declapract-typescript-ehmpathy 0.49.13 → 0.49.14

package/dist/.test/assets/cicd-service/declarations/practices/cicd-service/provision.yml.merge.declapract.integration.test.ts

@@ -0,0 +1,144 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useBeforeAll, when } from 'test-fns';
+import { parse } from 'yaml';
+
+import { getAllWorkflowJobDrifts } from '../../utils/getAllWorkflowJobDrifts';
+
+// executeApply is slow (full usecase evaluation), so widen the jest budget
+jest.setTimeout(240_000);
+
+/**
+ * .what = end-to-end proof of the provision.yml merge-by-job fix (#685), run through the REAL
+ *         declapract apply against a pre-oidc caller
+ * .why  = the callee workflows went oidc-only; a caller still on the retired access-key inputs
+ *         fails at github with `startup_failure` before any job starts. the old declaration was a
+ *         text-contains check with no fix, so `apply` reported the drift and changed no byte. only a
+ *         real apply proves declapract wires the custom check + fix to this file, that each declared
+ *         job lands in its oidc shape, and that the repo's own job survives.
+ * .note = the apply is scoped by `file`, so `projectPractices` keeps `persist-with-rds` and the
+ *         declaration emits its rds superset. [t2] then runs a NARROW `--practice cicd-service`
+ *         apply, where `projectPractices` shrinks and the emitted body drops the rds jobs — the
+ *         merge must keep them, since an undeclared job is never stripped.
+ */
+
+const FIXTURE = './src/practices/cicd-service/.test/assets/demo-repo-pre-oidc';
+const DECLARATIONS_MIRROR = './src/.test/assets/cicd-service/declarations';
+const PROVISION_PATH = '.github/workflows/provision.yml';
+const SOURCE_SUPERSET =
+  'src/practices/cicd-service/best-practice/.github/workflows/provision.yml';
+
+const DECLARED_JOBS = [
+  'aws-test-terraform',
+  'aws-prep-terraform',
+  'aws-prod-terraform',
+  'github',
+  'sql-schema-prep',
+  'sql-schema-prod',
+  'aws-prep-declastruct',
+  'aws-prod-declastruct',
+];
+
+describe('provision.yml — merge-by-job fix, end to end (#685)', () => {
+  given('[case1] an rds service whose provision.yml is a pre-oidc caller with a repo-own job', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-cicd-service-provision-pre-oidc',
+      clone: FIXTURE,
+      symlink: [
+        { at: 'declarations', to: DECLARATIONS_MIRROR },
+        { at: 'node_modules', to: 'node_modules' },
+      ],
+    });
+
+    const read = (rel: string) => fs.readFile(path.join(tempDir, rel), 'utf-8');
+    const config = () => path.join(tempDir, 'declapract.use.rds.yml');
+
+    const state = useBeforeAll(async () => {
+      const superset = await fs.readFile(SOURCE_SUPERSET, 'utf-8');
+      const before = await read(PROVISION_PATH);
+      await executeApply({ config: config(), file: PROVISION_PATH });
+      const after1 = await read(PROVISION_PATH);
+      await executeApply({ config: config(), file: PROVISION_PATH });
+      const after2 = await read(PROVISION_PATH);
+      await executeApply({ config: config(), practice: 'cicd-service' });
+      const afterNarrow = await read(PROVISION_PATH);
+      return { superset, before, after1, after2, afterNarrow };
+    }, 230_000);
+
+    when('[t0] declapract apply', () => {
+      then('each declared job matches the oidc template shape', () => {
+        const jobsAfter = parse(state.after1).jobs;
+        const jobsDeclared = parse(state.superset).jobs;
+        for (const name of DECLARED_JOBS)
+          expect(jobsAfter[name]).toEqual(jobsDeclared[name]);
+      });
+
+      then('no retired access-key input survives in a declared job', () => {
+        expect(state.before).toContain('aws-access-key-id');
+        expect(state.after1).not.toContain('aws-access-key-id');
+        expect(state.after1).not.toContain('aws-account-id');
+      });
+
+      then('the repo-own job survives, unchanged', () => {
+        expect(parse(state.after1).jobs['seed-prep-fixtures']).toEqual(
+          parse(state.before).jobs['seed-prep-fixtures'],
+        );
+        expect(state.after1).toContain(
+          "# the repo's own job, which the practice never declares",
+        );
+      });
+
+      then('the pull_request trigger stays bare, with no paths gate', () => {
+        expect(parse(state.after1).on.pull_request).toBeNull();
+      });
+
+      then("the repo's own schedule trigger survives, comment and all", () => {
+        expect(parse(state.after1).on.schedule).toEqual(
+          parse(state.before).on.schedule,
+        );
+        expect(parse(state.after1).on.schedule).toEqual([
+          { cron: '0 6 * * *' },
+        ]);
+        expect(state.after1).toContain(
+          "# the repo's own nightly drift plan, which the practice never declares",
+        );
+      });
+
+      then('the oidc permissions block lands', () => {
+        expect(parse(state.after1).permissions).toEqual({
+          'id-token': 'write',
+          contents: 'read',
+        });
+      });
+
+      then('the check passes on the fixed file', () => {
+        expect(
+          getAllWorkflowJobDrifts({
+            found: state.after1,
+            declared: state.superset,
+            dropJobWhen: null,
+          }),
+        ).toEqual([]);
+      });
+
+      then('before + after match snapshot', () => {
+        expect(state.before).toMatchSnapshot('provision.yml — before (pre-oidc)');
+        expect(state.after1).toMatchSnapshot('provision.yml — after merge');
+      });
+    });
+
+    when('[t1] declapract apply again', () => {
+      then('zero bytes change', () => {
+        expect(state.after2).toEqual(state.after1);
+      });
+    });
+
+    when('[t2] a narrow --practice cicd-service apply, where the rds jobs go undeclared', () => {
+      then('the rds jobs and the repo-own job survive; zero bytes change', () => {
+        expect(state.afterNarrow).toEqual(state.after1);
+      });
+    });
+  });
+});

