@tdk-landscape/tdk-cli-core 1.3.53 → 1.3.54

package/tests/tilt-engine/test_runtime_container_footprint.py

@@ -1,162 +0,0 @@
-"""
-Runtime container footprint: single Bun process, cheap healthchecks, lean golden images.
-
-Executes the real Starlark generators through Tilt's interpreter
-(`tilt alpha tiltfile-result`) instead of inspecting source text.
-Spec: openspec/changes/optimize-runtime-docker-layers/specs/runtime-container-footprint/spec.md
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-pytestmark = [
-    pytest.mark.generator,
-    pytest.mark.skipif(shutil.which("tilt") is None, reason="tilt CLI not installed"),
-]
-
-DOCKER_DIR = Path(__file__).resolve().parents[2] / "engine" / "topologies" / "platform" / "docker"
-RESULT_MARKER = "Error in fail: RESULT"
-
-
-def run_starlark(tmp_path: Path, body: str, env: dict | None = None) -> dict:
-    """Run `body` in a Tiltfile; `body` must assign a dict to `r`. `@DOCKER` is the engine docker dir."""
-    tiltfile = tmp_path / "Tiltfile"
-    tiltfile.write_text(
-        f"HERE = '{tmp_path}'\n"
-        + body.replace("@DOCKER", str(DOCKER_DIR))
-        + "\nfail('RESULT' + encode_json(r))\n"
-    )
-    proc = subprocess.run(
-        ["tilt", "alpha", "tiltfile-result", "-f", str(tiltfile)],
-        capture_output=True,
-        text=True,
-        env={**os.environ, **(env or {})},
-        timeout=180,
-    )
-    output = proc.stdout + proc.stderr
-    assert RESULT_MARKER in output, output[-3000:]
-    return json.loads(output.split(RESULT_MARKER, 1)[1].strip())
-
-
-def write_service(tmp_path: Path, name: str, start_script: str | None) -> None:
-    service_dir = tmp_path / name
-    service_dir.mkdir()
-    scripts = {} if start_script is None else {"start": start_script}
-    (service_dir / "package.json").write_text(json.dumps({"name": name, "scripts": scripts}))
-
-
-def cmd_lines(dockerfile: str) -> list[str]:
-    return [line for line in dockerfile.splitlines() if line.startswith("CMD ")]
-
-
-def healthcheck_lines(dockerfile: str) -> list[str]:
-    return [line for line in dockerfile.splitlines() if line.startswith("HEALTHCHECK")]
-
-
-@pytest.mark.parametrize(
-    ("start_script", "expected_cmd"),
-    [
-        ("bun run dist/index.js", 'CMD ["bun", "dist/index.js"]'),
-        ("bun dist/index.js", 'CMD ["bun", "dist/index.js"]'),
-        ("bun run dist/index.js --port 4000", 'CMD ["bun", "run", "start"]'),
-        ("NODE_ENV=x bun run dist/index.js", 'CMD ["bun", "run", "start"]'),
-        ("tsc && bun dist/index.js", 'CMD ["bun", "run", "start"]'),
-        ("bun run serve", 'CMD ["bun", "run", "start"]'),
-        (None, 'CMD ["bun", "run", "start"]'),
-    ],
-)
-def test_backend_cmd_follows_start_script(tmp_path, start_script, expected_cmd):
-    write_service(tmp_path, "svc", start_script)
-    r = run_starlark(
-        tmp_path,
-        "load('@DOCKER/layers/l4_runtime_layers.star', 'L4_generate_backend_runtime')\n"
-        "r = {\n"
-        "  'plain': L4_generate_backend_runtime(HERE + '/svc'),\n"
-        "  'infisical': L4_generate_backend_runtime(HERE + '/svc', use_infisical=True, resource_name='svc'),\n"
-        "}\n",
-    )
-    assert cmd_lines(r["plain"]) == [expected_cmd]
-    assert cmd_lines(r["infisical"]) == [expected_cmd]
-    assert 'ENTRYPOINT ["/entrypoint.sh"]' in r["infisical"]
-
-
-def test_explicit_cmd_override_is_kept(tmp_path):
