create-qpq-app 0.1.26 → 0.1.28

package/template/apps/qpqjs/services/test/service/src/smoke/config/defineSmoke.ts

@@ -1,266 +1,10 @@
-import {
-  defineCryptoKey,
-  defineEmailReceiver,
-  defineEmailSender,
-  defineEventBus,
-  defineKeyValueStore,
-  defineParameter,
-  defineQueue,
-  defineRoute,
-  defineSecret,
-  defineSigningKey,
-  defineStorageDrive,
-  QPQConfig,
-  QpqFunctionRuntime,
-} from 'quidproquo';
-import { defineEventDoc } from 'quidproquo-features';
+import { QPQConfig } from 'quidproquo';
 
-import { z } from 'zod/v4';
-import {
-  SMOKE_PROBE_DRIVE,
-  SMOKE_PROBE_SIGNING_KEY,
-  SMOKE_PROBE_STORE,
-} from '@qpqjs/constants';
-import {
-  SmokeProbeRecord,
-  SmokeRunStartedSchema,
-  SmokeRunWithSummarySchema,
-} from '@qpqjs/test-models';
+import { defineSmokeHarness } from '../harness/config/defineSmokeHarness';
+import { smokeSuites } from '../suites/smokeSuites';
 
-import { SMOKE_RUNS_STORE } from '../constants/SMOKE_RUNS_STORE';
-import {
-  SMOKE_EVENT_DOC_APPEND_MESSAGE_TYPE,
-  SMOKE_EVENT_DOC_APPEND_QUEUE,
-  SMOKE_EVENT_DOC_BASE_PATH,
-} from '../constants/smokeEventDoc';
-import {
-  SMOKE_CRYPTO_KEY,
-  SMOKE_EMAIL_RECEIVER,
-  SMOKE_ENCRYPTED_PROBE_DRIVE,
-  SMOKE_ENCRYPTED_PROBE_STORE,
-  SMOKE_FILE_EVENT_DRIVE,
-  SMOKE_PROBE_EVENT_BUS,
-  SMOKE_PROBE_EVENT_QUEUE,
-  SMOKE_PROBE_EVENT_TYPE,
-  SMOKE_PROBE_PARAMETER,
-  SMOKE_PROBE_PARAMETER_VALUE,
-  SMOKE_PROBE_SECRET,
-  SMOKE_SCOPED_PROBE_DRIVE,
-  SMOKE_SCOPED_PROBE_STORE,
-  SMOKE_STREAM_PROBE_STORE,
-} from '../constants/smokeProbe';
-import {
-  SMOKE_RUN_QUEUE,
-  SMOKE_TEST_REQUESTED_MESSAGE_TYPE,
-} from '../constants/smokeRunQueue';
-import { smokeProbeDocDefinition } from '../eventDoc/smokeProbeDocDefinition';
-
-// Everything the smoke feature needs: the run store, the queue runs execute
-// on, and the two routes. Runtimes are located relative to this file, so the
-// module can move as a unit.
-//
-// The routes look public (no user directory, no api keys) but carry a
-// per-runtime action processor override that swaps the route auth decode for
-// the GitHub OIDC validator - so ONLY a GitHub Actions run of our repo,
-// holding an OIDC token with the qpq-smoke audience and matching pinned
-// claims, gets past the preamble. Everything else 401s, tokenless included.
-export const defineSmoke = (): QPQConfig => {
-  const githubOidcAuth: QpqFunctionRuntime[] = [
-    {
-      basePath: __dirname,
-      relativePath: '../processors/github/getGithubOidcAuthProcessors',
-      functionName: 'getGithubOidcAuthProcessors',
-    },
-  ];
-
-  const onSmokeFileEvent: QpqFunctionRuntime = {
-    basePath: __dirname,
-    relativePath: '../storageDrive/onSmokeFileEvent',
-    functionName: 'onSmokeFileEvent',
-  };
-
-  return [
-    // One record per run, keyed by runId; the queue workers each write their
-    // own test's entry as it completes and the GET route polls it.
-    defineKeyValueStore(SMOKE_RUNS_STORE, 'runId'),
-
-    // One message per test per run. Not FIFO and no concurrency cap, so the
-    // tests of a run fan out and execute in parallel.
-    defineQueue(SMOKE_RUN_QUEUE, {
-      [SMOKE_TEST_REQUESTED_MESSAGE_TYPE]: {
-        basePath: __dirname,
-        relativePath: '../queue/onSmokeTestRequested',
-        functionName: 'onSmokeTestRequested',
-      },
