declapract-typescript-ehmpathy 0.49.10 → 0.49.12

package/dist/.test/assets/cache/declarations/declapract.declare.yml

@@ -0,0 +1,4 @@
+# minimal declarations for cache practice integration test
+declare:
+  practices: practices
+  use-cases: useCases.yml

package/dist/.test/assets/cache/declarations/practices/cache/.declapract.integration.test.ts

@@ -0,0 +1,108 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useBeforeAll, when } from 'test-fns';
+
+// executeApply is slow (90+ seconds per invocation due to full practice evaluation)
+jest.setTimeout(180_000); // 3 minutes
+
+/**
+ * .what = acceptance test for cache practice with .ifInstalled() modifier
+ * .why = verifies that minVersion().ifInstalled() correctly:
+ *        - skips check when package is not installed
+ *        - flags outdated versions when package IS installed
+ *        - passes when package is at or above minimum version
+ */
+describe('cache practice with ifInstalled', () => {
+  given('[case1] repo WITHOUT cache package installed', () => {
+    const tempDir = genTempDir({
+      slug: 'cache-not-installed',
+      clone: './src/practices/cache/.test/assets/repo-without-cache-package',
+      symlink: [
+        { at: 'declarations', to: './src/.test/assets/cache/declarations' },
+        { at: 'node_modules', to: 'node_modules' },
+      ],
+    });
+
+    // run executeApply before assertions
+    useBeforeAll(async () => {
+      await executeApply({
+        config: path.join(tempDir, 'declapract.use.yml'),
+        practice: 'cache',
+      });
+    }, 120_000); // 2 min timeout
+
+    when('[t0] after declapract apply', () => {
+      then('package.json is unchanged (ifInstalled skips absent packages)', async () => {
+        const packageJson = JSON.parse(
+          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
+        );
+        // should NOT have added cache packages since they were absent
+        expect(packageJson.dependencies['simple-in-memory-cache']).toBeUndefined();
+        expect(packageJson.dependencies['simple-on-disk-cache']).toBeUndefined();
+        expect(packageJson.dependencies['with-simple-cache']).toBeUndefined();
+        // original dependency should still be there
+        expect(packageJson.dependencies.lodash).toBe('4.17.21');
+      });
+    });
+  });
+
+  given('[case2] repo WITH outdated cache package', () => {
+    const tempDir = genTempDir({
+      slug: 'cache-outdated',
+      clone: './src/practices/cache/.test/assets/repo-with-old-cache-package',
+      symlink: [
+        { at: 'declarations', to: './src/.test/assets/cache/declarations' },
+        { at: 'node_modules', to: 'node_modules' },
+      ],
+    });
+
+    // run executeApply before assertions
+    useBeforeAll(async () => {
+      await executeApply({
+        config: path.join(tempDir, 'declapract.use.yml'),
+        practice: 'cache',
+      });
+    }, 120_000); // 2 min timeout
+
+    when('[t0] after declapract apply', () => {
+      then('package.json has version upgraded to minimum', async () => {
+        const packageJson = JSON.parse(
+          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
+        );
+        // should have upgraded from 0.3.0 to the 0.5.1 floor
+        expect(packageJson.dependencies['simple-in-memory-cache']).toBe('0.5.1');
+      });
+    });
+  });
+
+  given('[case3] repo WITH valid cache package version', () => {
+    const tempDir = genTempDir({
+      slug: 'cache-valid',
+      clone: './src/practices/cache/.test/assets/repo-with-valid-cache-package',
+      symlink: [
+        { at: 'declarations', to: './src/.test/assets/cache/declarations' },
+        { at: 'node_modules', to: 'node_modules' },
+      ],
+    });
+
+    // run executeApply before assertions
+    useBeforeAll(async () => {
+      await executeApply({
+        config: path.join(tempDir, 'declapract.use.yml'),
+        practice: 'cache',
+      });
+    }, 120_000); // 2 min timeout
+
+    when('[t0] after declapract apply', () => {
+      then('package.json version is unchanged (already at minimum)', async () => {
+        const packageJson = JSON.parse(
+          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
+        );
+        // should still be 0.5.1 (unchanged, already at the floor)
+        expect(packageJson.dependencies['simple-in-memory-cache']).toBe('0.5.1');
+      });
+    });
+  });
+});

package/dist/.test/assets/cache/declarations/practices/cache/.test/assets/repo-with-old-cache-package/declapract.use.yml

