declapract-typescript-ehmpathy 0.49.5 → 0.49.8

package/dist/practices/persist-with-rds/best-practice/provision/schema/connection.config.js

@@ -7,13 +7,19 @@ const { getConfig } = require('../../src/utils/config/getConfig');
 
 const promiseSchemaControlCredentials = async () => {
   const config = await getConfig();
+
+  // select the cicd grant to connect as; default to for-apply (full/write access).
+  // the plan job opts down to the readonly for-plan grant via GRANT=plan.
+  const grant = process.env.GRANT === 'plan' ? 'for-plan' : 'for-apply';
+  const role = config.database.role.cicd[grant];
+
   const credentials = {
     host: config.database.tunnel.local.host,
     port: config.database.tunnel.local.port,
     database: config.database.target.database,
     schema: config.database.target.schema,
-    username: config.database.role.cicd.username,
-    password: config.database.role.cicd.password,
+    username: role.username,
+    password: role.password,
   };
   return credentials;
 };

package/dist/practices/persist-with-rds/best-practice/src/utils/config/config.schema.ts

@@ -1,45 +1,103 @@
 import { z } from 'zod';
 
-export const schema = z.object({
-  organization: z.string(),
-  project: z.string(),
-  environment: z.object({
-    access: z.enum(['test', 'prep', 'prod']),
-  }),
-  aws: z.object({
-    account: z.string(),
-    namespace: z.string(),
-  }),
-  database: z.object({
-    target: z.object({
-      database: z.string(),
-      schema: z.string(),
+/** .what = the two oidc grant scopes config can be read under. */
+export type Grant = 'plan' | 'apply';
+
+/**
+ * .what = get the config schema for a given oidc grant.
+ * .why = the prod plan job's oidc role is DENIED every ssm secret except the
+ *        for-plan db credential. under grant=plan the
+ *        eagerly-read getConfig() cannot read for-apply's password (or any other
+ *        secret); sdk-config substitutes undefined for each denied param, so those
+ *        must be .optional() to tolerate the miss. grant=apply (the default — apply
+ *        job, cloud runtime, local dev, tests) keeps every secret REQUIRED, so its
+ *        inferred type carries no `| undefined` and needs no guards at consumers.
+ * .note = grant is a per-schema arg, NOT read from env here; getConfig picks which
+ *         schema to parse with at call time (see getConfig.ts).
+ */
+const getSchema = <TGrant extends Grant>(grant: TGrant) => {
+  // required by default; optional only under grant=plan. generic on the LITERAL
+  // TGrant so each schema infers monomorphically (all-required for apply,
+  // reader-denied-optional for plan) instead of the widened union.
+  // .note on `as`: a conditional return type cannot be proven from the runtime
+  //   ternary, so TS needs this one assertion. it is sound — the branch matches
+  //   TGrant exactly (plan => .optional(), apply => schema).
+  const secret = <T extends z.ZodTypeAny>(
+    schema: T,
+  ): TGrant extends 'plan' ? z.ZodOptional<T> : T =>
+    (grant === 'plan' ? schema.optional() : schema) as TGrant extends 'plan'
+      ? z.ZodOptional<T>
+      : T;
+
+  return z.object({
+    organization: z.string(),
+    project: z.string(),
+    environment: z.object({
+      access: z.enum(['test', 'prep', 'prod']),
     }),
-    role: z.object({
-      cicd: z.object({
-        username: z.string(),
-        password: z.string(),
-      }),
-      crud: z.object({
-        username: z.string(),
-        password: z.string(),
-      }),
+    aws: z.object({
+      account: z.string(),
+      namespace: z.string(),
     }),
-    tunnel: z.object({
-      bastion: z.string(),
-      cluster: z.string(),
-      local: z.object({
-        host: z.string(),
-        port: z.number(),
+    database: z.object({
+      target: z.object({
+        database: z.string(),
+        schema: z.string(),
       }),
-      lambda: z
-        .object({
+      role: z.object({
+        cicd: z.object({
+          // for-plan and for-apply may map to DIFFERENT db users (e.g. a readonly
+          // user for-plan), so each carries its own username. names mirror the prod
+          // oidc roles (for-plan / for-apply) that read them.
+          // .note: only for-apply's PASSWORD is reader-denied under grant=plan; the
+          // username is a readable static, so the object is always present. mark the
+          // password itself as the secret (a secret() on the whole object would never
+          // tolerate the miss — the present object still validates its required password).
+          'for-plan': z.object({ username: z.string(), password: z.string() }),
+          'for-apply': z.object({
+            username: z.string(),
+            password: secret(z.string()),
+          }),
+        }),
+        crud: z.object({
+          username: z.string(),
+          password: secret(z.string()),
+        }),
+      }),
+      tunnel: z.object({
+        bastion: z.object({ exid: z.string() }).optional(),
+        cluster: z.object({ name: z.string() }).optional(),
+        local: z.object({
           host: z.string(),
           port: z.number(),
-        })
-        .nullable(),
+        }),
+        lambda: z
+          .object({
+            host: z.string(),
+            port: z.number(),
+          })
+          .nullable(),
+      }),
     }),
-  }),
-});
+  });
+};
+
+/**
+ * .what = one schema per grant. apply = every secret required (the default);
+ *         plan = the reader-denied secrets optional.
+ * .why = getConfig picks which to parse with by grant (see getConfig.ts).
+ */
+export const schema = {
+  apply: getSchema('apply'),
+  plan: getSchema('plan'),
+} as const;
 
