declapract-typescript-ehmpathy 0.49.5 → 0.49.8

package/dist/practices/cache/.declapract.integration.test.ts

@@ -20,7 +20,7 @@ describe('cache practice with ifInstalled', () => {
       slug: 'cache-not-installed',
       clone: './src/practices/cache/.test/assets/repo-without-cache-package',
       symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
+        { at: 'declarations', to: './test/assets/cache/declarations' },
         { at: 'node_modules', to: 'node_modules' },
       ],
     });
@@ -53,7 +53,7 @@ describe('cache practice with ifInstalled', () => {
       slug: 'cache-outdated',
       clone: './src/practices/cache/.test/assets/repo-with-old-cache-package',
       symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
+        { at: 'declarations', to: './test/assets/cache/declarations' },
         { at: 'node_modules', to: 'node_modules' },
       ],
     });
@@ -82,7 +82,7 @@ describe('cache practice with ifInstalled', () => {
       slug: 'cache-valid',
       clone: './src/practices/cache/.test/assets/repo-with-valid-cache-package',
       symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
+        { at: 'declarations', to: './test/assets/cache/declarations' },
         { at: 'node_modules', to: 'node_modules' },
       ],
     });

package/dist/practices/cache/best-practice/package.json

@@ -1,7 +1,7 @@
 {
   "dependencies": {
     "simple-in-memory-cache": "@declapract{check.minVersion('0.4.3').ifInstalled()}",
-    "simple-on-disk-cache": "@declapract{check.minVersion('1.7.10').ifInstalled()}",
+    "simple-on-disk-cache": "@declapract{check.minVersion('1.7.11').ifInstalled()}",
     "with-simple-cache": "@declapract{check.minVersion('0.16.2').ifInstalled()}"
   }
 }

package/dist/practices/cicd-common/best-practice/.github/workflows/.declastruct.yml

@@ -1,14 +1,35 @@
 name: .declastruct
 
+# .what = reusable declastruct plan/apply for a wish, against either a github-app or an
+#   aws-oidc backend. one workflow, two auth models — each auth step fires only when its
+#   creds are supplied.
+# .why = declastruct wishes share the plan->artifact->apply shape regardless of backend;
+#   only the auth differs. github-provider wishes auth via a github-app token; aws-provider
+#   wishes auth via oidc role assumption (with a plan/apply role split — plan readonly, apply
+#   writer) + the ACCESS envar (read by the wish via sdk-environment). the plan is uploaded as
+#   an artifact so apply executes the EXACT plan reviewers saw.
+
 on:
   workflow_call:
     inputs:
       wish-path:
         type: string
         description: "the path to the wish declaration"
-      github-environment:
+        required: true
+      scope:
+        type: string
+        description: "the provider backend this wish targets (github | aws); scopes the plan artifact name"
+        required: true
+      access:
+        type: string
+        description: "the access tier this wish targets (test | prep | prod); read by the wish via sdk-environment as the ACCESS envar (aws wishes), and scopes the plan artifact name so parallel calls do not collide"
+        required: true
+      github-environment-plan:
+        type: string
+        description: "github environment for the plan job (empty = no env gate)"
+      github-environment-apply:
         type: string
-        description: "the github environment that the apply step will be executed in"
+        description: "github environment for the apply job (empty = no env gate)"
       allow-apply:
         type: boolean
         description: "whether the apply step is enabled. defaults to true on main"
@@ -16,24 +37,42 @@ on:
       creds-github-app-owner:
         type: string
         required: false
-        description: "the owner of the github app to generate a token for"
+        description: "github-app wishes: the owner of the github app to generate a token for"
       creds-github-app-id:
         type: string
         required: false
-        description: "the id of the github app to generate a token for"
+        description: "github-app wishes: the id of the github app to generate a token for"
+      creds-aws-region:
+        type: string
+        required: false
+        description: "aws wishes: the aws region for oidc auth"
+      creds-aws-role-arn-plan:
+        type: string
+        required: false
+        description: "aws wishes: oidc role arn for the plan job (readonly — DescribeParameters, no kms:Decrypt)"
+      creds-aws-role-arn-apply:
+        type: string
+        required: false
+        description: "aws wishes: oidc role arn for the apply job (writer — PutParameter, kms:Encrypt)"
     secrets:
       creds-github-app-private-key:
         required: false
-        description: the private key of the github app to generate a token for
+        description: "github-app wishes: the private key of the github app to generate a token for"
+
+permissions:
+  id-token: write # required for aws oidc (unused by github-app wishes)
+  contents: read
 
