declapract-typescript-ehmpathy 0.49.12 → 0.49.14

package/dist/practices/cicd-app-react-native-expo/.declapract.integration.test.ts

@@ -6,6 +6,7 @@ import { executeApply } from 'declapract';
 import { genTempDir, given, then, useBeforeAll, when } from 'test-fns';
 import yaml from 'yaml';
 
+import { genTempRepoWithDeclarationsOutside } from '../../utils/genTempRepoWithDeclarationsOutside';
 import { getAllPracticesForUsecase } from '../../utils/getAllPracticesForUsecase';
 
 // executeApply is slow (whole-usecase evaluation across ten practices)
@@ -27,13 +28,11 @@ jest.setTimeout(240_000);
  */
 describe('app-react-native-expo — graceful migration of an app-protools-shaped repo', () => {
   given('[case1] a customized npm expo repo on the deprecated src layers', () => {
-    const tempDir = genTempDir({
+    const tempDir = genTempRepoWithDeclarationsOutside({
       slug: 'expo-migration',
       clone: './src/.test/assets/expo-migration/repo-app-protools-shaped',
-      symlink: [
-        { at: 'declarations', to: './src/.test/assets/expo-migration/declarations' },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
+      declarations: './src/.test/assets/expo-migration/declarations',
+      symlink: [{ at: 'node_modules', to: 'node_modules' }],
     });
 
     const read = (rel: string) =>
@@ -166,7 +165,12 @@ describe('app-react-native-expo — graceful migration of an app-protools-shaped
         const pkg = JSON.parse(state.after2.pkg!);
         expect(pkg.overrides).toBeUndefined();
         expect(pkg.resolutions).toBeUndefined();
-        expect(pkg.pnpm.overrides['type-fns']).toEqual('1.9.9');
+        // the relocated type-fns override (1.9.9) undercuts the declared type-fns, so
+        // pnpm/override-undercuts-dependency raises it to the declared version (#624)
+        expect(pkg.pnpm.overrides['type-fns']).toEqual(
+          pkg.dependencies?.['type-fns'] ?? pkg.devDependencies?.['type-fns'],
+        );
+        expect(pkg.pnpm.overrides['type-fns']).not.toEqual('1.9.9');
         expect(pkg.pnpm.overrides['@commitlint/format']).toEqual('19.9.9');
       });
 
@@ -800,16 +804,11 @@ describe('app-react-native-expo — full-usecase evaluation smoke', () => {
   });
 
   given('[case1] the app-protools-shaped repo on the full usecase', () => {
-    const tempDir = genTempDir({
+    const tempDir = genTempRepoWithDeclarationsOutside({
       slug: 'expo-fullusecase',
       clone: './src/.test/assets/expo-migration/repo-app-protools-shaped',
-      symlink: [
-        {
-          at: 'declarations',
-          to: './src/.test/assets/expo-fullusecase/declarations',
-        },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
+      declarations: './src/.test/assets/expo-fullusecase/declarations',
+      symlink: [{ at: 'node_modules', to: 'node_modules' }],
     });
 
     const read = (rel: string) =>
@@ -857,16 +856,11 @@ describe('app-react-native-expo — full-usecase evaluation smoke', () => {
   });
 
   given('[case2] a bare create-expo-app scaffold with no src/ at all', () => {
-    const tempDir = genTempDir({
+    const tempDir = genTempRepoWithDeclarationsOutside({
       slug: 'expo-fullusecase-greenfield',
       clone: './src/.test/assets/expo-fullusecase/repo-greenfield',
-      symlink: [
-        {
-          at: 'declarations',
-          to: './src/.test/assets/expo-fullusecase/declarations',
-        },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
+      declarations: './src/.test/assets/expo-fullusecase/declarations',
+      symlink: [{ at: 'node_modules', to: 'node_modules' }],
     });
 
     const read = (rel: string) =>

package/dist/practices/cicd-app-react-native-expo/__snapshots__/.declapract.integration.test.ts.snap

