declapract-typescript-ehmpathy 0.49.13 → 0.49.15

package/dist/__snapshots__/actionPins.declapract.integration.test.ts.snap

@@ -3,31 +3,30 @@
 exports[`action pins given: [case1] every yaml template declared under a practice .github tree when: [t2] the refs are read together then: the pin table reads as declared -- if the diff surprises you, a bump reached more or fewer sites than intended 1`] = `
 [
   "Entle/action-pagerduty-alert@e6ca54cd88948b8a50f5bb1071dfa5bdb149ce7e — 1 site",
-  "actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 — 19 sites",
-  "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 — 22 sites",
+  "actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 — 20 sites",
+  "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 — 23 sites",
   "actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 — 3 sites",
   "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 — 1 site",
-  "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 — 18 sites",
+  "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 — 19 sites",
   "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 — 1 site",
   "amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 — 1 site",
-  "aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a — 13 sites",
+  "aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a — 14 sites",
   "expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e — 2 sites",
-  "hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd — 3 sites",
+  "hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd — 2 sites",
   "pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 — 1 site",
 ]
 `;
 
 exports[`action pins given: [case2] every yaml under this repo's own .github tree when: [t2] the refs are read together then: the pin table reads as declared -- if the diff surprises you, a bump reached more or fewer sites than intended 1`] = `
 [
-  "actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 — 12 sites",
-  "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 — 12 sites",
-  "actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 — 3 sites",
+  "actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 — 13 sites",
+  "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 — 13 sites",
+  "actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 — 4 sites",
   "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 — 1 site",
-  "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 — 11 sites",
+  "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 — 12 sites",
   "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 — 1 site",
   "amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 — 1 site",
   "aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a — 4 sites",
-  "hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd — 1 site",
   "pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 — 1 site",
 ]
 `;

package/dist/__snapshots__/ancientTargetPublished.declapract.integration.test.ts.snap

@@ -1,8 +1,8 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
-exports[`the EnvAccess target op emits only slugs the dual-publish scaffold publishes (case=2 no-404) given: the ancient/contemp target ops and the serverless accessByStage scaffold when: the per-tier emitted slugs are derived for both target ops then: the target-slug shape matches snapshot: per-tier target slug vs published stages 1`] = `
+exports[`the EnvAccess target op emits only slugs the dual-publish scaffold publishes (case=2 no-404) given: the ancient/contemp target ops and the serverless accessByStage scaffold when: the per-access emitted slugs are derived for both target ops then: the target-slug shape matches snapshot: per-access target slug vs published stages 1`] = `
 {
-  "perTier": [
+  "perAccess": [
     {
       "access": "prep",
       "ancient": "dev",
@@ -29,7 +29,7 @@ exports[`the EnvAccess target op emits only slugs the dual-publish scaffold publ
     "prep": "prep",
     "prod": "prod",
   },
-  "deployedTiers": [
+  "deployedAccesses": [
     "prep",
     "prod",
   ],

package/dist/__snapshots__/typecheckBestPracticeTemplates.declapract.integration.test.ts.snap