 jobs:
-  # install the dependencies
   install:
     uses: ./.github/workflows/.install.yml
 
   plan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-plan }}
     needs: [install]
+    env:
+      ACCESS: ${{ inputs.access }} # aws wishes: sdk-environment getEnvironment reads ACCESS
     outputs:
       has-changes-planned: ${{ steps.evaluate-plan.outputs.has-changes-planned }}
     steps:
@@ -50,6 +89,7 @@ jobs:
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
+          fail-on-cache-miss: true
 
       - name: get github auth, if creds supplied
         if: ${{ inputs.creds-github-app-id }}
@@ -61,6 +101,13 @@ jobs:
           app-id: ${{ inputs.creds-github-app-id }}
           private-key: ${{ secrets.creds-github-app-private-key }}
 
+      - name: get aws auth, if creds supplied
+        if: ${{ inputs.creds-aws-role-arn-plan }}
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ inputs.creds-aws-role-arn-plan }}
+          aws-region: ${{ inputs.creds-aws-region }}
+
       - name: declastruct plan
         id: plan
         run: |
@@ -72,8 +119,8 @@ jobs:
       - name: evaluate plan
         id: evaluate-plan
         run: |
-          # check whether it said there were required changes
-          if grep "Everything is in sync" ./plan.log
+          # declastruct prints this exact phrase when there is no diff
+          if grep "in sync" ./plan.log
           then
             echo "has-changes-planned=false" >> "$GITHUB_OUTPUT"
           else
@@ -87,17 +134,19 @@ jobs:
         if: ${{ inputs.allow-apply == true && steps.evaluate-plan.outputs.has-changes-planned == 'true' }}
         uses: actions/upload-artifact@v4
         with:
-          name: declastruct-plan
+          name: declastruct-${{ inputs.scope }}-${{ inputs.access }}-plan
           path: |
             ${{ inputs.wish-path }}.plan.json
           retention-days: 1
           include-hidden-files: false
 
   apply:
-    runs-on: ubuntu-latest
-    environment: ${{ inputs.github-environment }}
+    runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-apply }}
     needs: [install, plan]
     if: ${{ inputs.allow-apply == true && needs.plan.outputs.has-changes-planned == 'true' }}
+    env:
+      ACCESS: ${{ inputs.access }} # aws wishes: sdk-environment getEnvironment reads ACCESS
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -112,6 +161,7 @@ jobs:
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
+          fail-on-cache-miss: true
 
       - name: extract directory from wish-path
         id: extract-dir
@@ -120,7 +170,7 @@ jobs:
       - name: download plan artifact
         uses: actions/download-artifact@v4
         with:
-          name: declastruct-plan
+          name: declastruct-${{ inputs.scope }}-${{ inputs.access }}-plan
           path: ${{ steps.extract-dir.outputs.wish-dir }}
 
       - name: get github auth, if creds supplied
@@ -133,6 +183,13 @@ jobs:
           app-id: ${{ inputs.creds-github-app-id }}
           private-key: ${{ secrets.creds-github-app-private-key }}
 
+      - name: get aws auth, if creds supplied
+        if: ${{ inputs.creds-aws-role-arn-apply }}
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
+          aws-region: ${{ inputs.creds-aws-region }}
+
       - name: declastruct apply
         run: |
           set -o pipefail

package/dist/practices/cicd-package/best-practice/.github/workflows/.publish-npm.yml

@@ -48,8 +48,8 @@ jobs:
           NPM_VERSION=$(npm --version)
           MIN_VERSION="11.5.1"
           if [ "$(printf '%s\n' "$MIN_VERSION" "$NPM_VERSION" | sort -V | head -n1)" != "$MIN_VERSION" ]; then
-            echo "npm $NPM_VERSION < $MIN_VERSION, will upgrade npm now to support oidc..."
-            npm install -g npm@latest
+            echo "npm $NPM_VERSION < $MIN_VERSION, will upgrade npm to the latest 11.x for oidc..."
+            npm install -g npm@11
           else
             echo "npm $NPM_VERSION >= $MIN_VERSION, ready to use!"
           fi

package/dist/practices/cicd-package/best-practice/.github/workflows/provision.yml

