declapract-typescript-ehmpathy 0.49.14 → 0.50.0

package/dist/.test/assets/git/declarations/practices/persist-with-rds/__snapshots__/deploy-database-gerunds.declapract.integration.test.ts.snap

@@ -0,0 +1,102 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-rds deploy.database.sh gerund-free given: the shipped deploy.database.sh when: the template body is read then: the emitted deploy.database.sh matches snapshot: deploy.database.sh 1`] = `
+"#####################################################
+## initialize the database in a live cluster
+## - in other words, it does all of the things that docker does for us when we spin up a cluster without the db already
+## - i.e.,
+##    - create the database
+##    - install the extensions
+##    - creates the schema
+##    - creates the cicd user
+##    - grants the cicd user ownership of the db
+## - note:
+##   - requires pg admin access
+##   - requires _you_ to change the passwords in prod manually
+##
+## usage example:
+## \`\`\`sh
+## ./provision/schema/deploy.database.sh prep $(op item get ahbodedb.prep.postgres --fields label=password --format json | jq -r .value)
+## \`\`\`
+#####################################################
+
+set -eu
+
+# check that the human has defined the environment that they want this key created for correctly
+ENVIRONMENT="\${1:-}";
+if [ "$ENVIRONMENT" != "prod" ] && [ "$ENVIRONMENT" != "prep" ]; then
+  echo "\\nerror: environment, the first argument, must be specified as either 'prod' or 'prep'. you specified '$ENVIRONMENT'";
+  exit 2;
+fi
+
+# check that the human is authed into correct account
+AWS_ACCOUNT_ID=$(aws sts get-caller-identity | jq -r '.Account');
+EXPECTED_AWS_ACCOUNT_ID=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.awsAccountId.prod}" || echo "@declapract{variable.awsAccountId.prep}");
+if [ "$AWS_ACCOUNT_ID" != "$EXPECTED_AWS_ACCOUNT_ID" ]; then
+  echo "\\nerror: the AWS_ACCOUNT that you are signed into is not correct for the environment you specified. you are authed into account '$AWS_ACCOUNT_ID' but the correct account id for '$ENVIRONMENT' is '$EXPECTED_AWS_ACCOUNT_ID'";
+  exit 2;
+fi
+
+# check that pg admin password was specified
+POSTGRES_ADMIN_PASSWORD="\${2:-}"
+if [ -z "\${POSTGRES_ADMIN_PASSWORD:-}" ]; then
+  echo "\\nerror: POSTGRES_ADMIN_PASSWORD must be defined as second arg";
+  exit 2;
+fi;
+
+# check that the cicd password was provisioned, if in prod, since this is used to create the cicd user
+# note: this reads the legacy DOTTED param name (\`....database.role.cicd.password\`), a live consumer
+#       distinct from the slash-path plan/apply secrets. it is the prod cicd-user bootstrap credential
+#       and stays alive on purpose — do not prune it as an unreferenced legacy param.