@@ -0,0 +1,6 @@
+# .note = declarations dir is symlinked by the test (contains declapract.declare.yml + dist/)
+declarations: 'declarations/declapract.declare.yml'
+useCase: typescript-project
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project-old-cache'

package/dist/.test/assets/cache/declarations/practices/cache/.test/assets/repo-with-old-cache-package/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "test-project-old-cache",
+  "version": "1.0.0",
+  "dependencies": {
+    "simple-in-memory-cache": "0.3.0"
+  }
+}

package/dist/.test/assets/cache/declarations/practices/cache/.test/assets/repo-with-valid-cache-package/declapract.use.yml

@@ -0,0 +1,6 @@
+# .note = declarations dir is symlinked by the test (contains declapract.declare.yml + dist/)
+declarations: 'declarations/declapract.declare.yml'
+useCase: typescript-project
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project-valid-cache'

package/dist/.test/assets/cache/declarations/practices/cache/.test/assets/repo-with-valid-cache-package/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "test-project-valid-cache",
+  "version": "1.0.0",
+  "dependencies": {
+    "simple-in-memory-cache": "0.5.1"
+  }
+}

package/dist/.test/assets/cache/declarations/practices/cache/.test/assets/repo-without-cache-package/declapract.use.yml

@@ -0,0 +1,6 @@
+# .note = declarations dir is symlinked by the test (contains declapract.declare.yml + dist/)
+declarations: 'declarations/declapract.declare.yml'
+useCase: typescript-project
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project-no-cache'

package/dist/.test/assets/cache/declarations/practices/cache/.test/assets/repo-without-cache-package/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "test-project-no-cache",
+  "version": "1.0.0",
+  "dependencies": {
+    "lodash": "4.17.21"
+  }
+}

package/dist/.test/assets/cache/declarations/practices/cache/best-practice/package.json

@@ -0,0 +1,7 @@
+{
+  "dependencies": {
+    "simple-in-memory-cache": "@declapract{check.minVersion('0.5.1').ifInstalled()}",
+    "simple-on-disk-cache": "@declapract{check.minVersion('1.8.1').ifInstalled()}",
+    "with-simple-cache": "@declapract{check.minVersion('0.17.3').ifInstalled()}"
+  }
+}

package/dist/.test/assets/cache/declarations/useCases.yml

@@ -0,0 +1,5 @@
+# minimal use case for cache practice integration test
+use-cases:
+  typescript-project:
+    practices:
+      - cache

package/dist/.test/assets/cicd-service/declarations/declapract.declare.yml

@@ -0,0 +1,9 @@
+# minimal declarations for the cicd-service provision.yml (D28) integration test.
+# .why = a `file`-only apply (never `--practice`, so `projectPractices` keeps every usecase
+#        practice — see the test's .note) compiles EVERY practice under `practices:`. pointed at
+#        the real `src/practices` (~40 practices) that blows the jest hook timeout, so this mirror
+#        holds symlinks to only the two the D28 branch reads: cicd-service (its provision.yml is the
+#        applied declaration) and persist-with-rds (its NAME is the branch signal).
+declare:
+  practices: practices
+  use-cases: useCases.yml

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/.declapract.integration.test.ts

