fix(devx): seven gates that import typescript refuse an uninstalled tree with a named prerequisite, not a raw stack

`check:system-context-census` and six sibling sites still carried the bare
top-level `import ts from 'typescript'` (and, at one site, a bare dynamic
`import('@typescript-eslint/parser')`) that PR #11824 converted everywhere else.
node resolves those before any module body runs, so the gate cannot preflight
its own missing dependency: on a fresh worktree — the checkout shape CLAUDE.md
mandates — it died with a node-internals `ERR_MODULE_NOT_FOUND` stack and exit
**1**, the same code a real finding uses.

Each site now loads the dependency through `scripts/import-prerequisite.mjs`,
in the shape the 27 already-converted sites use, so the answer is
`PREREQUISITE NOT MET`, exit 3, and an explicit "nothing was measured".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

Author: claude

scripts/audits/14744-before-update-per-row-value-census.mjs

@@ -68,7 +68,8 @@
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import ts from 'typescript';
+import { requireDefaultExport } from '../import-prerequisite.mjs';
+const ts = await requireDefaultExport('typescript', () => import('typescript'), import.meta.url);
 // ⛔ Never `ts.createSourceFile` directly. It does not throw on a source it
 // cannot read — the errors are parked on `parseDiagnostics` and the recovered
 // tree walks like any other, so a file this census could not parse would be

scripts/check-comment-mask-corpus.mjs

@@ -130,6 +130,7 @@ import { tmpdir } from 'node:os';
 import { dirname, extname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { isEntrypoint } from './invoked-as.mjs';
+import { requireDependency } from './import-prerequisite.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
@@ -301,9 +302,25 @@ export async function loadMasker(maskerPath) {
   return module.scanSource;
 }
 
-/** The parser is loaded lazily so importing this module stays cheap. */
+/**
+ * The parser is loaded lazily so importing this module stays cheap — and through
+ * the prerequisite thunk, so an uninstalled tree gets a NAMED prerequisite and
+ * exit 3 instead of a raw `ERR_MODULE_NOT_FOUND` stack and exit 1. A dynamic
+ * import defers the resolution failure past linking, but it does not change what
+ * the failure LOOKS like: the rejection reaches the top level unhandled and node
+ * prints the same node-internals stack with the same exit 1 a finding uses.
+ *
+ * ⛔ `requireDependency`, not `requireDefaultExport`: this module wants the
+ * NAMESPACE (`parser.parse`). `@typescript-eslint/parser` has no default export
+ * worth reading, and the default-export helper reads `.default` strictly.
+ */
 async function loadParser() {
-  const parser = await import('@typescript-eslint/parser');
+  const parser = await requireDependency(
+    '@typescript-eslint/parser',
+    () => import('@typescript-eslint/parser'),
+    import.meta.url,
+    { measures: "`js-comment-mask.mjs` and an independent parser agree on every comment range in the tree" },
+  );
   return (source, options) => parser.parse(source, options);
 }
 

scripts/check-exported-any-returns.mts

@@ -118,7 +118,10 @@
 // them to the rest of the program — which is why landing this file lowered the
 // ledger entry by 54 errors it did not author. See the PR body.
 
-import ts from 'typescript';
+// `ts` is the RUNTIME namespace, loaded through the prerequisite thunk below; `TS`
+// is the same namespace as TYPES ONLY. `import type` is erased before the module
+// graph is linked, so it cannot bring back the `ERR_MODULE_NOT_FOUND` this closes.
+import type TS from 'typescript';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
@@ -127,6 +130,11 @@ import os from 'node:os';
 import { distIsStale } from './check-regen-pending.mjs';
 import { isEntrypoint } from './invoked-as.mjs';
 
+import { requireDefaultExport } from './import-prerequisite.mjs';
+const ts = await requireDefaultExport('typescript', () => import('typescript'), import.meta.url, {
+  measures: 'any exported callable of an SDK package resolves to `any`',
+});
+
 const HERE = path.dirname(url.fileURLToPath(import.meta.url));
 const ROOT = path.resolve(HERE, '..');
 const SELF_TEST = process.argv.includes('--self-test');
@@ -200,7 +208,7 @@ export type ScanResult = {
   anyReturns: Map<string, string>;
 };
 
