create-qpq-app 0.1.26 → 0.1.28

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/openApi → suites/openApi/logic}/askRunOpenApiDocumentTest.ts

@@ -1,6 +1,6 @@
 import { askOpenApiGetDocument, AskResponse } from 'quidproquo';
 
-import { askSmokeAssert } from '../askSmokeAssert';
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
 
 // The generated document, built in-process from the deployed config. Proves the
 // openApi processor is registered on this runtime and that the route schemas

package/template/apps/qpqjs/services/test/service/src/smoke/suites/openApi/openApiSmokeSuite.ts

@@ -0,0 +1,13 @@
+import { SmokeSuite } from '../../harness/types/SmokeSuite';
+import { defineOpenApiSmoke } from './config/defineOpenApiSmoke';
+import { askRunEchoRoundTripTest } from './logic/askRunEchoRoundTripTest';
+import { askRunOpenApiDocumentTest } from './logic/askRunOpenApiDocumentTest';
+
+/** The generated OpenAPI document, and the echo route called through its servers entry. */
+export const openApiSmokeSuite: SmokeSuite = {
+  defineConfig: defineOpenApiSmoke,
+  tests: [
+    { name: 'openApiDocument', askRun: askRunOpenApiDocumentTest },
+    { name: 'echoRoundTrip', askRun: askRunEchoRoundTripTest },
+  ],
+};

package/template/apps/qpqjs/services/test/service/src/smoke/suites/parameter/config/defineParameterSmoke.ts

@@ -0,0 +1,11 @@
+import { defineParameter, QPQConfig } from 'quidproquo';
+
+import { SMOKE_PROBE_PARAMETER } from '../constants/SMOKE_PROBE_PARAMETER';
+import { SMOKE_PROBE_PARAMETER_VALUE } from '../constants/SMOKE_PROBE_PARAMETER_VALUE';
+
+/** An owned parameter with a known value, for the parameter test to read back. */
+export const defineParameterSmoke = (): QPQConfig => [
+  defineParameter(SMOKE_PROBE_PARAMETER, {
+    value: SMOKE_PROBE_PARAMETER_VALUE,
+  }),
+];

package/template/apps/qpqjs/services/test/service/src/smoke/suites/parameter/config/index.ts

@@ -0,0 +1 @@
+export * from './defineParameterSmoke';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/parameter/constants/SMOKE_PROBE_PARAMETER.ts

@@ -0,0 +1,2 @@
+/** The owned parameter the parameter test reads through the tag-conditioned SSM grant. */
+export const SMOKE_PROBE_PARAMETER = 'smokeProbe';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/parameter/constants/SMOKE_PROBE_PARAMETER_VALUE.ts

@@ -0,0 +1,2 @@
+/** The value the probe parameter is deployed with, which the test expects to read back. */
+export const SMOKE_PROBE_PARAMETER_VALUE = 'smoke-probe-parameter';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/parameter/constants/index.ts

@@ -0,0 +1,2 @@
+export * from './SMOKE_PROBE_PARAMETER';
+export * from './SMOKE_PROBE_PARAMETER_VALUE';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/parameter/index.ts

@@ -0,0 +1,4 @@
+export * from './config';
+export * from './constants';
+export * from './logic';
+export * from './parameterSmokeSuite';

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/parameter → suites/parameter/logic}/askRunParameterTest.ts

@@ -4,11 +4,9 @@ import {
   AskResponse,
 } from 'quidproquo';
 
-import {
-  SMOKE_PROBE_PARAMETER,
-  SMOKE_PROBE_PARAMETER_VALUE,
-} from '../../constants/smokeProbe';
-import { askSmokeAssert } from '../askSmokeAssert';
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
+import { SMOKE_PROBE_PARAMETER } from '../constants/SMOKE_PROBE_PARAMETER';
+import { SMOKE_PROBE_PARAMETER_VALUE } from '../constants/SMOKE_PROBE_PARAMETER_VALUE';
 
 // ssm:GetParameter and ssm:GetParameters against an owned parameter, granted
 // by tag. Read-only on purpose: the runtime role is not granted PutParameter.