-export type Config = z.infer<typeof schema>;
+/**
+ * .what = the config type for a grant, default apply.
+ * .why = Config (= Config<'apply'>) is the fully-required shape ordinary consumers
+ *        get, so no `| undefined` leaks into the app's config type; Config<'plan'>
+ *        is the opt-in narrowed shape whose reader-denied secrets may be absent.
+ */
+export type Config<TGrant extends Grant = 'apply'> = z.infer<
+  (typeof schema)[TGrant]
+>;

package/dist/practices/provision-github/best-practice/package.json

@@ -1,6 +1,7 @@
 {
   "devDependencies": {
     "declastruct": "@declapract{check.minVersion('1.9.1')}",
-    "declastruct-github": "@declapract{check.minVersion('1.6.0')}"
+    "declastruct-github": "@declapract{check.minVersion('1.7.2')}",
+    "sdk-logs": "@declapract{check.minVersion('0.9.2')}"
   }
 }

package/dist/practices/provision-github/best-practice/provision/github.repo/resources.ts

@@ -3,14 +3,17 @@ import {
   type DeclaredGithubBranch,
   DeclaredGithubBranchProtection,
   DeclaredGithubEnvironment,
+  type DeclaredGithubOrg,
   DeclaredGithubRepo,
   DeclaredGithubRepoConfig,
   DeclaredGithubRepoRuleset,
+  type DeclaredGithubTeam,
   DeclaredGithubTeamRepoAccess,
   getDeclastructGithubProvider,
 } from 'declastruct-github';
 import { type DomainEntity, RefByUnique } from 'domain-objects';
 import { UnexpectedCodePathError } from 'helpful-errors';
+import { genLogMethods } from 'sdk-logs';
 
 import pkgJson from '../../package.json';
 
@@ -30,12 +33,8 @@ export const getProviders = async (): Promise<DeclastructProvider[]> => [
       },
     },
     {
-      log: {
-        info: () => {},
-        debug: () => {},
-        warn: console.warn,
-        error: console.error,
-      },
+      // MUST be an sdk-logs logger — 1.6.0 DAOs read log._.level via as-procedure
+      log: genLogMethods(),
     },
   ),
 ];
@@ -128,9 +127,15 @@ export const getResources = async (): Promise<DomainEntity<any>[]> => {
     restrictions: null,
   });
 