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.declapract.integration.test.ts

@@ -6,29 +6,33 @@ import { genTempDir, given, then, useThen, when } from 'test-fns';
 
 /**
  * .what = end-to-end proof of the persist-with-rds `old-dev-config-location` relocate +
- *         tier-migrate, run through the REAL declapract apply pipeline against a genTempDir
+ *         access-migrate, run through the REAL declapract apply pipeline against a genTempDir
  *         clone of a consumer repo (the row-4 clamp, rds declarer).
  * .why  = the config declarer has its own pipeline test; per
  *         `rule.require.declapract-integration-tests` EACH declarer that relocates a file AND
  *         transforms blocks owes its own end-to-end test — a unit test of the exported `fix`
  *         never exercises the glob→file match or the `relativeFilePath` rewrite. the rds
- *         declarer adds one transform the config twin lacks (`__CHANG3_ME__` → aws-param), so
- *         it needs its own clamp rather than a claim that the config test covers it.
+ *         declarer must also keep the `__CHANG3_ME__` passwords prep users are created with
+ *         (#683), so it needs its own clamp rather than a claim that the config test covers it.
  * .teeth = the input holds `"access": "dev"` (unambiguous → migrated to `prep`) plus four `.dev`
  *          hosts the util runs on in a CONSUMER's real config — a `://` URL `https://auth.myapp.dev`,
  *          a mid-dotted `bastion.dev.example.com`, a terminal `aws.ssmproxy.mydb.dev`, and a FOREIGN
  *          public host `api.dev.paypal.com` (paypal's own label). a `.dev` label is axis-ambiguous
  *          WHEREVER it sits, so per guard #3 EVERY host is preserved byte-for-byte — the after-state
  *          proves all four survive, that none flips to `.prep`, and that NO `@declapract:review`
- *          bytes ever enter the config. it also proves the rds-only `__CHANG3_ME__` → aws-param
- *          transform (the one the config twin lacks) plus the relocation.
+ *          bytes ever enter the config. it also proves the `__CHANG3_ME__` passwords survive as-is
+ *          (#683) plus the relocation.
  */
-describe('persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp)', () => {
+// the declarations mount at `declarations/`, never `src/`, so the practice's `src/**` wildcards scan
+// only the demo repo's own files; the whole-practice evaluation still runs long under load
+jest.setTimeout(600_000);
+
+describe('persist-with-rds — old-dev-config-location relocate + access-migrate (row-4 clamp)', () => {
   given('[case1] an rds repo with a config/dev.json to migrate', () => {
     const tempDir = genTempDir({
       slug: 'declapract-persist-with-rds-old-dev-config-location',
       clone: './src/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config',
-      symlink: [{ at: 'src', to: 'src' }],
+      symlink: [{ at: 'declarations', to: 'src' }],
     });
 