-    write_service(tmp_path, "svc", "bun run dist/index.js")
-    r = run_starlark(
-        tmp_path,
-        "load('@DOCKER/layers/l4_runtime_layers.star', 'L4_generate_backend_runtime')\n"
-        "r = {'df': L4_generate_backend_runtime(HERE + '/svc', cmd='bun run start:prod')}\n",
-    )
-    assert cmd_lines(r["df"]) == ['CMD ["bun", "run", "start:prod"]']
-
-
-def test_hugo_installed_only_for_services_declaring_it(tmp_path):
-    write_service(tmp_path, "svc", "bun run dist/index.js")
-    r = run_starlark(
-        tmp_path,
-        "load('@DOCKER/layers/l4_runtime_layers.star', 'L4_generate_backend_runtime')\n"
-        "r = {\n"
-        "  'with': L4_generate_backend_runtime(HERE + '/svc', manifest={'featuresEnabled': ['hugo']}),\n"
-        "  'without': L4_generate_backend_runtime(HERE + '/svc', manifest={'featuresEnabled': []}),\n"
-        "}\n",
-    )
-    assert "apk add --no-cache hugo" in r["with"]
-    assert "apk add --no-cache hugo" not in r["without"]
-
-
-def test_golden_dockerfile_is_lean_and_uses_shared_healthcheck(tmp_path):
-    r = run_starlark(
-        tmp_path,
-        "load('@DOCKER/build/golden_image_dockerfile.star', 'generate_golden_dockerfile')\n"
-        "r = {'df': generate_golden_dockerfile()}\n",
-    )
-    df = r["df"]
-    backend_bun_stage = df.split("AS l4_backend_bun", 1)[1].split("\nFROM ", 1)[0]
-    migrator_stage = df.split("AS l4_migrator_golden", 1)[1].split("\nFROM ", 1)[0]
-
-    assert "apk add --no-cache hugo" not in backend_bun_stage
-    assert "HEALTHCHECK NONE" in migrator_stage
-
-    checks = healthcheck_lines(df)
-    assert checks, "golden Dockerfile has no HEALTHCHECK instructions"
-    for line in checks:
-        assert "bunx" not in line and "npx" not in line, line
-        if line != "HEALTHCHECK NONE":
-            assert "--interval=30s --start-interval=2s" in line, line
-
-
-def test_compose_entries_use_init_and_shared_healthcheck(tmp_path):
-    r = run_starlark(
-        tmp_path,
-        "load('@DOCKER/compose/compose.star', 'generate_backend_compose_entry', 'generate_frontend_compose')\n"
-        "r = {\n"
-        "  'backend': generate_backend_compose_entry('services/finance', 'finance', {'name': 'cash-api'},"
-        " {'stack': 'finance', 'port': 4018, 'appType': 'backend'}),\n"
-        "  'frontend': generate_frontend_compose('services/finance', 'finance', {'name': 'dash-app'},"
-        " {'stack': 'finance', 'port': 3010, 'appType': 'frontend'}),\n"
-        "}\n",
-    )
-    for kind in ("backend", "frontend"):
-        entry = r[kind]
-        assert "init: true" in entry, kind
-        assert "interval: 30s" in entry, kind
-        assert "start_interval: 2s" in entry, kind
-        assert "interval: 10s" not in entry, kind
-
-
-def test_healthcheck_interval_is_configurable(tmp_path):
-    r = run_starlark(
-        tmp_path,
-        "load('@DOCKER/config/healthcheck.star', 'dockerfile_healthcheck_flags', 'compose_healthcheck_timing')\n"
-        "r = {'flags': dockerfile_healthcheck_flags(), 'timing': compose_healthcheck_timing()}\n",
-        env={"TDK_HEALTHCHECK_INTERVAL_SECONDS": "15"},
-    )
-    assert "--interval=15s" in r["flags"]
-    assert "interval: 15s" in r["timing"]

package/tests/tilt-engine/test_sablier_defer_start.py

@@ -1,237 +0,0 @@
-"""
-sablier.deferStart: schema field and its enable-required cross-field rule.