package/template/apps/qpqjs/services/test/service/src/smoke/suites/parameter/parameterSmokeSuite.ts

@@ -0,0 +1,9 @@
+import { SmokeSuite } from '../../harness/types/SmokeSuite';
+import { defineParameterSmoke } from './config/defineParameterSmoke';
+import { askRunParameterTest } from './logic/askRunParameterTest';
+
+/** Reads an owned parameter. */
+export const parameterSmokeSuite: SmokeSuite = {
+  defineConfig: defineParameterSmoke,
+  tests: [{ name: 'parameter', askRun: askRunParameterTest }],
+};

package/template/apps/qpqjs/services/test/service/src/{tick/config/defineTick.ts → smoke/suites/schedule/config/defineScheduleSmoke.ts}

@@ -23,7 +23,7 @@ import { ScheduleTickRecord } from '../models/ScheduleTickRecord';
  * Every minute, which is the fastest a schedule can go and the only cadence a
  * test can reasonably wait out.
  */
-export const defineTick = (): QPQConfig => [
+export const defineScheduleSmoke = (): QPQConfig => [
   defineKeyValueStore<ScheduleTickRecord>(
     SCHEDULE_TICK_STORE,
     'scheduleName',

package/template/apps/qpqjs/services/test/service/src/smoke/suites/schedule/config/index.ts

@@ -0,0 +1 @@
+export * from './defineScheduleSmoke';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/schedule/entry/index.ts

@@ -0,0 +1,2 @@
+export * from './kvsStream';
+export * from './schedule';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/schedule/index.ts

@@ -0,0 +1,6 @@
+export * from './config';
+export * from './constants';
+export * from './entry';
+export * from './logic';
+export * from './models';
+export * from './scheduleSmokeSuite';

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/schedule → suites/schedule/logic}/askRunScheduleTest.ts

@@ -7,10 +7,10 @@ import {
   Nullable,
 } from 'quidproquo';
 
-import { SCHEDULE_TICK_NAME } from '../../../tick/constants/scheduleTickName';
-import { SCHEDULE_TICK_STORE } from '../../../tick/constants/scheduleTickStore';
-import { ScheduleTickRecord } from '../../../tick/models/ScheduleTickRecord';
-import { askSmokeAssert } from '../askSmokeAssert';
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
+import { SCHEDULE_TICK_NAME } from '../constants/scheduleTickName';
+import { SCHEDULE_TICK_STORE } from '../constants/scheduleTickStore';
+import { ScheduleTickRecord } from '../models/ScheduleTickRecord';
 
 // The schedule runs every minute, so the wait has to cover a full boundary
 // plus the stream hop after it. Generous rather than tight: the first fire

package/template/apps/qpqjs/services/test/service/src/smoke/suites/schedule/scheduleSmokeSuite.ts

@@ -0,0 +1,9 @@
+import { SmokeSuite } from '../../harness/types/SmokeSuite';
+import { defineScheduleSmoke } from './config/defineScheduleSmoke';
+import { askRunScheduleTest } from './logic/askRunScheduleTest';
+
+/** A per-minute schedule and a kvs change stream, proven in one wait. */
+export const scheduleSmokeSuite: SmokeSuite = {
+  defineConfig: defineScheduleSmoke,
+  tests: [{ name: 'schedule', askRun: askRunScheduleTest }],
+};

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedKeyValueStore/config/defineScopedKeyValueStoreSmoke.ts

@@ -0,0 +1,19 @@
+import { defineKeyValueStore, QPQConfig } from 'quidproquo';
+
+import { SmokeProbeRecord } from '@qpqjs/test-models';
+
+import { SMOKE_SCOPED_PROBE_STORE } from '../constants/SMOKE_SCOPED_PROBE_STORE';
+
+/**
+ * A scoped store: the scope gate in both directions (a scoped store refuses an
+ * unscoped call, an unscoped one refuses a scope) and partition isolation
+ * between two scopes, including through the category index.
+ */
+export const defineScopedKeyValueStoreSmoke = (): QPQConfig => [
+  defineKeyValueStore<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    'probeId',
+    [],
+    { indexes: ['category'], scoped: true }
+  ),
+];