@@ -19,7 +19,9 @@ jobs:
     uses: ./.github/workflows/.declastruct.yml
     with:
       wish-path: provision/github.repo/resources.ts
-      github-environment: prod
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-apply: prod
       creds-github-app-owner: ${{ github.repository_owner }}
       creds-github-app-id: ${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
     secrets:

package/dist/practices/cicd-service/best-practice/.github/workflows/.deploy-sls.yml

@@ -7,16 +7,15 @@ on:
         type: string
         description: "the stage to deploy to"
         required: true
-      github-environment:
+      github-environment-apply:
         type: string
-        description: "the github environment that the apply step will be executed in"
-        required: true
+        description: "github environment for the deploy jobs (prod only; omit for prep — its oidc role is repo-scoped, no env claim)"
       creds-aws-region:
         description: "creds for aws, specifies the region"
         required: true
         type: string
-      creds-aws-role-arn:
-        description: "creds for aws, specifies the role to assume via oidc"
+      creds-aws-role-arn-apply:
+        description: "oidc role arn for the deploy jobs"
         required: true
         type: string
       needs-vpn-for-acceptance:
@@ -39,6 +38,7 @@ jobs:
 
   deploy:
     runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-apply }}
     needs: [install]
     steps:
       - name: checkout
@@ -52,7 +52,7 @@ jobs:
       - name: configure aws credentials (oidc)
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: node-modules cache get
@@ -67,6 +67,7 @@ jobs:
 
   assure:
     runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-apply }}
     needs: [install, deploy]
     steps:
       - name: checkout
@@ -80,7 +81,7 @@ jobs:
       - name: configure aws credentials (oidc)
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: node-modules cache get
@@ -90,14 +91,14 @@ jobs:
           key: ${{ needs.install.outputs.node-modules-cache-key }}
           fail-on-cache-miss: true
 
-      # .why = keyrack.yml can extend other manifests via symlinks (e.g., .agent/repo=ehmpathy/role=mechanic/keyrack.yml)
-      #        prepare:rhachet creates these symlinks so keyrack.source() can hydrate extended keys
+      # register the ghlitch operator role so `rhx use.vpc.tunnel` resolves
       - name: prepare:rhachet
+        if: inputs.needs-vpn-for-acceptance
         run: npm run prepare:rhachet --if-present
 
       - name: vpc:tunnel:open
         if: inputs.needs-vpn-for-acceptance
-        run: ACCESS=${{ inputs.stage }} .agent/repo=.this/skills/use.vpc.tunnel.ts
+        run: npx rhx use.vpc.tunnel --env ${{ inputs.stage }}
 
       - name: test:acceptance
         run: ACCESS=${{ inputs.stage }} npm run test:acceptance
@@ -113,6 +114,7 @@ jobs:
 
   prune:
     runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-apply }}
     needs: [install, deploy]
     steps:
       - name: checkout
@@ -126,7 +128,7 @@ jobs:
       - name: configure aws credentials (oidc)
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: node-modules cache get

package/dist/practices/cicd-service/best-practice/.github/workflows/.sql-schema-control.yml

@@ -7,9 +7,12 @@ on:
         type: string
         description: "the stage to execute against"
         required: true
-      github-environment:
+      github-environment-plan:
         type: string
-        description: "the github environment that the apply step will be executed in"
+        description: "github environment for the plan job (prod only; omit for prep — its oidc role is repo-scoped, no env claim)"
+      github-environment-apply:
+        type: string
+        description: "github environment for the apply job (prod only; omit for prep)"
       allow-apply:
         type: boolean
         description: "whether the apply step is enabled. defaults to true on main"
@@ -18,9 +21,13 @@ on:
         type: string
         description: creds for aws, specifies the region
         required: true
-      creds-aws-role-arn:
+      creds-aws-role-arn-plan:
+        type: string
+        description: "oidc role arn for the plan job (readonly)"
+        required: true
+      creds-aws-role-arn-apply:
         type: string
-        description: creds for aws, specifies the role to assume via oidc
+        description: "oidc role arn for the apply job"
         required: true
 
 permissions:
@@ -33,7 +40,13 @@ jobs:
 
   plan:
     runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-plan }}
     needs: [install]
+    # opt into the readonly plan grant for every step in this job (tunnel + plan
+    # both call getConfig): under plan the oidc role can read only the for-plan
+    # db credential, so config must select it and tolerate the denied secrets.
+    env:
+      GRANT: plan
     outputs:
       has-changes-planned: ${{ steps.evaluate-plan.outputs.has-changes-planned }}
     steps:
@@ -53,17 +66,23 @@ jobs:
           fail-on-cache-miss: true
 