-    }),
-
-    // Throwaway probe resources, one per kind of owned resource the tag-based
-    // IAM grants cover. The store's `category` index is what the KVS test
-    // queries through, proving the `table/*/index/*` half of the grant.
-    defineKeyValueStore<SmokeProbeRecord>(SMOKE_PROBE_STORE, 'probeId', [], {
-      indexes: ['category'],
-    }),
-    defineParameter(SMOKE_PROBE_PARAMETER, {
-      value: SMOKE_PROBE_PARAMETER_VALUE,
-    }),
-    defineSecret(SMOKE_PROBE_SECRET),
-    defineStorageDrive(SMOKE_PROBE_DRIVE),
-    // An owned RSA signing key: kms:Sign + kms:GetPublicKey through the
-    // alias-conditioned grant. testa declares the same key foreign (see
-    // defineCrossServiceProbe) for the cross-service verify test.
-    defineSigningKey(SMOKE_PROBE_SIGNING_KEY),
-
-    // Scoped probe resources: the scope gate in both directions (a scoped
-    // resource refuses an unscoped call, an unscoped one refuses a scope) and
-    // partition isolation between two scopes.
-    defineKeyValueStore<SmokeProbeRecord>(
-      SMOKE_SCOPED_PROBE_STORE,
-      'probeId',
-      [],
-      { indexes: ['category'], scoped: true }
-    ),
-    defineStorageDrive(SMOKE_SCOPED_PROBE_DRIVE, {
-      scoped: true,
-      onEvent: { create: onSmokeFileEvent, delete: onSmokeFileEvent },
-    }),
-
-    // File event test path: a write or delete on either drive fires the
-    // handler, which writes a marker into the probe store; the test polls for
-    // it. The scoped drive's events must arrive with the scope split off.
-    defineStorageDrive(SMOKE_FILE_EVENT_DRIVE, {
-      onEvent: { create: onSmokeFileEvent, delete: onSmokeFileEvent },
-    }),
-
-    // Kvs stream test path: a change on this scoped store streams to the
-    // handler, which writes a marker into the probe store; the test polls for
-    // it. The record must carry the scope as its own field with a raw key.
-    defineKeyValueStore<SmokeProbeRecord>(
-      SMOKE_STREAM_PROBE_STORE,
-      'probeId',
-      [],
-      {
-        scoped: true,
-        onStream: {
-          runtime: {
-            basePath: __dirname,
-            relativePath: '../kvsStream/onSmokeStreamRecord',
-            functionName: 'onSmokeStreamRecord',
-          },
-        },
-      }
-    ),
-
-    // Encrypted probe resources: a drive and a store encrypted with an owned
-    // crypto key, so the test proves the role's KMS grant covers data at rest.
-    defineCryptoKey(SMOKE_CRYPTO_KEY),
-    defineKeyValueStore<SmokeProbeRecord>(
-      SMOKE_ENCRYPTED_PROBE_STORE,
-      'probeId',
-      [],
-      { cryptoKeyName: SMOKE_CRYPTO_KEY }
-    ),
-    defineStorageDrive(SMOKE_ENCRYPTED_PROBE_DRIVE, {
-      cryptoKeyName: SMOKE_CRYPTO_KEY,
-    }),
-
-    // Inbound email test path: the test sends to its own receiving domain, the
-    // receiver hands the parsed message to onSmokeEmailReceived, which writes a
-    // marker into the probe store, and the test polls for it. The sender is what
-    // lets the test send; the receiving domain is a verified identity, so the
-    // SES sandbox allows it.
-    defineEmailSender(),
-    defineEmailReceiver(SMOKE_EMAIL_RECEIVER, {
-      onEmail: {
-        basePath: __dirname,
-        relativePath: '../email/onSmokeEmailReceived',
-        functionName: 'onSmokeEmailReceived',
