declapract-typescript-ehmpathy 0.49.11 → 0.49.13

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/provision.yml.declapract.integration.test.ts

@@ -0,0 +1,182 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useBeforeAll, when } from 'test-fns';
+
+// executeApply is slow (full usecase evaluation), so widen the jest budget
+jest.setTimeout(180_000); // 3 minutes
+
+/**
+ * .what = end-to-end proof of the D28 provision.yml rds-jobs gate, run through the REAL declapract
+ *   apply pipeline against a genTempDir consumer. per `rule.require.declapract-integration-tests`, a
+ *   `contents` fn that GENERATES a file from another source (the superset) is REQUIRED to carry a
+ *   pipeline test — a unit test of the exported `contents`/`withoutRdsJobs` never exercises the
+ *   glob→file match, the `projectPractices` derivation through a real usecase, nor the emitted file a
+ *   consumer actually receives.
+ * .why = the declaration branches on `context.projectPractices.includes('persist-with-rds')`. only a
+ *   real apply proves declapract (1) matches the declaration to `.github/workflows/provision.yml`,
+ *   (2) derives `projectPractices` from the resolved usecase (present for `lambda-service-with-rds`,
+ *   absent for `lambda-service`), (3) CREATES the absent best-practice file, and (4) emits the
+ *   superset for an rds consumer vs the narrowed workflow (4 rds jobs stripped) for a non-rds one —
+ *   the exact D28/#573 end-state the gate exists to deliver.
+ * .note = the apply is scoped by `file` ONLY, never by `practice`. a `--practice cicd-service` filter
+ *   narrows `projectPractices` to `['cicd-service']` (getDesiredPractices), which would strip
+ *   `persist-with-rds` from the derivation and silence the rds branch. file-only keeps every usecase
+ *   practice in `projectPractices` while it applies just the provision.yml plan.
+ * .note = because the apply is file-only (no `--practice` filter), declapract compiles EVERY practice
+ *   under the config's `practices:` dir. pointed at the real `src/practices` (~40 practices) that
+ *   blew the jest hook timeout, so the fixture symlinks a lean `declarations/` MIRROR that carries
+ *   only cicd-service + a persist-with-rds name-marker — the exact pattern the environments
+ *   old-stage-enum pipeline test uses. the mirror is the `src/.test/assets/cicd-service/declarations`
+ *   symlink below; the demo-repo's use.yml points its `declarations:` at it.
+ * .note = the emitted file is snapshotted in full (both usecases) plus the source superset, so a
+ *   reviewer eyeballs the exact strip diff, per `rule.require.declapract-integration-tests`.
+ */
+
+const FIXTURE = './src/practices/cicd-service/.test/assets/demo-repo-service';
+const DECLARATIONS_MIRROR = './src/.test/assets/cicd-service/declarations';
+const PROVISION_PATH = '.github/workflows/provision.yml';
+const SOURCE_SUPERSET =
+  'src/practices/cicd-service/best-practice/.github/workflows/provision.yml';
+
+const RDS_JOBS = [
+  'sql-schema-prep:',
+  'sql-schema-prod:',
+  'aws-prep-declastruct:',
+  'aws-prod-declastruct:',
+];
+const GENERIC_JOBS = [
+  'github:',
+  'aws-test-terraform:',
+  'aws-prep-terraform:',
+  'aws-prod-terraform:',
+];
+
+describe('provision.yml — the D28 rds-jobs gate, end to end', () => {
+  given('[case1] an rds-usecase consumer (lambda-service-with-rds)', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-cicd-service-provision-rds',
+      clone: FIXTURE,
+      symlink: [
+        { at: 'declarations', to: DECLARATIONS_MIRROR },
+        { at: 'node_modules', to: 'node_modules' },
+      ],
+    });
+
+    const read = (rel: string) => fs.readFile(path.join(tempDir, rel), 'utf-8');
+    const exists = async (rel: string): Promise<boolean> =>
+      fs
+        .access(path.join(tempDir, rel))
+        .then(() => true)
+        .catch(() => false);
+    const applyProvision = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.rds.yml'),
