declapract-typescript-ehmpathy 0.49.3 → 0.49.5

package/dist/getVariables.ts

@@ -10,7 +10,7 @@ export const getServiceVariables = createGetVariables({
   infrastructureNamespaceId: 'abcde12345',
   slackWebhookUrl: 'https://...',
   awsAccountId: {
-    dev: '123abc',
+    prep: '123abc',
     prod: '456def',
   },
 });
@@ -18,9 +18,13 @@ export const getServiceVariables = createGetVariables({
 export const getRdsVariables = createGetVariables({
   databaseName: 'awesomethingdb',
   databaseClusterHost: {
-    dev: 'awesomesdb.cluster-abc123.us-east-1.rds.amazonaws.com',
+    prep: 'awesomesdb.cluster-abc123.us-east-1.rds.amazonaws.com',
     prod: 'awesomesdb.cluster-def456.us-east-1.rds.amazonaws.com',
   },
+  databaseTunnelHost: {
+    prep: 'aws.ssmproxy.awesomesdb.prep',
+    prod: 'aws.ssmproxy.awesomesdb.prod',
+  },
   databaseUserName: {
     serviceUser: 'svc_awesome_thing_user',
     cicdUser: 'awesomethingdb_cicd',

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/.deploy-expo.yml

@@ -5,7 +5,7 @@ on:
     inputs:
       stage:
         type: string
-        description: "the stage of infrastructure to deploy against (e.g., prod, dev)"
+        description: "the stage of infrastructure to deploy against (e.g., prod, prep)"
         required: true
       build:
         type: string

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/deploy.yml

@@ -13,10 +13,10 @@ on:
         description: 'which stage do you want to deploy to?'
         type: choice
         options:
-          - dev
+          - prep
           - prod
         required: true
-        default: 'dev'
+        default: 'prep'
       thoroughly:
         description: 'should we run tests before this deployment?'
         type: choice
@@ -36,22 +36,22 @@ jobs:
     if: github.event_name != 'workflow_dispatch' || github.event.inputs.thoroughly == 'true'
     with:
       creds-aws-region: us-east-1
-      creds-aws-role-arn: arn:aws:iam::@declapract{variable.awsAccountId.dev}:role/@declapract{variable.projectName}-github-actions-dev
+      creds-aws-role-arn: arn:aws:iam::@declapract{variable.awsAccountId.prep}:role/@declapract{variable.projectName}-github-actions-prep
     secrets: inherit # keyrack firewall in .test.yml filters to declared keys
 
-  dev:
+  prep:
     uses: ./.github/workflows/.deploy-expo.yml
     needs: [test]
     # dont deploy on merge to main by default, since builds are expensive
     if: |
-      ((github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' && false) || github.event.inputs.stage == 'dev') &&
+      ((github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' && false) || github.event.inputs.stage == 'prep') &&
       always() && (needs.test.result == 'success' || needs.test.result == 'skipped')
     with:
-      stage: dev
+      stage: prep
       build: development
-      github-environment: dev
+      github-environment: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: arn:aws:iam::@declapract{variable.awsAccountId.dev}:role/@declapract{variable.projectName}-github-actions-dev
+      creds-aws-role-arn: arn:aws:iam::@declapract{variable.awsAccountId.prep}:role/@declapract{variable.projectName}-github-actions-prep
     secrets:
       expo-token: ${{ secrets.EXPO_TOKEN }}
 

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/test.yml

@@ -17,7 +17,7 @@ jobs:
     uses: ./.github/workflows/.test.yml
     with:
       aws-region: us-east-1
-      aws-account-id: '@declapract{variable.awsAccountId.dev}'
+      aws-account-id: '@declapract{variable.awsAccountId.prep}'
     secrets:
-      aws-access-key-id: ${{ secrets.DEV_AWS_ACCESS_KEY_ID }}
-      aws-secret-access-key: ${{ secrets.DEV_AWS_SECRET_ACCESS_KEY }}
+      aws-access-key-id: ${{ secrets.PREP_AWS_ACCESS_KEY_ID }}
+      aws-secret-access-key: ${{ secrets.PREP_AWS_SECRET_ACCESS_KEY }}

package/dist/practices/cicd-app-react-native-expo/best-practice/package.json

@@ -12,28 +12,28 @@
   },
   "scripts": {
     "start:hot:proxy": "npx local-ssl-proxy --source 3447 --target 8081",
-    "start:hot:dev": "STAGE=dev npx expo start --clear --dev-client",
-    "start:hot:dev:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.dev}:@declapract{variable.app.web.port.hot}'",
-    "start:hot:dev:proxy": "npm run start:hot:dev:link && npm run start:hot:proxy",
+    "start:hot:prep": "STAGE=prep npx expo start --clear --dev-client",
+    "start:hot:prep:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prep}:@declapract{variable.app.web.port.hot}'",
+    "start:hot:prep:proxy": "npm run start:hot:prep:link && npm run start:hot:proxy",
     "start:hot:prod": "STAGE=prod npx expo start --clear --dev-client",
     "start:hot:prod:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prod}:@declapract{variable.app.web.port.hot}'",
     "start:hot:prod:proxy": "npm run start:hot:prod:link && npm run start:hot:proxy",
     "start:cold:proxy": "npx local-ssl-proxy --source 3449 --target 3000",
-    "start:cold:dev": "npm run build:web && npx serve dist --single",
-    "start:cold:dev:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.dev}:@declapract{variable.app.web.port.cold}'",
-    "start:cold:dev:proxy": "echo npm run start:cold:dev:link && npm run start:cold:proxy",
+    "start:cold:prep": "npm run build:web && npx serve dist --single",
+    "start:cold:prep:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prep}:@declapract{variable.app.web.port.cold}'",
+    "start:cold:prep:proxy": "echo npm run start:cold:prep:link && npm run start:cold:proxy",
     "start:cold:prod": "npm run build:web && npx serve dist --single",
     "start:cold:prod:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prod}:@declapract{variable.app.web.port.cold}'",
     "register:device:apple:info": "echo 'learn more here https://docs.expo.dev/build/internal-distribution/'",
     "register:device:apple:inclusions:rebuild:prod": "npx eas build --platform ios --clear-cache",
-    "register:device:apple:inclusions:rebuild:dev": "npx eas build --profile development --platform ios --clear-cache",
+    "register:device:apple:inclusions:rebuild:prep": "npx eas build --profile development --platform ios --clear-cache",
     "register:device:apple:add": "echo 'register an apple device to allow it to install internal builds' && eas device:create && npm run register:device:apple:inclusions:rebuild",
     "register:device:apple:list": "eas device:list",
     "register:device:apple:delete": "eas device:delete",
     "register:device:apple:rename": "eas device:rename",
     "register:profile:apple:list": "echo 'see list here https://developer.apple.com/account/resources/profiles/list'",
-    "build:dev:ios": "eas build --profile development --platform ios --non-interactive",
-    "build:dev:android": "eas build --profile development --platform android --non-interactive",
+    "build:prep:ios": "eas build --profile development --platform ios --non-interactive",
+    "build:prep:android": "eas build --profile development --platform android --non-interactive",
     "build:web": "npx expo export --platform web",
     "deploy:prod:ios:metadata": "eas metadata:push",
     "deploy:prod": "echo 'use github actions'",