-      },
-    }),
-
-    // Event bus test path: publish to the bus, the subscribed queue's entry
-    // writes a marker into the probe store, the test polls for it.
-    defineEventBus(SMOKE_PROBE_EVENT_BUS),
-    defineQueue(
-      SMOKE_PROBE_EVENT_QUEUE,
-      {
-        [SMOKE_PROBE_EVENT_TYPE]: {
-          basePath: __dirname,
-          relativePath: '../queue/onSmokeProbeEvent',
-          functionName: 'onSmokeProbeEvent',
-        },
-      },
-      { eventBusSubscriptions: [SMOKE_PROBE_EVENT_BUS] }
-    ),
-
-    // The event-doc probe collection: a full registered collection (stores, stream
-    // projector, dynamic functions, routes) so the smoke tests exercise event docs the
-    // way a real service does. NOTE the routes mount with no auth - the test service
-    // has no user directory - so the collection is world-writable; it holds nothing
-    // but throwaway probe docs. The queue fans a test's writers out one invocation
-    // each, so their appends race across lambdas.
-    defineEventDoc(
-      smokeProbeDocDefinition,
-      {
-        basePath: __dirname,
-        relativePath: '../eventDoc/smokeProbeDocDefinition',
-        functionName: 'smokeProbeDocDefinition',
-      },
-      { basePath: SMOKE_EVENT_DOC_BASE_PATH }
-    ),
-    // A writer that loses the slot race past the append retry cap fails its message; a
-    // quick redelivery lets it land instead of vanishing, as a production queue should.
-    defineQueue(
-      SMOKE_EVENT_DOC_APPEND_QUEUE,
-      {
-        [SMOKE_EVENT_DOC_APPEND_MESSAGE_TYPE]: {
-          basePath: __dirname,
-          relativePath: '../queue/onSmokeEventDocAppend',
-          functionName: 'onSmokeEventDocAppend',
-        },
-      },
-      { maxTries: 3, ttRetryInSeconds: 10 }
-    ),
-
-    // The zod models double as the routes' published contract, flattened to
-    // JSON Schema here for the OpenAPI document at /v1/docs.
-    defineRoute(
-      'POST',
-      '/smoke/run',
-      {
-        basePath: __dirname,
-        relativePath: '../controller/askRunSmokeTests',
-        functionName: 'askRunSmokeTests',
-        actionProcessors: githubOidcAuth,
-      },
-      {
-        schema: {
-          summary: 'Start a smoke run',
-          description:
-            'Queues every registered smoke test and returns the run id to poll. Requires a GitHub Actions OIDC token for this repo.',
-          tags: ['smoke'],
-          responseJsonSchema: z.toJSONSchema(SmokeRunStartedSchema),
-        },
-      }
-    ),
-
-    defineRoute(
-      'GET',
-      '/smoke/run/{runId}',
-      {
-        basePath: __dirname,
-        relativePath: '../controller/askGetSmokeRun',
-        functionName: 'askGetSmokeRun',
-        actionProcessors: githubOidcAuth,
-      },
-      {
-        schema: {
-          summary: 'Get a smoke run',
-          description:
-            'The stored run plus pass/fail counts. Poll until status leaves running.',
-          tags: ['smoke'],
-          responseJsonSchema: z.toJSONSchema(SmokeRunWithSummarySchema),
-        },
-      }
-    ),
-  ];
-};
+/** The whole smoke feature: the harness plus the resources of every registered suite. */
+export const defineSmoke = (): QPQConfig => [
+  defineSmokeHarness(),
+  smokeSuites.map((suite) => suite.defineConfig?.() ?? []),
+];