@@ -16,7 +16,7 @@ on:
         required: true
       github-environment:
         type: string
-        description: "github environment for the deploy jobs"
+        description: "the github environment for the deploy jobs; always declared, and one of the environments that provision/github.repo/resources.ts declares, e.g. preparation or production-on-main"
         required: true
       creds-aws-region:
         type: string
@@ -36,8 +36,8 @@ on:
         required: true
         description: required credentials to authenticate with expo eas
 
+# .why = least privilege: only the jobs that assume the aws role grant id-token, at job scope
 permissions:
-  id-token: write # required for oidc
   contents: read
 
 jobs:
@@ -53,6 +53,9 @@ jobs:
           - android
     name: \${{ matrix.platform }}
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # required for oidc
     environment:
       # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so no
       # "deployed to <env>" status accretes on the PR timeline. the environment is ALWAYS
@@ -97,6 +100,9 @@ jobs:
   deploy-web:
     name: web
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # required for oidc
     environment:
       # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so no
       # "deployed to <env>" status accretes on the PR timeline. the environment is ALWAYS
@@ -135,9 +141,11 @@ jobs:
 
       - name: compile
         run: npm run build:web
+        env:
+          ACCESS: \${{ inputs.access }} # the bundle inlines the access it was built with; never a guess
 
       - name: deploy
-        run: aws s3 sync ./dist \${{ inputs.app-web-deployment-s3-bucket }} --delete --cache-control max-age=60,stale-while-revalidate=604800 # todo: fine tune the cache control; https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#stale-while-revalidate
+        run: aws s3 sync ./dist \${{ inputs.app-web-deployment-s3-bucket }} --delete --cache-control max-age=60,stale-while-revalidate=604800 # a deploy shows within 60s; stale-while-revalidate serves the prior build while it refreshes
 "
 `;
 