package/dist/practices/cicd-common/best-practice/.github/workflows/.test.yml

@@ -226,8 +226,8 @@ jobs:
       - name: start:testdb
         run: npm run start:testdb --if-present
 
-      - name: start:livedb:dev
-        run: npm run start:livedb:dev --if-present
+      - name: start:livedb:prep
+        run: npm run start:livedb:prep --if-present
 
       - name: build
         run: npm run build
@@ -310,8 +310,8 @@ jobs:
       - name: start:testdb
         run: npm run start:testdb --if-present
 
-      - name: start:livedb:dev
-        run: npm run start:livedb:dev --if-present
+      - name: start:livedb:prep
+        run: npm run start:livedb:prep --if-present
 
       - name: build
         run: npm run build

package/dist/practices/cicd-common/best-practice/.github/workflows/test.yml

@@ -21,5 +21,5 @@ jobs:
     uses: ./.github/workflows/.test.yml
     with:
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_DEV_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
     secrets: inherit # keyrack firewall in .test.yml filters to declared keys

package/dist/practices/cicd-package/best-practice/.github/workflows/publish.yml

@@ -18,7 +18,7 @@ jobs:
     uses: ./.github/workflows/.test.yml
     with:
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_DEV_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
     secrets: inherit # keyrack firewall in .test.yml filters to declared keys
 
   publish:

package/dist/practices/cicd-service/best-practice/.agent/repo=.this/skills/use.rds.capacity.sh

@@ -30,7 +30,7 @@ set -eo pipefail
 
 set -u
 
-# ensure the dev tunnel is awake
+# ensure the prep tunnel is awake
 .agent/repo=.this/skills/use.vpc.tunnel.ts
 
 # ping until available

package/dist/practices/cicd-service/best-practice/.declapract.readme.md

@@ -1,4 +1,4 @@
 flows:
 - test on every commit
-- deploy to dev every commit on master
+- deploy to prep every commit on master
 - deploy to prod every v* tagged commit on master

package/dist/practices/cicd-service/best-practice/.github/workflows/deploy.yml

@@ -40,7 +40,7 @@ jobs:
     if: github.event_name != 'workflow_dispatch' || github.event.inputs.thoroughly == 'true'
     with:
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_DEV_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
     secrets: inherit # keyrack firewall in .test.yml filters to declared keys
 
   dev:
@@ -51,9 +51,9 @@ jobs:
       always() && (needs.test.result == 'success' || needs.test.result == 'skipped')
     with:
       stage: dev
-      github-environment: dev
+      github-environment: prep # github environment stays as prep (where secrets/vars live)
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_DEV_OIDC_ROLE_ARN }}
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
 
   prod:
     uses: ./.github/workflows/.deploy-sls.yml

package/dist/practices/cicd-service/best-practice/.github/workflows/provision.yml

@@ -19,17 +19,17 @@ jobs:
     uses: ./.github/workflows/.terraform.yml
     with:
       working-directory: provision/aws/environments/test
-      github-environment: dev
+      github-environment: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_DEV_OIDC_ROLE_ARN }}
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
 
-  aws-dev:
+  aws-prep:
     uses: ./.github/workflows/.terraform.yml
     with:
-      working-directory: provision/aws/environments/dev
-      github-environment: dev
+      working-directory: provision/aws/environments/prep
+      github-environment: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_DEV_OIDC_ROLE_ARN }}
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
 
   aws-prod:
     uses: ./.github/workflows/.terraform.yml
@@ -50,13 +50,13 @@ jobs:
     secrets:
       creds-github-app-private-key: ${{ secrets.DECLASTRUCT_GITHUB_CONFORMER_APP_PRIVATE_KEY }}
 
-  sql-schema-dev:
+  sql-schema-prep:
     uses: ./.github/workflows/.sql-schema-control.yml
     with:
       stage: prep
-      github-environment: dev
+      github-environment: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_DEV_OIDC_ROLE_ARN }}
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
 
   sql-schema-prod:
     uses: ./.github/workflows/.sql-schema-control.yml

package/dist/practices/config/bad-practices/configs-contain-wrong-account-id/config/prod.json.declapract.ts

@@ -4,6 +4,6 @@ import { getServiceVariables } from '../../../../../getVariables';
 
 export const check: FileCheckFunction = (contents, context) => {
   const { awsAccountId } = getServiceVariables(context);
-  if (!contents?.includes(awsAccountId.dev))
-    throw new Error('does not contain aws dev account id');
+  if (!contents?.includes(awsAccountId.prep))
+    throw new Error('does not contain aws prep account id');
 };

package/dist/practices/config/bad-practices/divergent-config-shapes/.declapract.readme.md

