test(cloudflare): decouple native-binding coverage from token minting

[Mkassabov]

Three Cloudflare binding suites deployed their native-binding workers and their HTTP-token workers in a single stack. The *Http layers mint a scoped AccountApiToken, so a credential without token-creation permission failed the whole deploy — taking down the native-binding coverage, which needs no token:

Unauthorized: Unauthorized to access requested resource
  at AccountApiToken.ts (provider.create)

Cloudflare OAuth credentials have no token-creation scope at all, so this is not recoverable by re-authorizing. On --profile alchemy-testing it meant zero coverage of the R2, KV, and Queue native bindings, presenting as a red suite rather than a gap.

Each suite now deploys the two transports separately and gates only the HTTP half.

Queue and KV split their test.provider in two:

-test.provider("Queue write producer over binding + http", (stack) =>
-  // one deploy: WriteBindingWorker + WriteHttpWorker
+test.provider("Queue write producer over the native binding", (stack) =>
+  // deploys WriteBindingWorker only — no token needed
+
+test.provider.skipIf(!process.env.CLOUDFLARE_TEST_API_TOKENS)(
+  "Queue write producer over a scoped HTTP token", (stack) =>
+  // deploys WriteHttpWorker only

R2 uses a shared beforeAll, so it splits fixtures/stack.ts into a binding stack plus a new fixtures/stack-http.ts and gates at the describe:

+describe("native binding", () => {
+  const stack = beforeAll(deploy(Stack), { timeout: HOOK_TIMEOUT });
+
+describe.skipIf(!process.env.CLOUDFLARE_TEST_API_TOKENS)("http token", () => {
+  const stack = beforeAll(deploy(HttpStack), { timeout: HOOK_TIMEOUT });

The gate sits on the describe rather than the individual tests so the suite's beforeAll never runs at all — runSuite skips a suite's hooks when every test below it is skipped (alchemy-test/src/Runner.ts). Both stacks stay independently inspectable via alchemy tail.

The env var matches CLOUDFLARE_TEST_USER_TOKENS on the UserApiToken lifecycle tests, and each skip comment records the exact error per the entitlement-gating convention.

Result

suite	before	after
test/Cloudflare/Queue	24 passed, 1 failed	25 passed, 1 gated
R2/Binding + KV/Binding	0 passed, 5 failed	3 passed, 3 gated

The native-binding cases are coverage that was previously lost entirely, not failures that were re-labelled. Confirmed the gates are not inert: with CLOUDFLARE_TEST_API_TOKENS=1 the HTTP tests run and reach the recorded token-creation error.

[alchemy-version-bot]

Install the packages built from this commit:

Alchemy

alchemy

bun add https://pkg.ing/alchemy/a5646bb

@alchemy.run/better-auth

bun add https://pkg.ing/@alchemy.run/better-auth/a5646bb

@alchemy.run/cloudflare-runtime

bun add https://pkg.ing/@alchemy.run/cloudflare-runtime/a5646bb

@alchemy.run/frontend-frameworks

bun add https://pkg.ing/@alchemy.run/frontend-frameworks/a5646bb

@alchemy.run/node-utils

bun add https://pkg.ing/@alchemy.run/node-utils/a5646bb

@alchemy.run/pr-package

bun add https://pkg.ing/@alchemy.run/pr-package/a5646bb

@alchemy.run/floci

bun add https://pkg.ing/@alchemy.run/floci/a5646bb

Distilled

@distilled.cloud/core

bun add https://pkg.ing/@distilled.cloud/core/809f3d8

@distilled.cloud/aws

bun add https://pkg.ing/@distilled.cloud/aws/809f3d8

@distilled.cloud/axiom

bun add https://pkg.ing/@distilled.cloud/axiom/809f3d8

@distilled.cloud/cloudflare

bun add https://pkg.ing/@distilled.cloud/cloudflare/809f3d8

@distilled.cloud/hetzner

bun add https://pkg.ing/@distilled.cloud/hetzner/809f3d8

@distilled.cloud/neon

bun add https://pkg.ing/@distilled.cloud/neon/809f3d8

@distilled.cloud/planetscale

bun add https://pkg.ing/@distilled.cloud/planetscale/809f3d8