chore(deps): update cloudflare-workers

.github/workflows/site-deploy.yml

@@ -123,7 +123,7 @@ jobs:
         if: github.event.workflow_run.event == 'push'
         uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
         with:
-          wranglerVersion: "4.113.0"
+          wranglerVersion: "4.125.0"
           workingDirectory: cloudflare_site
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -135,7 +135,7 @@ jobs:
         if: github.event.workflow_run.event == 'pull_request'
         uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
         with:
-          wranglerVersion: "4.113.0"
+          wranglerVersion: "4.125.0"
           workingDirectory: cloudflare_site
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

internal/dispatch/cf/workersrc/cloudflare-env.d.ts

@@ -0,0 +1,18 @@
+// Ambient type declarations for the Cloudflare Worker test environment.
+//
+// @cloudflare/vitest-pool-workers v0.22+ moved the "cloudflare:test" module
+// declaration to a separate export subpath ("./types"). The triple-slash
+// reference below pulls it in so that test files can import
+// createExecutionContext, waitOnExecutionContext, etc.
+/// <reference types="@cloudflare/vitest-pool-workers/types" />
+
+// Declare the main module's exports so that
+//   import { exports } from "cloudflare:workers"
+// resolves exports.default to the worker's default export handler.
+// Required by @cloudflare/workers-types which derives Cloudflare.Exports
+// from GlobalProps.mainModule (defaults to {} when undeclared).
+declare namespace Cloudflare {
+  interface GlobalProps {
+    mainModule: typeof import("./src/index");
+  }
+}

internal/dispatch/cf/workersrc/package.json

@@ -16,10 +16,10 @@
     "test": "vitest run"
   },
   "devDependencies": {
-    "@cloudflare/vitest-pool-workers": "^0.8.0",
+    "@cloudflare/vitest-pool-workers": "^0.22.0",
     "@cloudflare/workers-types": "^5.20260708.1",
     "typescript": "^5.8.0",
-    "vitest": "^3.2.0",
+    "vitest": "^4.1.0",
     "wrangler": "^4.0.0"
   }
 }

internal/dispatch/cf/workersrc/src/index.test.ts

@@ -4,12 +4,11 @@
 // with the real Go WASM binary. They verify that the bridge boots —
 // not full mint OIDC coverage. Run after `make wasm-stage` so that
 // mintcore.wasm and wasm_exec.js are present.
-import { env } from "cloudflare:workers";
+import { env, exports } from "cloudflare:workers";
 import {
   createExecutionContext,
   waitOnExecutionContext,
 } from "cloudflare:test";
-import { SELF } from "cloudflare:test";
 import { describe, expect, it } from "vitest";
 import worker, { type Env } from "./index";
 
@@ -28,21 +27,21 @@ describe("mint worker bridge smoke", () => {
   // to verify the Worker boots for per-repo-only deployments (parity
   // with Go mintcore which allows empty ALLOWED_ORGS since #5856).
   it("boots and serves /health without ALLOWED_ORGS", async () => {
-    const resp = await SELF.fetch("https://worker.test/health");
+    const resp = await exports.default.fetch("https://worker.test/health");
     expect(resp.status).toBe(200);
 
     const body = await resp.text();
     expect(body).toContain("ok");
   });
 
   it("returns 404 for unknown paths", async () => {
-    const resp = await SELF.fetch("https://worker.test/nonexistent");
+    const resp = await exports.default.fetch("https://worker.test/nonexistent");
     // Go's ServeHTTP routes this; unmatched paths return 404.
     expect(resp.status).toBe(404);
   });
 
   it("returns 405 for non-POST on /v1/token", async () => {
-    const resp = await SELF.fetch("https://worker.test/v1/token", {
+    const resp = await exports.default.fetch("https://worker.test/v1/token", {
       method: "GET",
     });
     // The mint handler rejects non-POST on the token endpoint.

internal/dispatch/cf/workersrc/vitest.config.ts

@@ -1,32 +1,31 @@
-import { defineWorkersConfig } from "@cloudflare/vitest-pool-workers/config";
+import { cloudflareTest } from "@cloudflare/vitest-pool-workers";
+import { defineConfig } from "vitest/config";
 
-export default defineWorkersConfig({
-  test: {
-    poolOptions: {
-      workers: {
-        wrangler: { configPath: "./wrangler.toml" },
-        miniflare: {
-          // Minimal env bindings for smoke testing. These satisfy
-          // the inline ROLE_APP_IDS presence check and mintcoreInitMint()
-          // so the WASM bridge can boot. "coder" is a canonical mintcore role — using a
-          // non-canonical name (e.g. "test") causes mintcoreInitMint
-          // to fail because HasRole() rejects unknown roles, and the
-          // ConfigError is cached permanently.
-          // PEM secrets are not needed for the /health and routing tests.
-          //
-          // ALLOWED_ORGS is intentionally omitted to verify the Worker
-          // boots without it (per-repo-only deployment parity with Go
-          // mintcore, which allows empty ALLOWED_ORGS since #5856).
-          //
-          // ALLOWED_WORKFLOW_FILES is set explicitly here (not via a
-          // production default). Production code defaults to "" (fail-
-          // closed) when the env var is absent — matching cmd/mint.
-          bindings: {
-            ROLE_APP_IDS: '{"coder":"12345"}',
-            ALLOWED_WORKFLOW_FILES: "*",
-          },
+export default defineConfig({
+  plugins: [
+    cloudflareTest({
+      wrangler: { configPath: "./wrangler.toml" },
+      miniflare: {
+        // Minimal env bindings for smoke testing. These satisfy
+        // the inline ROLE_APP_IDS presence check and mintcoreInitMint()
+        // so the WASM bridge can boot. "coder" is a canonical mintcore role — using a
+        // non-canonical name (e.g. "test") causes mintcoreInitMint
+        // to fail because HasRole() rejects unknown roles, and the
+        // ConfigError is cached permanently.
+        // PEM secrets are not needed for the /health and routing tests.
+        //
+        // ALLOWED_ORGS is intentionally omitted to verify the Worker
+        // boots without it (per-repo-only deployment parity with Go
+        // mintcore, which allows empty ALLOWED_ORGS since #5856).
+        //
+        // ALLOWED_WORKFLOW_FILES is set explicitly here (not via a
+        // production default). Production code defaults to "" (fail-
+        // closed) when the env var is absent — matching cmd/mint.
+        bindings: {
+          ROLE_APP_IDS: '{"coder":"12345"}',
+          ALLOWED_WORKFLOW_FILES: "*",
         },
       },
-    },
-  },
+    }),
+  ],
 });