@@ -1,6 +1,6 @@
 the following places should have the shape of the config defined identically:
 - `config/test.json`
-- `config/dev.json`
+- `config/prep.json`
 - `config/prod.json`
 
 this check complains if one of them does not look like the others

package/dist/practices/config/bad-practices/divergent-config-shapes/config/{dev.json.declapract.ts → prep.json.declapract.ts}

@@ -16,18 +16,18 @@ export const check: FileCheckFunction = async (contents, context) => {
   const flattenedTestConfigKeys = Object.keys(flatten(testConfigObject));
 
   // grab the found keys
-  const devConfigObject = JSON.parse(contents);
-  const flattenedDevConfigKeys = Object.keys(flatten(devConfigObject));
+  const prepConfigObject = JSON.parse(contents);
+  const flattenedPrepConfigKeys = Object.keys(flatten(prepConfigObject));
 
   // determine which keys are not matched
-  const keysInTestButNotInDev = flattenedTestConfigKeys.filter(
-    (key) => !flattenedDevConfigKeys.includes(key),
+  const keysInTestButNotInPrep = flattenedTestConfigKeys.filter(
+    (key) => !flattenedPrepConfigKeys.includes(key),
   );
-  const keysInDevButNotInTest = flattenedDevConfigKeys.filter(
+  const keysInPrepButNotInTest = flattenedPrepConfigKeys.filter(
     (key) => !flattenedTestConfigKeys.includes(key),
   );
-  if (keysInTestButNotInDev.length) return; // matches bad practice
-  if (keysInDevButNotInTest.length) return; // matches bad practice
+  if (keysInTestButNotInPrep.length) return; // matches bad practice
+  if (keysInPrepButNotInTest.length) return; // matches bad practice
 
   // otherwise, does not match a bad practice
   throw new Error('its fine');

package/dist/practices/config/bad-practices/old-dev-config-location/config/dev.json.declapract.ts

@@ -4,9 +4,12 @@ export const check = FileCheckType.EXISTS;
 
 export const fix: FileFixFunction = (contents, context) => {
   // move config/dev.json → config/prep.json and update access: dev → prep
+  // also update .dev hostnames to .prep (e.g., bastion.dev.example.com → bastion.prep.example.com)
   let fixed = contents;
   if (fixed) {
-    fixed = fixed.replace(/"access":\s*"dev"/, '"access": "prep"');
+    fixed = fixed
+      .replace(/\.dev\b/g, '.prep')
+      .replace(/"access":\s*"dev"/, '"access": "prep"');
   }
   return {
     contents: fixed ?? null,

package/dist/practices/config/best-practice/config/prep.json

@@ -5,7 +5,7 @@
     "access": "prep"
   },
   "aws": {
-    "account": "@declapract{variable.awsAccountId.dev}",
+    "account": "@declapract{variable.awsAccountId.prep}",
     "namespace": "@declapract{variable.infrastructureNamespaceId}"
   }
 }

package/dist/practices/config/best-practice/config/test.json

@@ -5,7 +5,7 @@
     "access": "test"
   },
   "aws": {
-    "account": "@declapract{variable.awsAccountId.dev}",
+    "account": "@declapract{variable.awsAccountId.prep}",
     "namespace": "@declapract{variable.infrastructureNamespaceId}"
   }
 }

package/dist/practices/environments/bad-practices/old-dev-scripts/package.json.declapract.ts

@@ -0,0 +1,57 @@
+import type { FileCheckFunction, FileFixFunction } from 'declapract';
+
+/**
+ * .what = detects package.json scripts with `:dev` as a segment
+ * .why = standardizing on `prep` over `dev` for pre-production environment naming
+ *
+ * matches both `:dev` at end (deploy:dev) and `:dev:` in middle (build:dev:ios)
+ */
+export const check: FileCheckFunction = (contents) => {
+  if (!contents) throw new Error('fine, does not match bad practice');
+  const parsedContents = JSON.parse(contents);
+  const scripts = parsedContents.scripts ?? {};
+
+  // check if any script name contains :dev as a segment (either :dev at end or :dev: in middle)
+  const devScripts = Object.keys(scripts).filter(
+    (key) => key.endsWith(':dev') || key.includes(':dev:'),
+  );
+  if (devScripts.length > 0) return; // matches bad practice
+
+  throw new Error('fine, no scripts with :dev segment');
+};
+
+/**
+ * .what = renames scripts from `:dev` segment to `:prep` segment
+ * .why = standardizing on `prep` over `dev` for pre-production environment naming
+ *
+ * handles both `:dev` at end (deploy:dev) and `:dev:` in middle (build:dev:ios)
+ *
+ * .note = only renames script NAMES, not VALUES. script values may still reference
+ *         `--stage dev` for infrastructure naming (cloudformation stacks stay named
+ *         `$service-dev`). the serverless package.json handles this via SLS_STAGE
+ *         mapping. see brief: define.infrastructure-dev-vs-application-prep.md
+ */
+export const fix: FileFixFunction = (contents) => {
+  if (!contents) return {};
+  const parsedContents = JSON.parse(contents);
+  const scripts = parsedContents.scripts ?? {};
+
+  // find scripts with :dev segment and create renamed versions
+  const updatedScripts = { ...scripts };
+  for (const [key, value] of Object.entries(scripts)) {
+    if (key.endsWith(':dev') || key.includes(':dev:')) {
+      // replace :dev: in middle and :dev at end with :prep
+      const newKey = key.replace(/:dev:/g, ':prep:').replace(/:dev$/, ':prep');
+      updatedScripts[newKey] = value; // add :prep version
+      updatedScripts[key] = undefined; // remove :dev version
+    }
+  }
+
+  return {
+    contents: JSON.stringify(
+      { ...parsedContents, scripts: updatedScripts },
+      null,
+      2,
+    ),
+  };
+};

package/dist/practices/environments/best-practice/.declapract.readme.md

@@ -4,7 +4,7 @@ a critical part of an application's environment is which stage it is running in
 
 ehmpathy recognizes three standard stages in which applications run throughout their development cycle
 - `prod` stage - a deployed production stack in which application that the business depends on run, affecting real customers
-- `dev` stage - a deployed developer-only stack in which applications can run and interact with each other for testing
+- `prep` stage - a deployed pre-production stack in which applications can run and interact with each other for testing
 - `test` stage - an ephemeral, primarily local, developer-only stack in which developers run local code against for testing
 
 this information is expected to be defined in the runtime environment through the following environmental variables

package/dist/practices/environments/best-practice/src/utils/environment.ts

@@ -4,5 +4,5 @@ export { getEnvironment };
 
 export const envStatic = getEnvironment.static();
 