@@ -183,18 +191,18 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
   "scripts": {
     "install:deps": "npm install",
     "start": "expo start",
-    "start:hot:proxy": "npx local-ssl-proxy --source 3447 --target 8081",
-    "start:hot:prep": "ACCESS=prep npx expo start --clear --dev-client",
+    "start:hot:proxy": "wait-on tcp:8081 && npx local-ssl-proxy --source 3447 --target 8081",
+    "start:hot:prep": "ACCESS=prep expo start --clear --dev-client",
     "start:hot:prep:link": "echo '🚀 https://localhost.protools.prep.ahbode.dev:3447'",
     "start:hot:prep:proxy": "npm run start:hot:prep:link && npm run start:hot:proxy",
-    "start:hot:prod": "ACCESS=prod npx expo start --clear --dev-client",
+    "start:hot:prod": "ACCESS=prod expo start --clear --dev-client",
     "start:hot:prod:link": "echo '🚀 https://localhost.protools.ahbode.dev:3447'",
     "start:hot:prod:proxy": "npm run start:hot:prod:link && npm run start:hot:proxy",
-    "start:cold:proxy": "npx local-ssl-proxy --source 3449 --target 3000",
-    "start:cold:prep": "npm run build:web && npx serve dist --single",
+    "start:cold:proxy": "wait-on tcp:3000 && npx local-ssl-proxy --source 3449 --target 3000",
+    "start:cold:prep": "ACCESS=prep npm run build:web && npx serve dist --single",
     "start:cold:prep:link": "echo '🚀 https://localhost.protools.prep.ahbode.dev:3449'",
-    "start:cold:prep:proxy": "echo npm run start:cold:prep:link && npm run start:cold:proxy",
-    "start:cold:prod": "npm run build:web && npx serve dist --single",
+    "start:cold:prep:proxy": "npm run start:cold:prep:link && npm run start:cold:proxy",
+    "start:cold:prod": "ACCESS=prod npm run build:web && npx serve dist --single",
     "start:cold:prod:link": "echo '🚀 https://localhost.protools.ahbode.dev:3449'",
     "register:device:apple:info": "echo 'learn more here https://docs.expo.dev/build/internal-distribution/'",
     "register:device:apple:inclusions:rebuild:prod": "npx eas build --platform ios --clear-cache",
@@ -217,44 +225,47 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
     "postversion": "git push origin HEAD --tags --no-verify",
     "prepare:rhachet": "rhachet init --keys --hooks --roles mechanic behaver driver reviewer librarian ergonomist architect dispatcher learner achiever telepath operator observer deployer playwright enroller",
     "upgrade:rhachet": "rhachet upgrade",
+    "build:ifstale": "set -eu && if [ -f dist/.build.stamp ] && [ -z \\"$(find src assets package.json pnpm-lock.yaml tsconfig.json tsconfig.build.json app.json app.config.ts -newer dist/.build.stamp -type f ! -name '*.test.ts' ! -name '*.test.tsx' ! -name '*.snap' -print -quit 2>/dev/null)\\" ]; then echo '👌 dist is fresh, build skipped'; else npm run build && touch dist/.build.stamp; fi",
     "test:unit": "set -eu && jest -c ./jest.unit.config.ts --forceExit --verbose --passWithNoTests $([ -n \\"\${CI:-}\\" ] && echo '--ci') $([ \\"\${THOROUGH:-}\\" != \\"true\\" ] && echo '--changedSince=origin/main') $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
     "test:integration": "set -eu && jest -c ./jest.integration.config.ts --forceExit --verbose --passWithNoTests $([ -n \\"\${CI:-}\\" ] && echo '--ci') $([ \\"\${THOROUGH:-}\\" != \\"true\\" ] && echo '--changedSince=origin/main') $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
-    "test:acceptance:locally": "set -eu && npm run build && LOCALLY=true jest -c ./jest.acceptance.config.ts --forceExit --verbose --runInBand --passWithNoTests $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
+    "test:acceptance:locally": "set -eu && npm run build:ifstale && LOCALLY=true jest -c ./jest.acceptance.config.ts --forceExit --verbose --runInBand --passWithNoTests $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
     "test": "set -eu && npm run test:commits && npm run test:types && npm run test:format && npm run test:lint && npm run test:unit && npm run test:integration && npm run test:acceptance:locally",
     "test:acceptance": "set -eu && npm run build && jest -c ./jest.acceptance.config.ts --forceExit --verbose --runInBand --passWithNoTests $([ -n \\"\${CI:-}\\" ] && echo '--ci') $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
     "test:types": "tsc -p ./tsconfig.json --noEmit",
     "build": "npm run build:web",
-    "build:web": "npx expo export --platform web"
+    "build:web": "ACCESS=\${ACCESS:-prep} expo export --platform web"
   },
   "devDependencies": {
+    "@babel/core": "^7.24.0",
+    "@jest/globals": "30.2.0",
+    "@types/jest": "30.0.0",
+    "babel-preset-expo": "^12.0.0",
+    "esbuild-register": "3.6.0",
     "expo": "54.0.0",
-    "rhachet": "1.47.5",
+    "isomorphic-fetch": "^3.0.0",
+    "jest": "30.2.0",
+    "jest-expo": "^54.0.0",
+    "rhachet": "1.49.2",
     "rhachet-brains-anthropic": "0.4.3",
-    "rhachet-brains-fireworksai": "0.1.6",
+    "rhachet-brains-fireworksai": "0.2.3",
+    "rhachet-brains-openrouter": "0.1.3",
     "rhachet-brains-xai": "0.3.3",
-    "rhachet-roles-bhrain": "0.34.1",
+    "rhachet-roles-bhrain": "0.40.0",
     "rhachet-roles-bhrowser": "0.1.0",
-    "rhachet-roles-bhuild": "0.21.36",
-    "rhachet-roles-ehmpathy": "1.38.12",
+    "rhachet-roles-bhuild": "0.23.2",
+    "rhachet-roles-ehmpathy": "1.39.5",
     "rhachet-roles-ghlitch": "0.3.0",
     "rhachet-roles-rhachet": "0.1.7",
-    "@jest/globals": "30.2.0",
-    "@types/jest": "30.0.0",
-    "jest": "30.2.0",
-    "esbuild-register": "3.6.0",
     "test-fns": "1.17.0",
     "tsx": "4.20.6",
-    "jest-expo": "^54.0.0",
-    "@babel/core": "^7.24.0",
-    "babel-preset-expo": "^12.0.0",
-    "isomorphic-fetch": "^3.0.0",
+    "wait-on": "9.5.1",
     "typescript": "5.4.5"
   },
   "dependencies": {
+    "domain-objects": "0.34.0",
     "expo": "51.0.22",
     "expo-dev-client": "4.0.20",
     "expo-updates": "0.25.21",
-    "domain-objects": "0.34.0",
     "type-fns": "1.21.4"
   },
   "author": "ahbode",
@@ -264,8 +275,10 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
   "pnpm": {
     "overrides": {
       "@commitlint/format": "19.9.9",
-      "type-fns": "1.9.9"
-    }
+      "type-fns": "1.21.4"
+    },
+    "allowUnusedPatches": true,
+    "ignorePatchFailures": true
   }
 }
 "