package/template/apps/qpqjs/services/test/service/src/smoke/harness/assert/index.ts

@@ -0,0 +1,2 @@
+export * from './askSmokeAssert';
+export * from './askSmokePollForMarker';

package/template/apps/qpqjs/services/test/service/src/smoke/harness/config/defineSmokeHarness.ts

@@ -0,0 +1,115 @@
+import {
+  defineKeyValueStore,
+  defineQueue,
+  defineRoute,
+  defineStorageDrive,
+  QPQConfig,
+  QpqFunctionRuntime,
+} from 'quidproquo';
+
+import { z } from 'zod/v4';
+import { SMOKE_PROBE_DRIVE, SMOKE_PROBE_STORE } from '@qpqjs/constants';
+import {
+  SmokeProbeRecord,
+  SmokeRunStartedSchema,
+  SmokeRunWithSummarySchema,
+} from '@qpqjs/test-models';
+
+import { SMOKE_RUNS_STORE } from '../constants/SMOKE_RUNS_STORE';
+import {
+  SMOKE_RUN_QUEUE,
+  SMOKE_TEST_REQUESTED_MESSAGE_TYPE,
+} from '../constants/smokeRunQueue';
+
+/**
+ * The part of the smoke feature every suite relies on: the run store, the
+ * queue runs execute on, the shared probe store and drive, and the two
+ * routes. Knows nothing about individual suites; defineSmoke adds theirs
+ * alongside.
+ *
+ * The routes look public (no user directory, no api keys) but carry a
+ * per-runtime action processor override that swaps the route auth decode for
+ * the GitHub OIDC validator, so ONLY a GitHub Actions run of our repo holding
+ * an OIDC token with the qpq-smoke audience and matching pinned claims gets
+ * past the preamble. Everything else 401s, tokenless included.
+ */
+export const defineSmokeHarness = (): QPQConfig => {
+  const githubOidcAuth: QpqFunctionRuntime[] = [
+    {
+      basePath: __dirname,
+      relativePath: '../processors/github/getGithubOidcAuthProcessors',
+      functionName: 'getGithubOidcAuthProcessors',
+    },
+  ];
+
+  return [
+    // One record per run, keyed by runId; the queue workers each write their
+    // own test's entry as it completes and the GET route polls it.
+    defineKeyValueStore(SMOKE_RUNS_STORE, 'runId'),
+
+    // One message per test per run. Not FIFO and no concurrency cap, so the
+    // tests of a run fan out and execute in parallel.
+    defineQueue(SMOKE_RUN_QUEUE, {
+      [SMOKE_TEST_REQUESTED_MESSAGE_TYPE]: {
+        basePath: __dirname,
+        relativePath: '../queue/onSmokeTestRequested',
+        functionName: 'onSmokeTestRequested',
+      },
+    }),
+
+    // Every async suite's handler writes its marker here for
+    // askSmokePollForMarker. The keyValueStore suite queries its `category`
+    // index, proving the `table/*/index/*` half of the tag-conditioned grant,
+    // and testa reaches it cross-service.
+    defineKeyValueStore<SmokeProbeRecord>(SMOKE_PROBE_STORE, 'probeId', [], {
+      indexes: ['category'],
+    }),
+
+    // The unscoped probe drive: the storageDrive suite's subject, testa's
+    // cross-service target, and the drive the scopedStorageDrive suite proves
+    // refuses a scope.
+    defineStorageDrive(SMOKE_PROBE_DRIVE),
+
+    // The zod models double as the routes' published contract, flattened to
+    // JSON Schema here for the OpenAPI document at /v1/docs.
+    defineRoute(
+      'POST',
+      '/smoke/run',
+      {
+        basePath: __dirname,
+        relativePath: '../controller/askRunSmokeTests',
+        functionName: 'askRunSmokeTests',
+        actionProcessors: githubOidcAuth,
+      },
+      {
+        schema: {
+          summary: 'Start a smoke run',
+          description:
+            'Queues every registered smoke test and returns the run id to poll. Requires a GitHub Actions OIDC token for this repo.',
+          tags: ['smoke'],
+          responseJsonSchema: z.toJSONSchema(SmokeRunStartedSchema),
+        },
+      }
+    ),
+
+    defineRoute(
+      'GET',
+      '/smoke/run/{runId}',
+      {
+        basePath: __dirname,
+        relativePath: '../controller/askGetSmokeRun',
+        functionName: 'askGetSmokeRun',
+        actionProcessors: githubOidcAuth,
+      },
+      {
+        schema: {
+          summary: 'Get a smoke run',
+          description:
+            'The stored run plus pass/fail counts. Poll until status leaves running.',
+          tags: ['smoke'],
+          responseJsonSchema: z.toJSONSchema(SmokeRunWithSummarySchema),
+        },
+      }
+    ),
+  ];
+};

package/template/apps/qpqjs/services/test/service/src/smoke/harness/config/index.ts

@@ -0,0 +1 @@
+export * from './defineSmokeHarness';

package/template/apps/qpqjs/services/test/service/src/smoke/{constants → harness/constants}/index.ts