-  // grant releasers team access to the repo (required before they can be environment reviewers)
-  const teamReleasersAccess = DeclaredGithubTeamRepoAccess.as({
-    team: { org: { login: '@declapract{variable.organizationName}' }, slug: 'releasers' },
+  // ref the releasers team
+  const teamReleasers = RefByUnique.as<typeof DeclaredGithubTeam>({
+    org: RefByUnique.as<typeof DeclaredGithubOrg>({ login: '@declapract{variable.organizationName}' }),
+    slug: 'releasers',
+  });
+
+  // grant the releasers team push access to the repo (standalone; no env depends on it)
+  const teamReleasersRepoAccess = DeclaredGithubTeamRepoAccess.as({
+    team: teamReleasers,
     repo,
     permission: 'push', // write access needed to deploy
   });
@@ -141,32 +146,56 @@ export const getResources = async (): Promise<DomainEntity<any>[]> => {
     name: 'production-on-main',
     reviewers: null, // no approval required — PR merge is the gate
     waitTimer: null, // no delay
-    deploymentBranchPolicy: { customBranches: ['main'] }, // only main branch
+    deploymentBranchPolicy: {
+      // accept both the main branch and `v*` release tags: prod deploys are
+      // triggered by a release tag cut from main (see protect-release-tags
+      // ruleset below), so the ref gate must admit that tag. a branch-only
+      // policy would have the environment reject the tag-triggered deploy.
+      // (requires declastruct-github >=1.7.2 for tag-target customPatterns.)
+      customPatterns: [
+        { name: 'main', target: 'branch' },
+        { name: 'v*', target: 'tag' },
+      ],
+    },
+    preventSelfReview: false,
+  });
+
+  // declare environment for adhoc production apply from a non-main branch
+  // .why = github env "required reviewers" is Enterprise-only; on a private repo
+  //        under the Free/Pro/Team plan the api returns 422 for BOTH team and user
+  //        reviewers. so this env carries NO protection rule — the human gate lives
+  //        in aws via an `actor_id` allowlist on this env's sts trust statement
+  //        (declared org-wide in aws.auth). do NOT add `reviewers` here (it will 422 on apply).
+  const envProductionOnElseApply = DeclaredGithubEnvironment.as({
+    repo,
+    name: 'production-on-else-apply',
+    reviewers: null, // gate is the aws actor_id allowlist, not a github reviewer
+    waitTimer: null,
+    deploymentBranchPolicy: null, // any branch
     preventSelfReview: false,
   });
 
-  // declare environment for production deployments from other branches (requires approval)
-  const envProductionOnElse = DeclaredGithubEnvironment.as({
+  // declare environment for production plan from any branch (readonly, no approval)
+  const envProductionOnElsePlan = DeclaredGithubEnvironment.as({
     repo,
-    name: 'production-on-else',
-    reviewers: { users: null, teams: ['releasers'] },
-    waitTimer: null, // no delay once approved
+    name: 'production-on-else-plan',
+    reviewers: null, // no approval required — plan is readonly, safe
+    waitTimer: null, // no delay
     deploymentBranchPolicy: null, // any branch
-    preventSelfReview: false, // self-approval allowed if in reviewers list
+    preventSelfReview: false,
   });
 
   // restrict who may cut `v*` release tags to the rhelease app only
-  // .why = prod apply is gated on a version tag cut from main; if anyone could push a
-  //        `v*` tag, that gate is bypassable. this ruleset blocks creation, update, and
-  //        deletion of `v*` tags for everyone except the rhelease app — the github half
-  //        of the prod-apply oidc guarantee, and the immutability of released tags
+  // .why = prod apply is gated on a release tag cut from main; if anyone could push a
+  //        `v*` tag, that gate is bypassable. this ruleset blocks create/move/delete of
+  //        `v*` tags for everyone except the rhelease app (the github half of the oidc guarantee)
   const rulesetReleaseTags = DeclaredGithubRepoRuleset.as({
     repo,
     name: 'protect-release-tags',
     target: 'tag',
     enforcement: 'active',
 
-    // only the rhelease github app may write `v*` tags
+    // only the rhelease github app may create `v*` tags
     bypassActors: [
       {
         actorId: 2472031, // rhelease github app id (gh api /apps/rhelease)
@@ -191,9 +220,10 @@ export const getResources = async (): Promise<DomainEntity<any>[]> => {
     repo,
     repoConfig,
     branchMainProtection,
-    teamReleasersAccess, // must come before environments that reference this team
+    teamReleasersRepoAccess,
     envProductionOnMain,
-    envProductionOnElse,
+    envProductionOnElseApply,
+    envProductionOnElsePlan,
     rulesetReleaseTags,
   ];
 };