-
-Executes the real Starlark validator through Tilt's interpreter
-(`tilt alpha tiltfile-result`) instead of inspecting source text.
-Spec: openspec/changes/prioritized-cold-start/specs/on-demand-resource-startup/spec.md
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-pytestmark = [
-    pytest.mark.generator,
-    pytest.mark.skipif(shutil.which("tilt") is None, reason="tilt CLI not installed"),
-]
-
-MANIFEST_DIR = Path(__file__).resolve().parents[2] / "engine" / "topologies" / "tilt" / "manifest"
-ORCHESTRATOR_DIR = Path(__file__).resolve().parents[2] / "engine" / "topologies" / "tilt" / "resources" / "orchestrator"
-RESULT_MARKER = "Error in fail: RESULT"
-
-
-def run_starlark(tmp_path: Path, body: str) -> dict:
-    """Run `body` in a Tiltfile; `body` must assign a dict to `r`. `@MANIFEST`/`@ORCHESTRATOR` are module dirs."""
-    tiltfile = tmp_path / "Tiltfile"
-    tiltfile.write_text(
-        body.replace("@MANIFEST", str(MANIFEST_DIR)).replace("@ORCHESTRATOR", str(ORCHESTRATOR_DIR))
-        + "\nfail('RESULT' + encode_json(r))\n"
-    )
-    proc = subprocess.run(
-        ["tilt", "alpha", "tiltfile-result", "-f", str(tiltfile)],
-        capture_output=True,
-        text=True,
-        timeout=180,
-    )
-    output = proc.stdout + proc.stderr
-    assert RESULT_MARKER in output, output[-3000:]
-    return json.loads(output.split(RESULT_MARKER, 1)[1].strip())
-
-
-def validate_sablier(tmp_path: Path, sablier: dict | None) -> dict:
-    manifest = {"appType": "backend", "stack": "test"}
-    if sablier is not None:
-        manifest["sablier"] = sablier
-    return run_starlark(
-        tmp_path,
-        "load('@MANIFEST/validator.star', 'ManifestValidator')\n"
-        f"manifest = {manifest!r}\n"
-        "result = ManifestValidator.validate(manifest, level='cross_field')\n"
-        "r = {'valid': result.valid, 'errors': [e.message for e in result.errors]}\n",
-    )
-
-
-@pytest.mark.parametrize(
-    "sablier",
-    [
-        None,
-        {"enable": False},
-        {"enable": True},
-        {"enable": True, "deferStart": True},
-        {"enable": True, "deferStart": False},
-    ],
-)
-def test_defer_start_with_enable_is_valid(tmp_path, sablier):
-    r = validate_sablier(tmp_path, sablier)
-    assert r["valid"], r["errors"]
-
-
-def test_defer_start_without_enable_is_rejected(tmp_path):
-    r = validate_sablier(tmp_path, {"deferStart": True})
-    assert not r["valid"]
-    assert any("deferStart" in e and "enable" in e for e in r["errors"]), r["errors"]
-
-
-def test_defer_start_with_enable_false_is_rejected(tmp_path):
-    r = validate_sablier(tmp_path, {"enable": False, "deferStart": True})
-    assert not r["valid"]
-    assert any("deferStart" in e and "enable" in e for e in r["errors"]), r["errors"]
-
-
-def resource_defers_start(tmp_path: Path, sablier: dict | None) -> bool:
-    manifest = {"appType": "backend", "stack": "test"}
-    if sablier is not None:
-        manifest["sablier"] = sablier
-    result = run_starlark(
-        tmp_path,
-        "load('@ORCHESTRATOR/apply_compose_resource_registration.star', 'resource_defers_start')\n"
-        f"manifest = {manifest!r}\n"
-        "r = {'defers': resource_defers_start(manifest)}\n",
-    )
-    return result["defers"]
-
-
-@pytest.mark.parametrize(
-    "sablier",
-    [
-        None,
-        {},
-        {"enable": False},
-        {"enable": True},
-        {"enable": False, "deferStart": True},
-        {"enable": True, "deferStart": False},
-        {"enable": True, "deferStart": True},
-    ],
-)
-def test_resource_defers_start_stays_off_without_a_license(tmp_path, sablier):
-    """deferStart stays behind the same TDK_LICENSE_KEY gate as the rest of
-    `sablier` (an explicit product decision -- see openspec/changes/
-    prioritized-cold-start's design.md). This repo ships only the free-tier
-    `sablier_container_cycle.star` stub, whose sablier_middleware_suffix()
-    always reports disabled regardless of the manifest -- so every case here
-    must resolve to False, including {"enable": True, "deferStart": True}.
