declapract-typescript-ehmpathy 0.49.2 → 0.49.4

package/dist/practices/node-service/bad-practices/simple-lambda-client/.declapract.readme.md

@@ -0,0 +1,55 @@
+# simple-lambda-client
+
+## what
+
+detects and transforms simple-lambda-client usage to sdk-aws-lambda.
+
+## why
+
+sdk-aws-lambda provides modern lambda client patterns:
+- context-based configuration
+- trail.exid auto-propagation through call chain
+- better cache support
+
+## transforms
+
+| old | new |
+|-----|-----|
+| `import { invokeLambdaFunction } from 'simple-lambda-client'` | `import { askLambdaEndpoint } from 'sdk-aws-lambda'` |
+| `invokeLambdaFunction(...)` | `askLambdaEndpoint(...)` |
+
+## limitations
+
+these patterns require manual migration:
+
+- `{ service, function, stage, event }` → `{ which: { service, function }, event }, context`
+- `stage: string` → `context.env.access: string`
+- `logDebug?: LogMethod` → `context.log: LogMethods` (required)
+- `cache?: SimpleCache<O>` → `context.cache?: { response?, dedupe? }`
+
+## example
+
+before:
+```ts
+import { invokeLambdaFunction } from 'simple-lambda-client';
+
+const result = await invokeLambdaFunction({
+  service: 'svc-users',
+  function: 'getUser',
+  stage: 'prod',
+  event: { userId: '123' },
+});
+```
+
+after (requires manual refinement):
+```ts
+import { askLambdaEndpoint } from 'sdk-aws-lambda';
+
+const result = await askLambdaEndpoint(
+  {
+    which: { service: 'svc-users', function: 'getUser' },
+    event: { userId: '123' },
+  },
+  { log, env: { access: 'prod' } },
+);
+```

package/dist/practices/node-service/bad-practices/simple-lambda-client/package.json

@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "simple-lambda-client": "@declapract{check.minVersion('0.0.0')}"
+  }
+}

package/dist/practices/node-service/bad-practices/simple-lambda-client/package.json.declapract.ts

@@ -0,0 +1,27 @@
+import { FileCheckType, type FileFixFunction } from 'declapract';
+
+export const check = FileCheckType.CONTAINS;
+
+/**
+ * .what = removes simple-lambda-client and adds sdk-aws-lambda
+ * .why = sdk-aws-lambda is the modern replacement with better patterns
+ */
+export const fix: FileFixFunction = (contents) => {
+  if (!contents) return { contents };
+
+  const packageJSON = JSON.parse(contents);
+
+  const updatedPackageJSON = {
+    ...packageJSON,
+    dependencies: {
+      ...packageJSON.dependencies,
+      'simple-lambda-client': undefined,
+      'sdk-aws-lambda':
+        packageJSON.dependencies?.['sdk-aws-lambda'] ?? '^0.1.0',
+    },
+  };
+
+  return {
+    contents: JSON.stringify(updatedPackageJSON, null, 2),
+  };
+};

package/dist/practices/node-service/bad-practices/simple-lambda-client/src/<star><star>/<star>.ts.declapract.ts

@@ -0,0 +1,44 @@
+import type { FileCheckFunction, FileFixFunction } from 'declapract';
+
+/**
+ * .what = detects simple-lambda-client imports in source files
+ * .why = simple-lambda-client should be replaced with sdk-aws-lambda
+ */
+export const check: FileCheckFunction = (contents) => {
+  // match if file imports from simple-lambda-client
+  if (contents?.includes("from 'simple-lambda-client'")) return;
+  if (contents?.includes('from "simple-lambda-client"')) return;
+
+  // no match
+  throw new Error('does not import from simple-lambda-client');
+};
+
+/**
+ * .what = transforms simple-lambda-client imports to sdk-aws-lambda
+ * .why = automated migration reduces manual toil
+ *
+ * .note = basic transforms only; complex patterns require manual fix
+ *
+ * API map:
+ * - invokeLambdaFunction → askLambdaEndpoint
+ */
+export const fix: FileFixFunction = (contents) => {
+  if (!contents) return {};
+
+  const updated = contents
+    // transform imports
+    .replace(
+      /import\s+\{([^}]*)\}\s+from\s+['"]simple-lambda-client['"]/g,
+      (match, imports) => {
+        const updatedImports = imports.replace(
+          /invokeLambdaFunction/g,
+          'askLambdaEndpoint',
+        );
+        return `import {${updatedImports}} from 'sdk-aws-lambda'`;
+      },
+    )
+    // transform function calls
+    .replace(/invokeLambdaFunction/g, 'askLambdaEndpoint');
+
+  return { contents: updated };
+};

package/dist/practices/node-service/bad-practices/simple-lambda-handlers/.declapract.readme.md