+if [ "$ENVIRONMENT" = "prod" ]; then
+  CICD_USER_PASSWORD=$(aws ssm get-parameter --name "@declapract{variable.organizationName}.@declapract{variable.projectName}.$ENVIRONMENT.database.role.cicd.password" --with-decryption --output text --query Parameter.Value)
+  if [ -z "\${CICD_USER_PASSWORD:-}" ]; then
+    echo "\\nerror: CICD_USER_PASSWORD must be provisioned with terraform before you run this"
+    exit 2;
+  fi;
+  if [ "$CICD_USER_PASSWORD" = "__IGNORED__" ] || [ "$CICD_USER_PASSWORD" = "__CHANG3_ME__" ]; then
+    echo "\\nerror: CICD_USER_PASSWORD must be set to a value other than the default placeholder"
+    exit 2;
+  fi;
+fi;
+
+
+# define the postgres connection string
+CLUSTER_HOST=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.databaseTunnelHost.prod}" || echo "@declapract{variable.databaseTunnelHost.prep}");
+CLUSTER_CONNECTION_STRING=postgresql://postgres:$POSTGRES_ADMIN_PASSWORD@$CLUSTER_HOST:5432
+ROOT_DB_CONNECTION_STRING=$CLUSTER_CONNECTION_STRING/postgres
+SVC_DB_CONNECTION_STRING=$CLUSTER_CONNECTION_STRING/@declapract{variable.databaseName}
+
+# define path to the init sqls
+SRC_PATH=$(readlink --canonicalize "$0");
+SRC_DIR=$(dirname $SRC_PATH);
+INIT_SQLS_DIR=$SRC_DIR/sql/init;
+
+# run the create database command on root db
+echo "\\n 🔨 create the database..."
+psql $ROOT_DB_CONNECTION_STRING -f $INIT_SQLS_DIR/.database.sql
+
+echo "\\n 🔨 install the extensions..."
+psql $SVC_DB_CONNECTION_STRING -f $INIT_SQLS_DIR/.extensions.sql
+
+echo "\\n 🔨 create the schema..."
+psql $SVC_DB_CONNECTION_STRING -f $INIT_SQLS_DIR/.schema.sql
+
+if [ "$ENVIRONMENT" = "prod" ]; then
+  echo "\\n 🔨 grant reads to the datalakedb user..." # only in prod env; we dont want prep's test data in our datalake
+  psql $SVC_DB_CONNECTION_STRING -f $INIT_SQLS_DIR/.user.datalakedb.sql
+fi;
+
+echo "\\n 🔨 create the cicd user..."
+CICD_USER_CREATE_SQL_PATH=$INIT_SQLS_DIR/.user.cicd.sql
+if [ "$ENVIRONMENT" = "prod" ]; then
+  CICD_USER_CREATE_SQL_PATH_TEMP=$CICD_USER_CREATE_SQL_PATH.tmp # in prod, we must create a temp file which will have the actual password we'll use to create the cicd user
+  cat $CICD_USER_CREATE_SQL_PATH | sed "s/__CHANG3_ME__/\${CICD_USER_PASSWORD}/" > $CICD_USER_CREATE_SQL_PATH_TEMP # create the temp file w/ the actual password
+  psql $SVC_DB_CONNECTION_STRING -f $CICD_USER_CREATE_SQL_PATH_TEMP # run the temp create sql w/ the actual password
+  rm $CICD_USER_CREATE_SQL_PATH_TEMP # remove the temp file, so the password doesn't get checked in
+else
+  psql $SVC_DB_CONNECTION_STRING -f $CICD_USER_CREATE_SQL_PATH # otherwise, we can run the file directly. no password replacement required
+fi
+echo "\\n 🎉 done"
+"
+`;

