declapract-typescript-ehmpathy 0.49.10 → 0.49.12

package/dist/practices/package-json-order/best-practice/package.json.declapract.ts

@@ -1,5 +1,6 @@
 import type { FileCheckFunction, FileFixFunction } from 'declapract';
 import expect from 'expect';
+import { ConstraintError } from 'helpful-errors';
 
 /**
  * define the relative key order of keys we care about
@@ -80,6 +81,8 @@ export const desiredRelativeKeyOrder = {
     'prepare:rhachet',
     'prepare',
     'deploy:prune',
+    'deploy:release:ancient',
+    'deploy:release:contemp',
     'deploy:release',
     'deploy:send-notification',
     'deploy:prep',
@@ -212,7 +215,10 @@ const sortPackageJSONObjectKeys = (packageJSONObject: Record<string, any>) => {
 
 // define fix and check
 export const check: FileCheckFunction = (contents) => {
-  if (!contents) throw new Error('file not defined');
+  if (!contents)
+    throw new ConstraintError(
+      'package.json not defined; the repo must carry a package.json for key-order to apply',
+    );
   const packageJSONObject = JSON.parse(contents);
   const sortedPackageJSONObject = sortPackageJSONObjectKeys(packageJSONObject);
   expect(JSON.stringify(packageJSONObject, null, 2)).toEqual(

package/dist/practices/persist-with-dynamodb/.declapract.integration.test.ts

@@ -0,0 +1,92 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useThen, when } from 'test-fns';
+
+/**
+ * .what = end-to-end proof that the `jest.integration.env.ts` declaration REPAIRS a divergent
+ *         consumer file back to the canonical template, run through the REAL declapract apply
+ *         pipeline against a genTempDir clone of a consumer repo (D39 clamp).
+ * .why  = the declaration was a bare `CONTAINS` with no `fix`, so a whole-env-file divergence was
+ *         invisible to the check AND unclosable by any mechanism — a consumer's drift stood
+ *         forever. the fix REMOVED the `.declapract.ts` companion, so the file defaults to
+ *         `EQUALS`: a byte-exact check whose implicit fix OVERWRITES the consumer's file with the
+ *         template. this test is the clamp that a divergence is now both DETECTED and CLOSED.
+ * .note = the env file is snapshotted in full (before AND after) so a reviewer can eyeball the
+ *         exact end-state, per rule.require.declapract-integration-tests.
+ * .teeth = the divergent input carries port `9999` and drops the template's doc comment. a revert
+ *          to the deleted `CONTAINS` companion re-opens the divergence — the check would pass on
+ *          the drifted file (it still `CONTAINS` the assignment line) and no fix would fire, so
+ *          the after-state would keep `9999` and this assertion reddens.
+ */
+const BEST_PRACTICE_ENV = `${__dirname}/best-practice/jest.integration.env.ts`;
+
+describe('persist-with-dynamodb — jest.integration.env divergence repair (D39 clamp)', () => {
+  given('[case1] a repo with a divergent jest.integration.env.ts', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-dynamodb-jest-env',
+      clone: './src/practices/persist-with-dynamodb/.test/assets/demo-repo-with-divergent-jest-env',
+      symlink: [{ at: 'src', to: 'src' }],
+    });
+
+    const envPath = 'jest.integration.env.ts';
+    const read = (relativePath: string) =>
+      fs.readFile(path.join(tempDir, relativePath), 'utf-8');
+    const applyRepair = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.yml'),
+        practice: 'persist-with-dynamodb',
+        file: envPath,
+      });
+
+    when('[t0] the divergent input (before any fix)', () => {
+      then('the env input carries the drifted port and matches snapshot', async () => {
+        const before = await read(envPath);
+        expect(before).toContain('9999');
+        expect(before).toMatchSnapshot('jest.integration.env.ts — before');
+      });
+    });
+
+    when('[t1] the EQUALS repair is applied', () => {
+      useThen('repair the divergent env file', async () => applyRepair());
+
+      then(
+        'the consumer file now byte-equals the canonical template and matches snapshot',
+        async () => {
+          const after = await read(envPath);
+          const canonical = await fs.readFile(BEST_PRACTICE_ENV, 'utf-8');
+          // teeth: the drifted port is gone, the canonical endpoint + doc comment are restored
+          expect(after).not.toContain('9999');
+          expect(after).toContain('http://localhost:7337');
+          expect(after).toContain(
+            'specify that dynamodb should use the local dynamodb database',
+          );
+          // byte-for-byte: EQUALS repairs the WHOLE file, not just the assignment line
+          expect(after).toEqual(canonical);
+          // full content, for the reviewer's eye
+          expect(after).toMatchSnapshot('jest.integration.env.ts — after');
+        },
+      );
+    });
+
+    when('[t2] the repair is applied a second time (idempotency)', () => {
+      // capture the post-first-repair state, apply again, capture again — assert zero
+      // change. a byte-equal file must satisfy the EQUALS check, so a second apply fires
+      // no fix (per rule.require.idempotent-fixes).
+      const passes = useThen(
+        'a second repair over its own output',
+        async () => {
+          const before = await read(envPath); // post-first-repair (canonical)
+          await applyRepair(); // second apply
+          const after = await read(envPath);
+          return { before, after };
+        },
+      );
+
+      then('the second repair is a no-op', () => {
+        expect(passes.after).toEqual(passes.before);
+      });
+    });
+  });
+});