     const devPath = 'config/dev.json';
@@ -39,7 +43,10 @@ describe('persist-with-rds — old-dev-config-location relocate + tier-migrate (
       fs
         .access(path.join(tempDir, relativePath))
         .then(() => true)
-        .catch(() => false);
+        .catch((error: NodeJS.ErrnoException) => {
+          if (error.code === 'ENOENT') return false; // absent is the probe's answer
+          throw error; // any other read failure is a malfunction, never "absent"
+        });
     const applyMigrate = () =>
       executeApply({
         config: path.join(tempDir, 'declapract.use.yml'),
@@ -48,7 +55,7 @@ describe('persist-with-rds — old-dev-config-location relocate + tier-migrate (
       });
 
     when('[t0] the migration input (before any fix)', () => {
-      then('config/dev.json holds the dev tier + the placeholder + matches snapshot', async () => {
+      then('config/dev.json holds the dev access + the placeholder + matches snapshot', async () => {
         const before = await read(devPath);
         expect(before).toContain('"access": "dev"');
         expect(before).toContain('"__CHANG3_ME__"');
@@ -79,14 +86,14 @@ describe('persist-with-rds — old-dev-config-location relocate + tier-migrate (
           // rewrite turned this into `api.prep.paypal.com`, a silent public-endpoint corruption.
           expect(after).toContain('api.dev.paypal.com');
           expect(after).not.toContain('api.prep.paypal.com');
-          // no host was flipped to `.prep`, so no wrong-tier value ever enters the config
+          // no host was flipped to `.prep`, so no wrong-access value ever enters the config
           expect(after).not.toContain('bastion.prep.example.com');
           expect(after).not.toContain('aws.ssmproxy.mydb.prep');
           // the migration never emits a value it cannot verify — no marker bytes in config
           expect(after).not.toContain('@declapract:review');
-          // the rds-only placeholder → the aws-param reference (the transform the twin lacks)
-          expect(after).toContain('"$.at(aws::param)"');
-          expect(after).not.toContain('__CHANG3_ME__');
+          // the prep password placeholder survives — prep users are created with it (#683)
+          expect(after).toContain('"__CHANG3_ME__"');
+          expect(after).not.toContain('"$.at(aws::param)"');
           // full content, for the reviewer's eye
           expect(after).toMatchSnapshot('config/prep.json — after');
         },
@@ -140,7 +147,10 @@ describe('persist-with-rds — getConfig has a single declarer (D55 clamp)', ()
     fs
       .access(relativePath)
       .then(() => true)
-      .catch(() => false);
+      .catch((error: NodeJS.ErrnoException) => {
+        if (error.code === 'ENOENT') return false; // absent is the probe's answer
+        throw error; // any other read failure is a malfunction, never "absent"
+      });
 
   given('[case1] the two practices that touch src/utils/config/getConfig.ts', () => {
     when('[t0] the declarers of that path are read', () => {
@@ -159,7 +169,7 @@ describe('persist-with-rds — getConfig has a single declarer (D55 clamp)', ()
       then('persist-with-rds imports getConfig from the config-supplied path', async () => {
         // the consumer receives config's real getConfig at this exact path, so the import resolves
         const dbConn = await fs.readFile(rdsDbConnection, 'utf-8');
-        expect(dbConn).toContain("from '../config/getConfig'");
+        expect(dbConn).toContain("from '@src/utils/config/getConfig'");
       });
     });
   });
@@ -195,7 +205,10 @@ describe('persist-with-rds — config.schema.ts is a plain overwrite, not a spli
     fs
       .access(relativePath)
       .then(() => true)
-      .catch(() => false);
+      .catch((error: NodeJS.ErrnoException) => {
+        if (error.code === 'ENOENT') return false; // absent is the probe's answer
+        throw error; // any other read failure is a malfunction, never "absent"
+      });
 
   given('[case1] the two by-design declarers of src/utils/config/config.schema.ts', () => {
     when('[t0] the declared files are read', () => {

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.extensions.sql.declapract.integration.test.ts

@@ -1,6 +1,17 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useBeforeAll, useThen, when } from 'test-fns';
+
 import { readFile } from '../../utils/readFile';
 import { fix } from './best-practice/provision/schema/sql/init/.extensions.sql.declapract';
 