package/dist/.test/assets/git/declarations/practices/persist-with-rds/__snapshots__/engine-upgrade.declapract.integration.test.ts.snap

@@ -0,0 +1,151 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case1] a repo on dialect 10.7 with its own testdb pin when: [t0] the input, before any fix then: each file matches snapshot: codegen.sql.dao.yml — before 1`] = `
+"language: postgres
+dialect: 10.7
+generates:
+  daos:
+    to: src/access/daos
+    using:
+      log: src/utils/logger#log
+      DatabaseConnection: src/utils/database/getOneDatabaseConnection#DatabaseConnection
+  schema:
+    config: codegen.sql.schema.yml
+  control:
+    config: provision/schema/control.yml
+  code:
+    config: codegen.sql.types.yml
+for:
+  objects:
+    search:
+      - 'src/domain.objects/*.ts'
+    exclude:
+      - 'SurfReportDraft'
+"
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case1] a repo on dialect 10.7 with its own testdb pin when: [t0] the input, before any fix then: each file matches snapshot: provision/docker/testdb/build-image.dockerfile — before 1`] = `
+"FROM postgres:17.9
+
+COPY init/ /docker-entrypoint-initdb.d/
+
+ADD wait-for-postgres.sh /root/
+RUN chmod +x /root/wait-for-postgres.sh
+"
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case1] a repo on dialect 10.7 with its own testdb pin when: [t1] apply runs then: the dao config moves to dialect 17, and keeps its own exclusions: codegen.sql.dao.yml — after 1`] = `
+"language: postgres
+dialect: 17
+generates:
+  daos:
+    to: src/access/daos
+    using:
+      log: src/utils/logger#log
+      DatabaseConnection: src/utils/database/getOneDatabaseConnection#DatabaseConnection
+  schema:
+    config: codegen.sql.schema.yml
+  control:
+    config: provision/schema/control.yml
+  code:
+    config: codegen.sql.types.yml
+for:
+  objects:
+    search:
+      - 'src/domain.objects/*.ts'
+    exclude:
+      - 'SurfReportDraft'
+"
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case1] a repo on dialect 10.7 with its own testdb pin when: [t1] apply runs then: the testdb keeps the pin the repo chose, and the check passes on it: provision/docker/testdb/build-image.dockerfile — after 1`] = `
+"FROM postgres:17.9
+
+COPY init/ /docker-entrypoint-initdb.d/
+
+ADD wait-for-postgres.sh /root/
+RUN chmod +x /root/wait-for-postgres.sh
+
+"
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case3] check-engine-skew.sh when: [t0] the testdb leads the livedb then: the check lines match the snapshot 1`] = `
+{
+  "status": 2,
+  "stderr": "✋ ConstraintError: the testdb (postgres 17) leads the livedb (postgres 13)
+   ├─ why: a green suite here can rest on a postgres 17 feature the livedb rejects
+   └─ fix: one of two, by how the skew arrived
+      ├─ the pin moved before the flip: merge after the livedb reads postgres 17
+      └─ the livedb fell back:          pin the testdb to postgres 13 until the flip holds",
+  "stdout": "🔭 engine skew
+   ├─ testdb: postgres 17 (<dockerfile>)
+   └─ livedb: postgres 13.23
+",
+}
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case3] check-engine-skew.sh when: [t1] the testdb leads a livedb below its declared target then: the check lines match the snapshot 1`] = `
+{
+  "status": 2,
+  "stderr": "✋ ConstraintError: the testdb (postgres 17) leads the livedb (postgres 13)
+   ├─ why: a green suite here can rest on a postgres 17 feature the livedb rejects
+   ├─ how: the livedb sits below its declared target 17 — a flip was reverted, or has not yet applied
+   └─ fix: pin the testdb to postgres 13 until the flip holds. do not re-flip a reverted livedb from here",
+  "stdout": "🔭 engine skew
+   ├─ testdb: postgres 17 (<dockerfile>)
+   └─ livedb: postgres 13.23
+",
+}
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case3] check-engine-skew.sh when: [t2] the testdb trails the livedb then: the check lines match the snapshot 1`] = `
+{
+  "status": 0,
+  "stderr": "",
+  "stdout": "🔭 engine skew
+   ├─ testdb: postgres 13 (<dockerfile>)
+   └─ livedb: postgres 17.11
+
+::warning title=engine skew::testdb postgres 13 trails the livedb's postgres 17. safe, but bump the pin on the next declapract upgrade
+",
+}
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case3] check-engine-skew.sh when: [t3] the majors match then: the check lines match the snapshot 1`] = `
+{
+  "status": 0,
+  "stderr": "",
+  "stdout": "🔭 engine skew
+   ├─ testdb: postgres 17 (<dockerfile>)
+   └─ livedb: postgres 17.7
+✨ majors match
+",
+}
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case3] check-engine-skew.sh when: [t4] the dockerfile has no postgres pin then: the check lines match the snapshot 1`] = `
+{
+  "status": 1,
+  "stderr": "💥 MalfunctionError: no 'FROM postgres:<major>' pin found in <dockerfile>
+   └─ fix: pin a major, like 'FROM postgres:17.11', or pass --dockerfile with the testdb image",
+  "stdout": "",
+}
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case3] check-engine-skew.sh when: [t5] a flag with no value then: the check lines match the snapshot 1`] = `
+{
+  "status": 2,
+  "stderr": "✋ ConstraintError: --livedb-version needs a value
+   └─ fix: see <check-engine-skew.sh> --help",
+  "stdout": "",
+}
+`;
+
+exports[`persist-with-rds engine upgrade surface (#664) given: [case3] check-engine-skew.sh when: [t6] the livedb read fails then: the check lines match the snapshot 1`] = `
+{
+  "status": 1,
+  "stderr": "💥 MalfunctionError: could not read the engine version of cluster '@declapract{variable.databaseClusterName}'
+   └─ fix: the caller needs aws auth with rds:DescribeDBClusters on the livedb's account",
+  "stdout": "",
+}
+`;