@@ -0,0 +1,52 @@
+# simple-lambda-handlers
+
+## what
+
+detects and transforms simple-lambda-handlers usage to sdk-aws-lambda.
+
+## why
+
+sdk-aws-lambda provides modern lambda handler patterns:
+- better schema validation with zod (input + output)
+- log context passed to invoke function
+- trail.exid auto-propagation
+
+## transforms
+
+| old | new |
+|-----|-----|
+| `import { createStandardHandler } from 'simple-lambda-handlers'` | `import { genLambdaEndpoint } from 'sdk-aws-lambda'` |
+| `import { createApiGatewayHandler } from 'simple-lambda-handlers'` | `import { genLambdaEndpoint } from 'sdk-aws-lambda'` |
+| `createStandardHandler(...)` | `genLambdaEndpoint(...)` |
+| `createApiGatewayHandler(...)` | `genLambdaEndpoint.for.apiGateway(...)` |
+
+## limitations
+
+these patterns require manual migration:
+
+- `schema` (single joi) → `schema: { input, output }` (split zod)
+- `logic: (event) => O` → `invoke: ({ event }, { log }) => O`
+- `log` passed at creation → `log` also received in invoke context
+
+## example
+
+before:
+```ts
+import { createStandardHandler } from 'simple-lambda-handlers';
+
+export const handler = createStandardHandler({
+  log,
+  schema,
+  logic: async (event) => doStuff(event),
+});
+```
+
+after (requires manual refinement):
+```ts
+import { genLambdaEndpoint } from 'sdk-aws-lambda';
+
+export const handler = genLambdaEndpoint({
+  schema: { input: inputSchema, output: outputSchema },
+  invoke: async ({ event }, { log }) => doStuff(event),
+}, { log });
+```

package/dist/practices/node-service/bad-practices/simple-lambda-handlers/package.json

@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "simple-lambda-handlers": "@declapract{check.minVersion('0.0.0')}"
+  }
+}

package/dist/practices/node-service/bad-practices/simple-lambda-handlers/package.json.declapract.ts

@@ -0,0 +1,27 @@
+import { FileCheckType, type FileFixFunction } from 'declapract';
+
+export const check = FileCheckType.CONTAINS;
+
+/**
+ * .what = removes simple-lambda-handlers and adds sdk-aws-lambda
+ * .why = sdk-aws-lambda is the modern replacement with better patterns
+ */
+export const fix: FileFixFunction = (contents) => {
+  if (!contents) return { contents };
+
+  const packageJSON = JSON.parse(contents);
+
+  const updatedPackageJSON = {
+    ...packageJSON,
+    dependencies: {
+      ...packageJSON.dependencies,
+      'simple-lambda-handlers': undefined,
+      'sdk-aws-lambda':
+        packageJSON.dependencies?.['sdk-aws-lambda'] ?? '^0.1.0',
+    },
+  };
+
+  return {
+    contents: JSON.stringify(updatedPackageJSON, null, 2),
+  };
+};

package/dist/practices/node-service/bad-practices/simple-lambda-handlers/src/<star><star>/<star>.ts.declapract.ts