package/dist/practices/persist-with-dynamodb/.test/assets/demo-repo-with-divergent-jest-env/declapract.declare.yml

@@ -0,0 +1,4 @@
+declare:
+  examples: src/examples
+  practices: src/practices
+  use-cases: src/useCases.yml

package/dist/practices/persist-with-dynamodb/.test/assets/demo-repo-with-divergent-jest-env/declapract.use.yml

@@ -0,0 +1,2 @@
+declarations: './'
+useCase: lambda-service-with-dynamodb

package/dist/practices/persist-with-dynamodb/.test/assets/demo-repo-with-divergent-jest-env/jest.integration.env.ts

@@ -0,0 +1,4 @@
+import { access } from './src/utils/environment';
+
+if (access === 'test')
+  process.env.USE_CUSTOM_DYNAMODB_ENDPOINT = 'http://localhost:9999';

package/dist/practices/persist-with-dynamodb/.test/assets/demo-repo-with-divergent-jest-env/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/practices/persist-with-dynamodb/__snapshots__/.declapract.integration.test.ts.snap

@@ -0,0 +1,20 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-dynamodb — jest.integration.env divergence repair (D39 clamp) given: [case1] a repo with a divergent jest.integration.env.ts when: [t0] the divergent input (before any fix) then: the env input carries the drifted port and matches snapshot: jest.integration.env.ts — before 1`] = `
+"import { access } from './src/utils/environment';
+
+if (access === 'test')
+  process.env.USE_CUSTOM_DYNAMODB_ENDPOINT = 'http://localhost:9999';
+"
+`;
+
+exports[`persist-with-dynamodb — jest.integration.env divergence repair (D39 clamp) given: [case1] a repo with a divergent jest.integration.env.ts when: [t1] the EQUALS repair is applied then: the consumer file now byte-equals the canonical template and matches snapshot: jest.integration.env.ts — after 1`] = `
+"import { access } from './src/utils/environment';
+
+/**
+ * specify that dynamodb should use the local dynamodb database, under the test access
+ */
+if (access === 'test')
+  process.env.USE_CUSTOM_DYNAMODB_ENDPOINT = 'http://localhost:7337';
+"
+`;

package/dist/practices/persist-with-dynamodb/best-practice/jest.integration.env.ts

@@ -1,7 +1,7 @@
-import { stage } from './src/utils/environment';
+import { access } from './src/utils/environment';
 
 /**
- * specify that dynamodb should use the local dynamodb database, if running in test env
+ * specify that dynamodb should use the local dynamodb database, under the test access
  */
-if (stage === 'test')
+if (access === 'test')
   process.env.USE_CUSTOM_DYNAMODB_ENDPOINT = 'http://localhost:7337';

package/dist/practices/persist-with-dynamodb/best-practice/package.json

@@ -1,9 +1,9 @@
 {
   "dependencies": {
-    "simple-dynamodb-client": "@declapract{check.minVersion('0.10.0')}"
+    "simple-dynamodb-client": "@declapract{check.minVersion('0.10.4')}"
   },
   "devDependencies": {
-    "dynamodb-dao-generator": "@declapract{check.minVersion('1.0.7')}"
+    "dynamodb-dao-generator": "@declapract{check.minVersion('1.1.0')}"
   },
   "scripts": {
     "generate:dao:dynamodb": "npx dynamodb-dao-generator generate && npm run fix:format",

