toMatch(/^APIKEY=pk_/m);
+    expect(env).toMatch(/^CLIENT_SECRET=sk_/m);
+    expect(env).toContain(`SERVER_REGION=${DEFAULT_REGION}`);
+    expect(env).not.toContain('HIYVE_API_KEY');
+    expect(env).not.toContain('signal.hiyve.dev');
+    expect(env).toContain('console.hiyve.dev');
+  });
+
+  it('never emits ENVIRONMENT=development — same cloud as production plus a boot warning', () => {
+    const env = generateEnvExample(TEMPLATES.basic);
+    expect(env).toMatch(/^ENVIRONMENT=production$/m);
+    expect(env).not.toMatch(/^ENVIRONMENT=development/m);
+  });
+});
+
+describe('region pin', () => {
+  it('basic/ai: HiyveProvider in main.tsx carries the region', () => {
+    expect(generateMain(TEMPLATES.basic)).toContain(`<HiyveProvider region="${DEFAULT_REGION}">`);
+    expect(generateMain(TEMPLATES.ai)).toContain(`<HiyveProvider region="${DEFAULT_REGION}">`);
+  });
+
+  it('full: HiyveRoom carries the region and main.tsx does not double-wrap', () => {
+    expect(generateApp(TEMPLATES.full)).toContain(`region={REGION}`);
+    expect(generateApp(TEMPLATES.full)).toContain(`const REGION = '${DEFAULT_REGION}'`);
+    expect(generateMain(TEMPLATES.full)).not.toContain('HiyveProvider');
+  });
+
+  it('client and server agree on the region', () => {
+    const env = generateEnvExample(TEMPLATES.full);
+    const serverRegion = env.match(/^SERVER_REGION=(\S+)/m)[1];
+    expect(serverRegion).toBe(DEFAULT_REGION);
+  });
+});
+
+describe('generated client', () => {
+  it('basic/ai is the guide verbatim: useRoomFlow + JoinForm, SDK fetches the token', () => {
+    const app = generateApp(TEMPLATES.basic);
+    expect(app).toContain("import { useRoomFlow } from '@hiyve/react'");
+    expect(app).toContain('<JoinForm autoConnect devicePreviewMode="inline" />');
+    expect(app).not.toContain('fetch(');
+    expect(generateVideoRoom()).toContain('<VideoGrid localVideoElementId="local-video"');
+  });
+
+  it('full fetches tokens from the SDK routes and reads the fields they return', () => {
+    const app = generateApp(TEMPLATES.full);
+    expect(app).toContain("fetch('/api/generate-room-token'");
+    expect(app).toContain('return data.roomToken');
+    expect(app).toContain("fetch('/api/generate-cloud-token'");
+    expect(app).toContain('return data.cloudToken');
+    expect(app).not.toContain('/api/token');
+  });
+
+  it('tsconfig covers both the browser and the server sources', () => {
+    const ts = JSON.parse(generateTsConfig());
+    expect(ts.include).toEqual(expect.arrayContaining(['src', 'server']));
+    expect(ts.compilerOptions.types).toEqual(expect.arrayContaining(['vite/client', 'node']));
+  });
+});