fix(server-runtime): enforce auth & routing safety, fix lifecycle leaks (#1686)

packages/server-runtime/src/server.test.ts

@@ -1,3 +1,4 @@
+import { Format, LogLevelString } from '@guiiai/logg'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const serveMocks = vi.hoisted(() => {
@@ -10,15 +11,18 @@ const serveMocks = vi.hoisted(() => {
   }))
 
   const closeCall = vi.fn(async () => {})
+  const disposeCall = vi.fn(() => {})
   const setupAppCall = vi.fn(() => ({
     app: {
       fetch: vi.fn(async () => ({ crossws: {} })),
     },
     closeAllPeers: vi.fn(),
+    dispose: disposeCall,
   }))
 
   return {
     closeCall,
+    disposeCall,
     rejectServe: (error: Error) => rejectServe?.(error),
     resolveServe: () => resolveServe?.(),
     serveCall,
@@ -77,6 +81,7 @@ describe('createServer', async () => {
     serveMocks.rejectServe(new Error('bind failed'))
 
     await expect(firstStart).rejects.toThrow('bind failed')
+    expect(serveMocks.disposeCall).toHaveBeenCalledTimes(1)
 
     const retryStart = server.start()
     expect(serveMocks.serveCall).toHaveBeenCalledTimes(2)
@@ -84,4 +89,37 @@ describe('createServer', async () => {
     serveMocks.resolveServe()
     await retryStart
   })
+
+  it('merges nested config updates instead of replacing sibling logger settings', async () => {
+    const server = createServer({
+      hostname: '127.0.0.1',
+      port: 6121,
+      logger: {
+        app: { level: LogLevelString.Log },
+        websocket: { format: Format.Pretty },
+      },
+    })
+
+    server.updateConfig({
+      logger: {
+        app: { format: Format.Pretty },
+      },
+    })
+
+    const startTask = server.start()
+    serveMocks.resolveServe()
+    await startTask
+
+    expect(serveMocks.setupAppCall).toHaveBeenCalledWith(expect.objectContaining({
+      logger: {
+        app: {
+          level: LogLevelString.Log,
+          format: Format.Pretty,
+        },
+        websocket: {
+          format: Format.Pretty,
+        },
+      },
+    }))
+  })
 })