-export const stage = envStatic.access === 'prep' ? 'dev' : envStatic.access;
-export const serviceClientStage = stage === 'prod' ? 'prod' : 'dev';
+export const stage = envStatic.access;
+export const serviceClientStage = stage === 'prod' ? 'prod' : 'prep';

package/dist/practices/husky/best-practice/.husky/check.timestamps.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# .what = block commit of files that embed a timestamp (T?HH:MM:SS{tz})
+# .why  = timestamps in snapshots permadrift — they change every run, so the
+#         snapshot can never be "correct" twice; mask them to keep it stable
+# .how  = scan staged files (except .ts/.sh) for the pattern; halt with a
+#         constraint error (exit 2) if any are found
+
+# fail fast on errors and unbound vars (safe here: scan pipelines end in `head`
+# so a no-match grep does not abort, and all vars are assigned before use)
+set -eu
+
+# the timestamp pattern: optional lead T, HH:MM:SS, optional timezone (Z, ±HH:MM, ±HHMM)
+TIMESTAMP_PATTERN='T?[0-9][0-9]:[0-9][0-9]:[0-9][0-9](Z|[+-][0-9][0-9]:?[0-9][0-9])?'
+
+# collect staged files (added/copied/modified); skip deletions
+staged=$(git diff --cached --name-only --diff-filter=ACM)
+
+# scan each staged file for a raw timestamp
+# note: the here-doc feeds the loop in the current shell (no pipe subshell),
+#       so `exit 2` halts the commit directly and a clean pass falls through
+while IFS= read -r file; do
+  # skip empty lines
+  [ -n "$file" ] || continue
+
+  # skip exempt code files (.ts and .sh legitimately carry time logic)
+  case "$file" in
+    *.ts | *.sh) continue ;;
+  esac
+
+  # read the staged content; fail loud if git cannot read the staged blob
+  # (2>&1 captures git's error into the var so the halt message can surface it)
+  if ! content=$(git show ":$file" 2>&1); then
+    printf '💥 check.timestamps: failed to read staged content for %s\n' "$file" >&2
+    printf '   └─ %s\n' "$content" >&2
+    exit 1
+  fi
+
+  # halt if the staged content embeds a raw timestamp
+  match=$(printf '%s\n' "$content" | grep -nIE "$TIMESTAMP_PATTERN" | head -n 1)
+  if [ -n "$match" ]; then
+    printf '✋ timestamps are forbidden in snapshots. mask them to prevent permadrift\n'
+    printf '   └─ %s:%s\n' "$file" "$match"
+    exit 2
+  fi
+done <<EOF
+$staged
+EOF

package/dist/practices/husky/best-practice/.husky/pre-commit

@@ -6,3 +6,5 @@ fi
 . "$(dirname -- "$0")/_/husky.sh"
 
 . "$(dirname -- "$0")/check.yalc.sh"
+
+. "$(dirname -- "$0")/check.timestamps.sh"

package/dist/practices/husky/check.timestamps.play.declapract.integration.test.ts