package/dist/practices/persist-with-rds/.declapract.integration.test.ts

@@ -0,0 +1,224 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useThen, when } from 'test-fns';
+
+/**
+ * .what = end-to-end proof of the persist-with-rds `old-dev-config-location` relocate +
+ *         tier-migrate, run through the REAL declapract apply pipeline against a genTempDir
+ *         clone of a consumer repo (the row-4 clamp, rds declarer).
+ * .why  = the config declarer has its own pipeline test; per
+ *         `rule.require.declapract-integration-tests` EACH declarer that relocates a file AND
+ *         transforms blocks owes its own end-to-end test — a unit test of the exported `fix`
+ *         never exercises the glob→file match or the `relativeFilePath` rewrite. the rds
+ *         declarer adds one transform the config twin lacks (`__CHANG3_ME__` → aws-param), so
+ *         it needs its own clamp rather than a claim that the config test covers it.
+ * .teeth = the input holds `"access": "dev"` (unambiguous → migrated to `prep`) plus four `.dev`
+ *          hosts the util runs on in a CONSUMER's real config — a `://` URL `https://auth.myapp.dev`,
+ *          a mid-dotted `bastion.dev.example.com`, a terminal `aws.ssmproxy.mydb.dev`, and a FOREIGN
+ *          public host `api.dev.paypal.com` (paypal's own label). a `.dev` label is axis-ambiguous
+ *          WHEREVER it sits, so per guard #3 EVERY host is preserved byte-for-byte — the after-state
+ *          proves all four survive, that none flips to `.prep`, and that NO `@declapract:review`
+ *          bytes ever enter the config. it also proves the rds-only `__CHANG3_ME__` → aws-param
+ *          transform (the one the config twin lacks) plus the relocation.
+ */
+describe('persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp)', () => {
+  given('[case1] an rds repo with a config/dev.json to migrate', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-persist-with-rds-old-dev-config-location',
+      clone: './src/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config',
+      symlink: [{ at: 'src', to: 'src' }],
+    });
+
+    const devPath = 'config/dev.json';
+    const prepPath = 'config/prep.json';
+    const read = (relativePath: string) =>
+      fs.readFile(path.join(tempDir, relativePath), 'utf-8');
+    const exists = async (relativePath: string): Promise<boolean> =>
+      fs
+        .access(path.join(tempDir, relativePath))
+        .then(() => true)
+        .catch(() => false);
+    const applyMigrate = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.yml'),
+        practice: 'persist-with-rds',
+        file: devPath,
+      });
+
+    when('[t0] the migration input (before any fix)', () => {
+      then('config/dev.json holds the dev tier + the placeholder + matches snapshot', async () => {
+        const before = await read(devPath);
+        expect(before).toContain('"access": "dev"');
+        expect(before).toContain('"__CHANG3_ME__"');
+        expect(before).toMatchSnapshot('config/dev.json — before');
+      });
+    });
+
+    when('[t1] the relocate + migrate fix is applied', () => {
+      useThen('migrate the dev config', async () => applyMigrate());
+
+      then(
+        'config/prep.json now holds the migrated content + config/dev.json is gone + matches snapshot',
+        async () => {
+          // the relocation landed: the new path exists, the old path is unlinked
+          expect(await exists(prepPath)).toBe(true);
+          expect(await exists(devPath)).toBe(false);
+
+          const after = await read(prepPath);
+          // the access itself is the one unambiguous token → migrated
+          expect(after).toContain('"access": "prep"');
+          expect(after).not.toContain('"access": "dev"');
+          // EVERY host survives byte-for-byte — a `.dev` label is axis-ambiguous WHEREVER it sits,
+          // so per guard #3 the util rewrites NO host at all.
+          expect(after).toContain('bastion.dev.example.com');
+          expect(after).toContain('aws.ssmproxy.mydb.dev');
+          expect(after).toContain('https://auth.myapp.dev');
+          // the FOREIGN public host is the decisive corruption case: teeth — the prior mid-dotted
+          // rewrite turned this into `api.prep.paypal.com`, a silent public-endpoint corruption.
+          expect(after).toContain('api.dev.paypal.com');
+          expect(after).not.toContain('api.prep.paypal.com');
+          // no host was flipped to `.prep`, so no wrong-tier value ever enters the config
+          expect(after).not.toContain('bastion.prep.example.com');
+          expect(after).not.toContain('aws.ssmproxy.mydb.prep');
+          // the migration never emits a value it cannot verify — no marker bytes in config
+          expect(after).not.toContain('@declapract:review');
+          // the rds-only placeholder → the aws-param reference (the transform the twin lacks)
+          expect(after).toContain('"$.at(aws::param)"');
+          expect(after).not.toContain('__CHANG3_ME__');
+          // full content, for the reviewer's eye
+          expect(after).toMatchSnapshot('config/prep.json — after');
+        },
+      );
+    });
+
+    when('[t2] the fix is applied a second time (idempotency)', () => {
+      // config/dev.json is gone after the first relocate, so the EXISTS check no longer
+      // fires and no fix runs — config/prep.json must be untouched (per
+      // rule.require.idempotent-fixes).
+      const passes = useThen(
+        'a second apply over the already-migrated repo',
+        async () => {
+          const before = await read(prepPath);
+          await applyMigrate();
+          const after = await read(prepPath);
+          return { before, after };
+        },
+      );
+
+      then('the second apply is a no-op', () => {
+        expect(passes.after).toEqual(passes.before);
+      });
+    });
+  });
+});
+
+/**
+ * .what = D55 clamp: `src/utils/config/getConfig.ts` has exactly ONE declarer — the `config`
+ *         practice (the real sdk-config impl). `persist-with-rds` ships NO second copy of that
+ *         path (the old `'placeholder' as any` typed lie).