package/dist/.test/assets/git/declarations/practices/persist-with-rds/__snapshots__/pg-pool-patch.declapract.integration.test.ts.snap

@@ -0,0 +1,147 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.2.1, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.2.1 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.2.2, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.2.2 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.3.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.3.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.4.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.4.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.4.1, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.4.1 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.5.1, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.5.1 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.5.2, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.5.2 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.6.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.6.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.6.1, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.6.1 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.6.2, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.6.2 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.7.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.7.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.7.1, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.7.1 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.8.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.8.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.9.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.9.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.9.1, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.9.1 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.9.2, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.9.2 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.9.5, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.9.5 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.9.6, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.9.6 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.10.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.10.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.10.1, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.10.1 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.11.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.11.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.12.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.12.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.13.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.13.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case2] pg-pool 3.14.0, installed with the shipped patch when: [t0] pnpm install runs then: the patch lines an adopter reads match snapshot: pnpm install — patch lines, pg-pool 3.14.0 1`] = `[]`;
+
+exports[`persist-with-rds pg-pool patch given: [case4] an rds repo that already holds its own "pg-pool@3.14.0" hand patch when: [t0] the persist-with-rds practice is applied then: the before + after contents match snapshot: package.json — after 1`] = `
+"{
+  "name": "repo-with-hand-patch",
+  "version": "1.0.0",
+  "dependencies": {
+    "pg": "8.3.0",
+    "pg-pool": "3.14.0",
+    "iso-time": "@declapract{check.minVersion('<floor>')}",
+    "yesql": "@declapract{check.minVersion('<floor>')}"
+  },
+  "pnpm": {
+    "overrides": {
+      "react-refresh": "0.14.2"
+    },
+    "patchedDependencies": {
+      "pg-pool@3.14.0": "patches/pg-pool@3.14.0.patch",
+      "left-pad@1.3.0": "patches/left-pad@1.3.0.patch",
+      "pg-pool": "patches/pg-pool.patch"
+    }
+  },
+  "devDependencies": {
+    "sql-code-generator": "@declapract{check.minVersion('<floor>')}",
+    "sql-dao-generator": "@declapract{check.minVersion('<floor>')}",
+    "sql-schema-control": "@declapract{check.minVersion('<floor>')}",
+    "sql-schema-generator": "@declapract{check.minVersion('<floor>')}",
+    "@types/yesql": "@declapract{check.minVersion('<floor>')}",
+    "@types/pg": "@declapract{check.minVersion('<floor>')}"
+  },
+  "scripts": {
+    "generate:dao:postgres": "sql-dao-generator generate && npm run fix:format",
+    "generate:schema": "sql-schema-generator generate -c codegen.sql.schema.yml && npm run fix:format",
+    "generate:types-from-sql": "sql-code-generator generate -c codegen.sql.types.yml && npm run fix:format",