@@ -0,0 +1,50 @@
+import type { FileCheckFunction, FileFixFunction } from 'declapract';
+
+/**
+ * .what = detects simple-lambda-handlers imports in source files
+ * .why = simple-lambda-handlers should be replaced with sdk-aws-lambda
+ */
+export const check: FileCheckFunction = (contents) => {
+  // match if file imports from simple-lambda-handlers
+  if (contents?.includes("from 'simple-lambda-handlers'")) return;
+  if (contents?.includes('from "simple-lambda-handlers"')) return;
+
+  // no match
+  throw new Error('does not import from simple-lambda-handlers');
+};
+
+/**
+ * .what = transforms simple-lambda-handlers imports to sdk-aws-lambda
+ * .why = automated migration reduces manual toil
+ *
+ * .note = basic transforms only; complex patterns require manual fix
+ *
+ * API map:
+ * - createStandardHandler → genLambdaEndpoint
+ * - createApiGatewayHandler → genLambdaEndpoint.for.apiGateway
+ */
+export const fix: FileFixFunction = (contents) => {
+  if (!contents) return {};
+
+  const updated = contents
+    // transform imports (dedupe to avoid duplicate genLambdaEndpoint)
+    .replace(
+      /import\s+\{([^}]*)\}\s+from\s+['"]simple-lambda-handlers['"]/g,
+      (match, imports) => {
+        // split, replace, dedupe, join
+        const importList = imports.split(',').map((s: string) => s.trim());
+        const transformed = importList.map((name: string) => {
+          if (name === 'createStandardHandler') return 'genLambdaEndpoint';
+          if (name === 'createApiGatewayHandler') return 'genLambdaEndpoint';
+          return name;
+        });
+        const deduped = [...new Set(transformed)];
+        return `import { ${deduped.join(', ')} } from 'sdk-aws-lambda'`;
+      },
+    )
+    // transform function calls
+    .replace(/createStandardHandler/g, 'genLambdaEndpoint')
+    .replace(/createApiGatewayHandler/g, 'genLambdaEndpoint.for.apiGateway');
+
+  return { contents: updated };
+};

package/dist/practices/node-service/best-practice/package.json

@@ -1,3 +1,6 @@
 {
-  "private": true
+  "private": true,
+  "dependencies": {
+    "sdk-aws-lambda": "@declapract{check.minVersion('0.0.1')}"
+  }
 }

package/dist/practices/package-json-order/best-practice/package.json.declapract.ts

@@ -53,7 +53,7 @@ export const desiredRelativeKeyOrder = {
     'provision:testdb:docker:down',
     'provision:testdb',
     'start:testdb',
-    'start:livedb:dev',
+    'start:livedb:prep',
     'test:auth',
     'test:commits',
     'test:types',
@@ -82,34 +82,34 @@ export const desiredRelativeKeyOrder = {
     'deploy:prune',
     'deploy:release',
     'deploy:send-notification',
-    'deploy:dev',
+    'deploy:prep',
     'deploy:prod',
     'deploy',
 
     // from app-react-native-expo
     'start:hot:proxy',
-    'start:hot:dev',
-    'start:hot:dev:link',
-    'start:hot:dev:proxy',
+    'start:hot:prep',
+    'start:hot:prep:link',
+    'start:hot:prep:proxy',
     'start:hot:prod',
     'start:hot:prod:link',
     'start:hot:prod:proxy',
     'start:cold:proxy',
-    'start:cold:dev',
-    'start:cold:dev:link',
-    'start:cold:dev:proxy',
+    'start:cold:prep',
+    'start:cold:prep:link',
+    'start:cold:prep:proxy',
     'start:cold:prod',
     'start:cold:prod:link',
     'register:device:apple:info',
     'register:device:apple:inclusions:rebuild:prod',
-    'register:device:apple:inclusions:rebuild:dev',
+    'register:device:apple:inclusions:rebuild:prep',
     'register:device:apple:add',
     'register:device:apple:list',
     'register:device:apple:delete',
     'register:device:apple:rename',
     'register:profile:apple:list',
-    'build:dev:ios',
-    'build:dev:android',
+    'build:prep:ios',
+    'build:prep:android',
     'build:web',
     'deploy:prod:ios:metadata',
     'open:store:android',

package/dist/practices/persist-with-rds/best-practice/.declapract.readme.md

@@ -1,6 +1,26 @@
 we use:
 - postgres database
-  - provisioned by aws rds aurora when in dev and prod env
+  - provisioned by aws rds aurora when in prep and prod env
   - provisioned by docker when in test env
 - sql-schema-control to manage sql schema
 - sql-dao-generator to generate the sql-schemas + daos
+
+## required variables
+
+| variable | description | example |
+|----------|-------------|---------|
+| `databaseTunnelHost.{prep,prod}` | ssm proxy host for database tunnel | `aws.ssmproxy.ahbodedb.prep` |
+| `databaseClusterHost.{prep,prod}` | rds cluster endpoint | `ahbodedb.cluster-xxx.us-east-1.rds.amazonaws.com` |
+
+## ssm parameters
+
+terraform provisions these ssm parameters for database credentials:
+
+| parameter name | description | environments |
+|----------------|-------------|--------------|
+| `{namespace}.database.role.cicd.password` | password for cicd database user | prep, prod |
+| `{namespace}.database.role.crud.password` | password for crud database user | prep, prod |
+
+legacy parameters (kept for backwards compatibility):
+- `{namespace}.database.admin.password`
+- `{namespace}.database.service.password`

package/dist/practices/persist-with-rds/best-practice/provision/aws/product/parameter-store.tf