+ * .why  = `lambda-service-with-rds` extends `lambda-service`, which always supplies `config`, so the
+ *         placeholder was dead weight whose correctness rested on alphabetical apply order
+ *         (`config` < `persist-with-rds`). two declarers of one path, one a typed lie, is a silent
+ *         hazard: a consumer converged to the real file only by accident of that order. one
+ *         declarer removes both the order dependency and the lie — the consumer receives config's
+ *         real getConfig at this exact path, so persist-with-rds's own import resolves.
+ * .teeth = re-add a getConfig.ts under persist-with-rds/best-practice → the sole-declarer assertion
+ *          reddens.
+ * .note = INTEGRATION by `rule.forbid.unit.remote-boundaries`: it reads the filesystem (the
+ *         practice trees). no credential, no network.
+ */
+describe('persist-with-rds — getConfig has a single declarer (D55 clamp)', () => {
+  const configGetConfig =
+    'src/practices/config/best-practice/src/utils/config/getConfig.ts';
+  const rdsGetConfig =
+    'src/practices/persist-with-rds/best-practice/src/utils/config/getConfig.ts';
+  const rdsDbConnection =
+    'src/practices/persist-with-rds/best-practice/src/utils/database/getOneDatabaseConnection.ts';
+  const exists = async (relativePath: string): Promise<boolean> =>
+    fs
+      .access(relativePath)
+      .then(() => true)
+      .catch(() => false);
+
+  given('[case1] the two practices that touch src/utils/config/getConfig.ts', () => {
+    when('[t0] the declarers of that path are read', () => {
+      then('the config practice is the sole declarer (real sdk-config impl)', async () => {
+        expect(await exists(configGetConfig)).toBe(true);
+        const real = await fs.readFile(configGetConfig, 'utf-8');
+        expect(real).toContain("from 'sdk-config'");
+        expect(real).not.toContain("'placeholder' as any");
+      });
+
+      then('persist-with-rds ships NO second copy (no typed-lie placeholder)', async () => {
+        // teeth: re-add a getConfig.ts under persist-with-rds/best-practice and this reddens
+        expect(await exists(rdsGetConfig)).toBe(false);
+      });
+
+      then('persist-with-rds imports getConfig from the config-supplied path', async () => {
+        // the consumer receives config's real getConfig at this exact path, so the import resolves
+        const dbConn = await fs.readFile(rdsDbConnection, 'utf-8');
+        expect(dbConn).toContain("from '../config/getConfig'");
+      });
+    });
+  });
+});
+
+/**
+ * .what = config.schema.ts clamp: this path has TWO declarers BY DESIGN — `config` (the base
+ *         shape, for a non-rds `lambda-service`) and `persist-with-rds` (the full shape with the
+ *         database block, for `lambda-service-with-rds`). persist-with-rds declares its full schema
+ *         as a PLAIN overwrite template (EQUALS), NOT a CONTAINS + regex-splice fix.
+ * .why  = a CONTAINS+splice `fix` for this path was dead code: its regex anchored on `});` before
+ *         `export type Config`, but config's base emits `} as const;` there, so on a fresh
+ *         `lambda-service-with-rds` consumer the fix no-oped and the check stayed permanently red —
+ *         no path to green via `declapract fix`. worse, its inline splice string was stale (flat
+ *         `role.cicd.{username,password}` vs the real `for-plan`/`for-apply` split). the later
+ *         declarer (persist-with-rds) shadows config's base for rds consumers, so removal of the
+ *         `.declapract.ts` makes its full `config.schema.ts` a plain EQUALS overwrite (declapract's
+ *         default with no companion) that always converges — rule.prefer.overwrite-over-mutate: do
+ *         not pair an overwrite template with a separate splice fix for the same path.
+ * .teeth = re-add a config.schema.ts.declapract.ts under persist-with-rds/best-practice → the
+ *          "no splice-fix declarer" assertion reddens; strip the `for-plan` split from
+ *          persist-with-rds's full schema → the "full schema declared" assertion reddens.
+ * .note = INTEGRATION by rule.forbid.unit.remote-boundaries: reads the filesystem (practice trees).
+ */
+describe('persist-with-rds — config.schema.ts is a plain overwrite, not a splice-fix (config.schema clamp)', () => {
+  const configSchema =
+    'src/practices/config/best-practice/src/utils/config/config.schema.ts';
+  const rdsSchema =
+    'src/practices/persist-with-rds/best-practice/src/utils/config/config.schema.ts';
+  const rdsSchemaFix =
+    'src/practices/persist-with-rds/best-practice/src/utils/config/config.schema.ts.declapract.ts';
+  const exists = async (relativePath: string): Promise<boolean> =>
+    fs
+      .access(relativePath)
+      .then(() => true)
+      .catch(() => false);
+
+  given('[case1] the two by-design declarers of src/utils/config/config.schema.ts', () => {
+    when('[t0] the declared files are read', () => {
+      then('config declares the BASE shape (no database block) for a non-rds service', async () => {
+        const base = await fs.readFile(configSchema, 'utf-8');
+        expect(base).toContain('const base = z.object(');
+        expect(base).not.toContain('database: z.object(');
+      });
+
+      then('persist-with-rds declares the FULL schema (database + for-plan/for-apply split)', async () => {
+        // teeth: strip the for-plan split from the full schema and this reddens
+        const full = await fs.readFile(rdsSchema, 'utf-8');
+        expect(full).toContain('database: z.object(');
+        expect(full).toContain("'for-plan': z.object(");
+        expect(full).toContain("'for-apply': z.object(");
+      });
+
+      then('persist-with-rds ships NO CONTAINS+splice fix for that path (dead regex gone)', async () => {
+        // teeth: re-add config.schema.ts.declapract.ts and this reddens. the paired full template
+        // is a plain EQUALS overwrite, so a fresh rds consumer converges via overwrite, never a
+        // splice that no-ops on config's `} as const;` base.
+        expect(await exists(rdsSchemaFix)).toBe(false);
+      });
+    });
+  });
+});

