vitest.config.ts

import { defineWorkersConfig } from '@cloudflare/vitest-pool-workers/config';
import { configDefaults } from 'vitest/config';

export default defineWorkersConfig(async () => {
  // The PG test DB: a Neon branch in CI (TEST_DATABASE_URL secret), or a
  // DEDICATED local database (agent_coordinator_test) on pg0 — separate from the
  // dev `agent_coordinator` DB so the suite never pollutes local development.
  // pg-global-setup creates + migrates + truncates it. Used by BOTH the Node-side
  // migrator and the HYPERDRIVE binding (worker side) so they target one DB.
  const testPgConnectionString =
    process.env.TEST_DATABASE_URL ||
    'postgres://postgres:postgres@127.0.0.1:5440/agent_coordinator_test';

  return {
    test: {
      // test/node/** is the Node lane (real WS/child-process) — it runs via
      // `npm run test:node` (vitest.node.config.ts), never the Workers pool.
      exclude: [...configDefaults.exclude, 'packages/**', '.sisyphus/**', 'tools/**', 'test/node/**'],
      // Ensures the PG schema exists once before the suite (idempotent no-op
      // against an already-migrated DB). Runs in Node, not the worker isolate.
      globalSetup: ['./test/helpers/pg-global-setup.ts'],
      pool: '@cloudflare/vitest-pool-workers',
      poolOptions: {
        workers: {
          isolatedStorage: false,
          // All test files share one worker so modules are fetched from the
          // vite-node service ONCE rather than per-file. Without this, the
          // single-runtime suite opens tens of thousands of short-lived loopback
          // connections (one per module fetch × file), exhausting the macOS
          // ephemeral port range mid-run ("Can't assign requested address").
          singleWorker: true,
          wrangler: {
            configPath: './wrangler.jsonc',
          },
          main: './src/index.ts',
          miniflare: {
            // Point the HYPERDRIVE binding at the test PG DB. @cloudflare/vitest-pool-workers
            // forwards poolOptions.workers.miniflare.* to miniflare's WorkerOptions, and
            // miniflare exposes `hyperdrives: Record<binding, connectionString>` — so the
            // worker's c.env.HYPERDRIVE.connectionString resolves to TEST_DATABASE_URL (CI)
            // or pg0 (local). Chosen over the wrangler env-var override because it keeps the
            // resolution in one typed place alongside d1Databases.
            hyperdrives: {
              HYPERDRIVE: testPgConnectionString,
            },
            bindings: {
              ALLOW_LOCAL_ORIGIN: '1',
              ENCRYPTION_KEY: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
              GITHUB_WEBHOOK_SECRET: 'test-webhook-secret',
              GITHUB_APP_ID: '3542682',
              // Guard-only placeholder so GET /api/github/setup gets past its
              // `GITHUB_APP_ID && GITHUB_APP_PRIVATE_KEY` check (audit-row-coverage
              // mocks getInstallation, so the key is never used to sign). Non-PEM
              // on purpose: if doSpawn's App-token resolver ever activates in a
              // test, crypto.subtle.importKey throws BEFORE any network call and
              // doSpawn swallows it (cloneToken stays undefined) — never reaches
              // api.github.com.
              GITHUB_APP_PRIVATE_KEY: 'test-app-private-key-placeholder-not-a-pem',
              // The pool inherits the Hyperdrive→pg0 binding from wrangler.jsonc;
              // disable the durable run flush so terminal transitions across the
              // suite don't open real pg connections (connection churn exhausts
              // ephemeral ports and destabilizes workerd). The flush write is
              // verified against the live acdev stack, not the unit suite.
              RUN_FLUSH_DISABLED: '1',
              // Environment-validation routes: a shared HMAC secret so the
              // callback can be exercised, and a deliberately-unreachable Modal
              // URL so the validate dispatch fails fast (we test the run-created
              // + failRun path; the happy dispatch is covered by smoke/E2E).
              MODAL_API_SECRET: 'test-modal-secret',
              MODAL_API_URL: 'http://127.0.0.1:9',
            },
          },
        },
      },
    },
  };
});