@@ -1,3 +1,6 @@
+# ====================
+# legacy params (kept for backwards compatibility)
+# ====================
 resource "aws_ssm_parameter" "secret_database_admin_password" {
   name  = "${local.parameter_store_namespace}.database.admin.password"
   type  = "SecureString"
@@ -22,3 +25,39 @@ resource "aws_ssm_parameter" "secret_database_service_password" {
     ]
   }
 }
+
+# ====================
+# new role-based params (standard naming)
+# ====================
+# read legacy params to copy values (prod only)
+data "aws_ssm_parameter" "legacy_admin_password" {
+  name            = "${local.parameter_store_namespace}.database.admin.password"
+  count           = var.environment == "prod" ? 1 : 0
+  with_decryption = true
+}
+data "aws_ssm_parameter" "legacy_service_password" {
+  name            = "${local.parameter_store_namespace}.database.service.password"
+  count           = var.environment == "prod" ? 1 : 0
+  with_decryption = true
+}
+
+resource "aws_ssm_parameter" "secret_database_role_cicd_password" {
+  name  = "${local.parameter_store_namespace}.database.role.cicd.password"
+  type  = "SecureString"
+  value = var.environment == "prod" ? data.aws_ssm_parameter.legacy_admin_password[0].value : "__CHANG3_ME__"
+  tags  = local.tags
+  count = var.environment != "test" ? 1 : 0
+  lifecycle {
+    ignore_changes = [value]
+  }
+}
+resource "aws_ssm_parameter" "secret_database_role_crud_password" {
+  name  = "${local.parameter_store_namespace}.database.role.crud.password"
+  type  = "SecureString"
+  value = var.environment == "prod" ? data.aws_ssm_parameter.legacy_service_password[0].value : "__CHANG3_ME__"
+  tags  = local.tags
+  count = var.environment != "test" ? 1 : 0
+  lifecycle {
+    ignore_changes = [value]
+  }
+}

package/dist/practices/persist-with-rds/best-practice/provision/schema/deploy.database.sh

@@ -13,20 +13,20 @@
 ##
 ## usage example:
 ## ```sh
-## ./provision/schema/deploy.database.sh dev $(op item get ahbodedb.dev.postgres --fields label=password --format json | jq -r .value)
+## ./provision/schema/deploy.database.sh prep $(op item get ahbodedb.prep.postgres --fields label=password --format json | jq -r .value)
 ## ```
 #####################################################
 
 # check that user has defined the environment that they want this key created for correctly
 ENVIRONMENT=$1;
-if [ "$ENVIRONMENT" != "prod" ] && [ "$ENVIRONMENT" != "dev" ]; then
-  echo "\nerror: Environment, the first argument, must be specified as either 'prod' or 'dev'. You specified '$ENVIRONMENT'";
+if [ "$ENVIRONMENT" != "prod" ] && [ "$ENVIRONMENT" != "prep" ]; then
+  echo "\nerror: Environment, the first argument, must be specified as either 'prod' or 'prep'. You specified '$ENVIRONMENT'";
   exit 1;
 fi
 
 # check that user is authed into correct account
 AWS_ACCOUNT_ID=$(aws sts get-caller-identity | jq -r '.Account');
-EXPECTED_AWS_ACCOUNT_ID=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.awsAccountId.prod}" || echo "@declapract{variable.awsAccountId.dev}");
+EXPECTED_AWS_ACCOUNT_ID=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.awsAccountId.prod}" || echo "@declapract{variable.awsAccountId.prep}");
 if [ "$AWS_ACCOUNT_ID" != "$EXPECTED_AWS_ACCOUNT_ID" ]; then
   echo "\nerror: the AWS_ACCOUNT that you are signed into is not correct for the environment you specified. You are authed into account '$AWS_ACCOUNT_ID' but the correct account id for '$ENVIRONMENT' IS '$EXPECTED_AWS_ACCOUNT_ID'";
   exit 1;
@@ -41,20 +41,20 @@ fi;
 