package/dist/practices/rhachet/best-practice/package.json

@@ -1,16 +1,18 @@
 {
   "devDependencies": {
-    "rhachet": "@declapract{check.minVersion('1.41.15')}",
+    "rhachet": "@declapract{check.minVersion('1.43.1')}",
     "rhachet-brains-anthropic": "@declapract{check.minVersion('0.4.1')}",
-    "rhachet-brains-fireworksai": "@declapract{check.minVersion('0.1.1')}",
+    "rhachet-brains-fireworksai": "@declapract{check.minVersion('0.1.3')}",
     "rhachet-brains-xai": "@declapract{check.minVersion('0.3.3')}",
-    "rhachet-roles-bhrain": "@declapract{check.minVersion('0.29.0')}",
-    "rhachet-roles-bhuild": "@declapract{check.minVersion('0.21.15')}",
-    "rhachet-roles-ehmpathy": "@declapract{check.minVersion('1.35.12')}",
+    "rhachet-roles-bhrain": "@declapract{check.minVersion('0.29.24')}",
+    "rhachet-roles-bhrowser": "@declapract{check.minVersion('0.1.0')}",
+    "rhachet-roles-bhuild": "@declapract{check.minVersion('0.21.22')}",
+    "rhachet-roles-ehmpathy": "@declapract{check.minVersion('1.38.1')}",
+    "rhachet-roles-ghlitch": "@declapract{check.minVersion('0.2.5')}",
     "rhachet-roles-rhachet": "@declapract{check.minVersion('0.1.7')}"
   },
   "scripts": {
-    "prepare:rhachet": "rhachet init --keys --hooks --roles mechanic behaver driver reviewer librarian ergonomist architect dispatcher",
+    "prepare:rhachet": "rhachet init --keys --hooks --roles mechanic behaver driver reviewer librarian ergonomist architect dispatcher learner operator observer deployer playwright enroller",
     "upgrade:rhachet": "rhachet upgrade"
   }
 }

package/dist/practices/terraform-aws/best-practice/provision/aws/environments/prep/versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.14"
+  required_version = ">= 1.7" # removed{} blocks (parameter-store forget) need >= 1.7
   required_providers {
     aws = {
       source  = "hashicorp/aws"

package/dist/practices/terraform-aws/best-practice/provision/aws/environments/prod/versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.14"
+  required_version = ">= 1.7" # removed{} blocks (parameter-store forget) need >= 1.7
   required_providers {
     aws = {
       source  = "hashicorp/aws"

package/dist/practices/terraform-aws/best-practice/provision/aws/environments/test/versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.14"
+  required_version = ">= 1.7" # removed{} blocks (parameter-store forget) need >= 1.7
   required_providers {
     aws = {
       source  = "hashicorp/aws"

package/package.json

@@ -2,7 +2,7 @@
   "name": "declapract-typescript-ehmpathy",
   "author": "ehmpathy",
   "description": "declapract best practices declarations for typescript",
-  "version": "0.49.5",
+  "version": "0.49.8",
   "license": "MIT",
   "main": "src/index.js",
   "repository": "ehmpathy/declapract-typescript-ehmpathy",
@@ -43,7 +43,7 @@
     "preversion": "npm run prepush",
     "postversion": "git push origin HEAD --tags --no-verify",
     "prepare:husky": "husky install && chmod ug+x .husky/*",
-    "prepare:rhachet": "rhachet init --hooks --roles mechanic behaver driver architect ergonomist reviewer dreamer dispatcher",
+    "prepare:rhachet": "rhachet init --hooks --roles mechanic behaver driver architect ergonomist reviewer dreamer dispatcher learner operator observer deployer playwright enroller",
     "prepare": "if [ -e .git ] && [ -z \"${CI:-}\" ]; then npm run prepare:husky && npm run prepare:rhachet; fi"
   },
   "dependencies": {
@@ -76,13 +76,16 @@
     "esbuild-register": "3.6.0",
     "husky": "8.0.3",
     "jest": "30.2.0",
-    "rhachet": "1.42.5",
+    "rhachet": "1.43.1",
     "rhachet-brains-anthropic": "0.4.1",
     "rhachet-brains-fireworksai": "0.1.3",
     "rhachet-brains-xai": "0.3.3",
-    "rhachet-roles-bhrain": "0.29.15",
-    "rhachet-roles-bhuild": "0.21.19",
-    "rhachet-roles-ehmpathy": "1.37.6",
+    "rhachet-roles-bhrain": "0.30.2",
+    "rhachet-roles-bhrowser": "0.1.0",
+    "rhachet-roles-bhuild": "0.21.26",
+    "rhachet-roles-ehmpathy": "1.38.1",
+    "rhachet-roles-ghlitch": "0.2.5",
+    "rhachet-roles-rhachet": "0.1.7",
     "tsc-alias": "1.8.10",
     "tsx": "4.20.6",
     "type-fns": "1.21.2",

package/dist/practices/cache/.test/assets/declarations/declapract.declare.yml

@@ -1,4 +0,0 @@
-# minimal declarations for cache practice integration test
-declare:
-  practices: practices
-  use-cases: useCases.yml

package/dist/practices/cache/.test/assets/declarations/practices/cache/.declapract.integration.test.ts