@@ -1,5 +1,3 @@
 export * from './githubOidc';
 export * from './SMOKE_RUNS_STORE';
-export * from './smokeEventDoc';
-export * from './smokeProbe';
 export * from './smokeRunQueue';

package/template/apps/qpqjs/services/test/service/src/smoke/harness/index.ts

@@ -0,0 +1,10 @@
+export * from './assert';
+export * from './config';
+export * from './constants';
+export * from './controller';
+export * from './data';
+export * from './logic';
+export * from './models';
+export * from './processors';
+export * from './queue';
+export * from './types';

package/template/apps/qpqjs/services/test/service/src/smoke/{logic → harness/logic}/smokeRun/askExecuteSmokeTest.ts

@@ -16,8 +16,8 @@ import {
 import { askGetSmokeRunById } from '../../data/askGetSmokeRunById';
 import { askRecordSmokeTestResult } from '../../data/askRecordSmokeTestResult';
 import { askSetSmokeRunOutcome } from '../../data/askSetSmokeRunOutcome';
-import { SmokeTestDefinition } from '../../tests/SmokeTestDefinition';
-import { smokeTestRegistry } from '../../tests/smokeTestRegistry';
+import { SmokeTestDefinition } from '../../types/SmokeTestDefinition';
+import { listSmokeTests } from './listSmokeTests';
 
 // Runs one registered test, returning its completed result entry.
 function* askRunSmokeTest(
@@ -53,7 +53,7 @@ export function* askExecuteSmokeTest(
   runId: string,
   testName: string
 ): AskResponse<SmokeRun> {
-  const test = smokeTestRegistry.find((t) => t.name === testName);
+  const test = listSmokeTests().find((t) => t.name === testName);
   if (!test) {
     return yield* askThrowError(
       ErrorTypeEnum.NotFound,

package/template/apps/qpqjs/services/test/service/src/smoke/{logic → harness/logic}/smokeRun/askStartSmokeRun.ts

@@ -20,8 +20,8 @@ import {
 } from '../../constants/smokeRunQueue';
 import { askSaveSmokeRun } from '../../data/askSaveSmokeRun';
 import { SmokeTestRequestedPayload } from '../../models/SmokeTestRequestedQueueEvent';
-import { SmokeTestDefinition } from '../../tests/SmokeTestDefinition';
-import { smokeTestRegistry } from '../../tests/smokeTestRegistry';
+import { SmokeTestDefinition } from '../../types/SmokeTestDefinition';
+import { listSmokeTests } from './listSmokeTests';
 
 const createInitialResult = (
   test: SmokeTestDefinition,
@@ -57,7 +57,8 @@ export function* askStartSmokeRun(): AskResponse<SmokeRun> {
   const shouldSkip = (test: SmokeTestDefinition): boolean =>
     !!test.deployedOnly && platformName === 'devServer';
 
-  const queued = smokeTestRegistry.filter((test) => !shouldSkip(test));
+  const smokeTests = listSmokeTests();
+  const queued = smokeTests.filter((test) => !shouldSkip(test));
 
   const smokeRun: SmokeRun = {
     runId,
@@ -65,7 +66,7 @@ export function* askStartSmokeRun(): AskResponse<SmokeRun> {
       queued.length === 0 ? SmokeRunStatus.passed : SmokeRunStatus.running,
     startedAt,
     finishedAt: queued.length === 0 ? startedAt : null,
-    tests: smokeTestRegistry.map((test, index) =>
+    tests: smokeTests.map((test, index) =>
       createInitialResult(test, index, shouldSkip(test))
     ),
   };

package/template/apps/qpqjs/services/test/service/src/smoke/{logic → harness/logic}/smokeRun/index.ts

@@ -1,4 +1,5 @@
 export * from './askExecuteSmokeTest';
 export * from './askFindSmokeRun';
 export * from './askStartSmokeRun';
+export * from './listSmokeTests';
 export * from './summarizeSmokeRun';

package/template/apps/qpqjs/services/test/service/src/smoke/harness/logic/smokeRun/listSmokeTests.ts