+        file: PROVISION_PATH,
+      });
+
+    const state = useBeforeAll(async () => {
+      const before = await exists(PROVISION_PATH);
+      await applyProvision();
+      const after1 = await read(PROVISION_PATH);
+      await applyProvision(); // second apply — prove a fixed point
+      const after2 = await read(PROVISION_PATH);
+      return { before, after1, after2 };
+    }, 170_000);
+
+    when('[t0] before any apply', () => {
+      then('the consumer has no provision.yml yet', () => {
+        expect(state.before).toBe(false);
+      });
+    });
+
+    when('[t1] the cicd-service provision declaration is applied', () => {
+      then('the created file holds ALL 4 rds jobs', () => {
+        for (const job of RDS_JOBS) expect(state.after1).toContain(job);
+      });
+
+      then('the generic jobs are present too', () => {
+        for (const job of GENERIC_JOBS) expect(state.after1).toContain(job);
+      });
+
+      then('the emitted rds workflow matches snapshot', () => {
+        expect(state.after1).toMatchSnapshot(
+          'provision.yml — rds usecase (emitted superset)',
+        );
+      });
+    });
+
+    when('[t2] the declaration is applied a second time', () => {
+      then('the second apply is a no-op (idempotent)', () => {
+        expect(state.after2).toEqual(state.after1);
+      });
+    });
+  });
+
+  given('[case2] a non-rds consumer (lambda-service)', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-cicd-service-provision-nords',
+      clone: FIXTURE,
+      symlink: [
+        { at: 'declarations', to: DECLARATIONS_MIRROR },
+        { at: 'node_modules', to: 'node_modules' },
+      ],
+    });
+
+    const read = (rel: string) => fs.readFile(path.join(tempDir, rel), 'utf-8');
+    const applyProvision = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.nords.yml'),
+        file: PROVISION_PATH,
+      });
+
+    const state = useBeforeAll(async () => {
+      await applyProvision();
+      const after1 = await read(PROVISION_PATH);
+      await applyProvision(); // second apply — prove a fixed point
+      const after2 = await read(PROVISION_PATH);
+      return { after1, after2 };
+    }, 170_000);
+
+    when('[t0] the cicd-service provision declaration is applied', () => {
+      then('the emitted workflow STRIPS all 4 rds jobs', () => {
+        for (const job of RDS_JOBS) expect(state.after1).not.toContain(job);
+      });
+
+      then('the generic jobs survive the strip', () => {
+        for (const job of GENERIC_JOBS) expect(state.after1).toContain(job);
+      });
+
+      then(
+        'the emitted narrowed workflow matches snapshot (the strip diff a reviewer eyeballs)',
+        () => {
+          expect(state.after1).toMatchSnapshot(
+            'provision.yml — non-rds usecase (emitted, narrowed)',
+          );
+        },
+      );
+    });
+
+    when('[t1] the declaration is applied a second time', () => {
+      then('the second apply is a no-op (idempotent)', () => {
+        expect(state.after2).toEqual(state.after1);
+      });
+    });
+  });
+
+  given('[case3] the shipped source superset the strip acts on', () => {
+    // the strip's INPUT — snapshotted as the "before" a reviewer diffs the narrowed emit against,
+    // since a fresh consumer starts with NO provision.yml (case1/case2 [t0] prove the absence).
+    when('[t0] the practice ships its provision.yml superset', () => {
+      then('the source superset holds all 4 rds jobs + matches snapshot', async () => {
+        const superset = await fs.readFile(SOURCE_SUPERSET, 'utf-8');
+        for (const job of RDS_JOBS) expect(superset).toContain(job);
+        for (const job of GENERIC_JOBS) expect(superset).toContain(job);
+        expect(superset).toMatchSnapshot(
+          'provision.yml — source superset (before strip)',
+        );
+      });
+    });
+  });
+});