@@ -0,0 +1,175 @@
+import { readFileSync } from 'node:fs';
+
+import { given, then, useBeforeAll, when } from 'test-fns';
+import yaml from 'yaml';
+
+/**
+ * .what = two clamps on the `deploy.yml` caller:
+ *         1. caller↔callee reconciliation — the caller must pass the `pagerduty-integration-key`
+ *            secret the `.deploy-sls.yml` callee DECLARES and USES, so a prod deploy/acceptance
+ *            failure actually pages (D29 / #573).
+ *         2. prod test-gate precedence — the prod job's `if:` must bind the `needs.test` gate to
+ *            EVERY trigger branch, so a tag push cannot deploy to prod on a failed test (i014 r11).
+ * .why  = (1) the callee marks the secret `required: false`, so github never errors when a caller
+ *         omits it — the omission is SILENT. the callee's `alarm on failure` step gates on
+ *         `if: failure() && env.PAGERDUTY_INTEGRATION_KEY`, so an unpassed secret leaves the step
+ *         SKIPPED and every prod alert dead. the current template shipped a `prod` job with no
+ *         `secrets:` block, and `deploy.yml` is EQUALS — so `declapract fix` STRIPPED the
+ *         pass-through a consumer had, so its alerts died by conformance. this clamp is the guard
+ *         github cannot be: it reconciles the caller's pass-through against the callee's declaration.
+ *         (2) github-actions `&&` binds tighter than `||`, so an `if:` written
+ *         `(tag) || (access==prod) && always() && (test ok)` parses as `tag || (access && always &&
+ *         test)` — the test gate binds ONLY to the access branch, so a `v*` TAG PUSH deploys to prod
+ *         even when `test` FAILED. the correct shape wraps both trigger branches in one outer group:
+ *         `((tag) || access==prod) && always() && (test ok)`. this is the silent-break class the wish
+ *         fights — an untested build reaches prod, every gate green. the clamp reads the raw `if:`
+ *         and reddens on the un-grouped (bug) shape.
+ * .note = a filesystem walk → integration suite per `rule.forbid.unit.remote-boundaries`; no
+ *         credential, no network — the boundary alone classifies it.
+ * .note = the secret clamp is scoped to the `prod` job by design. the callee marks the secret
+ *         `required: false` and the org convention alerts under prod access alone (a prep failure that pages
+ *         prod would be noise), so a `prep` job legitimately omits it. the reconciliation asserts
+ *         the ONE call that matters.
+ */
+
+const WORKFLOWS_DIR = `${__dirname}/best-practice/.github/workflows`;
+const PAGERDUTY_SECRET = 'pagerduty-integration-key';
+
+/**
+ * .what = whether the prod job's collapsed `if:` wraps BOTH trigger branches in ONE outer group
+ *         that the ` && always()` test-gate binds over — the correct precedence.
+ * .why  = a pure transformer leaf, named so the assertion below reads intent rather than a raw
+ *         precedence regex a reader must simulate. the buggy single-group shape opens one paren
+ *         `(startsWith`; the correct shape opens a second, OUTER paren `((startsWith` the
+ *         ` && always()` gate closes over, so the gate binds to the tag-push branch too, not the
+ *         access branch alone. mirrors the peer cicd-app-react-native-expo prod-gate clamp.
+ */
+const isProdGateGroupedCorrectly = (input: { collapsedIf: string }): boolean =>
+  /\(\(startsWith\(github\.ref, 'refs\/tags\/'\).*\|\| github\.event\.inputs\.access == 'prod'\) &&\s*always\(\)/.test(
+    input.collapsedIf,
+  );
+
+const readWorkflow = (input: { file: string }): { text: string; parsed: any } => {
+  const text = readFileSync(`${WORKFLOWS_DIR}/${input.file}`, 'utf-8');
+  return { text, parsed: yaml.parse(text) };
+};
+
+describe('cicd-service — deploy caller↔callee secret reconciliation (D29 clamp)', () => {
+  given('[case1] the `.deploy-sls.yml` callee and the `deploy.yml` caller', () => {
+    const scene = useBeforeAll(() => ({
+      callee: readWorkflow({ file: '.deploy-sls.yml' }),
+      caller: readWorkflow({ file: 'deploy.yml' }),
+    }));
+
+    when('[t0] the callee declares and uses the pagerduty secret', () => {
+      then('it declares the secret under `workflow_call.secrets`', () => {
+        // guard the shape so an absent `on.workflow_call` fails as a clean red, not a
+        // raw TypeError — this file is a durable sentry, a crash undermines that role
+        const workflowCall = scene.callee.parsed.on?.workflow_call;
+        expect(workflowCall).toBeDefined();
+        const declared = workflowCall?.secrets ?? {};
+        expect(Object.keys(declared)).toContain(PAGERDUTY_SECRET);
+      });
+
+      then('it USES the secret in a step (so an unpassed value is a live gap)', () => {
+        expect(scene.callee.text).toContain(`secrets.${PAGERDUTY_SECRET}`);
+      });
+    });
+
+    when('[t1] the caller invokes the callee for the prod deploy', () => {
+      then('the prod job passes the pagerduty secret through', () => {
+        // guard the shape: an absent `jobs.prod` fails as a clean red, not a raw TypeError
+        const prodJob = scene.caller.parsed.jobs?.prod;
+        expect(prodJob).toBeDefined();