-    The corresponding "licensed and enabled" True case can only be exercised
-    where the real premium module is actually vendored (tdk-cli-extensions),
-    not from this repo's stub."""
-    assert resource_defers_start(tmp_path, sablier) is False
-
-
-def _run_resolve_deps(tmp_path: Path, manifest: dict, resource_manifests: dict, all_services_map: dict) -> list:
-    result = run_starlark(
-        tmp_path,
-        "load('@ORCHESTRATOR/apply_compose_resource_registration.star', 'resolve_defer_start_dependencies')\n"
-        f"manifest = {manifest!r}\n"
-        f"resource_manifests = {resource_manifests!r}\n"
-        f"all_services_map = {all_services_map!r}\n"
-        "r = {'deps': [list(pair) for pair in resolve_defer_start_dependencies(manifest, resource_manifests, all_services_map)]}\n",
-    )
-    return result["deps"]
-
-
-LICENSED_SABLIER_MANIFEST = {"appType": "backend", "stack": "test", "sablier": {"enable": True, "deferStart": True}}
-
-
-def test_resolve_defer_start_dependencies_excludes_non_defer_dependency(tmp_path):
-    """A dependsOn entry that resolves to a real resource with no sablier.deferStart
-    (e.g. always-on infra, or a normal backend) contributes nothing to X-Wake-Deps."""
-    manifest = {"appType": "backend", "stack": "test", "dependsOn": ["plain-backend"]}
-    resource_manifests = {"plain-backend": {"appType": "backend", "stack": "other"}}
-    all_services_map = {"plain-backend": {"name": "other-service", "resources": [{"name": "plain-backend"}]}}
-    assert _run_resolve_deps(tmp_path, manifest, resource_manifests, all_services_map) == []
-
-
-def test_resolve_defer_start_dependencies_excludes_unresolvable_name(tmp_path):
-    """A dependsOn short name that doesn't match any known resource/service falls
-    back (via _resolve_dependency_to_resource) to a name absent from
-    resource_manifests, so it's quietly excluded rather than guessed at (D5)."""
-    manifest = {"appType": "backend", "stack": "test", "dependsOn": ["nonexistent-thing"]}
-    assert _run_resolve_deps(tmp_path, manifest, {}, {}) == []
-
-
-def test_resolve_defer_start_dependencies_stays_empty_without_a_license(tmp_path):
-    """Even when a dependsOn entry resolves to a resource whose manifest asks for
-    sablier.deferStart, this repo's free-tier stub keeps resource_defers_start()
-    False for it too (same license gate as the resource's own deferStart check),
-    so it's excluded here just as it would be for the resource itself."""