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedKeyValueStore/config/index.ts

@@ -0,0 +1 @@
+export * from './defineScopedKeyValueStoreSmoke';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedKeyValueStore/constants/SMOKE_SCOPED_PROBE_STORE.ts

@@ -0,0 +1,2 @@
+/** A scoped probe store: every call must carry a scope, and an unscoped one is refused. */
+export const SMOKE_SCOPED_PROBE_STORE = 'smokeScopedProbe';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedKeyValueStore/constants/index.ts

@@ -0,0 +1 @@
+export * from './SMOKE_SCOPED_PROBE_STORE';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedKeyValueStore/index.ts

@@ -0,0 +1,4 @@
+export * from './config';
+export * from './constants';
+export * from './logic';
+export * from './scopedKeyValueStoreSmokeSuite';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedKeyValueStore/logic/askRunScopedKeyValueStoreTest.ts

@@ -0,0 +1,256 @@
+import {
+  askCatch,
+  askDelay,
+  askKeyValueStoreDelete,
+  askKeyValueStoreGet,
+  askKeyValueStoreGetBase,
+  askKeyValueStoreQuery,
+  askKeyValueStoreQueryBase,
+  askKeyValueStoreUpdate,
+  askKeyValueStoreUpsert,
+  askKeyValueStoreUpsertBase,
+  askNewGuid,
+  AskResponse,
+  kvsEqual,
+  kvsSet,
+  kvsUpdate,
+} from 'quidproquo';
+
+import { SMOKE_PROBE_STORE } from '@qpqjs/constants';
+import { SmokeProbeRecord } from '@qpqjs/test-models';
+
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
+import { SMOKE_SCOPED_PROBE_STORE } from '../constants/SMOKE_SCOPED_PROBE_STORE';
+
+const INDEX_POLL_ATTEMPTS = 10;
+const INDEX_POLL_INTERVAL_MS = 1000;
+
+const probeIdsOf = (items: SmokeProbeRecord[]): string =>
+  items
+    .map((item) => item.probeId)
+    .sort()
+    .join(',');
+
+// GSI reads are eventually consistent, so poll until the scoped category
+// index shows exactly the expected rows, returning the last read either way
+// for the caller to assert on.
+function* askSmokeScopedCategoryQuery(
+  category: string,
+  scope: string,
+  expectedProbeIds: string[]
+): AskResponse<SmokeProbeRecord[]> {
+  const expected = [...expectedProbeIds].sort().join(',');
+
+  let items: SmokeProbeRecord[] = [];
+  for (let attempt = 0; attempt < INDEX_POLL_ATTEMPTS; attempt += 1) {
+    const page = yield* askKeyValueStoreQuery<SmokeProbeRecord>(
+      SMOKE_SCOPED_PROBE_STORE,
+      kvsEqual('category', category),
+      { scope }
+    );
+    items = page.items;
+    if (probeIdsOf(items) === expected) {
+      return items;
+    }
+
+    yield* askDelay(INDEX_POLL_INTERVAL_MS);
+  }
+
+  return items;
+}
+
+// The scope gate on a store, on whichever backend is running: a scoped store
+// serves scoped calls (including queries on the pk and on a GSI) and keeps two
+// scopes apart, refuses an unscoped call, and an unscoped store refuses a
+// scoped one. On dynamo the scope is composed into the partition key and into
+// a hidden copy of each GSI partition key, so the reads also prove neither
+// composed form leaks to the caller, and a page key can't cross scopes.
+export function* askRunScopedKeyValueStoreTest(): AskResponse<void> {
+  const probeId = yield* askNewGuid();
+  const otherProbeId = yield* askNewGuid();
+  const scopeA = `smoke-a-${probeId}`;
+  const scopeB = `smoke-b-${probeId}`;
+  const category = `scoped-kvs-${probeId}`;
+  const movedCategory = `scoped-kvs-moved-${probeId}`;
+
+  const record: SmokeProbeRecord = { probeId, category, value: 1 };
+  yield* askKeyValueStoreUpsert<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    record,
+    { scope: scopeA }
+  );
+
+  const written = yield* askKeyValueStoreGet<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    probeId,
+    { scope: scopeA }
+  );
+  yield* askSmokeAssert(
+    written?.probeId === probeId && written.value === 1,
+    'scoped get did not return the record with its raw key'
+  );
+
+  const byKey = yield* askKeyValueStoreQuery<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    kvsEqual('probeId', probeId),
+    { scope: scopeA }
+  );
+  yield* askSmokeAssert(
+    byKey.items.some((item) => item.category === category),
+    'scoped query by partition key did not return the record'
+  );
+
+  const fromB = yield* askKeyValueStoreGet<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    probeId,
+    { scope: scopeB }
+  );
+  yield* askSmokeAssert(
+    !fromB,
+    'record written under scope A is visible from scope B'
+  );
+
+  // The same category under another scope: the category GSI must only ever
+  // answer with the querying scope's own rows.