+        // teeth: a `prod` job with no `secrets:` block (the shipped defect) leaves this undefined,
+        // so the assertion reddens — which is exactly the state that killed prod alerts.
+        const prodSecrets = prodJob?.secrets ?? {};
+        expect(Object.keys(prodSecrets)).toContain(PAGERDUTY_SECRET);
+      });
+
+      then('the prod job actually calls `.deploy-sls.yml`', () => {
+        // guard the shape: a `prod` job absent a `uses:` key leaves this undefined, so assert it
+        // is a string first — else `.toContain` on undefined throws a raw TypeError, not a clean
+        // red. this file is a durable sentry; a crash undermines that role (r7 i012 nitpick).
+        // guards the assertion above from vacuity — it reconciles a REAL call, not a renamed job
+        const prodUses = scene.caller.parsed.jobs?.prod?.uses;
+        expect(typeof prodUses).toBe('string');
+        expect(prodUses).toContain('.deploy-sls.yml');
+      });
+    });
+
+    when('[t2] the prod job gates on the test result across every trigger branch', () => {
+      // github-actions `&&` binds tighter than `||`. so a prod `if:` written
+      //   (tag) || (access==prod) && always() && (test ok)
+      // parses as  tag || (access && always && test)  — the test gate binds ONLY to the access
+      // branch, and a `v*` TAG PUSH deploys to prod on a FAILED test. the correct shape wraps
+      // both trigger branches in one OUTER group the gate applies to:
+      //   ((tag) || access==prod) && always() && (test ok)
+      // `scene` is a useBeforeAll proxy — read it only inside a `then` (post-setup), never at the
+      // `when` body level, so each `then` derives the collapsed `if:` string itself.
+      const collapseProdIf = (): string =>
+        (scene.caller.parsed.jobs?.prod?.if ?? '').replace(/\s+/g, ' ').trim();
+
+      then('the two trigger branches sit in one outer group the test-gate binds to', () => {
+        const collapsed = collapseProdIf();
+        // guard the shape: an absent `if` leaves collapsed empty, a clean red not a crash
+        expect(collapsed.length).toBeGreaterThan(0);
+        // teeth: revert the outer paren and isProdGateGroupedCorrectly reddens.
+        expect(isProdGateGroupedCorrectly({ collapsedIf: collapsed })).toEqual(
+          true,
+        );
+      });
+
+      then('the buggy per-branch group (access alone in parens after `||`) is absent', () => {
+        // teeth: the precedence bug wraps the access branch in its OWN parens after the `||`
+        // (`|| (github.event.inputs.access == 'prod') &&`), which lets the tag branch stand alone.
+        // the correct shape leaves the access branch bare inside the outer group.
+        expect(collapseProdIf()).not.toContain(
+          "|| (github.event.inputs.access == 'prod') &&",
+        );
+      });
+
+      then('the test-result gate itself is present (guards the above from vacuity)', () => {
+        expect(collapseProdIf()).toContain(
+          "always() && (needs.test.result == 'success' || needs.test.result == 'skipped')",
+        );
+      });
+    });
+
+    when('[t3] the emitted prod-job contract is snapshotted for review', () => {
+      // the regex + toContain clamps above prove the SHAPE; this snapshots the emitted
+      // contract itself so a reviewer vibechecks the actual `if:` gate and `secrets:`
+      // pass-through, and any drift (a reword, an operand reshuffle, a dropped secret)
+      // shows as a diff. per rule.require.contract-snapshot-exhaustiveness.
+      then('the prod job `if:` gate matches snapshot', () => {
+        const prodIf = scene.caller.parsed.jobs?.prod?.if ?? '';
+        expect(prodIf).toMatchSnapshot('deploy.yml prod job if: (test-gate precedence)');
+      });
+
+      then('the prod job `secrets:` pass-through matches snapshot', () => {
+        const prodSecrets = scene.caller.parsed.jobs?.prod?.secrets ?? {};
+        expect(yaml.stringify(prodSecrets)).toMatchSnapshot(
+          'deploy.yml prod job secrets: (pagerduty pass-through)',
+        );
+      });
+
+      then('the callee alarm-on-failure step matches snapshot', () => {
+        // the pass-through only pages if the callee still gates an alarm step on the secret;
+        // snapshot the CONTIGUOUS `alarm on failure` step block — not a line-filter join across the
+        // whole file, which spliced the `secrets:` declaration (6-space indent) and this step's
+        // env/with lines (10-space indent) into an unparseable, mis-indented fragment. the whole
+        // step is valid, uniformly-based yaml, and it still shows both secret usages, so a drop of
+        // the step (or of its secret reference) stays diff-visible.
+        const alarmBlock =
+          scene.callee.text.match(
+            /[ \t]*- name: alarm on failure[\s\S]*?pagerduty-dedup-key: github_workflow_failed\n/,
+          )?.[0] ?? '';
+        // guard vacuity: an empty match would snapshot '' and pass silently on a renamed step
+        expect(alarmBlock.length).toBeGreaterThan(0);
+        expect(alarmBlock).toMatchSnapshot(
+          '.deploy-sls.yml alarm-on-failure step',
+        );
+      });
+    });
+  });
+});