-    manifest = {"appType": "backend", "stack": "test", "dependsOn": ["peer-backend"]}
-    resource_manifests = {"peer-backend": LICENSED_SABLIER_MANIFEST}
-    all_services_map = {"peer-backend": {"name": "peer-service", "resources": [{"name": "peer-backend"}]}}
-    assert _run_resolve_deps(tmp_path, manifest, resource_manifests, all_services_map) == []
-
-
-def test_resolve_defer_start_dependencies_no_depends_on(tmp_path):
-    manifest = {"appType": "backend", "stack": "test"}
-    assert _run_resolve_deps(tmp_path, manifest, {}, {}) == []
-
-
-def _run_resolve_names(tmp_path: Path, manifest: dict, all_services_map: dict) -> list:
-    result = run_starlark(
-        tmp_path,
-        "load('@ORCHESTRATOR/apply_compose_resource_registration.star', 'resolve_manifest_dependency_names')\n"
-        f"manifest = {manifest!r}\n"
-        f"all_services_map = {all_services_map!r}\n"
-        "r = {'names': resolve_manifest_dependency_names(manifest, all_services_map)}\n",
-    )
-    return result["names"]
-
-
-def test_resolve_manifest_dependency_names_exact_match(tmp_path):
-    """The common case: dependsOn already names a real resource exactly, so
-    _resolve_dependency_to_resource returns it unchanged (no '-yaml' guess)."""
-    manifest = {"dependsOn": ["identity-management-backend"]}
-    all_services_map = {
-        "identity-management-backend": {"name": "identity-management", "resources": [{"name": "identity-management-backend"}]},
-    }
-    assert _run_resolve_names(tmp_path, manifest, all_services_map) == ["identity-management-backend"]
-
-
-def test_prebuild_dockerignore_mirrors_docker_build_only_and_ignore(tmp_path):
-    """A deferStart resource's image is pre-built by a plain `docker build`
-    (auto_init=False skips the dc_resource's own docker_build -- found live,
-    task 7.2). A plain build has no only= filter, so the generated allowlist
-    must include exactly what docker_build's only= does (root lockfiles, the
-    service, docker-templates, its internal libraries) and re-exclude its
-    ignore= patterns, or the whole project root becomes the build context."""
-    project = tmp_path / "project"
-    service = project / "services" / "analytics" / "data-governance-api"
-    (service / ".autogenerated").mkdir(parents=True)
-    (service / "package.json").write_text(
-        json.dumps({"dependencies": {"@tdk-project/platform-logging": "workspace:*", "zod": "^3"}})
-    )
-    dockerfile = service / ".autogenerated" / "Dockerfile.app.autogenerated"
-    dockerfile.write_text("FROM scratch\n")
-    (service / ".autogenerated" / "Dockerfile.app.autogenerated.dockerignore").write_text(
-        "# comment\nnode_modules\n*.md\n!.env.example\n"
-    )
-    tiltdir = tmp_path / "tilt"
-    tiltdir.mkdir()
-    r = run_starlark(
-        tiltdir,
-        "load('@ORCHESTRATOR/builders/typescript.star', 'prebuild_dockerignore')\n"
-        f"r = {{'content': prebuild_dockerignore({str(dockerfile)!r}, {str(project)!r}, "
-        "'services/analytics/data-governance-api')}\n",
-    )
-    lines = r["content"].splitlines()
-    res = "services/analytics/data-governance-api"
-    assert lines[0] == "*"
-    for allowed in ["package.json", "bun.lock", res, "shared-platform-engineering/docker-templates",
-                    "shared-platform-engineering/platform-logging"]:
-        assert "!" + allowed in lines, (allowed, lines)
-    # Only the service's own relative path is allowed, never the absolute one.
-    assert not any(line.startswith("!" + str(project)) for line in lines), lines
-    # Re-excludes come after the allowlist (dockerignore: later lines win).
-    assert res + "/node_modules" in lines and res + "/*.md" in lines
-    assert lines.index(res + "/node_modules") > lines.index("!" + res)
-    # The Dockerfile's own negations aren't carried over (same as docker_build's ignore=).