package/dist/practices/persist-with-rds/.extensions.sql.declapract.integration.test.ts

@@ -0,0 +1,38 @@
+import { readFile } from '../../utils/readFile';
+import { fix } from './best-practice/provision/schema/sql/init/.extensions.sql.declapract';
+
+describe('.extensions.sql fix', () => {
+  it('should be able to fix a file with custom extensions correctly', async () => {
+    const declaredFileContents = await readFile({
+      filePath: `${__dirname}/best-practice/provision/schema/sql/init/.extensions.sql`,
+    }); // grab the declared contents
+    const exampleFoundContents = `
+/**
+ NOTE: because db owner is not allowed to create extensions, these changes are applied manually
+
+  NOTE: for the integration test db, these are applied automatically upon spinning up the docker instance
+*/
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+CREATE EXTENSION IF NOT EXISTS "cube";
+CREATE EXTENSION IF NOT EXISTS "earthdistance";
+    `;
+    const { contents: fixedContents } = await fix(exampleFoundContents, {
+      declaredFileContents,
+    } as any);
+    expect(fixedContents).toContain('CREATE EXTENSION IF NOT EXISTS "cube";');
+    expect(fixedContents).toContain(
+      'CREATE EXTENSION IF NOT EXISTS "earthdistance";',
+    );
+    expect(fixedContents).toMatchSnapshot();
+  });
+  it('should be able to create a new file to fix case where file does not exist yet', async () => {
+    const declaredFileContents = await readFile({
+      filePath: `${__dirname}/best-practice/provision/schema/sql/init/.extensions.sql`,
+    }); // grab the declared contents
+    const { contents: fixedContents } = await fix(null, {
+      declaredFileContents,
+    } as any);
+    expect(fixedContents).toMatchSnapshot();
+  });
+});

package/dist/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/config/dev.json