+// executeApply evaluates the whole persist-with-rds practice before the `file` filter narrows it
+jest.setTimeout(10 * 60 * 1000);
+
+const EXTENSIONS_SQL = 'provision/schema/sql/init/.extensions.sql';
+
 describe('.extensions.sql fix', () => {
   it('should be able to fix a file with custom extensions correctly', async () => {
     const declaredFileContents = await readFile({
@@ -35,4 +46,114 @@ CREATE EXTENSION IF NOT EXISTS "earthdistance";
     } as any);
     expect(fixedContents).toMatchSnapshot();
   });
+
+  /**
+   * .what = the twice-applied clamp (rule.require.idempotent-fixes)
+   * .why  = the fix rebuilds the file from the template plus the custom lines it finds. a second
+   *         pass must find the same custom lines once, keep them once, and emit the same bytes —
+   *         else each `declapract fix` grows or reorders the custom block. the output must also
+   *         CONTAIN the template, so the CONTAINS check passes and the plan stops to flag it.
+   */
+  it('should be a fixed point — fix(fix(x)) equals fix(x), and the output contains the template', async () => {
+    const declaredFileContents = await readFile({
+      filePath: `${__dirname}/best-practice/provision/schema/sql/init/.extensions.sql`,
+    });
+    const context = { declaredFileContents } as any;
+    const input = `
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "cube";
+CREATE EXTENSION IF NOT EXISTS "earthdistance";
+-- CREATE EXTENSION IF NOT EXISTS ...
+`;
+
+    const { contents: once } = await fix(input, context);
+    const { contents: twice } = await fix(once, context);
+
+    expect(twice).toEqual(once);
+    expect(once).toContain(declaredFileContents.trim());
+    expect(once?.match(/"cube"/g)).toHaveLength(1);
+    expect(once?.match(/"uuid-ossp"/g)).toHaveLength(1);
+  });
+
+  /**
+   * .what = the fix through the real declapract pipeline, on a repo with custom extensions
+   * .why  = the unit cases above prove the fix in isolation; only executeApply proves the
+   *         declared path reaches the target file, the CONTAINS check gates the fix, the
+   *         `declaredFileContents` the fix reads is the template, and a rerun settles
+   *         (rule.require.declapract-integration-tests)
+   */
+  given('[case1] a repo whose .extensions.sql predates the template and holds custom lines', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-persist-with-rds-extensions-sql',
+      clone:
+        './src/practices/persist-with-rds/.test/assets/demo-repo-with-custom-extensions',
+      symlink: [{ at: 'declarations', to: 'src' }],
+    });
+    const read = () =>
+      fs.readFile(path.join(tempDir, EXTENSIONS_SQL), 'utf-8');
+    const apply = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.yml'),
+        practice: 'persist-with-rds',
+        file: EXTENSIONS_SQL,
+      });
+
+    when('[t0] before any apply', () => {
+      then('the input file matches snapshot', async () => {
+        expect(await read()).toMatchSnapshot('.extensions.sql — before');
+      });
+    });
+
+    when('[t1] apply runs', () => {
+      const scene = useThen('apply settles', async () => {
+        await apply();
+        const declared = await readFile({
+          filePath: `${__dirname}/best-practice/${EXTENSIONS_SQL}`,
+        });
+        return { after: await read(), declared };
+      });
+
+      then('the file now contains the whole template', () => {
+        expect(scene.after).toContain(scene.declared.trim());
+      });
+
+      then('each custom extension survives, once', () => {
+        expect(scene.after).toContain('CREATE EXTENSION IF NOT EXISTS "cube";');
+        expect(scene.after).toContain(
+          'CREATE EXTENSION IF NOT EXISTS "earthdistance";',
+        );
+        expect(scene.after.match(/"cube"/g)).toHaveLength(1);
+        expect(scene.after.match(/"earthdistance"/g)).toHaveLength(1);
+      });
+
+      then('each required extension appears once, never duplicated', () => {
+        expect(scene.after.match(/"uuid-ossp"/g)).toHaveLength(1);
+        expect(scene.after.match(/"pgcrypto"/g)).toHaveLength(1);
+      });
+
+      then('the legacy note block is gone', () => {
+        expect(scene.after).not.toContain('NOTE: because db owner');
+      });
+
+      then('no declapract template syntax leaked', () => {
+        expect(scene.after).not.toContain('@declapract{');
+      });
+
+      then('the output matches snapshot', () => {
+        expect(scene.after).toMatchSnapshot('.extensions.sql — after');
+      });
+    });
+
+    when('[t2] apply runs a second time', () => {
+      const before = useBeforeAll(async () => ({ contents: await read() }));
+      const scene = useThen('apply again', async () => {
+        await apply();
+        return { after: await read() };
+      });
+
+      then('the file is byte-identical — the apply is a fixed point', () => {
+        expect(scene.after).toEqual(before.contents);
+      });
+    });
+  });
 });