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.declapract.integration.test.ts

@@ -0,0 +1,224 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useThen, when } from 'test-fns';
+
+/**
+ * .what = end-to-end proof of the persist-with-rds `old-dev-config-location` relocate +
+ *         tier-migrate, run through the REAL declapract apply pipeline against a genTempDir
+ *         clone of a consumer repo (the row-4 clamp, rds declarer).
+ * .why  = the config declarer has its own pipeline test; per
+ *         `rule.require.declapract-integration-tests` EACH declarer that relocates a file AND
+ *         transforms blocks owes its own end-to-end test — a unit test of the exported `fix`
+ *         never exercises the glob→file match or the `relativeFilePath` rewrite. the rds
+ *         declarer adds one transform the config twin lacks (`__CHANG3_ME__` → aws-param), so
+ *         it needs its own clamp rather than a claim that the config test covers it.
+ * .teeth = the input holds `"access": "dev"` (unambiguous → migrated to `prep`) plus four `.dev`
+ *          hosts the util runs on in a CONSUMER's real config — a `://` URL `https://auth.myapp.dev`,
+ *          a mid-dotted `bastion.dev.example.com`, a terminal `aws.ssmproxy.mydb.dev`, and a FOREIGN
+ *          public host `api.dev.paypal.com` (paypal's own label). a `.dev` label is axis-ambiguous
+ *          WHEREVER it sits, so per guard #3 EVERY host is preserved byte-for-byte — the after-state
+ *          proves all four survive, that none flips to `.prep`, and that NO `@declapract:review`
+ *          bytes ever enter the config. it also proves the rds-only `__CHANG3_ME__` → aws-param
+ *          transform (the one the config twin lacks) plus the relocation.
+ */
+describe('persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp)', () => {
+  given('[case1] an rds repo with a config/dev.json to migrate', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-persist-with-rds-old-dev-config-location',
+      clone: './src/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config',
+      symlink: [{ at: 'src', to: 'src' }],
+    });
+
+    const devPath = 'config/dev.json';
+    const prepPath = 'config/prep.json';
+    const read = (relativePath: string) =>
+      fs.readFile(path.join(tempDir, relativePath), 'utf-8');
+    const exists = async (relativePath: string): Promise<boolean> =>
+      fs
+        .access(path.join(tempDir, relativePath))
+        .then(() => true)
+        .catch(() => false);
+    const applyMigrate = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.yml'),
+        practice: 'persist-with-rds',
+        file: devPath,
+      });
+
+    when('[t0] the migration input (before any fix)', () => {
+      then('config/dev.json holds the dev tier + the placeholder + matches snapshot', async () => {
+        const before = await read(devPath);
+        expect(before).toContain('"access": "dev"');
+        expect(before).toContain('"__CHANG3_ME__"');
+        expect(before).toMatchSnapshot('config/dev.json — before');
+      });
+    });
+
+    when('[t1] the relocate + migrate fix is applied', () => {
+      useThen('migrate the dev config', async () => applyMigrate());
+
+      then(
+        'config/prep.json now holds the migrated content + config/dev.json is gone + matches snapshot',
+        async () => {
+          // the relocation landed: the new path exists, the old path is unlinked
+          expect(await exists(prepPath)).toBe(true);
+          expect(await exists(devPath)).toBe(false);
+
+          const after = await read(prepPath);
+          // the access itself is the one unambiguous token → migrated
+          expect(after).toContain('"access": "prep"');
+          expect(after).not.toContain('"access": "dev"');
+          // EVERY host survives byte-for-byte — a `.dev` label is axis-ambiguous WHEREVER it sits,
+          // so per guard #3 the util rewrites NO host at all.
+          expect(after).toContain('bastion.dev.example.com');
+          expect(after).toContain('aws.ssmproxy.mydb.dev');
+          expect(after).toContain('https://auth.myapp.dev');
+          // the FOREIGN public host is the decisive corruption case: teeth — the prior mid-dotted
+          // rewrite turned this into `api.prep.paypal.com`, a silent public-endpoint corruption.
+          expect(after).toContain('api.dev.paypal.com');
+          expect(after).not.toContain('api.prep.paypal.com');
+          // no host was flipped to `.prep`, so no wrong-tier value ever enters the config
+          expect(after).not.toContain('bastion.prep.example.com');
+          expect(after).not.toContain('aws.ssmproxy.mydb.prep');
+          // the migration never emits a value it cannot verify — no marker bytes in config
+          expect(after).not.toContain('@declapract:review');
+          // the rds-only placeholder → the aws-param reference (the transform the twin lacks)
+          expect(after).toContain('"$.at(aws::param)"');
+          expect(after).not.toContain('__CHANG3_ME__');
+          // full content, for the reviewer's eye
+          expect(after).toMatchSnapshot('config/prep.json — after');
+        },
+      );
+    });
+
+    when('[t2] the fix is applied a second time (idempotency)', () => {
+      // config/dev.json is gone after the first relocate, so the EXISTS check no longer
+      // fires and no fix runs — config/prep.json must be untouched (per
+      // rule.require.idempotent-fixes).
+      const passes = useThen(
+        'a second apply over the already-migrated repo',
+        async () => {
+          const before = await read(prepPath);
+          await applyMigrate();
+          const after = await read(prepPath);
+          return { before, after };
+        },
+      );
+
+      then('the second apply is a no-op', () => {
+        expect(passes.after).toEqual(passes.before);
+      });
+    });
+  });
+});
+
+/**
+ * .what = D55 clamp: `src/utils/config/getConfig.ts` has exactly ONE declarer — the `config`
+ *         practice (the real sdk-config impl). `persist-with-rds` ships NO second copy of that
+ *         path (the old `'placeholder' as any` typed lie).