+    "provision:schema:plan": "sql-schema-control plan -c provision/schema/control.yml",
+    "provision:schema:apply": "sql-schema-control apply -c provision/schema/control.yml",
+    "provision:schema:sync": "sql-schema-control sync -c provision/schema/control.yml",
+    "provision:testdb:docker:clear": "for port in $(bash provision/docker/testdb/compose.sh config --format json | jq -r '.services[].ports[]?.published'); do docker rm -f $(docker ps -a -f \\"publish=$port\\" -q) 2>/dev/null || true; done && echo 'ensured ports are available 👍'",
+    "provision:testdb:docker:prepare": "cp provision/schema/sql/init/.extensions.sql provision/docker/testdb/init/extensions.sql && cp provision/schema/sql/init/.schema.sql provision/docker/testdb/init/schema.sql && cp provision/schema/sql/init/.user.cicd.sql provision/docker/testdb/init/user.cicd.sql",
+    "provision:testdb:docker:up": "bash provision/docker/testdb/compose.sh up -d --force-recreate --build --renew-anon-volumes",
+    "provision:testdb:docker:await": "bash provision/docker/testdb/compose.sh exec -T postgres /root/wait-for-postgres.sh",
+    "provision:testdb:docker:down": "bash provision/docker/testdb/compose.sh down",
+    "provision:testdb": "npm run provision:testdb:docker:clear && npm run provision:testdb:docker:prepare && npm run provision:testdb:docker:up && npm run provision:testdb:docker:await && ACCESS=test npm run provision:schema:plan && ACCESS=test npm run provision:schema:apply && ACCESS=test npm run provision:schema:plan",
+    "start:testdb": "npm run provision:testdb",
+    "start:livedb:prep": "rhx use.rds.capacity --env prep"
+  }
+}
+"
+`;
+
+exports[`persist-with-rds pg-pool patch given: [case4] an rds repo that already holds its own "pg-pool@3.14.0" hand patch when: [t0] the persist-with-rds practice is applied then: the before + after contents match snapshot: package.json — before 1`] = `
+"{
+  "name": "repo-with-hand-patch",
+  "version": "1.0.0",
+  "dependencies": {
+    "pg": "8.3.0",
+    "pg-pool": "3.14.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "react-refresh": "0.14.2"
+    },
+    "patchedDependencies": {
+      "pg-pool@3.14.0": "patches/pg-pool@3.14.0.patch",
+      "left-pad@1.3.0": "patches/left-pad@1.3.0.patch"
+    }
+  }
+}
+"
+`;
+
+exports[`persist-with-rds pg-pool patch given: [case5] a pg-pool release where the patched line moved, so the hunk fails when: [t0] pnpm install runs then: the warn an adopter reads matches snapshot: pnpm install — patch failure warn 1`] = `
+[
+  " WARN  Could not apply patch <tempdir>/patches/pg-pool.patch to <tempdir>/node_modules/.pnpm/pg-pool@3.14.0_patch_hash=<hash>_pg@8.3.0/node_modules/pg-pool",
+]
+`;
+
+exports[`persist-with-rds pg-pool patch given: [case6] a bare rds adopter: pg, pg-pool, the shipped cycle check, and one src file that imports pg when: [t0] its cycle check runs, with the shipped patch then: the verdict an adopter reads matches snapshot: test:lint:cycles — with the shipped patch 1`] = `
+[
+  "> pg-pool-patch-demo@ test:lint:cycles <tempdir>",
+  "> EXCL=$(node -p "(require('yaml').parse(require('fs').readFileSync('.dpdmrc.yaml','utf8'))?.exclude ?? []).join('|')") && dpdm --no-warning --no-tree --transform --exit-code circular:1 --exclude "$EXCL" 'src/**/!(*.test).ts'",
+  "• Circular Dependencies",
+  "  ✅ Congratulations, no circular dependency was found in your project.",
+  "- Start analyzing dependencies...",
+  "✔ [37/37] Analyze done!",
+]
+`;
+
+exports[`persist-with-rds pg-pool patch given: [case6] a bare rds adopter: pg, pg-pool, the shipped cycle check, and one src file that imports pg when: [t1] its cycle check runs, with no patch then: the verdict an adopter reads matches snapshot: test:lint:cycles — with no patch 1`] = `
+[
+  "> pg-pool-patch-demo@ test:lint:cycles <tempdir>",
+  "> EXCL=$(node -p "(require('yaml').parse(require('fs').readFileSync('.dpdmrc.yaml','utf8'))?.exclude ?? []).join('|')") && dpdm --no-warning --no-tree --transform --exit-code circular:1 --exclude "$EXCL" 'src/**/!(*.test).ts'",
+  "• Circular Dependencies",
+  "  1) node_modules/.pnpm/pg@<floor>/node_modules/pg/lib/index.js -> node_modules/.pnpm/pg-pool@3.14.0_pg@<floor>/node_modules/pg-pool/index.js",
+  " ELIFECYCLE  Command failed with exit code 1.",
+  "- Start analyzing dependencies...",
+  "✔ [37/37] Analyze done!",
+]
+`;

package/dist/.test/assets/git/declarations/practices/persist-with-rds/__snapshots__/provision-testdb-access.declapract.integration.test.ts.snap