-    assert not any(".env.example" in line for line in lines)
-
-
-def test_resolve_manifest_dependency_names_dedupes_and_skips_empty(tmp_path):
-    manifest = {"dependsOn": []}
-    assert _run_resolve_names(tmp_path, manifest, {}) == []

package/tests/tilt-engine/test_safety_aliases.py

@@ -1,84 +0,0 @@
-"""
-Tests for safety shell aliases.
-Tests the alias configuration and functionality.
-"""
-
-import pytest
-
-
-@pytest.mark.safety
-class TestSafetyAliases:
-    """Tests for safety alias functionality."""
-    
-    def test_safe_prune_alias_works(self):
-        """
-        Scenario: Safe prune alias works
-        WHEN a user runs `docker-prune-safe` after sourcing aliases
-        THEN it SHALL execute `safe-docker-prune.sh standard`
-        """
-        alias_mapping = {
-            "docker-prune-safe": "./scripts/safe-docker-prune.sh standard",
-        }
-        
-        assert "docker-prune-safe" in alias_mapping
-        assert "safe-docker-prune.sh" in alias_mapping["docker-prune-safe"]
-        assert "standard" in alias_mapping["docker-prune-safe"]
-    
-    def test_full_prune_alias_works(self):
-        """
-        Scenario: Full prune alias works
-        WHEN a user runs `docker-prune-full` after sourcing aliases
-        THEN it SHALL execute `safe-docker-prune.sh full`
-        """
-        alias_mapping = {
-            "docker-prune-full": "./scripts/safe-docker-prune.sh full",
-        }
-        
-        assert "docker-prune-full" in alias_mapping
-        assert "safe-docker-prune.sh" in alias_mapping["docker-prune-full"]
-        assert "full" in alias_mapping["docker-prune-full"]
-    
-    def test_alias_is_idempotent(self):
-        """
-        Scenario: Alias is idempotent
-        WHEN a user sources the aliases file multiple times
-        THEN the aliases SHALL remain functional
-        AND no duplicate definitions SHALL cause errors
-        """
-        # Simulate sourcing aliases multiple times
-        aliases = {}
-        
-        # First source
-        aliases["docker-prune-safe"] = "./scripts/safe-docker-prune.sh standard"
-        
-        # Second source (should overwrite, not duplicate)
-        aliases["docker-prune-safe"] = "./scripts/safe-docker-prune.sh standard"
-        
-        # Third source
-        aliases["docker-prune-safe"] = "./scripts/safe-docker-prune.sh standard"
-        
-        # Should still work correctly
-        assert len(aliases) == 1
-        assert aliases["docker-prune-safe"] == "./scripts/safe-docker-prune.sh standard"
-    
-    def test_protected_volumes_alias_exists(self):
-        """Test that docker-protected-volumes alias exists."""
-        alias_mapping = {
-            "docker-protected-volumes": "docker volume ls | grep -E '(verdaccio|infisical)'",
-        }
-        
-        assert "docker-protected-volumes" in alias_mapping
-        assert "verdaccio" in alias_mapping["docker-protected-volumes"]
-        assert "infisical" in alias_mapping["docker-protected-volumes"]
-    
-    def test_alias_commands_are_safe(self):
-        """Test that aliased commands don't use --volumes with prune."""
-        alias_commands = [
-            "./scripts/safe-docker-prune.sh standard",
-            "./scripts/safe-docker-prune.sh full",
-        ]
-        
-        for cmd in alias_commands:
-            # Safe commands should use the script, not direct docker prune
-            assert "safe-docker-prune.sh" in cmd, "Should use safe script"
-            assert "docker system prune" not in cmd or "--volumes" not in cmd, "Should not use dangerous direct prune"

package/tests/tilt-engine/test_snapshot_diff.py

@@ -1,136 +0,0 @@
-"""
-Tests for snapshot diff detection functionality.
-Tests the comparison between old and new snapshots.
-"""
-
-import pytest
-from pathlib import Path
-import sys
-
-sys.path.insert(0, str(Path("discovery").resolve()))
-from resource_snapshot import diff_snapshots
-
-
-@pytest.mark.snapshot
-class TestSnapshotDiff:
-    """Tests for snapshot diff detection."""