@@ -0,0 +1,18 @@
+{
+  "organization": "test-org",
+  "project": "test-project",
+  "environment": {
+    "access": "dev"
+  },
+  "database": {
+    "host": "bastion.dev.example.com",
+    "tunnel": "aws.ssmproxy.mydb.dev",
+    "password": "__CHANG3_ME__"
+  },
+  "upstream": {
+    "paypal": "api.dev.paypal.com"
+  },
+  "auth": {
+    "callbackUrl": "https://auth.myapp.dev"
+  }
+}

package/dist/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/declapract.declare.yml

@@ -0,0 +1,4 @@
+declare:
+  examples: src/examples
+  practices: src/practices
+  use-cases: src/useCases.yml

package/dist/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/declapract.use.yml

@@ -0,0 +1,18 @@
+declarations: './'
+useCase: lambda-service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'

package/dist/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/practices/persist-with-rds/__snapshots__/.declapract.integration.test.ts.snap

@@ -0,0 +1,45 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp) given: [case1] an rds repo with a config/dev.json to migrate when: [t0] the migration input (before any fix) then: config/dev.json holds the dev tier + the placeholder + matches snapshot: config/dev.json — before 1`] = `
+"{
+  "organization": "test-org",
+  "project": "test-project",
+  "environment": {
+    "access": "dev"
+  },
+  "database": {
+    "host": "bastion.dev.example.com",
+    "tunnel": "aws.ssmproxy.mydb.dev",
+    "password": "__CHANG3_ME__"
+  },
+  "upstream": {
+    "paypal": "api.dev.paypal.com"
+  },
+  "auth": {
+    "callbackUrl": "https://auth.myapp.dev"
+  }
+}
+"
+`;
+
+exports[`persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp) given: [case1] an rds repo with a config/dev.json to migrate when: [t1] the relocate + migrate fix is applied then: config/prep.json now holds the migrated content + config/dev.json is gone + matches snapshot: config/prep.json — after 1`] = `
+"{
+  "organization": "test-org",
+  "project": "test-project",
+  "environment": {
+    "access": "prep"
+  },
+  "database": {
+    "host": "bastion.dev.example.com",
+    "tunnel": "aws.ssmproxy.mydb.dev",
+    "password": "$.at(aws::param)"
+  },
+  "upstream": {
+    "paypal": "api.dev.paypal.com"
+  },
+  "auth": {
+    "callbackUrl": "https://auth.myapp.dev"
+  }
+}
+"
+`;

package/dist/practices/persist-with-rds/__snapshots__/.extensions.sql.declapract.integration.test.ts.snap

@@ -0,0 +1,42 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`.extensions.sql fix should be able to create a new file to fix case where file does not exist yet 1`] = `
+"/**
+ * postgres databases use extensions to increase functionality
+ * - we have a minimum set of extensions that are required for sql-schema-generator
+ * - services may also include their own extensions if they want additional functionality
+ * - this is not managed by sql-schema-control
+ *   - requires superuser privileges, cicd user only has db_owner privileges
+ * - this is applied
+ *   - automatically for integration-test db (through \`provision/docker/.../init/\` directory, with files cp'd by npm provision scripts)
+ *   - by the deployment script for live deployments
+ */
+
+-- extensions required for all sql-schema-generator resources:
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+-- extensions required for custom use cases in this service:
+-- CREATE EXTENSION IF NOT EXISTS ..."
+`;
+
+exports[`.extensions.sql fix should be able to fix a file with custom extensions correctly 1`] = `
+"/**
+ * postgres databases use extensions to increase functionality
+ * - we have a minimum set of extensions that are required for sql-schema-generator
+ * - services may also include their own extensions if they want additional functionality
+ * - this is not managed by sql-schema-control
+ *   - requires superuser privileges, cicd user only has db_owner privileges
+ * - this is applied
+ *   - automatically for integration-test db (through \`provision/docker/.../init/\` directory, with files cp'd by npm provision scripts)
+ *   - by the deployment script for live deployments
+ */
+
+-- extensions required for all sql-schema-generator resources:
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+-- extensions required for custom use cases in this service:
+CREATE EXTENSION IF NOT EXISTS "cube";
+CREATE EXTENSION IF NOT EXISTS "earthdistance";"
+`;