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-config-schema/declapract.use.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: lambda-service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'localhost'
+    prod: 'localhost'
+  databaseClusterHost:
+    prep: 'awesomesdb.cluster-abc123.us-east-1.rds.amazonaws.com'
+    prod: 'awesomesdb.cluster-def456.us-east-1.rds.amazonaws.com'
+  slackWebhookUrl: 'https://hooks.slack.test/webhook'
+  awsAccountId:
+    prep: '111111111111'
+    prod: '222222222222'

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-config-schema/declarations/declapract.declare.yml

@@ -0,0 +1,6 @@
+# the test symlinks `declarations/practices` -> src/practices and `declarations/useCases.yml` ->
+# src/useCases.yml at genTempDir time, so the temp repo's own `src/` stays its own: the apply writes
+# src/utils/config/config.schema.ts there, never into this repo's src.
+declare:
+  practices: practices
+  use-cases: useCases.yml

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-config-schema/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-on-a-prior-major/codegen.sql.dao.yml

@@ -0,0 +1,20 @@
+language: postgres
+dialect: 10.7
+generates:
+  daos:
+    to: src/access/daos
+    using:
+      log: src/utils/logger#log
+      DatabaseConnection: src/utils/database/getOneDatabaseConnection#DatabaseConnection
+  schema:
+    config: codegen.sql.schema.yml
+  control:
+    config: provision/schema/control.yml
+  code:
+    config: codegen.sql.types.yml
+for:
+  objects:
+    search:
+      - 'src/domain.objects/*.ts'
+    exclude:
+      - 'SurfReportDraft'

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-on-a-prior-major/declapract.declare.yml

@@ -0,0 +1,4 @@
+declare:
+  examples: declarations/examples
+  practices: declarations/practices
+  use-cases: declarations/useCases.yml

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-on-a-prior-major/declapract.use.yml

@@ -0,0 +1,19 @@
+declarations: './'
+useCase: lambda-service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  databaseName: 'testdb'
+  databaseClusterName: 'testdb'
+  databaseUserName:
+    cicdUser: 'testdb_cicd'
+    serviceUser: 'testdb_service'
+  databaseTunnelHost:
+    prep: 'localhost'
+    prod: 'localhost'
+  databaseClusterHost:
+    prep: 'localhost'
+    prod: 'localhost'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-on-a-prior-major/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-on-a-prior-major/provision/docker/testdb/build-image.dockerfile

@@ -0,0 +1,6 @@
+FROM postgres:17.9
+
+COPY init/ /docker-entrypoint-initdb.d/
+
+ADD wait-for-postgres.sh /root/
+RUN chmod +x /root/wait-for-postgres.sh

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-custom-extensions/declapract.declare.yml

@@ -0,0 +1,4 @@
+declare:
+  examples: declarations/examples
+  practices: declarations/practices
+  use-cases: declarations/useCases.yml

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-custom-extensions/declapract.use.yml

@@ -0,0 +1,21 @@
+# .note = apply evaluates the whole persist-with-rds practice, so every
+#         `@declapract{variable.*}` its best-practice dir references is defined here
+declarations: './'
+useCase: lambda-service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  databaseName: 'testdb'
+  databaseClusterName: 'testdb'
+  databaseUserName:
+    cicdUser: 'testdb_cicd'
+    serviceUser: 'testdb_service'
+  databaseTunnelHost:
+    prep: 'localhost'
+    prod: 'localhost'
+  databaseClusterHost:
+    prep: 'localhost'
+    prod: 'localhost'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-custom-extensions/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-custom-extensions/provision/schema/sql/init/.extensions.sql