+  yield* askKeyValueStoreUpsert<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    { probeId: otherProbeId, category, value: 2 },
+    { scope: scopeB }
+  );
+
+  const byCategory = yield* askSmokeScopedCategoryQuery(category, scopeA, [
+    probeId,
+  ]);
+  yield* askSmokeAssert(
+    probeIdsOf(byCategory) === probeId,
+    `scoped index query returned [${probeIdsOf(byCategory)}], expected only [${probeId}]`
+  );
+  yield* askSmokeAssert(
+    byCategory.every((item) =>
+      Object.keys(item).every((attribute) => !attribute.includes('@@QPQ'))
+    ),
+    'scoped index query leaked a reserved @@QPQ attribute'
+  );
+
+  // Paging a scoped index: the scope's own page key (a real DynamoDB page key,
+  // carrying the hidden index copy) continues the listing, and the same key
+  // used from another scope is refused rather than read.
+  const pagedProbeId = yield* askNewGuid();
+  yield* askKeyValueStoreUpsert<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    { probeId: pagedProbeId, category, value: 3 },
+    { scope: scopeB }
+  );
+
+  const scopeBRows = [otherProbeId, pagedProbeId].sort().join(',');
+  const indexedInB = yield* askSmokeScopedCategoryQuery(category, scopeB, [
+    otherProbeId,
+    pagedProbeId,
+  ]);
+  yield* askSmokeAssert(
+    probeIdsOf(indexedInB) === scopeBRows,
+    'scoped index never showed both of scope B rows'
+  );
+
+  const firstPage = yield* askKeyValueStoreQuery<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    kvsEqual('category', category),
+    { scope: scopeB, limit: 1 }
+  );
+  yield* askSmokeAssert(
+    firstPage.items.length === 1 && !!firstPage.nextPageKey,
+    'scoped index query with limit 1 did not return a page key'
+  );
+
+  const secondPage = yield* askKeyValueStoreQuery<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    kvsEqual('category', category),
+    { scope: scopeB, limit: 1, nextPageKey: firstPage.nextPageKey }
+  );
+  yield* askSmokeAssert(
+    probeIdsOf([...firstPage.items, ...secondPage.items]) === scopeBRows,
+    'paging the scoped index did not walk both of scope B rows'
+  );
+
+  const pageKeyFromOtherScope = yield* askCatch(
+    askKeyValueStoreQuery<SmokeProbeRecord>(
+      SMOKE_SCOPED_PROBE_STORE,
+      kvsEqual('category', category),
+      { scope: scopeA, nextPageKey: firstPage.nextPageKey }
+    )
+  );
+  yield* askSmokeAssert(
+    !pageKeyFromOtherScope.success &&
+      pageKeyFromOtherScope.error.errorType ===
+        askKeyValueStoreQueryBase.errorType.InvalidScope,
+    'scope B page key was not refused from scope A'
+  );
+
+  // Changing the indexed attribute moves the row's index entry with it.
+  yield* askKeyValueStoreUpdate(
+    SMOKE_SCOPED_PROBE_STORE,
+    kvsUpdate([kvsSet('category', movedCategory)]),
+    probeId,
+    undefined,
+    { scope: scopeA }
+  );
+
+  const moved = yield* askSmokeScopedCategoryQuery(movedCategory, scopeA, [
+    probeId,
+  ]);
+  yield* askSmokeAssert(
+    probeIdsOf(moved) === probeId,
+    'scoped index query did not follow the updated category'
+  );
+
+  const leftBehind = yield* askSmokeScopedCategoryQuery(category, scopeA, []);
+  yield* askSmokeAssert(
+    leftBehind.length === 0,
+    'scoped index query still found the record under its old category'
+  );
+
+  const unscopedGet = yield* askCatch(
+    askKeyValueStoreGet<SmokeProbeRecord>(SMOKE_SCOPED_PROBE_STORE, probeId)
+  );
+  yield* askSmokeAssert(
+    !unscopedGet.success &&
+      unscopedGet.error.errorType ===
+        askKeyValueStoreGetBase.errorType.InvalidScope,
+    'unscoped get on the scoped store was not refused with InvalidScope'
+  );
+
+  const scopedUpsertOnUnscopedStore = yield* askCatch(
+    askKeyValueStoreUpsert<SmokeProbeRecord>(SMOKE_PROBE_STORE, record, {
+      scope: scopeA,
+    })
+  );
+  yield* askSmokeAssert(
+    !scopedUpsertOnUnscopedStore.success &&
+      scopedUpsertOnUnscopedStore.error.errorType ===
+        askKeyValueStoreUpsertBase.errorType.InvalidScope,
+    'scoped upsert on the unscoped store was not refused with InvalidScope'
+  );
+
+  yield* askKeyValueStoreDelete(SMOKE_SCOPED_PROBE_STORE, probeId, undefined, {
+    scope: scopeA,
+  });
+  yield* askKeyValueStoreDelete(
+    SMOKE_SCOPED_PROBE_STORE,
+    otherProbeId,
+    undefined,
+    { scope: scopeB }
+  );
+  yield* askKeyValueStoreDelete(
+    SMOKE_SCOPED_PROBE_STORE,
+    pagedProbeId,
+    undefined,
+    { scope: scopeB }
+  );
+
+  const deleted = yield* askKeyValueStoreGet<SmokeProbeRecord>(
+    SMOKE_SCOPED_PROBE_STORE,
+    probeId,
+    { scope: scopeA }
+  );
+  yield* askSmokeAssert(!deleted, 'scoped record still present after delete');
+}