package/dist/practices/cicd-app-react-native-expo/__snapshots__/package.json.declapract.integration.test.ts.snap

@@ -0,0 +1,19 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`cicd-app-react-native-expo package.json — access + proxy clamps given: [case1] the shipped start commands when: [t2] the start commands are snapshotted for review then: the start:* commands match snapshot: start:* commands 1`] = `
+{
+  "start:cold:prep": "ACCESS=prep npm run build:web && npx serve dist --single",
+  "start:cold:prep:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prep}:@declapract{variable.app.web.port.cold}'",
+  "start:cold:prep:proxy": "npm run start:cold:prep:link && npm run start:cold:proxy",
+  "start:cold:prod": "ACCESS=prod npm run build:web && npx serve dist --single",
+  "start:cold:prod:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prod}:@declapract{variable.app.web.port.cold}'",
+  "start:cold:proxy": "wait-on tcp:3000 && npx local-ssl-proxy --source 3449 --target 3000",
+  "start:hot:prep": "ACCESS=prep expo start --clear --dev-client",
+  "start:hot:prep:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prep}:@declapract{variable.app.web.port.hot}'",
+  "start:hot:prep:proxy": "npm run start:hot:prep:link && npm run start:hot:proxy",
+  "start:hot:prod": "ACCESS=prod expo start --clear --dev-client",
+  "start:hot:prod:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prod}:@declapract{variable.app.web.port.hot}'",
+  "start:hot:prod:proxy": "npm run start:hot:prod:link && npm run start:hot:proxy",
+  "start:hot:proxy": "wait-on tcp:8081 && npx local-ssl-proxy --source 3447 --target 8081",
+}
+`;

package/dist/practices/cicd-app-react-native-expo/__snapshots__/provision.yml.declapract.integration.test.ts.snap

@@ -0,0 +1,76 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`expo provision.yml — merge-by-job, end to end (#608) given: [case4] an expo repo with a provision.yml that holds a terraform github job and an aws job when: [t0] declapract apply then: before + after match snapshot: provision.yml — after merge 1`] = `
+"name: provision
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - "main"
+      - "master"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.ref }} # per [workflow] x [branch, tag]
+  cancel-in-progress: true #  cancel workflows for non-latest commits
+
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
+jobs:
+  # the pre-migration github job: terraform over the provision/github/ dir the migration deletes
+  github:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/github.repo/resources.ts
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply
+      creds-github-app-owner: \${{ github.repository_owner }}
+      creds-github-app-id: \${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
+    secrets:
+      creds-github-app-private-key: \${{ secrets.DECLASTRUCT_GITHUB_CONFORMER_APP_PRIVATE_KEY }}
+
+  # the repo's own aws job, which the practice never declares
+  aws:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prod
+"
+`;
+
+exports[`expo provision.yml — merge-by-job, end to end (#608) given: [case4] an expo repo with a provision.yml that holds a terraform github job and an aws job when: [t0] declapract apply then: before + after match snapshot: provision.yml — before 1`] = `
+"name: provision
+
+on:
+  push:
+    branches:
+      - "main"
+  pull_request:
+
+jobs:
+  # the pre-migration github job: terraform over the provision/github/ dir the migration deletes
+  github:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/github/product
+      github-environment: prod
+
+  # a second terraform job on the deleted dir, under another name
+  github-environment:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/github/environment
+
+  # the repo's own aws job, which the practice never declares
+  aws:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prod
+"
+`;