@@ -0,0 +1,176 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`typecheck best-practice templates given: [usecase] app-react-native-expo applied to a bare repo when: [t1] the emitted tree is compiled with the emitted tsconfig then: the tsc diagnostics match snapshot: app-react-native-expo — tsc --noEmit diagnostics 1`] = `""`;
+
+exports[`typecheck best-practice templates given: [usecase] app-react-native-expo applied to a bare repo when: [t2] the twice-applied repo is planned again then: the files left for a human to author match snapshot: app-react-native-expo — files flagged for a human 1`] = `
+[
+  ".agent/keyrack.yml",
+  "src/**/*.integration.test.ts",
+  "src/**/*.test.ts",
+  "src/contract/**/*.ts",
+  "src/domain.objects/**/*.ts",
+  "src/domain.objects/index.ts",
+  "src/domain.operations/**/*.ts",
+]
+`;
+
+exports[`typecheck best-practice templates given: [usecase] app-react-native-expo applied to a bare repo when: [t3] the emitted cycle check runs, as \`npm run test:lint\` does then: the exit status and the cycles it finds match snapshot: app-react-native-expo — test:lint:cycles summary 1`] = `
+{
+  "analyzed": false,
+  "cycles": [],
+  "status": 1,
+}
+`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service applied to a bare repo when: [t1] the emitted tree is compiled with the emitted tsconfig then: the tsc diagnostics match snapshot: lambda-service — tsc --noEmit diagnostics 1`] = `""`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service applied to a bare repo when: [t2] the twice-applied repo is planned again then: the files left for a human to author match snapshot: lambda-service — files flagged for a human 1`] = `
+[
+  ".agent/keyrack.yml",
+  "blackbox/**/*.acceptance.test.ts",
+  "blackbox/lambdas/*.acceptance.test.ts",
+  "src/domain.objects/**/*.ts",
+  "src/domain.objects/index.ts",
+  "src/domain.operations/**/*.ts",
+  "serverless.yml",
+]
+`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service applied to a bare repo when: [t3] the emitted cycle check runs, as \`npm run test:lint\` does then: the exit status and the cycles it finds match snapshot: lambda-service — test:lint:cycles summary 1`] = `
+{
+  "analyzed": true,
+  "cycles": [
+    "bottleneck -> bottleneck",
+    "domain-objects -> domain-objects",
+    "domain-objects -> domain-objects -> domain-objects",
+    "helpful-errors -> helpful-errors",
+    "util -> inherits",
+    "with-simple-cache -> with-simple-cache",
+    "with-simple-cache -> with-simple-cache -> with-simple-cache -> with-simple-cache",
+  ],
+  "status": 1,
+}
+`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service-with-dynamodb applied to a bare repo when: [t1] the emitted tree is compiled with the emitted tsconfig then: the tsc diagnostics match snapshot: lambda-service-with-dynamodb — tsc --noEmit diagnostics 1`] = `""`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service-with-dynamodb applied to a bare repo when: [t2] the twice-applied repo is planned again then: the files left for a human to author match snapshot: lambda-service-with-dynamodb — files flagged for a human 1`] = `
+[
+  ".agent/keyrack.yml",
+  "blackbox/**/*.acceptance.test.ts",
+  "blackbox/lambdas/*.acceptance.test.ts",
+  "src/domain.objects/**/*.ts",
+  "src/domain.objects/index.ts",
+  "src/domain.operations/**/*.ts",
+  "serverless.yml",
+]
+`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service-with-dynamodb applied to a bare repo when: [t3] the emitted cycle check runs, as \`npm run test:lint\` does then: the exit status and the cycles it finds match snapshot: lambda-service-with-dynamodb — test:lint:cycles summary 1`] = `
+{
+  "analyzed": true,
+  "cycles": [
+    "bottleneck -> bottleneck",
+    "domain-objects -> domain-objects",
+    "domain-objects -> domain-objects -> domain-objects",
+    "helpful-errors -> helpful-errors",
+    "util -> inherits",
+    "with-simple-cache -> with-simple-cache",
+    "with-simple-cache -> with-simple-cache -> with-simple-cache -> with-simple-cache",
+  ],
+  "status": 1,
+}
+`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service-with-rds applied to a bare repo when: [t1] the emitted tree is compiled with the emitted tsconfig then: the tsc diagnostics match snapshot: lambda-service-with-rds — tsc --noEmit diagnostics 1`] = `""`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service-with-rds applied to a bare repo when: [t2] the twice-applied repo is planned again then: the files left for a human to author match snapshot: lambda-service-with-rds — files flagged for a human 1`] = `
+[
+  ".agent/keyrack.yml",
+  "blackbox/**/*.acceptance.test.ts",
+  "blackbox/lambdas/*.acceptance.test.ts",
+  "src/domain.objects/**/*.ts",
+  "src/domain.objects/index.ts",
+  "src/domain.operations/**/*.ts",
+  "serverless.yml",
+]
+`;
+
+exports[`typecheck best-practice templates given: [usecase] lambda-service-with-rds applied to a bare repo when: [t3] the emitted cycle check runs, as \`npm run test:lint\` does then: the exit status and the cycles it finds match snapshot: lambda-service-with-rds — test:lint:cycles summary 1`] = `
+{
+  "analyzed": true,
+  "cycles": [
+    "bottleneck -> bottleneck",
+    "domain-objects -> domain-objects",
+    "domain-objects -> domain-objects -> domain-objects",
+    "helpful-errors -> helpful-errors",
+    "util -> inherits",
+    "with-simple-cache -> with-simple-cache",
+    "with-simple-cache -> with-simple-cache -> with-simple-cache -> with-simple-cache",
+  ],
+  "status": 1,
+}
+`;
+
+exports[`typecheck best-practice templates given: [usecase] npm-package applied to a bare repo when: [t1] the emitted tree is compiled with the emitted tsconfig then: the tsc diagnostics match snapshot: npm-package — tsc --noEmit diagnostics 1`] = `""`;
+
+exports[`typecheck best-practice templates given: [usecase] npm-package applied to a bare repo when: [t2] the twice-applied repo is planned again then: the files left for a human to author match snapshot: npm-package — files flagged for a human 1`] = `
+[
+  ".agent/keyrack.yml",
+  "src/**/*.integration.test.ts",
+  "src/contract/**/*.ts",
+  "src/domain.objects/**/*.ts",
+  "src/domain.objects/index.ts",
+  "src/domain.operations/**/*.ts",
+]
+`;
+
+exports[`typecheck best-practice templates given: [usecase] npm-package applied to a bare repo when: [t3] the emitted cycle check runs, as \`npm run test:lint\` does then: the exit status and the cycles it finds match snapshot: npm-package — test:lint:cycles summary 1`] = `
+{
+  "analyzed": false,
+  "cycles": [],
+  "status": 1,
+}
+`;
+
+exports[`typecheck best-practice templates given: [usecase] rhachet-roles-package applied to a bare repo when: [t1] the emitted tree is compiled with the emitted tsconfig then: the tsc diagnostics match snapshot: rhachet-roles-package — tsc --noEmit diagnostics 1`] = `""`;
+
+exports[`typecheck best-practice templates given: [usecase] rhachet-roles-package applied to a bare repo when: [t2] the twice-applied repo is planned again then: the files left for a human to author match snapshot: rhachet-roles-package — files flagged for a human 1`] = `
+[
+  ".agent/keyrack.yml",
+  "src/**/*.integration.test.ts",
+  "src/contract/**/*.ts",
+  "src/domain.objects/**/*.ts",
+  "src/domain.objects/index.ts",
+  "src/domain.operations/**/*.ts",
+]
+`;
+
+exports[`typecheck best-practice templates given: [usecase] rhachet-roles-package applied to a bare repo when: [t3] the emitted cycle check runs, as \`npm run test:lint\` does then: the exit status and the cycles it finds match snapshot: rhachet-roles-package — test:lint:cycles summary 1`] = `
+{
+  "analyzed": false,
+  "cycles": [],
+  "status": 1,
+}
+`;
+
+exports[`typecheck best-practice templates given: [usecase] typescript-project applied to a bare repo when: [t1] the emitted tree is compiled with the emitted tsconfig then: the tsc diagnostics match snapshot: typescript-project — tsc --noEmit diagnostics 1`] = `""`;
+
+exports[`typecheck best-practice templates given: [usecase] typescript-project applied to a bare repo when: [t2] the twice-applied repo is planned again then: the files left for a human to author match snapshot: typescript-project — files flagged for a human 1`] = `
+[
+  ".agent/keyrack.yml",
+  "src/**/*.integration.test.ts",
+  "src/contract/**/*.ts",
+  "src/domain.objects/**/*.ts",
+  "src/domain.objects/index.ts",
+  "src/domain.operations/**/*.ts",
+]
+`;
+
+exports[`typecheck best-practice templates given: [usecase] typescript-project applied to a bare repo when: [t3] the emitted cycle check runs, as \`npm run test:lint\` does then: the exit status and the cycles it finds match snapshot: typescript-project — test:lint:cycles summary 1`] = `
+{
+  "analyzed": false,
+  "cycles": [],
+  "status": 1,
+}
+`;