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedKeyValueStore/scopedKeyValueStoreSmokeSuite.ts

@@ -0,0 +1,11 @@
+import { SmokeSuite } from '../../harness/types/SmokeSuite';
+import { defineScopedKeyValueStoreSmoke } from './config/defineScopedKeyValueStoreSmoke';
+import { askRunScopedKeyValueStoreTest } from './logic/askRunScopedKeyValueStoreTest';
+
+/** A scoped store's gate and partition isolation. */
+export const scopedKeyValueStoreSmokeSuite: SmokeSuite = {
+  defineConfig: defineScopedKeyValueStoreSmoke,
+  tests: [
+    { name: 'scopedKeyValueStore', askRun: askRunScopedKeyValueStoreTest },
+  ],
+};

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedStorageDrive/config/defineScopedStorageDriveSmoke.ts

@@ -0,0 +1,12 @@
+import { defineStorageDrive, QPQConfig } from 'quidproquo';
+
+import { SMOKE_SCOPED_PROBE_DRIVE } from '../constants/SMOKE_SCOPED_PROBE_DRIVE';
+
+/**
+ * A scoped drive for the scope gate in both directions (it refuses an unscoped
+ * call, the harness's unscoped probe drive refuses a scope) and partition
+ * isolation between two scopes.
+ */
+export const defineScopedStorageDriveSmoke = (): QPQConfig => [
+  defineStorageDrive(SMOKE_SCOPED_PROBE_DRIVE, { scoped: true }),
+];