@@ -0,0 +1,148 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { given, then, when } from 'test-fns';
+
+/**
+ * .what = integration test for the check.timestamps husky guard
+ * .why = proves the guard halts commits of files that embed a timestamp
+ *        (except .ts/.sh) with exit 2, and allows clean/exempt files with exit 0
+ * .how = build a temp git repo, stage fixtures, spawn the guard, assert exit code
+ */
+
+// the guard under test (the distributed best-practice template)
+const guardPath = path.join(
+  __dirname,
+  'best-practice/.husky/check.timestamps.sh',
+);
+
+// build a fresh temp git repo with the given files staged
+const genStagedRepo = (files: Record<string, string>): string => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'check-timestamps-'));
+  execFileSync('git', ['init', '-q'], { cwd: dir });
+  for (const [name, content] of Object.entries(files)) {
+    const full = path.join(dir, name);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content);
+    execFileSync('git', ['add', '--', name], { cwd: dir });
+  }
+  return dir;
+};
+
+// spawn the guard against a repo; return its exit code + stdout
+const runGuard = (dir: string): { code: number | null; stdout: string } => {
+  const res = spawnSync('bash', [guardPath], { cwd: dir, encoding: 'utf-8' });
+  return { code: res.status, stdout: res.stdout };
+};
+
+describe('check.timestamps guard', () => {
+  given('[case1] a non-code file with an iso timestamp', () => {
+    when('[t0] the guard runs', () => {
+      const dir = genStagedRepo({
+        'snapshot.json': '{ "createdAt": "2026-06-25T14:30:00Z" }\n',
+      });
+      const result = runGuard(dir);
+
+      then('it halts with exit 2', () => {
+        expect(result.code).toEqual(2);
+      });
+      then('it prints the verbatim constraint message', () => {
+        expect(result.stdout).toContain(
+          'timestamps are forbidden in snapshots. mask them to prevent permadrift',
+        );
+      });
+      then('it names the matched file', () => {
+        expect(result.stdout).toContain('snapshot.json');
+      });
+      then('it renders the matched file:line:content detail line', () => {
+        // locks the exact halt-output shape: tree-prefixed detail line
+        expect(result.stdout).toContain(
+          '   └─ snapshot.json:1:{ "createdAt": "2026-06-25T14:30:00Z" }',
+        );
+      });
+    });
+  });
+
+  given('[case2] a non-code file with a bare time (no lead T)', () => {
+    when('[t0] the guard runs', () => {
+      const dir = genStagedRepo({ 'doc.md': 'released at 14:30:00 today\n' });
+      const result = runGuard(dir);
+
+      then('it halts with exit 2 (optional T prefix matches bare time)', () => {
+        expect(result.code).toEqual(2);
+      });
+    });
+  });
+
+  given('[case3] a .ts file with a timestamp', () => {
+    when('[t0] the guard runs', () => {
+      const dir = genStagedRepo({ 'time.ts': "const t = '14:30:00';\n" });
+      const result = runGuard(dir);
+
+      then('it allows the commit with exit 0 (.ts is exempt)', () => {
+        expect(result.code).toEqual(0);
+      });
+    });
+  });
+
+  given('[case4] a .sh file with a timestamp', () => {
+    when('[t0] the guard runs', () => {
+      const dir = genStagedRepo({ 'log.sh': "echo 'at 14:30:00Z'\n" });
+      const result = runGuard(dir);
+
+      then('it allows the commit with exit 0 (.sh is exempt)', () => {
+        expect(result.code).toEqual(0);
+      });
+    });
+  });
+
+  given('[case5] a clean non-code file with no timestamp', () => {
+    when('[t0] the guard runs', () => {
+      const dir = genStagedRepo({ 'notes.md': 'hello world, no times here\n' });
+      const result = runGuard(dir);
+
+      then('it allows the commit with exit 0', () => {
+        expect(result.code).toEqual(0);
+      });
+    });
+  });
+
+  given('[case6] a non-code file with only a date (no time)', () => {
+    when('[t0] the guard runs', () => {
+      const dir = genStagedRepo({ 'dated.md': 'shipped on 2026-06-25\n' });
+      const result = runGuard(dir);
+
+      then('it allows the commit with exit 0 (date alone does not match)', () => {
+        expect(result.code).toEqual(0);
+      });
+    });
+  });
+
+  given('[case7] a non-code file with a timezone-offset timestamp', () => {
+    when('[t0] the guard runs', () => {
+      const dir = genStagedRepo({
+        'rec.yml': 'when: 2026-06-25T14:30:00+05:00\n',
+      });
+      const result = runGuard(dir);
+
+      then('it halts with exit 2 (offset tz form matches)', () => {
+        expect(result.code).toEqual(2);
+      });
+    });
+  });
+
+  given('[case8] a snapshot with a masked timestamp placeholder', () => {
+    when('[t0] the guard runs', () => {
+      const dir = genStagedRepo({
+        'render.test.ts.snap': '{ "createdAt": "[timestamp]" }\n',
+      });
+      const result = runGuard(dir);
+
+      then('it allows the commit with exit 0 (mask remedy is committable)', () => {
+        expect(result.code).toEqual(0);
+      });
+    });
+  });
+});

package/dist/practices/package-json-order/best-practice/package.json.declapract.ts

@@ -53,7 +53,7 @@ export const desiredRelativeKeyOrder = {
     'provision:testdb:docker:down',
     'provision:testdb',
     'start:testdb',
-    'start:livedb:dev',
+    'start:livedb:prep',
     'test:auth',
     'test:commits',
     'test:types',
@@ -82,34 +82,34 @@ export const desiredRelativeKeyOrder = {
     'deploy:prune',
     'deploy:release',
     'deploy:send-notification',
-    'deploy:dev',
+    'deploy:prep',
     'deploy:prod',
     'deploy',
 
     // from app-react-native-expo
     'start:hot:proxy',
-    'start:hot:dev',
-    'start:hot:dev:link',
-    'start:hot:dev:proxy',
+    'start:hot:prep',
+    'start:hot:prep:link',
+    'start:hot:prep:proxy',
     'start:hot:prod',
     'start:hot:prod:link',
     'start:hot:prod:proxy',
     'start:cold:proxy',
-    'start:cold:dev',
-    'start:cold:dev:link',
-    'start:cold:dev:proxy',
+    'start:cold:prep',
+    'start:cold:prep:link',
+    'start:cold:prep:proxy',
     'start:cold:prod',
     'start:cold:prod:link',
     'register:device:apple:info',
     'register:device:apple:inclusions:rebuild:prod',
-    'register:device:apple:inclusions:rebuild:dev',
+    'register:device:apple:inclusions:rebuild:prep',
     'register:device:apple:add',
     'register:device:apple:list',
     'register:device:apple:delete',
     'register:device:apple:rename',
     'register:profile:apple:list',
-    'build:dev:ios',
-    'build:dev:android',
+    'build:prep:ios',
+    'build:prep:android',
     'build:web',
     'deploy:prod:ios:metadata',
     'open:store:android',

package/dist/practices/persist-with-rds/best-practice/.declapract.readme.md

@@ -1,6 +1,26 @@
 we use:
 - postgres database
-  - provisioned by aws rds aurora when in dev and prod env
+  - provisioned by aws rds aurora when in prep and prod env
   - provisioned by docker when in test env
 - sql-schema-control to manage sql schema
 - sql-dao-generator to generate the sql-schemas + daos
+
+## required variables
+
+| variable | description | example |
+|----------|-------------|---------|
+| `databaseTunnelHost.{prep,prod}` | ssm proxy host for database tunnel | `aws.ssmproxy.ahbodedb.prep` |
+| `databaseClusterHost.{prep,prod}` | rds cluster endpoint | `ahbodedb.cluster-xxx.us-east-1.rds.amazonaws.com` |
+
+## ssm parameters
+
+terraform provisions these ssm parameters for database credentials:
+
+| parameter name | description | environments |
+|----------------|-------------|--------------|
+| `{namespace}.database.role.cicd.password` | password for cicd database user | prep, prod |
+| `{namespace}.database.role.crud.password` | password for crud database user | prep, prod |
+
+legacy parameters (kept for backwards compatibility):
+- `{namespace}.database.admin.password`
+- `{namespace}.database.service.password`

package/dist/practices/persist-with-rds/best-practice/provision/aws/product/parameter-store.tf