@@ -0,0 +1,3 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-rds provision:testdb access given: the shipped best-practice package.json when: the provision:testdb chain is read then: the emitted provision:testdb chain matches snapshot: provision:testdb chain 1`] = `"npm run provision:testdb:docker:clear && npm run provision:testdb:docker:prepare && npm run provision:testdb:docker:up && npm run provision:testdb:docker:await && ACCESS=test npm run provision:schema:plan && ACCESS=test npm run provision:schema:apply && ACCESS=test npm run provision:schema:plan"`;

package/dist/.test/assets/git/declarations/practices/persist-with-rds/__snapshots__/ssm-param-names.declapract.integration.test.ts.snap

@@ -0,0 +1,9 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-rds ssm param names are the sdk-config derived names (#637) given: [case1] the wish run with ACCESS=prep CONFIG=prep when: [t0] getAllParameters is called with no choice override then: the declared names match snapshot 1`] = `
+[
+  "/@declapract{variable.organizationName}/@declapract{variable.projectName}/prep/database.role.crud.password",
+  "/@declapract{variable.organizationName}/@declapract{variable.projectName}/prep/database.role.cicd.for-plan.password",
+  "/@declapract{variable.organizationName}/@declapract{variable.projectName}/prep/database.role.cicd.for-apply.password",
+]
+`;

package/dist/.test/assets/git/declarations/practices/persist-with-rds/__snapshots__/testdb-preflight-failloud.declapract.integration.test.ts.snap

@@ -0,0 +1,30 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`testdb preflight fails loud (#589) given: the shipped wait-for-postgres preflight probe when: [t4] the shipped probe is vibechecked as a whole then: the emitted wait-for-postgres.sh matches snapshot: wait-for-postgres.sh preflight probe 1`] = `
+"#!/bin/sh
+set -eu
+# wait until postgres is really available
+maxcounter=45
+
+echo "waiting for postgres server to begin accepting connections..."
+counter=1
+# pass the secret via PGPASSWORD, not inline in the connection string (which leaks it to \`ps\`)
+export PGPASSWORD="\${POSTGRES_PASSWORD:-}"
+# capture the probe's stderr so the real cause (bad password, port conflict, image build failure)
+# surfaces on timeout, rather than one hardcoded diagnosis that reads the same for every cause
+lasterr=""
+while true; do
+    # fold the capture into the if-condition so \`set -e\` does not exit on the expected
+    # connect failures while postgres warms up; lasterr still holds the last stderr
+    if lasterr=$(psql "dbname=\${POSTGRES_DB:-} host=localhost user=postgres port=5432" -c '\\l' 2>&1); then break; fi
+    sleep 1
+    counter=\`expr $counter + 1\`
+    if [ $counter -gt $maxcounter ]; then
+        >&2 echo "postgres did not accept connections after \${maxcounter}s; the last psql error was:"
+        >&2 echo "$lasterr"
+        exit 1
+    fi;
+done
+echo "connected to postgres instance successfully"
+"
+`;

package/dist/.test/assets/git/declarations/practices/persist-with-rds/__snapshots__/with-connection-in-input.declapract.integration.test.ts.snap