@@ -1,108 +0,0 @@
-import fs from 'fs/promises';
-import path from 'node:path';
-
-import { executeApply } from 'declapract';
-import { genTempDir, given, then, useBeforeAll, when } from 'test-fns';
-
-// executeApply is slow (90+ seconds per invocation due to full practice evaluation)
-jest.setTimeout(180_000); // 3 minutes
-
-/**
- * .what = acceptance test for cache practice with .ifInstalled() modifier
- * .why = verifies that minVersion().ifInstalled() correctly:
- *        - skips check when package is not installed
- *        - flags outdated versions when package IS installed
- *        - passes when package is at or above minimum version
- */
-describe('cache practice with ifInstalled', () => {
-  given('[case1] repo WITHOUT cache package installed', () => {
-    const tempDir = genTempDir({
-      slug: 'cache-not-installed',
-      clone: './src/practices/cache/.test/assets/repo-without-cache-package',
-      symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
-    });
-
-    // run executeApply before assertions
-    useBeforeAll(async () => {
-      await executeApply({
-        config: path.join(tempDir, 'declapract.use.yml'),
-        practice: 'cache',
-      });
-    }, 120_000); // 2 min timeout
-
-    when('[t0] after declapract apply', () => {
-      then('package.json is unchanged (ifInstalled skips absent packages)', async () => {
-        const packageJson = JSON.parse(
-          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
-        );
-        // should NOT have added cache packages since they were absent
-        expect(packageJson.dependencies['simple-in-memory-cache']).toBeUndefined();
-        expect(packageJson.dependencies['simple-on-disk-cache']).toBeUndefined();
-        expect(packageJson.dependencies['with-simple-cache']).toBeUndefined();
-        // original dependency should still be there
-        expect(packageJson.dependencies.lodash).toBe('4.17.21');
-      });
-    });
-  });
-
-  given('[case2] repo WITH outdated cache package', () => {
-    const tempDir = genTempDir({
-      slug: 'cache-outdated',
-      clone: './src/practices/cache/.test/assets/repo-with-old-cache-package',
-      symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
-    });
-
-    // run executeApply before assertions
-    useBeforeAll(async () => {
-      await executeApply({
-        config: path.join(tempDir, 'declapract.use.yml'),
-        practice: 'cache',
-      });
-    }, 120_000); // 2 min timeout
-
-    when('[t0] after declapract apply', () => {
-      then('package.json has version upgraded to minimum', async () => {
-        const packageJson = JSON.parse(
-          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
-        );
-        // should have upgraded from 0.3.0 to 0.4.3
-        expect(packageJson.dependencies['simple-in-memory-cache']).toBe('0.4.3');
-      });
-    });
-  });
-
-  given('[case3] repo WITH valid cache package version', () => {
-    const tempDir = genTempDir({
-      slug: 'cache-valid',
-      clone: './src/practices/cache/.test/assets/repo-with-valid-cache-package',
-      symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
-    });
-
-    // run executeApply before assertions
-    useBeforeAll(async () => {
-      await executeApply({
-        config: path.join(tempDir, 'declapract.use.yml'),
-        practice: 'cache',
-      });
-    }, 120_000); // 2 min timeout
-
-    when('[t0] after declapract apply', () => {
-      then('package.json version is unchanged (already at minimum)', async () => {
-        const packageJson = JSON.parse(
-          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
-        );
-        // should still be 0.4.3 (unchanged, already valid)
-        expect(packageJson.dependencies['simple-in-memory-cache']).toBe('0.4.3');
-      });
-    });
-  });
-});

package/dist/practices/cache/.test/assets/declarations/practices/cache/.test/assets/declarations/declapract.declare.yml