 # check that the cicd password was provisioned, if in prod, since this is used to create the cicd user
 if [ "$ENVIRONMENT" = "prod" ]; then
-  CICD_USER_PASSWORD=$(aws ssm get-parameter --name "@declapract{variable.organizationName}.@declapract{variable.projectName}.$ENVIRONMENT.database.admin.password" --with-decryption --output text --query Parameter.Value)
+  CICD_USER_PASSWORD=$(aws ssm get-parameter --name "@declapract{variable.organizationName}.@declapract{variable.projectName}.$ENVIRONMENT.database.role.cicd.password" --with-decryption --output text --query Parameter.Value)
   if [ -z "$CICD_USER_PASSWORD" ]; then
     echo "\nerror: CICD_USER_PASSWORD must be provisioned with terraform before running this"
     exit 1;
   fi;
-  if [ "$CICD_USER_PASSWORD" = "__IGNORED__" ]; then
-    echo "\nerror: CICD_USER_PASSWORD must be set to a value other than the default of '__IGNORED__'"
+  if [ "$CICD_USER_PASSWORD" = "__IGNORED__" ] || [ "$CICD_USER_PASSWORD" = "__CHANG3_ME__" ]; then
+    echo "\nerror: CICD_USER_PASSWORD must be set to a value other than the default placeholder"
     exit 1;
   fi;
 fi;
 
 
 # define the postgres connecition string
-CLUSTER_HOST=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.databaseTunnelHost.prod}" || echo "@declapract{variable.databaseTunnelHost.dev}");
+CLUSTER_HOST=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.databaseTunnelHost.prod}" || echo "@declapract{variable.databaseTunnelHost.prep}");
 CLUSTER_CONNECTION_STRING=postgresql://postgres:$POSTGRES_ADMIN_PASSWORD@$CLUSTER_HOST:5432
 ROOT_DB_CONNECTION_STRING=$CLUSTER_CONNECTION_STRING/postgres
 SVC_DB_CONNECTION_STRING=$CLUSTER_CONNECTION_STRING/@declapract{variable.databaseName}
@@ -75,7 +75,7 @@ echo "\n 🔨 creating the schema..."
 psql $SVC_DB_CONNECTION_STRING -f $INIT_SQLS_DIR/.schema.sql
 
 if [ "$ENVIRONMENT" = "prod" ]; then
-  echo "\n 🔨 granting reads to the datalakedb user..." # only in prod env; we dont want dev's testing data in our datalake
+  echo "\n 🔨 granting reads to the datalakedb user..." # only in prod env; we dont want prep's test data in our datalake
   psql $SVC_DB_CONNECTION_STRING -f $INIT_SQLS_DIR/.user.datalakedb.sql
 fi;
 

package/dist/practices/provision-github/best-practice/.declapract.readme.md

@@ -0,0 +1,7 @@
+provisions github repository settings and environments via declastruct-github-sdk.
+
+## required variables
+
+| variable | description | example |
+|----------|-------------|---------|
+| `reviewers.users` | github usernames for production deployment reviewers | `['whodisio', 'ehmpathy']` |

package/dist/practices/rhachet/bad-practices/review-peer-artifacts/.behavior/<star><star>/.reviews/<star><star>/<star>peer-review<star>.md.declapract.ts

@@ -0,0 +1,16 @@
+import { FileCheckType, type FileFixFunction } from 'declapract';
+
+/**
+ * .what = detects committed peer-review artifacts under .behavior/**\/.reviews
+ * .why = peer-review files are noise; far less important than the root behavior
+ *        files, so they should not be tracked in git
+ *
+ * .note = matches the old flat shape, where peer-review files sit directly in
+ *         .reviews with `peer-review` in the filename
+ */
+
+export const check = FileCheckType.EXISTS;
+
+export const fix: FileFixFunction = () => {
+  return { contents: null }; // delete the file
+};

package/dist/practices/rhachet/bad-practices/review-peer-artifacts/.behavior/<star><star>/.reviews/peer/<star><star>/<star>.md.declapract.ts