+ * .why  = `lambda-service-with-rds` extends `lambda-service`, which always supplies `config`, so the
+ *         placeholder was dead weight whose correctness rested on alphabetical apply order
+ *         (`config` < `persist-with-rds`). two declarers of one path, one a typed lie, is a silent
+ *         hazard: a consumer converged to the real file only by accident of that order. one
+ *         declarer removes both the order dependency and the lie — the consumer receives config's
+ *         real getConfig at this exact path, so persist-with-rds's own import resolves.
+ * .teeth = re-add a getConfig.ts under persist-with-rds/best-practice → the sole-declarer assertion
+ *          reddens.
+ * .note = INTEGRATION by `rule.forbid.unit.remote-boundaries`: it reads the filesystem (the
+ *         practice trees). no credential, no network.
+ */
+describe('persist-with-rds — getConfig has a single declarer (D55 clamp)', () => {
+  const configGetConfig =
+    'src/practices/config/best-practice/src/utils/config/getConfig.ts';
+  const rdsGetConfig =
+    'src/practices/persist-with-rds/best-practice/src/utils/config/getConfig.ts';
+  const rdsDbConnection =
+    'src/practices/persist-with-rds/best-practice/src/utils/database/getOneDatabaseConnection.ts';
+  const exists = async (relativePath: string): Promise<boolean> =>
+    fs
+      .access(relativePath)
+      .then(() => true)
+      .catch(() => false);
+
+  given('[case1] the two practices that touch src/utils/config/getConfig.ts', () => {
+    when('[t0] the declarers of that path are read', () => {
+      then('the config practice is the sole declarer (real sdk-config impl)', async () => {
+        expect(await exists(configGetConfig)).toBe(true);
+        const real = await fs.readFile(configGetConfig, 'utf-8');
+        expect(real).toContain("from 'sdk-config'");
+        expect(real).not.toContain("'placeholder' as any");
+      });
+
+      then('persist-with-rds ships NO second copy (no typed-lie placeholder)', async () => {
+        // teeth: re-add a getConfig.ts under persist-with-rds/best-practice and this reddens
+        expect(await exists(rdsGetConfig)).toBe(false);
+      });
+
+      then('persist-with-rds imports getConfig from the config-supplied path', async () => {
+        // the consumer receives config's real getConfig at this exact path, so the import resolves
+        const dbConn = await fs.readFile(rdsDbConnection, 'utf-8');
+        expect(dbConn).toContain("from '../config/getConfig'");
+      });
+    });
+  });
+});
+
+/**
+ * .what = config.schema.ts clamp: this path has TWO declarers BY DESIGN — `config` (the base
+ *         shape, for a non-rds `lambda-service`) and `persist-with-rds` (the full shape with the
+ *         database block, for `lambda-service-with-rds`). persist-with-rds declares its full schema
+ *         as a PLAIN overwrite template (EQUALS), NOT a CONTAINS + regex-splice fix.
+ * .why  = a CONTAINS+splice `fix` for this path was dead code: its regex anchored on `});` before
+ *         `export type Config`, but config's base emits `} as const;` there, so on a fresh
+ *         `lambda-service-with-rds` consumer the fix no-oped and the check stayed permanently red —
+ *         no path to green via `declapract fix`. worse, its inline splice string was stale (flat
+ *         `role.cicd.{username,password}` vs the real `for-plan`/`for-apply` split). the later
+ *         declarer (persist-with-rds) shadows config's base for rds consumers, so removal of the
+ *         `.declapract.ts` makes its full `config.schema.ts` a plain EQUALS overwrite (declapract's
+ *         default with no companion) that always converges — rule.prefer.overwrite-over-mutate: do
+ *         not pair an overwrite template with a separate splice fix for the same path.
+ * .teeth = re-add a config.schema.ts.declapract.ts under persist-with-rds/best-practice → the
+ *          "no splice-fix declarer" assertion reddens; strip the `for-plan` split from
+ *          persist-with-rds's full schema → the "full schema declared" assertion reddens.
+ * .note = INTEGRATION by rule.forbid.unit.remote-boundaries: reads the filesystem (practice trees).
+ */
+describe('persist-with-rds — config.schema.ts is a plain overwrite, not a splice-fix (config.schema clamp)', () => {
+  const configSchema =
+    'src/practices/config/best-practice/src/utils/config/config.schema.ts';
+  const rdsSchema =
+    'src/practices/persist-with-rds/best-practice/src/utils/config/config.schema.ts';
+  const rdsSchemaFix =
+    'src/practices/persist-with-rds/best-practice/src/utils/config/config.schema.ts.declapract.ts';
+  const exists = async (relativePath: string): Promise<boolean> =>
+    fs
+      .access(relativePath)
+      .then(() => true)
+      .catch(() => false);
+
+  given('[case1] the two by-design declarers of src/utils/config/config.schema.ts', () => {
+    when('[t0] the declared files are read', () => {
+      then('config declares the BASE shape (no database block) for a non-rds service', async () => {
+        const base = await fs.readFile(configSchema, 'utf-8');
+        expect(base).toContain('const base = z.object(');
+        expect(base).not.toContain('database: z.object(');
+      });
+
+      then('persist-with-rds declares the FULL schema (database + for-plan/for-apply split)', async () => {
+        // teeth: strip the for-plan split from the full schema and this reddens
+        const full = await fs.readFile(rdsSchema, 'utf-8');
+        expect(full).toContain('database: z.object(');
+        expect(full).toContain("'for-plan': z.object(");
+        expect(full).toContain("'for-apply': z.object(");
+      });
+
+      then('persist-with-rds ships NO CONTAINS+splice fix for that path (dead regex gone)', async () => {
+        // teeth: re-add config.schema.ts.declapract.ts and this reddens. the paired full template
+        // is a plain EQUALS overwrite, so a fresh rds consumer converges via overwrite, never a
+        // splice that no-ops on config's `} as const;` base.
+        expect(await exists(rdsSchemaFix)).toBe(false);
+      });
+    });
+  });
+});