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedStorageDrive/config/index.ts

@@ -0,0 +1 @@
+export * from './defineScopedStorageDriveSmoke';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedStorageDrive/constants/SMOKE_SCOPED_PROBE_DRIVE.ts

@@ -0,0 +1,2 @@
+/** A scoped probe drive: every call must carry a scope, and an unscoped one is refused. */
+export const SMOKE_SCOPED_PROBE_DRIVE = 'smoke-scoped-probe';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedStorageDrive/constants/index.ts

@@ -0,0 +1 @@
+export * from './SMOKE_SCOPED_PROBE_DRIVE';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedStorageDrive/index.ts

@@ -0,0 +1,4 @@
+export * from './config';
+export * from './constants';
+export * from './logic';
+export * from './scopedStorageDriveSmokeSuite';

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/scopedStorageDrive → suites/scopedStorageDrive/logic}/askRunScopedStorageDriveTest.ts

@@ -11,8 +11,8 @@ import {
 
 import { SMOKE_PROBE_DRIVE } from '@qpqjs/constants';
 
-import { SMOKE_SCOPED_PROBE_DRIVE } from '../../constants/smokeProbe';
-import { askSmokeAssert } from '../askSmokeAssert';
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
+import { SMOKE_SCOPED_PROBE_DRIVE } from '../constants/SMOKE_SCOPED_PROBE_DRIVE';
 
 // The scope gate on a drive, on whichever backend is running: a scoped drive
 // serves scoped calls and keeps two scopes apart, refuses an unscoped call,

package/template/apps/qpqjs/services/test/service/src/smoke/suites/scopedStorageDrive/scopedStorageDriveSmokeSuite.ts

@@ -0,0 +1,9 @@
+import { SmokeSuite } from '../../harness/types/SmokeSuite';
+import { defineScopedStorageDriveSmoke } from './config/defineScopedStorageDriveSmoke';
+import { askRunScopedStorageDriveTest } from './logic/askRunScopedStorageDriveTest';
+
+/** A scoped drive's gate and partition isolation. */
+export const scopedStorageDriveSmokeSuite: SmokeSuite = {
+  defineConfig: defineScopedStorageDriveSmoke,
+  tests: [{ name: 'scopedStorageDrive', askRun: askRunScopedStorageDriveTest }],
+};

package/template/apps/qpqjs/services/test/service/src/smoke/suites/secret/config/defineSecretSmoke.ts

@@ -0,0 +1,8 @@
+import { defineSecret, QPQConfig } from 'quidproquo';
+
+import { SMOKE_PROBE_SECRET } from '../constants/SMOKE_PROBE_SECRET';
+
+/** An owned secret for the secret test to read. */
+export const defineSecretSmoke = (): QPQConfig => [
+  defineSecret(SMOKE_PROBE_SECRET),
+];

package/template/apps/qpqjs/services/test/service/src/smoke/suites/secret/config/index.ts

@@ -0,0 +1 @@
+export * from './defineSecretSmoke';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/secret/constants/SMOKE_PROBE_SECRET.ts

@@ -0,0 +1,2 @@
+/** The owned secret the secret test reads through the tag-conditioned grant. */
+export const SMOKE_PROBE_SECRET = 'smokeProbe';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/secret/constants/index.ts

@@ -0,0 +1 @@
+export * from './SMOKE_PROBE_SECRET';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/secret/index.ts

@@ -0,0 +1,4 @@
+export * from './config';
+export * from './constants';
+export * from './logic';
+export * from './secretSmokeSuite';

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/secret → suites/secret/logic}/askRunSecretTest.ts

@@ -1,7 +1,7 @@
 import { askConfigGetSecret, AskResponse } from 'quidproquo';
 
-import { SMOKE_PROBE_SECRET } from '../../constants/smokeProbe';
-import { askSmokeAssert } from '../askSmokeAssert';
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
+import { SMOKE_PROBE_SECRET } from '../constants/SMOKE_PROBE_SECRET';
 