-    
-    def test_detects_new_services(self):
-        """
-        Scenario: Detecting new services
-        WHEN a new service.json file appears in a previously empty directory
-        THEN the diff SHALL report "added" with the new service path and metadata
-        """
-        old = {"services": [], "count": 0}
-        new = ["services/product/new/service.json"]
-        
-        added, removed, modified = diff_snapshots(old, new)
-        
-        assert added == {"services/product/new/service.json"}
-        assert removed == set()
-        assert modified == set()
-    
-    def test_detects_removed_services(self):
-        """
-        Scenario: Detecting removed services
-        WHEN an existing service.json file is deleted
-        THEN the diff SHALL report "removed" with the removed service path
-        """
-        old = {"services": ["services/product/old/service.json"], "count": 1}
-        new = []
-        
-        added, removed, modified = diff_snapshots(old, new)
-        
-        assert added == set()
-        assert removed == {"services/product/old/service.json"}
-        assert modified == set()
-    
-    def test_detects_modified_services(self, temp_dir):
-        """
-        Scenario: Detecting modified services
-        WHEN an existing service.json file changes its content (hash differs)
-        THEN the diff SHALL report "modified" with the field changes and service path
-        """
-        import os
-        original_dir = os.getcwd()
-        
-        try:
-            os.chdir(temp_dir)
-            
-            # Create a service file
-            resource_dir = temp_dir / "services" / "product" / "test"
-            resource_dir.mkdir(parents=True)
-            resource_file = resource_dir / "service.json"
-            resource_file.write_text('{"name": "test", "version": "1.0.0"}')
-            
-            # Use relative path for service
-            rel_path = "services/product/test/service.json"
-            
-            # Create old snapshot with hash of old content
-            from resource_snapshot import compute_resource_hash
-            old_hash = compute_resource_hash(rel_path)
-            old = {
-                "services": [rel_path],
-                "count": 1,
-                "resource_hashes": {rel_path: old_hash}
-            }
-            
-            # Modify the file
-            resource_file.write_text('{"name": "test", "version": "2.0.0"}')
-            new = [rel_path]
-            
-            added, removed, modified = diff_snapshots(old, new, use_hashes=True)
-            
-            assert added == set()
-            assert removed == set()
-            assert modified == {rel_path}
-        finally:
-            os.chdir(original_dir)
-    
-    def test_no_changes_detected(self):
-        """
-        Scenario: No changes detected
-        WHEN the filesystem matches the existing snapshot exactly
-        THEN the diff SHALL report an empty changeset
-        """
-        old = {
-            "services": [
-                "services/product/a/service.json",
-                "services/product/b/service.json"
-            ],
-            "count": 2,
-            "hash": "abc123"  # This hash will mismatch, but individual hashes match
-        }
-        new = [
-            "services/product/a/service.json",
-            "services/product/b/service.json"
-        ]
-        
-        # Without actual hash computation, should find no changes
-        added, removed, modified = diff_snapshots(old, new, use_hashes=False)
-        
-        assert added == set()
-        assert removed == set()
-        assert modified == set()
-    
-    def test_detects_both_added_and_removed(self):
-        """Test detecting simultaneous additions and removals."""
-        old = {"services": ["a/service.json", "b/service.json"], "count": 2}
-        new = ["b/service.json", "c/service.json"]
-        
-        added, removed, modified = diff_snapshots(old, new)
-        
-        assert added == {"c/service.json"}
-        assert removed == {"a/service.json"}
-        assert modified == set()
-    
-    def test_empty_to_multiple_services(self):
-        """Test diff when going from empty to multiple services."""
-        old = {"services": [], "count": 0}
-        new = ["a/service.json", "b/service.json", "c/service.json"]
-        
-        added, removed, modified = diff_snapshots(old, new)
-        
-        assert added == {"a/service.json", "b/service.json", "c/service.json"}
-        assert removed == set()
-        assert modified == set()