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/.deploy-expo.yml

@@ -13,7 +13,7 @@ on:
         required: true
       github-environment:
         type: string
-        description: "github environment for the deploy jobs"
+        description: "the github environment for the deploy jobs; always declared, and one of the environments that provision/github.repo/resources.ts declares, e.g. preparation or production-on-main"
         required: true
       creds-aws-region:
         type: string
@@ -33,8 +33,8 @@ on:
         required: true
         description: required credentials to authenticate with expo eas
 
+# .why = least privilege: only the jobs that assume the aws role grant id-token, at job scope
 permissions:
-  id-token: write # required for oidc
   contents: read
 
 jobs:
@@ -50,6 +50,9 @@ jobs:
           - android
     name: ${{ matrix.platform }}
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # required for oidc
     environment:
       # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so no
       # "deployed to <env>" status accretes on the PR timeline. the environment is ALWAYS
@@ -94,6 +97,9 @@ jobs:
   deploy-web:
     name: web
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # required for oidc
     environment:
       # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so no
       # "deployed to <env>" status accretes on the PR timeline. the environment is ALWAYS
@@ -132,6 +138,8 @@ jobs:
 
       - name: compile
         run: npm run build:web
+        env:
+          ACCESS: ${{ inputs.access }} # the bundle inlines the access it was built with; never a guess
 
       - name: deploy
-        run: aws s3 sync ./dist ${{ inputs.app-web-deployment-s3-bucket }} --delete --cache-control max-age=60,stale-while-revalidate=604800 # todo: fine tune the cache control; https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#stale-while-revalidate
+        run: aws s3 sync ./dist ${{ inputs.app-web-deployment-s3-bucket }} --delete --cache-control max-age=60,stale-while-revalidate=604800 # a deploy shows within 60s; stale-while-revalidate serves the prior build while it refreshes

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/provision.yml

@@ -0,0 +1,33 @@
+name: provision
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - "main"
+      - "master"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }} # per [workflow] x [branch, tag]
+  cancel-in-progress: true #  cancel workflows for non-latest commits
+
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
+jobs:
+  github:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/github.repo/resources.ts
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply
+      creds-github-app-owner: ${{ github.repository_owner }}
+      creds-github-app-id: ${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
+    secrets:
+      creds-github-app-private-key: ${{ secrets.DECLASTRUCT_GITHUB_CONFORMER_APP_PRIVATE_KEY }}

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/provision.yml.declapract.ts

@@ -0,0 +1,75 @@
+import type { FileCheckFunction, FileFixFunction } from 'declapract';
+import { MalfunctionError } from 'helpful-errors';
+
+import { asWorkflowMergedByJob } from '../../../../../utils/asWorkflowMergedByJob';
+import { getAllWorkflowJobDrifts } from '../../../../../utils/getAllWorkflowJobDrifts';
+
+/**
+ * .what = whether a found workflow job still points at the `provision/github/` terraform dir
+ * .why  = `provision-github`'s migration deletes that dir; a job that still reads it fails
+ *         `terraform validate` on every branch, so it is obsolete and must leave with the dir.
+ *         `provision/github.repo/` (the declastruct wish) is a distinct path and never matches.
+ */
+const isJobOnTerraformGithubDir = (input: { job: unknown }): boolean =>
+  JSON.stringify(input.job ?? null).includes('provision/github/');
+
+/**
+ * .what = the declared contents this check and fix read, or a loud failure where none arrived
+ * .why  = this declaration ships a template beside it, so an absent body is a pipeline
+ *         malfunction, never a consumer input
+ */
+const asDeclaredContents = (input: {
+  declaredFileContents: string | null;
+  relativeFilePath: string;
+}): string => {
+  if (input.declaredFileContents === null)
+    throw new MalfunctionError(
+      'the cicd-app-react-native-expo practice emitted no declared provision.yml',
+      {
+        practice: 'cicd-app-react-native-expo',
+        relativeFilePath: input.relativeFilePath,
+      },
+    );
+  return input.declaredFileContents;
+};
+
+/**
+ * .what = pass when the declared `github` job (and each declared top-level key) holds its
+ *         declared shape, and no job still points at the deleted `provision/github/` dir
+ * .why  = the expo usecase composes `provision-github`, whose migration deletes
+ *         `provision/github/**` and leaves no caller for its declastruct replacement (#608). an
+ *         EQUALS template would reach the expo repo and delete any other provision job it holds
+ *         (e.g. an aws job), so this declaration merges by job: the `github` job is the
+ *         practice's; every other job is the repo's, kept as found — except a job that still
+ *         reads the deleted terraform dir.
+ */
+export const check: FileCheckFunction = (contents, context) => {
+  if (!contents) throw new Error('provision.yml is absent');
+  const drift = getAllWorkflowJobDrifts({
+    found: contents,
+    declared: asDeclaredContents(context),
+    dropJobWhen: isJobOnTerraformGithubDir,
+  });
+  if (drift.length > 0)
+    throw new Error(
+      `provision.yml drifts from its declaration:\n- ${drift.join('\n- ')}`,
+    );
+};
+
+/**
+ * .what = create the file where absent; else replace the `github` job, drop each job on the
+ *         deleted terraform dir, and keep every other job as it stands
+ * .why  = see `check`. the merge returns the found text untouched where no drift remains, so a
+ *         second apply changes zero bytes.
+ */
+export const fix: FileFixFunction = (contents, context) => {
+  const declared = asDeclaredContents(context);
+  if (!contents) return { contents: declared };
+  return {
+    contents: asWorkflowMergedByJob({
+      found: contents,
+      declared,
+      dropJobWhen: isJobOnTerraformGithubDir,
+    }),
+  };
+};