 // secretsmanager:GetSecretValue against an owned secret, granted by tag. The
 // deployed secret is created without an explicit value, so the platform

package/template/apps/qpqjs/services/test/service/src/smoke/suites/secret/secretSmokeSuite.ts

@@ -0,0 +1,9 @@
+import { SmokeSuite } from '../../harness/types/SmokeSuite';
+import { defineSecretSmoke } from './config/defineSecretSmoke';
+import { askRunSecretTest } from './logic/askRunSecretTest';
+
+/** Reads an owned secret. */
+export const secretSmokeSuite: SmokeSuite = {
+  defineConfig: defineSecretSmoke,
+  tests: [{ name: 'secret', askRun: askRunSecretTest }],
+};

package/template/apps/qpqjs/services/test/service/src/smoke/suites/signingKey/config/defineSigningKeySmoke.ts

@@ -0,0 +1,12 @@
+import { defineSigningKey, QPQConfig } from 'quidproquo';
+
+import { SMOKE_PROBE_SIGNING_KEY } from '@qpqjs/constants';
+
+/**
+ * An owned RSA signing key: kms:Sign and kms:GetPublicKey through the
+ * alias-conditioned grant. testa declares the same key foreign (see its
+ * smoke/suites/signingKey) for the cross-service verify test.
+ */
+export const defineSigningKeySmoke = (): QPQConfig => [
+  defineSigningKey(SMOKE_PROBE_SIGNING_KEY),
+];

package/template/apps/qpqjs/services/test/service/src/smoke/suites/signingKey/config/index.ts

@@ -0,0 +1 @@
+export * from './defineSigningKeySmoke';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/signingKey/index.ts

@@ -0,0 +1,3 @@
+export * from './config';
+export * from './logic';
+export * from './signingKeySmokeSuite';

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/crossService → suites/signingKey/logic}/askRunCrossServiceSigningKeyTest.ts

@@ -17,7 +17,7 @@ import {
   CrossServiceSigningKeyProbeResult,
 } from '@qpqjs/testa-models';
 
-import { askSmokeAssert } from '../askSmokeAssert';
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
 
 // The issuer/verifier split a signing key exists for: THIS service signs a
 // jwt with its owned key, testa verifies it through its foreign declaration

package/template/apps/qpqjs/services/test/service/src/smoke/{tests/signingKey → suites/signingKey/logic}/askRunSigningKeyTest.ts

@@ -11,7 +11,7 @@ import {
 import { SMOKE_PROBE_SIGNING_KEY } from '@qpqjs/constants';
 import { SmokeSigningKeyClaims } from '@qpqjs/test-models';
 
-import { askSmokeAssert } from '../askSmokeAssert';
+import { askSmokeAssert } from '../../../harness/assert/askSmokeAssert';
 
 const PUBLIC_KEY_PEM_HEADER = '-----BEGIN PUBLIC KEY-----';
 

package/template/apps/qpqjs/services/test/service/src/smoke/suites/signingKey/logic/index.ts

@@ -0,0 +1,2 @@
+export * from './askRunCrossServiceSigningKeyTest';
+export * from './askRunSigningKeyTest';

package/template/apps/qpqjs/services/test/service/src/smoke/suites/signingKey/signingKeySmokeSuite.ts

@@ -0,0 +1,16 @@
+import { SmokeSuite } from '../../harness/types/SmokeSuite';
+import { defineSigningKeySmoke } from './config/defineSigningKeySmoke';
+import { askRunCrossServiceSigningKeyTest } from './logic/askRunCrossServiceSigningKeyTest';
+import { askRunSigningKeyTest } from './logic/askRunSigningKeyTest';
+
+/** An owned signing key, and testa verifying (but never signing) with it. */
+export const signingKeySmokeSuite: SmokeSuite = {
+  defineConfig: defineSigningKeySmoke,
+  tests: [
+    { name: 'signingKey', askRun: askRunSigningKeyTest },
+    {
+      name: 'crossServiceSigningKey',
+      askRun: askRunCrossServiceSigningKeyTest,
+    },
+  ],
+};