@@ -1,3 +1,6 @@
+# ====================
+# legacy params (kept for backwards compatibility)
+# ====================
 resource "aws_ssm_parameter" "secret_database_admin_password" {
   name  = "${local.parameter_store_namespace}.database.admin.password"
   type  = "SecureString"
@@ -22,3 +25,39 @@ resource "aws_ssm_parameter" "secret_database_service_password" {
     ]
   }
 }
+
+# ====================
+# new role-based params (standard naming)
+# ====================
+# read legacy params to copy values (prod only)
+data "aws_ssm_parameter" "legacy_admin_password" {
+  name            = "${local.parameter_store_namespace}.database.admin.password"
+  count           = var.environment == "prod" ? 1 : 0
+  with_decryption = true
+}
+data "aws_ssm_parameter" "legacy_service_password" {
+  name            = "${local.parameter_store_namespace}.database.service.password"
+  count           = var.environment == "prod" ? 1 : 0
+  with_decryption = true
+}
+
+resource "aws_ssm_parameter" "secret_database_role_cicd_password" {
+  name  = "${local.parameter_store_namespace}.database.role.cicd.password"
+  type  = "SecureString"
+  value = var.environment == "prod" ? data.aws_ssm_parameter.legacy_admin_password[0].value : "__CHANG3_ME__"
+  tags  = local.tags
+  count = var.environment != "test" ? 1 : 0
+  lifecycle {
+    ignore_changes = [value]
+  }
+}
+resource "aws_ssm_parameter" "secret_database_role_crud_password" {
+  name  = "${local.parameter_store_namespace}.database.role.crud.password"
+  type  = "SecureString"
+  value = var.environment == "prod" ? data.aws_ssm_parameter.legacy_service_password[0].value : "__CHANG3_ME__"
+  tags  = local.tags
+  count = var.environment != "test" ? 1 : 0
+  lifecycle {
+    ignore_changes = [value]
+  }
+}

package/dist/practices/persist-with-rds/best-practice/provision/schema/deploy.database.sh

@@ -13,20 +13,20 @@
 ##
 ## usage example:
 ## ```sh
-## ./provision/schema/deploy.database.sh dev $(op item get ahbodedb.dev.postgres --fields label=password --format json | jq -r .value)
+## ./provision/schema/deploy.database.sh prep $(op item get ahbodedb.prep.postgres --fields label=password --format json | jq -r .value)
 ## ```
 #####################################################
 
 # check that user has defined the environment that they want this key created for correctly
 ENVIRONMENT=$1;
-if [ "$ENVIRONMENT" != "prod" ] && [ "$ENVIRONMENT" != "dev" ]; then
-  echo "\nerror: Environment, the first argument, must be specified as either 'prod' or 'dev'. You specified '$ENVIRONMENT'";
+if [ "$ENVIRONMENT" != "prod" ] && [ "$ENVIRONMENT" != "prep" ]; then
+  echo "\nerror: Environment, the first argument, must be specified as either 'prod' or 'prep'. You specified '$ENVIRONMENT'";
   exit 1;
 fi
 
 # check that user is authed into correct account
 AWS_ACCOUNT_ID=$(aws sts get-caller-identity | jq -r '.Account');
-EXPECTED_AWS_ACCOUNT_ID=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.awsAccountId.prod}" || echo "@declapract{variable.awsAccountId.dev}");
+EXPECTED_AWS_ACCOUNT_ID=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.awsAccountId.prod}" || echo "@declapract{variable.awsAccountId.prep}");
 if [ "$AWS_ACCOUNT_ID" != "$EXPECTED_AWS_ACCOUNT_ID" ]; then
   echo "\nerror: the AWS_ACCOUNT that you are signed into is not correct for the environment you specified. You are authed into account '$AWS_ACCOUNT_ID' but the correct account id for '$ENVIRONMENT' IS '$EXPECTED_AWS_ACCOUNT_ID'";
   exit 1;
@@ -41,20 +41,20 @@ fi;
 
 # check that the cicd password was provisioned, if in prod, since this is used to create the cicd user
 if [ "$ENVIRONMENT" = "prod" ]; then
-  CICD_USER_PASSWORD=$(aws ssm get-parameter --name "@declapract{variable.organizationName}.@declapract{variable.projectName}.$ENVIRONMENT.database.admin.password" --with-decryption --output text --query Parameter.Value)
+  CICD_USER_PASSWORD=$(aws ssm get-parameter --name "@declapract{variable.organizationName}.@declapract{variable.projectName}.$ENVIRONMENT.database.role.cicd.password" --with-decryption --output text --query Parameter.Value)
   if [ -z "$CICD_USER_PASSWORD" ]; then
     echo "\nerror: CICD_USER_PASSWORD must be provisioned with terraform before running this"
     exit 1;
   fi;
-  if [ "$CICD_USER_PASSWORD" = "__IGNORED__" ]; then
-    echo "\nerror: CICD_USER_PASSWORD must be set to a value other than the default of '__IGNORED__'"
+  if [ "$CICD_USER_PASSWORD" = "__IGNORED__" ] || [ "$CICD_USER_PASSWORD" = "__CHANG3_ME__" ]; then
+    echo "\nerror: CICD_USER_PASSWORD must be set to a value other than the default placeholder"
     exit 1;
   fi;
 fi;
 