@@ -0,0 +1,9 @@
+/**
+ NOTE: because db owner is not allowed to create extensions, these changes are applied manually
+
+  NOTE: for the integration test db, these are applied automatically when the docker instance starts
+*/
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+CREATE EXTENSION IF NOT EXISTS "cube";
+CREATE EXTENSION IF NOT EXISTS "earthdistance";

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/.test/assets/demo-repo-with-dev-config/declapract.declare.yml

@@ -1,4 +1,4 @@
 declare:
-  examples: src/examples
-  practices: src/practices
-  use-cases: src/useCases.yml
+  examples: declarations/examples
+  practices: declarations/practices
+  use-cases: declarations/useCases.yml

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/__snapshots__/.declapract.integration.test.ts.snap

@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
-exports[`persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp) given: [case1] an rds repo with a config/dev.json to migrate when: [t0] the migration input (before any fix) then: config/dev.json holds the dev tier + the placeholder + matches snapshot: config/dev.json — before 1`] = `
+exports[`persist-with-rds — old-dev-config-location relocate + access-migrate (row-4 clamp) given: [case1] an rds repo with a config/dev.json to migrate when: [t0] the migration input (before any fix) then: config/dev.json holds the dev access + the placeholder + matches snapshot: config/dev.json — before 1`] = `
 "{
   "organization": "test-org",
   "project": "test-project",
@@ -22,7 +22,7 @@ exports[`persist-with-rds — old-dev-config-location relocate + tier-migrate (r
 "
 `;
 
-exports[`persist-with-rds — old-dev-config-location relocate + tier-migrate (row-4 clamp) given: [case1] an rds repo with a config/dev.json to migrate when: [t1] the relocate + migrate fix is applied then: config/prep.json now holds the migrated content + config/dev.json is gone + matches snapshot: config/prep.json — after 1`] = `
+exports[`persist-with-rds — old-dev-config-location relocate + access-migrate (row-4 clamp) given: [case1] an rds repo with a config/dev.json to migrate when: [t1] the relocate + migrate fix is applied then: config/prep.json now holds the migrated content + config/dev.json is gone + matches snapshot: config/prep.json — after 1`] = `
 "{
   "organization": "test-org",
   "project": "test-project",
@@ -32,7 +32,7 @@ exports[`persist-with-rds — old-dev-config-location relocate + tier-migrate (r
   "database": {
     "host": "bastion.dev.example.com",
     "tunnel": "aws.ssmproxy.mydb.dev",
-    "password": "$.at(aws::param)"
+    "password": "__CHANG3_ME__"
   },
   "upstream": {
     "paypal": "api.dev.paypal.com"

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/__snapshots__/.extensions.sql.declapract.integration.test.ts.snap

@@ -1,5 +1,40 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
+exports[`.extensions.sql fix given: [case1] a repo whose .extensions.sql predates the template and holds custom lines when: [t0] before any apply then: the input file matches snapshot: .extensions.sql — before 1`] = `
+"/**
+ NOTE: because db owner is not allowed to create extensions, these changes are applied manually
+
+  NOTE: for the integration test db, these are applied automatically when the docker instance starts
+*/
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+CREATE EXTENSION IF NOT EXISTS "cube";
+CREATE EXTENSION IF NOT EXISTS "earthdistance";
+"
+`;
+
+exports[`.extensions.sql fix given: [case1] a repo whose .extensions.sql predates the template and holds custom lines when: [t1] apply runs then: the output matches snapshot: .extensions.sql — after 1`] = `
+"/**
+ * postgres databases use extensions to increase functionality
+ * - we have a minimum set of extensions that are required for sql-schema-generator
+ * - services may also include their own extensions if they want additional functionality
+ * - this is not managed by sql-schema-control
+ *   - requires superuser privileges, cicd user only has db_owner privileges
+ * - this is applied
+ *   - automatically for integration-test db (through \`provision/docker/.../init/\` directory, with files cp'd by npm provision scripts)
+ *   - by the deployment script for live deployments
+ */
+
+-- extensions required for all sql-schema-generator resources:
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+-- extensions required for custom use cases in this service:
+CREATE EXTENSION IF NOT EXISTS "cube";
+CREATE EXTENSION IF NOT EXISTS "earthdistance";
+"
+`;
+
 exports[`.extensions.sql fix should be able to create a new file to fix case where file does not exist yet 1`] = `
 "/**
  * postgres databases use extensions to increase functionality