@@ -0,0 +1,57 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`persist-with-rds with-connection-in-input given: [case1] a repo whose op imports withDatabaseConnection when: [t0] the input (before any fix) then: both src files match snapshot: op — before 1`] = `
+"import { DatabaseConnection } from '../utils/database/getDatabaseConnection';
+import {
+  withDatabaseConnection,
+} from '../utils/database/withDatabaseConnection';
+
+export const findSurferById = withDatabaseConnection(
+  async ({ id, dbConnection }: { id: string; dbConnection: DatabaseConnection }) =>
+    dbConnection.query({ sql: 'select * from surfer where id = :id', values: { id } }),
+);
+"
+`;
+
+exports[`persist-with-rds with-connection-in-input given: [case1] a repo whose op imports withDatabaseConnection when: [t0] the input (before any fix) then: both src files match snapshot: wrapper — before 1`] = `
+"import { DatabaseConnection, getDatabaseConnection } from './getDatabaseConnection';
+
+export const withDatabaseConnection =
+  <I extends { dbConnection: DatabaseConnection }, O>(
+    logic: (input: I) => Promise<O>,
+  ) =>
+  async (input: Omit<I, 'dbConnection'>): Promise<O> => {
+    const dbConnection = await getDatabaseConnection();
+    return logic({ ...input, dbConnection } as I);
+  };
+"
+`;
+
+exports[`persist-with-rds with-connection-in-input given: [case1] a repo whose op imports withDatabaseConnection when: [t1] the fix is applied then: the op gains one review line above its import, which names withDatabaseContext: op — after 1`] = `
+"import { DatabaseConnection } from '../utils/database/getDatabaseConnection';
+import {
+  withDatabaseConnection,
+// @declapract:review: withDatabaseConnection (dbConnection in the input) is retired — move to withDatabaseContext (src/utils/database/withDatabaseContext.ts), the (input, context) shape: each op becomes \`(input, context) => …\`, a dependency (dbConnection, log) moves out of the input into the context arg, and each caller passes it as the 2nd arg. then delete this marker
+} from '../utils/database/withDatabaseConnection';
+
+export const findSurferById = withDatabaseConnection(
+  async ({ id, dbConnection }: { id: string; dbConnection: DatabaseConnection }) =>
+    dbConnection.query({ sql: 'select * from surfer where id = :id', values: { id } }),
+);
+"
+`;
+
+exports[`persist-with-rds with-connection-in-input given: [case1] a repo whose op imports withDatabaseConnection when: [t1] the fix is applied then: the wrapper stays in place, marked, so the tree still builds: wrapper — after 1`] = `
+"import { DatabaseConnection, getDatabaseConnection } from './getDatabaseConnection';
+
+// @declapract:review: withDatabaseConnection (dbConnection in the input) is retired — move to withDatabaseContext (src/utils/database/withDatabaseContext.ts), the (input, context) shape: each op becomes \`(input, context) => …\`, a dependency (dbConnection, log) moves out of the input into the context arg, and each caller passes it as the 2nd arg. then delete this marker
+export const withDatabaseConnection =
+  <I extends { dbConnection: DatabaseConnection }, O>(
+    logic: (input: I) => Promise<O>,
+  ) =>
+  async (input: Omit<I, 'dbConnection'>): Promise<O> => {
+    const dbConnection = await getDatabaseConnection();
+    return logic({ ...input, dbConnection } as I);
+  };
+"
+`;

package/dist/.test/assets/git/declarations/practices/persist-with-rds/bad-practices/legacy-change-id/.declapract.integration.test.ts