@@ -0,0 +1,6 @@
+import { smokeSuites } from '../../../suites/smokeSuites';
+import { SmokeTestDefinition } from '../../types/SmokeTestDefinition';
+
+/** Every registered test across all suites, in list order; a test's 1-based position is its run record id. */
+export const listSmokeTests = (): SmokeTestDefinition[] =>
+  smokeSuites.flatMap((suite) => suite.tests);

package/template/apps/qpqjs/services/test/service/src/smoke/{models → harness/models}/SmokeTestRequestedQueueEvent.ts

@@ -1,6 +1,6 @@
 import { QueueEvent, QueueMessage } from 'quidproquo';
 
-// One registered test of one run. `testName` is the registry's stable key,
+// One registered test of one run. `testName` is the test's stable key,
 // never the positional id.
 export type SmokeTestRequestedPayload = {
   runId: string;

package/template/apps/qpqjs/services/test/service/src/smoke/harness/models/index.ts

@@ -0,0 +1,2 @@
+export * from './GithubOidcClaims';
+export * from './SmokeTestRequestedQueueEvent';

package/template/apps/qpqjs/services/test/service/src/smoke/harness/queue/index.ts

@@ -0,0 +1 @@
+export * from './onSmokeTestRequested';

package/template/apps/qpqjs/services/test/service/src/smoke/harness/types/SmokeSuite.ts

@@ -0,0 +1,13 @@
+import { QPQConfig } from 'quidproquo';
+
+import { SmokeTestDefinition } from './SmokeTestDefinition';
+
+/**
+ * One folder under suites/: its tests plus the resources and handlers only
+ * they use. Tests that share a resource belong in the same suite, so deleting
+ * a suite's folder and its line in smokeSuites removes it completely.
+ */
+export type SmokeSuite = {
+  tests: SmokeTestDefinition[];
+  defineConfig?: () => QPQConfig;
+};

package/template/apps/qpqjs/services/test/service/src/smoke/harness/types/index.ts

@@ -0,0 +1,2 @@
+export * from './SmokeSuite';
+export * from './SmokeTestDefinition';

package/template/apps/qpqjs/services/test/service/src/smoke/index.ts

@@ -1,13 +1,3 @@
 export * from './config';
-export * from './constants';
-export * from './controller';
-export * from './data';
-export * from './email';
-export * from './eventDoc';
-export * from './kvsStream';
-export * from './logic';
-export * from './models';
-export * from './processors';
-export * from './queue';
-export * from './storageDrive';
-export * from './tests';
+export * from './harness';
+export * from './suites';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/emailReceive/config/defineEmailReceiveSmoke.ts

@@ -0,0 +1,20 @@
+import { defineEmailReceiver, defineEmailSender, QPQConfig } from 'quidproquo';
+
+import { SMOKE_EMAIL_RECEIVER } from '../constants/SMOKE_EMAIL_RECEIVER';
+
+/**
+ * The test sends to its own receiving domain, the receiver hands the parsed
+ * message to onSmokeEmailReceived, which writes a marker into the probe store,
+ * and the test polls for it. The sender is what lets the test send; the
+ * receiving domain is a verified identity, so the SES sandbox allows it.
+ */
+export const defineEmailReceiveSmoke = (): QPQConfig => [
+  defineEmailSender(),
+  defineEmailReceiver(SMOKE_EMAIL_RECEIVER, {
+    onEmail: {
+      basePath: __dirname,
+      relativePath: '../entry/email/onSmokeEmailReceived',
+      functionName: 'onSmokeEmailReceived',
+    },
+  }),
+];

package/template/apps/qpqjs/services/test/service/src/smoke/suites/emailReceive/config/index.ts

@@ -0,0 +1 @@
+export * from './defineEmailReceiveSmoke';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/emailReceive/constants/SMOKE_EMAIL_RECEIVER.ts

@@ -0,0 +1,2 @@
+/** The inbound email receiver; its onEmail writes the marker the email test polls for. */
+export const SMOKE_EMAIL_RECEIVER = 'smoke';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/emailReceive/constants/index.ts

@@ -0,0 +1 @@
+export * from './SMOKE_EMAIL_RECEIVER';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/emailReceive/emailReceiveSmokeSuite.ts