@@ -0,0 +1,16 @@
+import { FileCheckType, type FileFixFunction } from 'declapract';
+
+/**
+ * .what = detects committed peer-review artifacts under .behavior/**\/.reviews/peer
+ * .why = peer-review files are noise; far less important than the root behavior
+ *        files, so they should not be tracked in git
+ *
+ * .note = matches the new shape, where all peer-review files live under a
+ *         dedicated `peer` directory
+ */
+
+export const check = FileCheckType.EXISTS;
+
+export const fix: FileFixFunction = () => {
+  return { contents: null }; // delete the file
+};

package/dist/practices/rhachet/bad-practices/review-peer-artifacts/.declapract.readme.md

@@ -0,0 +1,12 @@
+peer review artifacts should not be committed to git
+
+these files live under `.behavior/**/.reviews/` and capture peer-review feedback
+from the behavior build lifecycle. they are noise for the most part — far less
+important than the root behavior files themselves.
+
+two path shapes are removed:
+
+- old (flat): `.behavior/**/.reviews/**/*peer-review*.md`
+- new (peer dir): `.behavior/**/.reviews/peer/**/*.md`
+
+self-reviews and other non-peer artifacts under `.reviews/` are intentionally left alone.

package/dist/practices/{runtime-type-checking → runtime-schemas}/bad-practices/joi/package.json.declapract.ts

@@ -12,6 +12,10 @@ export const fix: FileFixFunction = (contents) => {
       joi: undefined,
       zod: packageJSON.dependencies?.zod ?? '^3.24.0',
     },
+    devDependencies: {
+      ...packageJSON.devDependencies,
+      '@types/joi': undefined,
+    },
   };
   return {
     contents: JSON.stringify(updatedPackageJSON, null, 2),

package/dist/practices/runtime-schemas/bad-practices/joi/src/<star><star>/<star>.ts.declapract.ts

@@ -0,0 +1,50 @@
+import type { FileCheckFunction, FileFixFunction } from 'declapract';
+
+/**
+ * .what = detects joi imports in source files
+ * .why = joi should be replaced with zod for better typescript integration
+ */
+export const check: FileCheckFunction = (contents) => {
+  // match if file imports from joi
+  if (contents?.includes("from 'joi'")) return;
+  if (contents?.includes('from "joi"')) return;
+
+  // no match
+  throw new Error('does not import from joi');
+};
+
+/**
+ * .what = transforms joi imports and basic schema patterns to zod
+ * .why = automated migration reduces manual toil
+ *
+ * .note = basic transforms only; complex patterns require manual fix
+ */
+export const fix: FileFixFunction = (contents) => {
+  if (!contents) return {};
+
+  const updated = contents
+    // transform imports: import Joi from 'joi' → import { z } from 'zod'
+    .replace(/import\s+Joi\s+from\s+['"]joi['"]/g, "import { z } from 'zod'")
+    // transform imports: import * as Joi from 'joi' → import { z } from 'zod'
+    .replace(
+      /import\s+\*\s+as\s+Joi\s+from\s+['"]joi['"]/g,
+      "import { z } from 'zod'",
+    )
+    // transform imports: import { ... } from 'joi' → import { z } from 'zod'
+    .replace(
+      /import\s+\{[^}]*\}\s+from\s+['"]joi['"]/g,
+      "import { z } from 'zod'",
+    )
+    // transform basic schema patterns: Joi.* → z.*
+    .replace(/Joi\.object/g, 'z.object')
+    .replace(/Joi\.string/g, 'z.string')
+    .replace(/Joi\.number/g, 'z.number')
+    .replace(/Joi\.boolean/g, 'z.boolean')
+    .replace(/Joi\.array/g, 'z.array')
+    .replace(/Joi\.date/g, 'z.date')
+    .replace(/Joi\.any/g, 'z.any')
+    // transform .required() → remove (zod is required by default)
+    .replace(/\.required\(\)/g, '');
+
+  return { contents: updated };
+};