@@ -0,0 +1,71 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useThen, when } from 'test-fns';
+
+/**
+ * .what = end-to-end proof of the legacy-change-id rename (#530), run through the REAL declapract
+ *         apply pipeline against a genTempDir clone of a consumer repo.
+ * .why = a unit test of `fix` never proves the `provision/schema/**\/*.yml` glob reaches a nested
+ *        definitions file, nor that one apply leaves the best-practice `init.yml` (CONTAINS, now on
+ *        `exid:`) satisfied. the repo's own change entry must move too, and keep its comment.
+ * .note = the init.yml is snapshotted in full, before AND after, per
+ *         rule.require.declapract-integration-tests.
+ */
+// each apply evaluates the whole practice, which runs long under a full suite
+jest.setTimeout(10 * 60 * 1000);
+
+describe('legacy-change-id (#530)', () => {
+  given('[case1] a repo whose schema definitions use the legacy `id:` key', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-persist-with-rds-legacy-change-id',
+      clone:
+        './src/practices/persist-with-rds/bad-practices/legacy-change-id/.test/assets/demo-repo-with-legacy-change-id',
+      symlink: [{ at: 'declarations', to: 'src' }],
+    });
+
+    const initPath = 'provision/schema/sql/init.yml';
+    const read = () => fs.readFile(path.join(tempDir, initPath), 'utf-8');
+    const apply = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.yml'),
+        practice: 'persist-with-rds',
+        file: initPath,
+      });
+
+    when('[t0] the input, before any fix', () => {
+      then('init.yml holds `id:` on each change, and matches snapshot', async () => {
+        const before = await read();
+        expect(before).toContain('  id: init_service_user');
+        expect(before).toMatchSnapshot('init.yml — before');
+      });
+    });
+
+    when('[t1] apply runs', () => {
+      useThen('apply the fix', async () => apply());
+
+      then('each change entry declares `exid:`, the repo extra kept, and matches snapshot', async () => {
+        const after = await read();
+        expect(after).toContain('  exid: init_default_txn_isolation');
+        expect(after).toContain('  exid: init_service_user');
+        expect(after).toContain('  exid: init_analyst_user');
+        expect(after).toContain('# a change the repo added on its own');
+        expect(after).not.toMatch(/^\s*id:/m);
+        expect(after).toMatchSnapshot('init.yml — after');
+      });
+    });
+
+    when('[t2] apply runs again (idempotency)', () => {
+      const passes = useThen('a second apply', async () => {
+        const before = await read();
+        await apply();
+        return { before, after: await read() };
+      });
+
+      then('the second apply changes zero bytes', () => {
+        expect(passes.after).toEqual(passes.before);
+      });
+    });
+  });
+});

package/dist/.test/assets/git/declarations/practices/persist-with-rds/bad-practices/legacy-change-id/.declapract.readme.md

@@ -0,0 +1,6 @@
+sql-schema-control@1.8.0 renamed a change entry's natural key from `id:` to `exid:`. the tool still
+reads `id:`, with a deprecation nudge on every plan and apply.
+
+this fix renames `id:` to `exid:` on each `type: change` entry under `provision/schema/`. the value
+stays the same, so the change hashes still match. an `id` key outside a change entry is left alone,
+and an entry that already declares `exid` is left alone.

package/dist/.test/assets/git/declarations/practices/persist-with-rds/bad-practices/legacy-change-id/.test/assets/demo-repo-with-legacy-change-id/declapract.declare.yml

@@ -0,0 +1,4 @@
+declare:
+  examples: declarations/examples
+  practices: declarations/practices
+  use-cases: declarations/useCases.yml

package/dist/.test/assets/git/declarations/practices/persist-with-rds/bad-practices/legacy-change-id/.test/assets/demo-repo-with-legacy-change-id/declapract.use.yml

@@ -0,0 +1,19 @@
+declarations: './'
+useCase: lambda-service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  databaseName: 'testdb'
+  databaseClusterName: 'testdb'
+  databaseUserName:
+    cicdUser: 'testdb_cicd'
+    serviceUser: 'testdb_service'
+  databaseTunnelHost:
+    prep: 'localhost'
+    prod: 'localhost'
+  databaseClusterHost:
+    prep: 'localhost'
+    prod: 'localhost'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'

package/dist/.test/assets/git/declarations/practices/persist-with-rds/bad-practices/legacy-change-id/.test/assets/demo-repo-with-legacy-change-id/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/.test/assets/git/declarations/practices/persist-with-rds/bad-practices/legacy-change-id/.test/assets/demo-repo-with-legacy-change-id/provision/schema/sql/init.yml

@@ -0,0 +1,15 @@
+- type: change
+  id: init_default_txn_isolation
+  author: declapract
+  path: ./init/default_transaction_isolation.sql
+
+- type: change
+  id: init_service_user
+  author: declapract
+  path: ./init/user.service.sql
+
+# a change the repo added on its own
+- type: change
+  id: init_analyst_user
+  author: surfschool
+  path: ./init/user.analyst.sql