@@ -1,4 +0,0 @@
-# minimal declarations for cache practice integration test
-declare:
-  practices: practices
-  use-cases: useCases.yml

package/dist/practices/cache/.test/assets/declarations/practices/cache/.test/assets/declarations/practices/cache/.declapract.integration.test.ts

@@ -1,108 +0,0 @@
-import fs from 'fs/promises';
-import path from 'node:path';
-
-import { executeApply } from 'declapract';
-import { genTempDir, given, then, useBeforeAll, when } from 'test-fns';
-
-// executeApply is slow (90+ seconds per invocation due to full practice evaluation)
-jest.setTimeout(180_000); // 3 minutes
-
-/**
- * .what = acceptance test for cache practice with .ifInstalled() modifier
- * .why = verifies that minVersion().ifInstalled() correctly:
- *        - skips check when package is not installed
- *        - flags outdated versions when package IS installed
- *        - passes when package is at or above minimum version
- */
-describe('cache practice with ifInstalled', () => {
-  given('[case1] repo WITHOUT cache package installed', () => {
-    const tempDir = genTempDir({
-      slug: 'cache-not-installed',
-      clone: './src/practices/cache/.test/assets/repo-without-cache-package',
-      symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
-    });
-
-    // run executeApply before assertions
-    useBeforeAll(async () => {
-      await executeApply({
-        config: path.join(tempDir, 'declapract.use.yml'),
-        practice: 'cache',
-      });
-    }, 120_000); // 2 min timeout
-
-    when('[t0] after declapract apply', () => {
-      then('package.json is unchanged (ifInstalled skips absent packages)', async () => {
-        const packageJson = JSON.parse(
-          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
-        );
-        // should NOT have added cache packages since they were absent
-        expect(packageJson.dependencies['simple-in-memory-cache']).toBeUndefined();
-        expect(packageJson.dependencies['simple-on-disk-cache']).toBeUndefined();
-        expect(packageJson.dependencies['with-simple-cache']).toBeUndefined();
-        // original dependency should still be there
-        expect(packageJson.dependencies.lodash).toBe('4.17.21');
-      });
-    });
-  });
-
-  given('[case2] repo WITH outdated cache package', () => {
-    const tempDir = genTempDir({
-      slug: 'cache-outdated',
-      clone: './src/practices/cache/.test/assets/repo-with-old-cache-package',
-      symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
-    });
-
-    // run executeApply before assertions
-    useBeforeAll(async () => {
-      await executeApply({
-        config: path.join(tempDir, 'declapract.use.yml'),
-        practice: 'cache',
-      });
-    }, 120_000); // 2 min timeout
-
-    when('[t0] after declapract apply', () => {
-      then('package.json has version upgraded to minimum', async () => {
-        const packageJson = JSON.parse(
-          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
-        );
-        // should have upgraded from 0.3.0 to 0.4.3
-        expect(packageJson.dependencies['simple-in-memory-cache']).toBe('0.4.3');
-      });
-    });
-  });
-
-  given('[case3] repo WITH valid cache package version', () => {
-    const tempDir = genTempDir({
-      slug: 'cache-valid',
-      clone: './src/practices/cache/.test/assets/repo-with-valid-cache-package',
-      symlink: [
-        { at: 'declarations', to: './src/practices/cache/.test/assets/declarations' },
-        { at: 'node_modules', to: 'node_modules' },
-      ],
-    });
-
-    // run executeApply before assertions
-    useBeforeAll(async () => {
-      await executeApply({
-        config: path.join(tempDir, 'declapract.use.yml'),
-        practice: 'cache',
-      });
-    }, 120_000); // 2 min timeout
-
-    when('[t0] after declapract apply', () => {
-      then('package.json version is unchanged (already at minimum)', async () => {
-        const packageJson = JSON.parse(
-          await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8'),
-        );
-        // should still be 0.4.3 (unchanged, already valid)
-        expect(packageJson.dependencies['simple-in-memory-cache']).toBe('0.4.3');
-      });
-    });
-  });
-});

package/dist/practices/cache/.test/assets/declarations/practices/cache/.test/assets/declarations/practices/cache/.test/assets/declarations/declapract.declare.yml

@@ -1,4 +0,0 @@
-# minimal declarations for cache practice integration test
-declare:
-  practices: practices
-  use-cases: useCases.yml