test(dynamodb): prove protect-dynamodb 6.0.1 items read and query under Stack 1.x

.github/workflows/tests.yml

@@ -407,8 +407,9 @@ jobs:
       CS_CLIENT_ID: ${{ vars.CS_CLIENT_ID }}
       CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
       CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
-      CS_ZEROKMS_HOST: https://ap-southeast-2.aws.zerokms.cipherstashmanaged.net
-      CS_CTS_HOST: https://ap-southeast-2.aws.cts.cipherstashmanaged.net
+      # No CS_ZEROKMS_HOST / CS_CTS_HOST: current clients derive both from the
+      # CRN, and a pinned region points the shared credentials at the wrong
+      # deployment (see integration-protect-ffi.yml).
 
     steps:
       - name: Checkout Repo
@@ -444,15 +445,13 @@ jobs:
           client-key: ${{ secrets.CS_CLIENT_KEY }}
           client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
 
-      # `e2e/vitest.config.ts` includes `tests/**/*.e2e.test.ts` and the step
-      # below applies no file filter, so this job runs
-      # `tests/prisma-example-readme.e2e.test.ts` — whose
-      # `describe.skipIf(!authConfigured)` un-skips the moment CS_CLIENT_ID and
-      # CS_CLIENT_KEY are set, which the job env above does. That walkthrough's
-      # `pnpm start` step encrypts against the live service through
-      # `@cipherstash/stack`, so it needs `index.node`; turbo's `^build` only
-      # gets as far as protect-ffi's `build` (tsc → `lib/`), which is the half
-      # that does not encrypt anything.
+      # The protect-dynamodb compatibility step at the end of this job
+      # encrypts against the live service through `@cipherstash/stack`, so it
+      # needs `index.node`; turbo's `^build` only gets as far as protect-ffi's
+      # `build` (tsc → `lib/`), which is the half that does not encrypt
+      # anything. (`tests/prisma-example-readme.e2e.test.ts` would need it too,
+      # but under turbo's strict env mode the job-level CS_* never reach it,
+      # so it skips.)
       #
       # After the pre-flight above, per
       # scripts/__tests__/ffi-binding-step-order.test.mjs. No `wasm: true` —
@@ -471,6 +470,16 @@ jobs:
       - name: Run E2E tests
         run: pnpm exec turbo run test:e2e --filter @cipherstash/e2e
 
+      # The step above runs under turbo's strict env mode, which filters out
+      # every env var `turbo.json` does not declare, so the job-level CS_*
+      # never reach vitest there and auth-gated suites skip. The
+      # protect-dynamodb compatibility suite proves a migration claim made to
+      # customers, so the default e2e config leaves it out and it runs here
+      # with `--env-mode=loose`, which lets the credentials through. It fails
+      # rather than skips if they are missing.
+      - name: Run the protect-dynamodb compatibility suite
+        run: pnpm exec turbo run test:protect-compat --filter @cipherstash/e2e --env-mode=loose
+
   # Verifies @cipherstash/stack/wasm-inline works under Deno — i.e. the
   # WASM build of protect-ffi 0.26+ and auth 0.40+ can round-trip an
   # encryption against ZeroKMS / CTS in a runtime with no native

e2e/package.json

@@ -6,15 +6,20 @@
   "type": "module",
   "scripts": {
     "test:e2e": "vitest run",
+    "test:protect-compat": "vitest run --config vitest.protect-compat.config.ts",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "stash": "workspace:*",
     "@cipherstash/stack": "workspace:*",
-    "@cipherstash/wizard": "workspace:*"
+    "@cipherstash/wizard": "workspace:*",
+    "stash": "workspace:*"
   },
   "devDependencies": {
+    "@cipherstash/protect": "10.2.1",
+    "@cipherstash/protect-dynamodb": "6.0.1",
+    "@cipherstash/stack-0.19": "npm:@cipherstash/stack@0.19.0",
     "@types/semver": "7.8.0",
+    "dotenv": "17.4.2",
     "semver": "^7.8.0",
     "typescript": "catalog:repo",
     "vitest": "catalog:repo",