       - name: get aws auth
-        if: ${{ inputs.creds-aws-role-arn }}
+        if: ${{ inputs.creds-aws-role-arn-plan }}
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          role-to-assume: ${{ inputs.creds-aws-role-arn-plan }}
           aws-region: ${{ inputs.creds-aws-region }}
 
+      # register the ghlitch operator role so `rhx use.vpc.tunnel` resolves
+      - name: prepare:rhachet
+        run: npm run prepare:rhachet --if-present
+
       - name: vpc:tunnel:open
-        run: ACCESS=${{ inputs.stage }} .agent/repo=.this/skills/use.vpc.tunnel.ts
+        run: npx rhx use.vpc.tunnel --env ${{ inputs.stage }}
 
       - name: plan
-        run: ACCESS=${{ inputs.stage }} npm run provision:schema:plan | tee ./plan.log
+        run: |
+          set -o pipefail
+          ACCESS=${{ inputs.stage }} npm run provision:schema:plan | tee ./plan.log
 
       - name: evaluate plan
         id: evaluate-plan
@@ -88,7 +107,7 @@ jobs:
 
   apply:
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.github-environment }}
+    environment: ${{ inputs.github-environment-apply }}
     needs: [install, plan]
     if: ${{ inputs.allow-apply == true && needs.plan.outputs.has-changes-planned == 'true' }}
     steps:
@@ -108,14 +127,18 @@ jobs:
           fail-on-cache-miss: true
 
       - name: get aws auth
-        if: ${{ inputs.creds-aws-role-arn }}
+        if: ${{ inputs.creds-aws-role-arn-apply }}
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
+      # register the ghlitch operator role so `rhx use.vpc.tunnel` resolves
+      - name: prepare:rhachet
+        run: npm run prepare:rhachet --if-present
+
       - name: vpc:tunnel:open
-        run: ACCESS=${{ inputs.stage }} .agent/repo=.this/skills/use.vpc.tunnel.ts
+        run: npx rhx use.vpc.tunnel --env ${{ inputs.stage }}
 
       - name: apply
         run: ACCESS=${{ inputs.stage }} npm run provision:schema:apply

package/dist/practices/cicd-service/best-practice/.github/workflows/.terraform.yml

@@ -6,9 +6,12 @@ on:
       working-directory:
         type: string
         description: "the directory from within which to execute terraform commands"
-      github-environment:
+      github-environment-plan:
         type: string
-        description: "the github environment that the apply step will be executed in"
+        description: "github environment for the plan job (prod only; omit for prep — its oidc role is repo-scoped, no env claim)"
+      github-environment-apply:
+        type: string
+        description: "github environment for the apply job (prod only; omit for prep)"
       allow-apply:
         type: boolean
         description: "whether the apply step is enabled. defaults to true on main"
@@ -17,8 +20,12 @@ on:
         description: "creds for aws, specifies the region"
         required: true
         type: string
-      creds-aws-role-arn:
-        description: "creds for aws, specifies the role to assume via oidc"
+      creds-aws-role-arn-plan:
+        description: "oidc role arn for the plan job (readonly)"
+        required: true
+        type: string
+      creds-aws-role-arn-apply:
+        description: "oidc role arn for the apply job"
         required: true
         type: string
 
@@ -29,6 +36,7 @@ permissions:
 jobs:
   plan:
     runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-plan }}
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
@@ -39,10 +47,10 @@ jobs:
         uses: actions/checkout@v4
 
       - name: get aws auth
-        if: ${{ inputs.creds-aws-role-arn }}
+        if: ${{ inputs.creds-aws-role-arn-plan }}
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          role-to-assume: ${{ inputs.creds-aws-role-arn-plan }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: setup terraform
@@ -73,7 +81,7 @@ jobs:
 
   apply:
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.github-environment }}
+    environment: ${{ inputs.github-environment-apply }}
     needs: plan
     if: ${{ inputs.allow-apply == true && needs.plan.outputs.has-changes-planned == 'true' }}
     defaults:
@@ -84,10 +92,10 @@ jobs:
         uses: actions/checkout@v4
 