 
 # define the postgres connecition string
-CLUSTER_HOST=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.databaseTunnelHost.prod}" || echo "@declapract{variable.databaseTunnelHost.dev}");
+CLUSTER_HOST=$([ "$ENVIRONMENT" = 'prod' ] && echo "@declapract{variable.databaseTunnelHost.prod}" || echo "@declapract{variable.databaseTunnelHost.prep}");
 CLUSTER_CONNECTION_STRING=postgresql://postgres:$POSTGRES_ADMIN_PASSWORD@$CLUSTER_HOST:5432
 ROOT_DB_CONNECTION_STRING=$CLUSTER_CONNECTION_STRING/postgres
 SVC_DB_CONNECTION_STRING=$CLUSTER_CONNECTION_STRING/@declapract{variable.databaseName}
@@ -75,7 +75,7 @@ echo "\n 🔨 creating the schema..."
 psql $SVC_DB_CONNECTION_STRING -f $INIT_SQLS_DIR/.schema.sql
 
 if [ "$ENVIRONMENT" = "prod" ]; then
-  echo "\n 🔨 granting reads to the datalakedb user..." # only in prod env; we dont want dev's testing data in our datalake
+  echo "\n 🔨 granting reads to the datalakedb user..." # only in prod env; we dont want prep's test data in our datalake
   psql $SVC_DB_CONNECTION_STRING -f $INIT_SQLS_DIR/.user.datalakedb.sql
 fi;
 

package/dist/practices/provision-github/best-practice/.declapract.readme.md

@@ -0,0 +1,7 @@
+provisions github repository settings and environments via declastruct-github-sdk.
+
+## required variables
+
+| variable | description | example |
+|----------|-------------|---------|
+| `reviewers.users` | github usernames for production deployment reviewers | `['whodisio', 'ehmpathy']` |

package/dist/practices/provision-github/best-practice/package.json

@@ -1,6 +1,6 @@
 {
   "devDependencies": {
     "declastruct": "@declapract{check.minVersion('1.9.1')}",
-    "declastruct-github": "@declapract{check.minVersion('1.5.5')}"
+    "declastruct-github": "@declapract{check.minVersion('1.6.0')}"
   }
 }

package/dist/practices/provision-github/best-practice/provision/github.repo/resources.ts

@@ -5,6 +5,7 @@ import {
   DeclaredGithubEnvironment,
   DeclaredGithubRepo,
   DeclaredGithubRepoConfig,
+  DeclaredGithubRepoRuleset,
   DeclaredGithubTeamRepoAccess,
   getDeclastructGithubProvider,
 } from 'declastruct-github';
@@ -154,6 +155,37 @@ export const getResources = async (): Promise<DomainEntity<any>[]> => {
     preventSelfReview: false, // self-approval allowed if in reviewers list
   });
 
+  // restrict who may cut `v*` release tags to the rhelease app only
+  // .why = prod apply is gated on a version tag cut from main; if anyone could push a
+  //        `v*` tag, that gate is bypassable. this ruleset blocks creation, update, and
+  //        deletion of `v*` tags for everyone except the rhelease app — the github half
+  //        of the prod-apply oidc guarantee, and the immutability of released tags
+  const rulesetReleaseTags = DeclaredGithubRepoRuleset.as({
+    repo,
+    name: 'protect-release-tags',
+    target: 'tag',
+    enforcement: 'active',
+
+    // only the rhelease github app may write `v*` tags
+    bypassActors: [
+      {
+        actorId: 2472031, // rhelease github app id (gh api /apps/rhelease)
+        actorType: 'Integration',
+        bypassMode: 'always',
+      },
+    ],
+
+    // applies to release tags only
+    conditions: {
+      refNameInclude: ['refs/tags/v*'],
+      refNameExclude: [],
+    },
+
+    // enforce release-tag immutability: only the bypass actor may create, move, or delete
+    // matched tags. a released `v1.2.3` must never be re-pointed or removed once cut
+    rules: [{ type: 'creation' }, { type: 'update' }, { type: 'deletion' }],
+  });
+
   // and return the full set
   return [
     repo,
@@ -162,5 +194,6 @@ export const getResources = async (): Promise<DomainEntity<any>[]> => {
     teamReleasersAccess, // must come before environments that reference this team
     envProductionOnMain,
     envProductionOnElse,
+    rulesetReleaseTags,
   ];
 };

package/dist/practices/serverless/best-practice/package.json

@@ -5,8 +5,8 @@
     "if-env": "@declapract{check.minVersion('1.0.4')}"
   },
   "scripts": {
-    "deploy:prune": "SLS_STAGE=$(if [ \"$ACCESS\" = 'prep' ]; then echo 'dev'; else echo \"$ACCESS\"; fi) && export COMMIT=$(npx sdk-environment get commit) && npx sls prune -n 7 --stage $SLS_STAGE",
-    "deploy:release": "SLS_STAGE=$(if [ \"$ACCESS\" = 'prep' ]; then echo 'dev'; else echo \"$ACCESS\"; fi) && export COMMIT=$(npx sdk-environment get commit) && npm run build && sls deploy --verbose --stage $SLS_STAGE",
+    "deploy:prune": "export COMMIT=$(npx sdk-environment get commit) && export SLS_STAGE=$([ \"$ACCESS\" = 'prep' ] && echo 'dev' || echo \"$ACCESS\") && npx sls prune -n 7 --stage $SLS_STAGE",
+    "deploy:release": "export COMMIT=$(npx sdk-environment get commit) && export SLS_STAGE=$([ \"$ACCESS\" = 'prep' ] && echo 'dev' || echo \"$ACCESS\") && npm run build && sls deploy --verbose --stage $SLS_STAGE",
     "deploy:send-notification": "curl -X POST -H 'Content-type: application/json' --data \"{\\\"text\\\":\\\"$([ -z $DEPLOYER_NAME ] && git config user.name || echo $DEPLOYER_NAME) has deployed $npm_package_name@v$npm_package_version:\nhttps://github.com/@declapract{variable.organizationName}/$npm_package_name/tree/v$npm_package_version\\\"}\" @declapract{variable.slackWebhookUrl}",
     "deploy:prep": "ACCESS=prep npm run deploy:release",
     "deploy:prod": "ACCESS=prod npm run deploy:release && npm run deploy:send-notification",