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.extensions.sql.declapract.integration.test.ts

@@ -0,0 +1,38 @@
+import { readFile } from '../../utils/readFile';
+import { fix } from './best-practice/provision/schema/sql/init/.extensions.sql.declapract';
+
+describe('.extensions.sql fix', () => {
+  it('should be able to fix a file with custom extensions correctly', async () => {
+    const declaredFileContents = await readFile({
+      filePath: `${__dirname}/best-practice/provision/schema/sql/init/.extensions.sql`,
+    }); // grab the declared contents
+    const exampleFoundContents = `
+/**
+ NOTE: because db owner is not allowed to create extensions, these changes are applied manually
+
+  NOTE: for the integration test db, these are applied automatically upon spinning up the docker instance
+*/
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+CREATE EXTENSION IF NOT EXISTS "cube";
+CREATE EXTENSION IF NOT EXISTS "earthdistance";
+    `;
+    const { contents: fixedContents } = await fix(exampleFoundContents, {
+      declaredFileContents,
+    } as any);
+    expect(fixedContents).toContain('CREATE EXTENSION IF NOT EXISTS "cube";');
+    expect(fixedContents).toContain(
+      'CREATE EXTENSION IF NOT EXISTS "earthdistance";',
+    );
+    expect(fixedContents).toMatchSnapshot();
+  });
+  it('should be able to create a new file to fix case where file does not exist yet', async () => {
+    const declaredFileContents = await readFile({
+      filePath: `${__dirname}/best-practice/provision/schema/sql/init/.extensions.sql`,
+    }); // grab the declared contents
+    const { contents: fixedContents } = await fix(null, {
+      declaredFileContents,
+    } as any);
+    expect(fixedContents).toMatchSnapshot();
+  });
+});