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/.test/assets/demo-repo-pre-stamped-nords/.github/workflows/provision.yml

@@ -0,0 +1,110 @@
+name: provision
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - "main"
+      - "master"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }} # per [workflow] x [branch, tag]
+  cancel-in-progress: true #  cancel workflows for non-latest commits
+
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
+jobs:
+  aws-test-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/test
+      github-environment-plan: test
+      github-environment-apply: test
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prep-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prep
+      github-environment-plan: prep
+      github-environment-apply: prep
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
+      allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  github:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/github.repo/resources.ts
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-plan: prod
+      github-environment-apply: prod
+      creds-github-app-owner: ${{ github.repository_owner }}
+      creds-github-app-id: ${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
+    secrets:
+      creds-github-app-private-key: ${{ secrets.DECLASTRUCT_GITHUB_CONFORMER_APP_PRIVATE_KEY }}
+
+  sql-schema-prep:
+    uses: ./.github/workflows/.sql-schema-control.yml
+    with:
+      access: prep
+      github-environment-plan: prep
+      github-environment-apply: prep
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  sql-schema-prod:
+    uses: ./.github/workflows/.sql-schema-control.yml
+    with:
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
+      allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  aws-prep-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prep
+      github-environment-plan: prep
+      github-environment-apply: prep
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
+      allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/.test/assets/demo-repo-pre-stamped-nords/declapract.use.nords.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: service-without-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  slackWebhookUrl: 'https://hooks.slack.example.com/test'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/.test/assets/demo-repo-pre-stamped-nords/declapract.use.rds.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  slackWebhookUrl: 'https://hooks.slack.example.com/test'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/.test/assets/demo-repo-service/declapract.use.nords.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: service-without-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  slackWebhookUrl: 'https://hooks.slack.example.com/test'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/.test/assets/demo-repo-service/declapract.use.rds.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  slackWebhookUrl: 'https://hooks.slack.example.com/test'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/.test/assets/demo-repo-service/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/__snapshots__/.declapract.integration.test.ts.snap