package/dist/practices/serverless/best-practice/serverless.yml

@@ -10,7 +10,7 @@ plugins:
 
 custom:
   accessByStage:
-    dev: prep
+    dev: prep # stage=dev deploys to $service-dev but uses ACCESS=prep (config/prep.json)
     prod: prod
 
 provider:
@@ -25,8 +25,8 @@ provider:
     product: ${self:service}
   environment:
     TZ: UTC # guarantee that utc timezone will be used explicitly, to facilitate a pit of success
-    NODE_ENV: production # deploy with production optimizations of all resources, to make `dev` and `prod` stage deployments equivalent functionally (i.e., the same code paths in dev and prod)
-    ACCESS: ${self:custom.accessByStage.${opt:stage}, 'prep'} # sdk-environment access tier, to target the correct config + resources (e.g., hit dev db -vs- prod db)
+    NODE_ENV: production # deploy with production optimizations of all resources, to make `prep` and `prod` stage deployments equivalent functionally (i.e., the same code paths in prep and prod)
+    ACCESS: ${self:custom.accessByStage.${opt:stage}, 'prep'} # sdk-environment access tier, to target the correct config + resources (e.g., hit prep db -vs- prod db)
     COMMIT: ${env:COMMIT} # sdk-environment commit slug, must be set by deploy command
     AWS_NODEJS_CONNECTION_REUSE_ENABLED: true # https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/node-reusing-connections.html
   deploymentBucket: serverless-deployment-@declapract{variable.infrastructureNamespaceId}-${self:provider.stage}

package/dist/practices/serverless/best-practice/serverless.yml.declapract.ts

@@ -11,7 +11,7 @@ const accessInferencePolicy = `    # allow access inference from account name
 
 const accessByStageCustom = `custom:
   accessByStage:
-    dev: prep
+    dev: prep # stage=dev deploys to $service-dev but uses ACCESS=prep (config/prep.json)
     prod: prod
 
 `;
@@ -70,7 +70,7 @@ export const fix: FileFixFunction = (contents) => {
   ) {
     fixed = fixed.replace(
       /STAGE: \$\{self:provider\.stage\}[^\n]*/,
-      "ACCESS: ${self:custom.accessByStage.${opt:stage}, 'prep'} # sdk-environment access tier, to target the correct config + resources (e.g., hit dev db -vs- prod db)\n    COMMIT: ${env:COMMIT} # sdk-environment commit slug, must be set by deploy command",
+      "ACCESS: ${self:custom.accessByStage.${opt:stage}, 'prep'} # sdk-environment access tier, to target the correct config + resources (e.g., hit prep db -vs- prod db)\n    COMMIT: ${env:COMMIT} # sdk-environment commit slug, must be set by deploy command",
     );
   }
 

package/dist/practices/terraform-aws/bad-practices/old-dev-env-dir/provision/aws/environments/dev/<star>.declapract.ts

@@ -0,0 +1,14 @@
+import { FileCheckType, type FileFixFunction } from 'declapract';
+
+export const check = FileCheckType.EXISTS;
+
+export const fix: FileFixFunction = (contents, context) => {
+  const newPath = context.relativeFilePath.replace(
+    /^provision\/aws\/environments\/dev\//,
+    'provision/aws/environments/prep/',
+  );
+  return {
+    contents: contents ?? null,
+    relativeFilePath: newPath,
+  };
+};

package/dist/practices/terraform-aws/best-practice/provision/aws/environments/{dev → prep}/main.tf

@@ -1,6 +1,6 @@
 provider "aws" {
   region              = "us-east-1"
-  allowed_account_ids = ["@declapract{variable.awsAccountId.dev}"] # `dev` environment resources are provisioned in the `dev` aws account
+  allowed_account_ids = ["@declapract{variable.awsAccountId.prep}"] # `prep` access tier resources are provisioned in the `prep` aws account
 }
 
 terraform {
@@ -14,5 +14,5 @@ terraform {
 
 module "product" {
   source      = "../../product"
-  environment = "dev"
+  environment = "dev" # infrastructure stays named 'dev', application uses ACCESS=prep
 }

package/dist/practices/terraform-aws/best-practice/provision/aws/environments/test/main.tf

@@ -1,6 +1,6 @@
 provider "aws" {
   region              = "us-east-1"
-  allowed_account_ids = ["@declapract{variable.awsAccountId.dev}"] # `test` environment resources are provisioned in the `dev` aws account
+  allowed_account_ids = ["@declapract{variable.awsAccountId.prep}"] # `test` environment resources are provisioned in the `prep` aws account
 }
 
 terraform {

package/package.json

@@ -2,7 +2,7 @@
   "name": "declapract-typescript-ehmpathy",
   "author": "ehmpathy",
   "description": "declapract best practices declarations for typescript",
-  "version": "0.49.3",
+  "version": "0.49.5",
   "license": "MIT",
   "main": "src/index.js",
   "repository": "ehmpathy/declapract-typescript-ehmpathy",
@@ -76,13 +76,13 @@
     "esbuild-register": "3.6.0",
     "husky": "8.0.3",
     "jest": "30.2.0",
-    "rhachet": "1.42.2",
+    "rhachet": "1.42.5",
     "rhachet-brains-anthropic": "0.4.1",
     "rhachet-brains-fireworksai": "0.1.3",
     "rhachet-brains-xai": "0.3.3",
-    "rhachet-roles-bhrain": "0.29.10",
-    "rhachet-roles-bhuild": "0.21.18",
-    "rhachet-roles-ehmpathy": "1.37.0",
+    "rhachet-roles-bhrain": "0.29.15",
+    "rhachet-roles-bhuild": "0.21.19",
+    "rhachet-roles-ehmpathy": "1.37.6",
     "tsc-alias": "1.8.10",
     "tsx": "4.20.6",
     "type-fns": "1.21.2",