package/dist/practices/cicd-app-react-native-expo/best-practice/package.json

@@ -4,19 +4,22 @@
     "expo-dev-client": "@declapract{check.minVersion('4.0.20')}",
     "expo-updates": "@declapract{check.minVersion('0.25.21')}"
   },
+  "devDependencies": {
+    "wait-on": "@declapract{check.minVersion('9.5.1')}"
+  },
   "scripts": {
-    "start:hot:proxy": "npx local-ssl-proxy --source 3447 --target 8081",
-    "start:hot:prep": "ACCESS=prep npx expo start --clear --dev-client",
+    "start:hot:proxy": "wait-on tcp:8081 && npx local-ssl-proxy --source 3447 --target 8081",
+    "start:hot:prep": "ACCESS=prep expo start --clear --dev-client",
     "start:hot:prep:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prep}:@declapract{variable.app.web.port.hot}'",
     "start:hot:prep:proxy": "npm run start:hot:prep:link && npm run start:hot:proxy",
-    "start:hot:prod": "ACCESS=prod npx expo start --clear --dev-client",
+    "start:hot:prod": "ACCESS=prod expo start --clear --dev-client",
     "start:hot:prod:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prod}:@declapract{variable.app.web.port.hot}'",
     "start:hot:prod:proxy": "npm run start:hot:prod:link && npm run start:hot:proxy",
-    "start:cold:proxy": "npx local-ssl-proxy --source 3449 --target 3000",
-    "start:cold:prep": "npm run build:web && npx serve dist --single",
+    "start:cold:proxy": "wait-on tcp:3000 && npx local-ssl-proxy --source 3449 --target 3000",
+    "start:cold:prep": "ACCESS=prep npm run build:web && npx serve dist --single",
     "start:cold:prep:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prep}:@declapract{variable.app.web.port.cold}'",
-    "start:cold:prep:proxy": "echo npm run start:cold:prep:link && npm run start:cold:proxy",
-    "start:cold:prod": "npm run build:web && npx serve dist --single",
+    "start:cold:prep:proxy": "npm run start:cold:prep:link && npm run start:cold:proxy",
+    "start:cold:prod": "ACCESS=prod npm run build:web && npx serve dist --single",
     "start:cold:prod:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prod}:@declapract{variable.app.web.port.cold}'",
     "register:device:apple:info": "echo 'learn more here https://docs.expo.dev/build/internal-distribution/'",
     "register:device:apple:inclusions:rebuild:prod": "npx eas build --platform ios --clear-cache",