-function makeProgram(files: string[], extra: ts.CompilerOptions = {}): ts.Program {
+function makeProgram(files: string[], extra: TS.CompilerOptions = {}): TS.Program {
   return ts.createProgram(files, {
     module: ts.ModuleKind.NodeNext,
     moduleResolution: ts.ModuleResolutionKind.NodeNext,
@@ -224,7 +232,7 @@ function makeProgram(files: string[], extra: ts.CompilerOptions = {}): ts.Progra
  * refuses. A named class that IS part of the surface (`RealtimeAPI`,
  * `QueryBuilder`) is reached anyway, as its own module export.
  */
-export function scan(program: ts.Program, entryFile: string): ScanResult {
+export function scan(program: TS.Program, entryFile: string): ScanResult {
   const checker = program.getTypeChecker();
   const result: ScanResult = { callables: 0, generics: 0, anyReturns: new Map() };
 
@@ -236,19 +244,19 @@ export function scan(program: ts.Program, entryFile: string): ScanResult {
     );
   }
 
-  const isAny = (t: ts.Type | undefined): boolean => Boolean(t && t.flags & ts.TypeFlags.Any);
-  const unalias = (s: ts.Symbol): ts.Symbol =>
+  const isAny = (t: TS.Type | undefined): boolean => Boolean(t && t.flags & ts.TypeFlags.Any);
+  const unalias = (s: TS.Symbol): TS.Symbol =>
     s.getFlags() & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(s) : s;
 
   /** A `{ … }` type literal — the namespacing shape, not a named data type. */
-  const isAnonymousObject = (t: ts.Type): boolean => {
+  const isAnonymousObject = (t: TS.Type): boolean => {
     if (!(t.flags & ts.TypeFlags.Object)) return false;
-    if (!((t as ts.ObjectType).objectFlags & ts.ObjectFlags.Anonymous)) return false;
+    if (!((t as TS.ObjectType).objectFlags & ts.ObjectFlags.Anonymous)) return false;
     const decl = t.getSymbol()?.declarations?.[0];
     return Boolean(decl && ts.isTypeLiteralNode(decl));
   };
 
-  const record = (key: string, sig: ts.Signature): void => {
+  const record = (key: string, sig: TS.Signature): void => {
     result.callables++;
     if ((sig.getTypeParameters() ?? []).length > 0) result.generics++;
     const ret = checker.getReturnTypeOfSignature(sig);
@@ -272,7 +280,7 @@ export function scan(program: ts.Program, entryFile: string): ScanResult {
   // walk happened to reach first, so the second path's sites are invisible to the
   // ratchet and the ledger keys silently depend on walk order. A per-branch set
   // still terminates (a cycle must revisit an ancestor) and reports every path.
-  const walk = (type: ts.Type, path: string, depth: number, ancestors: ReadonlySet<ts.Type>): void => {
+  const walk = (type: TS.Type, path: string, depth: number, ancestors: ReadonlySet<TS.Type>): void => {
     if (depth > 8 || ancestors.has(type)) return;
     const branch = new Set(ancestors).add(type);
     for (const prop of checker.getPropertiesOfType(type)) {

scripts/check-sdui-lockstep.mjs

@@ -109,7 +109,8 @@ import { fileURLToPath } from 'node:url';
 
 import { isEntrypoint } from './invoked-as.mjs';
 import { parseSourceFile } from './ts-parse.mjs';
-import ts from 'typescript';
+import { requireDefaultExport } from './import-prerequisite.mjs';
+const ts = await requireDefaultExport('typescript', () => import('typescript'), import.meta.url);
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 

scripts/isystem-census.mjs

@@ -75,7 +75,8 @@ import { execFileSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import ts from 'typescript';
+import { requireDefaultExport } from './import-prerequisite.mjs';
+const ts = await requireDefaultExport('typescript', () => import('typescript'), import.meta.url);
 
 import { isEntrypoint } from './invoked-as.mjs';
 import { parseSourceFile } from './ts-parse.mjs';

scripts/measure-durability-swallow-family.mjs

@@ -256,7 +256,8 @@
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import ts from 'typescript';
+import { requireDefaultExport } from './import-prerequisite.mjs';
+const ts = await requireDefaultExport('typescript', () => import('typescript'), import.meta.url);
 import { parseSourceFile } from './ts-parse.mjs';
 
 const ROOT = fileURLToPath(new URL('..', import.meta.url));

scripts/tenant-audit-census.mjs

@@ -144,7 +144,8 @@ import { execFileSync } from 'node:child_process';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import ts from 'typescript';
+import { requireDefaultExport } from './import-prerequisite.mjs';
+const ts = await requireDefaultExport('typescript', () => import('typescript'), import.meta.url);
 
 import { isEntrypoint } from './invoked-as.mjs';
 import { parseSourceFile } from './ts-parse.mjs';