package/dist/practices/serverless/best-practice/package.json

@@ -5,8 +5,8 @@
     "if-env": "@declapract{check.minVersion('1.0.4')}"
   },
   "scripts": {
-    "deploy:prune": "SLS_STAGE=$(if [ \"$ACCESS\" = 'prep' ]; then echo 'dev'; else echo \"$ACCESS\"; fi) && export COMMIT=$(npx sdk-environment get commit) && npx sls prune -n 7 --stage $SLS_STAGE",
-    "deploy:release": "SLS_STAGE=$(if [ \"$ACCESS\" = 'prep' ]; then echo 'dev'; else echo \"$ACCESS\"; fi) && export COMMIT=$(npx sdk-environment get commit) && npm run build && sls deploy --verbose --stage $SLS_STAGE",
+    "deploy:prune": "export COMMIT=$(npx sdk-environment get commit) && export SLS_STAGE=$([ \"$ACCESS\" = 'prep' ] && echo 'dev' || echo \"$ACCESS\") && npx sls prune -n 7 --stage $SLS_STAGE",
+    "deploy:release": "export COMMIT=$(npx sdk-environment get commit) && export SLS_STAGE=$([ \"$ACCESS\" = 'prep' ] && echo 'dev' || echo \"$ACCESS\") && npm run build && sls deploy --verbose --stage $SLS_STAGE",
     "deploy:send-notification": "curl -X POST -H 'Content-type: application/json' --data \"{\\\"text\\\":\\\"$([ -z $DEPLOYER_NAME ] && git config user.name || echo $DEPLOYER_NAME) has deployed $npm_package_name@v$npm_package_version:\nhttps://github.com/@declapract{variable.organizationName}/$npm_package_name/tree/v$npm_package_version\\\"}\" @declapract{variable.slackWebhookUrl}",
     "deploy:prep": "ACCESS=prep npm run deploy:release",
     "deploy:prod": "ACCESS=prod npm run deploy:release && npm run deploy:send-notification",

package/dist/practices/serverless/best-practice/serverless.yml

@@ -10,7 +10,7 @@ plugins:
 
 custom:
   accessByStage:
-    dev: prep
+    dev: prep # stage=dev deploys to $service-dev but uses ACCESS=prep (config/prep.json)
     prod: prod
 
 provider:
@@ -25,8 +25,8 @@ provider:
     product: ${self:service}
   environment:
     TZ: UTC # guarantee that utc timezone will be used explicitly, to facilitate a pit of success
-    NODE_ENV: production # deploy with production optimizations of all resources, to make `dev` and `prod` stage deployments equivalent functionally (i.e., the same code paths in dev and prod)
-    ACCESS: ${self:custom.accessByStage.${opt:stage}, 'prep'} # sdk-environment access tier, to target the correct config + resources (e.g., hit dev db -vs- prod db)
+    NODE_ENV: production # deploy with production optimizations of all resources, to make `prep` and `prod` stage deployments equivalent functionally (i.e., the same code paths in prep and prod)
+    ACCESS: ${self:custom.accessByStage.${opt:stage}, 'prep'} # sdk-environment access tier, to target the correct config + resources (e.g., hit prep db -vs- prod db)
     COMMIT: ${env:COMMIT} # sdk-environment commit slug, must be set by deploy command
     AWS_NODEJS_CONNECTION_REUSE_ENABLED: true # https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/node-reusing-connections.html
   deploymentBucket: serverless-deployment-@declapract{variable.infrastructureNamespaceId}-${self:provider.stage}

package/dist/practices/serverless/best-practice/serverless.yml.declapract.ts

@@ -11,7 +11,7 @@ const accessInferencePolicy = `    # allow access inference from account name
 
 const accessByStageCustom = `custom:
   accessByStage:
-    dev: prep
+    dev: prep # stage=dev deploys to $service-dev but uses ACCESS=prep (config/prep.json)
     prod: prod
 
 `;
@@ -70,7 +70,7 @@ export const fix: FileFixFunction = (contents) => {
   ) {
     fixed = fixed.replace(
       /STAGE: \$\{self:provider\.stage\}[^\n]*/,
-      "ACCESS: ${self:custom.accessByStage.${opt:stage}, 'prep'} # sdk-environment access tier, to target the correct config + resources (e.g., hit dev db -vs- prod db)\n    COMMIT: ${env:COMMIT} # sdk-environment commit slug, must be set by deploy command",
+      "ACCESS: ${self:custom.accessByStage.${opt:stage}, 'prep'} # sdk-environment access tier, to target the correct config + resources (e.g., hit prep db -vs- prod db)\n    COMMIT: ${env:COMMIT} # sdk-environment commit slug, must be set by deploy command",
     );
   }