       - name: get aws auth
-        if: ${{ inputs.creds-aws-role-arn }}
+        if: ${{ inputs.creds-aws-role-arn-apply }}
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: setup terraform

package/dist/practices/cicd-service/best-practice/.github/workflows/deploy.yml

@@ -13,10 +13,10 @@ on:
         description: "which stage do you want to deploy to?"
         type: choice
         options:
-          - dev
+          - prep
           - prod
         required: true
-        default: "dev"
+        default: "prep"
       thoroughly:
         description: "should we run tests before this deployment?"
         type: choice
@@ -43,17 +43,18 @@ jobs:
       creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
     secrets: inherit # keyrack firewall in .test.yml filters to declared keys
 
-  dev:
+  prep:
     uses: ./.github/workflows/.deploy-sls.yml
     needs: [test]
     if: |
-      ((github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch') || github.event.inputs.stage == 'dev') &&
+      ((github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch') || github.event.inputs.stage == 'prep') &&
       always() && (needs.test.result == 'success' || needs.test.result == 'skipped')
+    # prep omits github-environment: the ahbode-prep-oidc role trusts any branch
+    # (repo-scoped sub), so no env claim is needed — only prod gates on environment.
     with:
-      stage: dev
-      github-environment: prep # github environment stays as prep (where secrets/vars live)
+      stage: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
 
   prod:
     uses: ./.github/workflows/.deploy-sls.yml
@@ -63,6 +64,6 @@ jobs:
     needs: [test]
     with:
       stage: prod
-      github-environment: prod
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}

package/dist/practices/cicd-service/best-practice/.github/workflows/provision.yml

@@ -15,36 +15,42 @@ concurrency:
   cancel-in-progress: true #  cancel workflows for non-latest commits
 
 jobs:
-  aws-test:
+  aws-test-terraform:
     uses: ./.github/workflows/.terraform.yml
+    # prep omits github-environment: the ahbode-prep-oidc role trusts any branch
+    # (repo-scoped sub), so no env claim is needed — only prod gates on environment.
     with:
       working-directory: provision/aws/environments/test
-      github-environment: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
 
-  aws-prep:
+  aws-prep-terraform:
     uses: ./.github/workflows/.terraform.yml
     with:
       working-directory: provision/aws/environments/prep
-      github-environment: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
 
-  aws-prod:
+  aws-prod-terraform:
     uses: ./.github/workflows/.terraform.yml
     with:
       working-directory: provision/aws/environments/prod
-      github-environment: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
       allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
 
   github:
     uses: ./.github/workflows/.declastruct.yml
     with:
       wish-path: provision/github.repo/resources.ts
-      github-environment: prod
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-apply: prod
       creds-github-app-owner: ${{ github.repository_owner }}
       creds-github-app-id: ${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
     secrets:
@@ -52,17 +58,44 @@ jobs:
 
   sql-schema-prep:
     uses: ./.github/workflows/.sql-schema-control.yml
+    # prep omits github-environment (repo-scoped oidc role, any branch, no env claim)
     with:
       stage: prep
-      github-environment: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
 
   sql-schema-prod:
     uses: ./.github/workflows/.sql-schema-control.yml
     with:
       stage: prod
-      github-environment: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
       allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  aws-prep-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    # prep omits github-environment (repo-scoped oidc role, any branch, no env claim)
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prep
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
+      allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}

package/dist/practices/cicd-service/best-practice/package.json

@@ -1,7 +1,7 @@
 {
   "devDependencies": {
     "declastruct": "@declapract{check.minVersion('1.9.1')}",
-    "declastruct-aws": "@declapract{check.minVersion('1.5.0')}",
+    "declastruct-aws": "@declapract{check.minVersion('1.9.0')}",
     "declastruct-unix-network": "@declapract{check.minVersion('1.0.5')}"
   }
 }

package/dist/practices/config/best-practice/package.json

@@ -1,5 +1,6 @@
 {
   "dependencies": {
+    "sdk-aws-s3": "@declapract{check.minVersion('0.1.1')}",
     "sdk-config": "@declapract{check.minVersion('0.1.1')}",
     "zod": "@declapract{check.minVersion('4.0.0')}"
   }