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/config/dev.json

@@ -0,0 +1,18 @@
+{
+  "organization": "test-org",
+  "project": "test-project",
+  "environment": {
+    "access": "dev"
+  },
+  "database": {
+    "host": "bastion.dev.example.com",
+    "tunnel": "aws.ssmproxy.mydb.dev",
+    "password": "__CHANG3_ME__"
+  },
+  "upstream": {
+    "paypal": "api.dev.paypal.com"
+  },
+  "auth": {
+    "callbackUrl": "https://auth.myapp.dev"
+  }
+}

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/declapract.declare.yml

@@ -0,0 +1,4 @@
+declare:
+  examples: src/examples
+  practices: src/practices
+  use-cases: src/useCases.yml

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/declapract.use.yml

@@ -0,0 +1,18 @@
+declarations: './'
+useCase: lambda-service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/__snapshots__/.declapract.integration.test.ts.snap

@@ -0,0 +1,45 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp) given: [case1] an rds repo with a config/dev.json to migrate when: [t0] the migration input (before any fix) then: config/dev.json holds the dev tier + the placeholder + matches snapshot: config/dev.json — before 1`] = `
+"{
+  "organization": "test-org",
+  "project": "test-project",
+  "environment": {
+    "access": "dev"
+  },
+  "database": {
+    "host": "bastion.dev.example.com",
+    "tunnel": "aws.ssmproxy.mydb.dev",
+    "password": "__CHANG3_ME__"
+  },
+  "upstream": {
+    "paypal": "api.dev.paypal.com"
+  },
+  "auth": {
+    "callbackUrl": "https://auth.myapp.dev"
+  }
+}
+"
+`;
+
+exports[`persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp) given: [case1] an rds repo with a config/dev.json to migrate when: [t1] the relocate + migrate fix is applied then: config/prep.json now holds the migrated content + config/dev.json is gone + matches snapshot: config/prep.json — after 1`] = `
+"{
+  "organization": "test-org",
+  "project": "test-project",
+  "environment": {
+    "access": "prep"
+  },
+  "database": {
+    "host": "bastion.dev.example.com",
+    "tunnel": "aws.ssmproxy.mydb.dev",
+    "password": "$.at(aws::param)"
+  },
+  "upstream": {
+    "paypal": "api.dev.paypal.com"
+  },
+  "auth": {
+    "callbackUrl": "https://auth.myapp.dev"
+  }
+}
+"
+`;

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/__snapshots__/.extensions.sql.declapract.integration.test.ts.snap

@@ -0,0 +1,42 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`.extensions.sql fix should be able to create a new file to fix case where file does not exist yet 1`] = `
+"/**
+ * postgres databases use extensions to increase functionality
+ * - we have a minimum set of extensions that are required for sql-schema-generator
+ * - services may also include their own extensions if they want additional functionality
+ * - this is not managed by sql-schema-control
+ *   - requires superuser privileges, cicd user only has db_owner privileges
+ * - this is applied
+ *   - automatically for integration-test db (through \`provision/docker/.../init/\` directory, with files cp'd by npm provision scripts)
+ *   - by the deployment script for live deployments
+ */
+
+-- extensions required for all sql-schema-generator resources:
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+-- extensions required for custom use cases in this service:
+-- CREATE EXTENSION IF NOT EXISTS ..."
+`;
+
+exports[`.extensions.sql fix should be able to fix a file with custom extensions correctly 1`] = `
+"/**
+ * postgres databases use extensions to increase functionality
+ * - we have a minimum set of extensions that are required for sql-schema-generator
+ * - services may also include their own extensions if they want additional functionality
+ * - this is not managed by sql-schema-control
+ *   - requires superuser privileges, cicd user only has db_owner privileges
+ * - this is applied
+ *   - automatically for integration-test db (through \`provision/docker/.../init/\` directory, with files cp'd by npm provision scripts)
+ *   - by the deployment script for live deployments
+ */
+
+-- extensions required for all sql-schema-generator resources:
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+-- extensions required for custom use cases in this service:
+CREATE EXTENSION IF NOT EXISTS "cube";
+CREATE EXTENSION IF NOT EXISTS "earthdistance";"
+`;