test: adopt @cloudflare/vitest-pool-workers, delete SQL-parser mock (#9)

* test: introduce vitest-pool-workers for D1-backed integration tests

Migrates 4 server tests from the SQL-parsing mock DB to real D1 running
inside the Workers runtime via @cloudflare/vitest-pool-workers. Existing
tests on happy-dom remain untouched.

Changes:
- Adds vitest.workers.config.ts (cloudflareTest plugin + cloudflarePool)
  scoped to the 4 migrated tests; filters out data-only migrations
- Adds src/lib/test/{apply-migrations,seed,call}.ts as the new test
  infrastructure (real-D1 seeding, FK-aware reset, minimal RequestEvent
  builder)
- Migrates health, db/configs, api/configs, and api/auth/cli/poll tests
- Bumps vitest 4.0.18 -> 4.1.x (pool-workers peer dep)
- Fixes migration 0002 to use ADD COLUMN + CREATE UNIQUE INDEX instead
  of ALTER TABLE ADD COLUMN ... UNIQUE (SQLite-illegal; hosted D1 had
  tolerated it). Safe for prod, already applied
- Fixes 3 hidden test bugs where fixtures duplicated UNIQUE alias
  values; the SQL-parser mock didn't enforce the constraint

After: 48 tests on pool-workers (4 files), 232 on happy-dom (16 files),
all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test: complete vitest-pool-workers migration, delete SQL-parser mock

Migrates the remaining 9 server tests to vitest-pool-workers and removes
the fragile SQL-parsing mock DB. Pure-library tests (rate-limit,
install-script, validation) and archtests stay on happy-dom — they don't
need D1 or the Workers runtime.

Migrated to pool-workers in this commit:
- src/lib/server/auth.test.ts (JWT + DB-backed getCurrentUser)
- src/routes/api/auth/cli/start/server.test.ts
- src/routes/api/auth/cli/approve/server.test.ts
- src/routes/api/configs/[slug]/server.test.ts
- src/routes/api/configs/[slug]/revisions/server.test.ts
- src/routes/[username]/[slug]/install/server.test.ts
- src/routes/[username]/[slug]/config/server.test.ts
- src/smoke-tests/{cli-auth-flow,config-crud,critical-paths}.test.ts

The CLI auth-flow smoke test now exercises the real approve endpoint
end-to-end (previously had to fake it because the mock couldn't handle
datetime expressions). The config-crud smoke test now verifies UPDATE
side effects in the DB (previously couldn't — mock didn't honor
COALESCE).

Infrastructure:
- Adds src/lib/test/call.ts helper to cut RequestEvent boilerplate
- Extends call() with params/clientAddress for routes that need them
- Deletes src/lib/test/db-mock.ts (~390 lines of SQL-parsing mock)
- Deletes src/lib/test/setup.ts (process.env shims no longer needed)
- Deletes src/lib/test/helpers.ts (unused after migration)
- Trims src/lib/test/fixtures.ts to data-only exports
- Adds @cloudflare/vitest-pool-workers/types to tsconfig.json
- Wires npm test / test:run / test:coverage to run both configs;
  adds test:happy-dom and test:workers for targeted runs

Final test layout: 181 tests on pool-workers (14 files, real D1 +
Workers runtime), 99 tests on happy-dom (6 files, pure libs +
archtests). Both green; full npm run validate clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: bump Node to 22 and silence knip on cloudflare:test virtual module

CI Node 20 → 22 because @cloudflare/vitest-pool-workers transitively
pulls @cloudflare/kv-asset-handler@0.5.0 which requires Node ≥22.

knip drift sensor was flagging every `cloudflare:test` import as an
unlisted dependency (it doesn't grok the virtual-module convention).
Added `cloudflare` to knip.json's ignoreDependencies so the sensor stops
opening tracking issues for this. The package itself is provided by
@cloudflare/vitest-pool-workers and not a real dependency entry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(test): skip v8 coverage on pool-workers suite

workerd has no node:inspector/promises module, which @vitest/coverage-v8
requires. Coverage now runs only on the happy-dom suite; the
pool-workers suite still runs (verifying behavior) but does not
contribute to the coverage report. Trade-off: covered % drops because
many tests moved to pool-workers. Acceptable — tests still execute,
and switching the coverage backend (e.g. istanbul) is a separate
decision.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: fullstackjam

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install dependencies
         run: npm install --legacy-peer-deps

.github/workflows/deploy.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install dependencies
         run: npm install --legacy-peer-deps

.github/workflows/harness.yml

@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
       - name: npm audit --audit-level=high
         # Fails on a high-or-critical advisory. Production-only because we
         # don't act on devDep advisories (no runtime exposure).
@@ -48,7 +48,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
       - name: Install dependencies
         run: npm install --legacy-peer-deps --no-audit --no-fund
       - name: Run knip

knip.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://unpkg.com/knip@5/schema.json",
 	"entry": ["src/lib/components/SearchModal.svelte!"],
-	"ignoreDependencies": ["@cloudflare/workers-types"],
+	"ignoreDependencies": ["@cloudflare/workers-types", "cloudflare"],
 	"rules": {
 		"exports": "off",
 		"types": "off",

migrations/0002_add_alias.sql

@@ -2,9 +2,15 @@
 -- Created: 2024-02-01
 -- Note: SQLite doesn't support "IF NOT EXISTS" for ALTER TABLE ADD COLUMN
 -- This migration may fail if already applied - that's expected behavior
+--
+-- 2026 update: SQLite forbids `ADD COLUMN ... UNIQUE` (hosted D1 silently
+-- tolerated this in the past, local Miniflare D1 rejects it strictly per
+-- the SQLite spec). Replaced with the canonical pattern:
+-- ADD COLUMN (no constraint) + CREATE UNIQUE INDEX. Equivalent uniqueness
+-- guarantee, runs on both hosted and local D1. Safe to re-apply on prod:
+-- this migration is already recorded in d1_migrations, so it will not
+-- re-execute against the hosted DB.
 
--- Add alias column (will fail if exists - that's OK)
-ALTER TABLE configs ADD COLUMN alias TEXT UNIQUE;
+ALTER TABLE configs ADD COLUMN alias TEXT;
 
--- Create index (idempotent)
-CREATE INDEX IF NOT EXISTS idx_configs_alias ON configs(alias);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_configs_alias_unique ON configs(alias);