@@ -0,0 +1,15 @@
+import { SmokeSuite } from '../../harness/types/SmokeSuite';
+import { defineEmailReceiveSmoke } from './config/defineEmailReceiveSmoke';
+import { askRunEmailReceiveTest } from './logic/askRunEmailReceiveTest';
+
+/** Inbound email to our own receiving domain. Deployed only. */
+export const emailReceiveSmokeSuite: SmokeSuite = {
+  defineConfig: defineEmailReceiveSmoke,
+  tests: [
+    {
+      name: 'emailReceive',
+      askRun: askRunEmailReceiveTest,
+      deployedOnly: true,
+    },
+  ],
+};

package/template/apps/qpqjs/services/test/service/src/smoke/{email → suites/emailReceive/entry/email}/index.ts

@@ -1,2 +1 @@
 export * from './onSmokeEmailReceived';
-export * from './smokeEmailMarkerId';

package/template/apps/qpqjs/services/test/service/src/smoke/{email → suites/emailReceive/entry/email}/onSmokeEmailReceived.ts

@@ -8,7 +8,7 @@ import {
 import { SMOKE_PROBE_STORE } from '@qpqjs/constants';
 import { SmokeProbeRecord } from '@qpqjs/test-models';
 
-import { smokeEmailMarkerId } from './smokeEmailMarkerId';
+import { smokeEmailMarkerId } from '../../logic/smokeEmailMarkerId';
 
 // The smoke receiver's onEmail: one marker per delivered recipient, carrying
 // the subject and the provider's SPF/DKIM verdicts so the test can check the

package/template/apps/qpqjs/services/test/service/src/smoke/suites/emailReceive/entry/index.ts

@@ -0,0 +1 @@
+export * from './email';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/emailReceive/index.ts

@@ -0,0 +1,5 @@
+export * from './config';
+export * from './constants';
+export * from './emailReceiveSmokeSuite';
+export * from './entry';
+export * from './logic';

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/emailReceive → suites/emailReceive/logic}/askRunEmailReceiveTest.ts

@@ -1,8 +1,8 @@
 import { askDnsResolveHosts, askEmailSendEmail, AskResponse } from 'quidproquo';
 
-import { smokeEmailMarkerId } from '../../email/smokeEmailMarkerId';
-import { askSmokeAssert } from '../askSmokeAssert';
-import { askSmokePollForMarker } from '../askSmokePollForMarker';
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
+import { askSmokePollForMarker } from '../../../harness/assert/askSmokePollForMarker';
+import { smokeEmailMarkerId } from './smokeEmailMarkerId';
 
 // The inbound email path end to end: send to this app's own receiving domain
 // with its own sender, SES receives it through the account rule set and the

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/emailReceive → suites/emailReceive/logic}/index.ts

@@ -1 +1,2 @@
 export * from './askRunEmailReceiveTest';
+export * from './smokeEmailMarkerId';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/encryptedResources/config/defineEncryptedResourcesSmoke.ts

@@ -0,0 +1,29 @@
+import {
+  defineCryptoKey,
+  defineKeyValueStore,
+  defineStorageDrive,
+  QPQConfig,
+} from 'quidproquo';
+
+import { SmokeProbeRecord } from '@qpqjs/test-models';
+
+import { SMOKE_CRYPTO_KEY } from '../constants/SMOKE_CRYPTO_KEY';
+import { SMOKE_ENCRYPTED_PROBE_DRIVE } from '../constants/SMOKE_ENCRYPTED_PROBE_DRIVE';
+import { SMOKE_ENCRYPTED_PROBE_STORE } from '../constants/SMOKE_ENCRYPTED_PROBE_STORE';
+
+/**
+ * A drive and a store encrypted with an owned crypto key, so the test proves
+ * the role's KMS grant covers data at rest.
+ */
+export const defineEncryptedResourcesSmoke = (): QPQConfig => [
+  defineCryptoKey(SMOKE_CRYPTO_KEY),
+  defineKeyValueStore<SmokeProbeRecord>(
+    SMOKE_ENCRYPTED_PROBE_STORE,
+    'probeId',
+    [],
+    { cryptoKeyName: SMOKE_CRYPTO_KEY }
+  ),
+  defineStorageDrive(SMOKE_ENCRYPTED_PROBE_DRIVE, {
+    cryptoKeyName: SMOKE_CRYPTO_KEY,
+  }),
+];

package/template/apps/qpqjs/services/test/service/src/smoke/suites/encryptedResources/config/index.ts

@@ -0,0 +1 @@
+export * from './defineEncryptedResourcesSmoke';