@@ -0,0 +1,24 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`cicd-service — deploy caller↔callee secret reconciliation (D29 clamp) given: [case1] the \`.deploy-sls.yml\` callee and the \`deploy.yml\` caller when: [t3] the emitted prod-job contract is snapshotted for review then: the callee alarm-on-failure step matches snapshot: .deploy-sls.yml alarm-on-failure step 1`] = `
+"      - name: alarm on failure
+        env:
+          PAGERDUTY_INTEGRATION_KEY: \${{ secrets.pagerduty-integration-key }}
+        if: failure() && env.PAGERDUTY_INTEGRATION_KEY
+        uses: Entle/action-pagerduty-alert@e6ca54cd88948b8a50f5bb1071dfa5bdb149ce7e # 0.2.0 — https://github.com/marketplace/actions/pagerduty-alert
+        with:
+          pagerduty-integration-key: "\${{ secrets.pagerduty-integration-key }}"
+          pagerduty-dedup-key: github_workflow_failed
+"
+`;
+
+exports[`cicd-service — deploy caller↔callee secret reconciliation (D29 clamp) given: [case1] the \`.deploy-sls.yml\` callee and the \`deploy.yml\` caller when: [t3] the emitted prod-job contract is snapshotted for review then: the prod job \`if:\` gate matches snapshot: deploy.yml prod job if: (test-gate precedence) 1`] = `
+"((startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch') || github.event.inputs.access == 'prod') &&
+always() && (needs.test.result == 'success' || needs.test.result == 'skipped')
+"
+`;
+
+exports[`cicd-service — deploy caller↔callee secret reconciliation (D29 clamp) given: [case1] the \`.deploy-sls.yml\` callee and the \`deploy.yml\` caller when: [t3] the emitted prod-job contract is snapshotted for review then: the prod job \`secrets:\` pass-through matches snapshot: deploy.yml prod job secrets: (pagerduty pass-through) 1`] = `
+"pagerduty-integration-key: \${{ secrets.PAGERDUTY_INTEGRATION_KEY }}
+"
+`;

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/__snapshots__/acceptanceContempFleetGuard.declapract.integration.test.ts.snap

@@ -0,0 +1,13 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`contemp-only acceptance guard — the shipped deploy template cannot re-split into a dual fleet fan-out given: [case2] the acceptance-job block as a whole when: [t0] the block is read from the shipped deploy template then: the acceptance-job block matches snapshot (a reworded step reddens): deploy-sls acceptance-job block 1`] = `
+"      # acceptance targets the contemp fleet — the service's own access-tier slug (-prep- at prep,
+      # -prod- at prod). dual-publish ships the SAME artifact under the ancient (-dev-) slug too, so
+      # a run against contemp proves the deployed code; the ancient slug is an alias for inbound
+      # callers still on the old name, never a second target to test. contemp maps to the deployed
+      # access at both prep and prod, so one run covers every tier this job deploys — no
+      # per-fleet fan-out, no per-tier skip.
+      - name: test:acceptance
+        run: ACCESS=\${{ inputs.access }} npm run test:acceptance
+"
+`;

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/__snapshots__/insync-grep.declapract.integration.test.ts.snap

@@ -0,0 +1,5 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`cicd-service apply-gate in-sync greps given: the shipped .sql-schema-control.yml when: the apply-gate grep is read then: the emitted apply-gate grep line matches snapshot: sql-schema-control apply-gate grep 1`] = `"if grep "connect ETIMEDOUT" ./plan.log"`;
+
+exports[`cicd-service apply-gate in-sync greps given: the shipped .terraform.yml when: the apply-gate grep is read then: the emitted apply-gate grep line matches snapshot: terraform apply-gate grep 1`] = `"if grep "infrastructure matches the configuration" ./plan.log"`;