package/dist/__snapshots__/useCases.rhachet-roles-package.declapract.integration.test.ts.snap

@@ -0,0 +1,29 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`useCases.yml — rhachet-roles-package given: [case1] the declared usecases when: [t0] rhachet-roles-package is resolved then: its resolved set matches snapshot: rhachet-roles-package practices 1`] = `
+[
+  "bottleneck",
+  "cache",
+  "cicd-common",
+  "cicd-package",
+  "conventional-commits",
+  "directory-structure-src",
+  "domain",
+  "errors",
+  "format",
+  "git",
+  "husky",
+  "lint",
+  "node",
+  "node-package",
+  "nonpublished-modules",
+  "package-json-order",
+  "pnpm",
+  "provision-github",
+  "rhachet",
+  "tests-any",
+  "tests-node",
+  "typescript-any",
+  "typescript-node",
+]
+`;

package/dist/__snapshots__/workflowCallerCalleeReconciliation.declapract.integration.test.ts.snap

@@ -141,13 +141,6 @@ exports[`reusable workflows reconcile caller against callee (#573 · #580) given
       "secrets": [],
       "secretsRequired": [],
     },
-    {
-      "base": "test.yml",
-      "inputs": [],
-      "inputsRequired": [],
-      "secrets": [],
-      "secretsRequired": [],
-    },
   ],
   "callers": [
     {
@@ -217,6 +210,23 @@ exports[`reusable workflows reconcile caller against callee (#573 · #580) given
         "wish-path",
       ],
     },
+    {
+      "base": ".declastruct.yml",
+      "job": "github",
+      "secretKeys": [
+        "creds-github-app-private-key",
+      ],
+      "secretsInherit": false,
+      "withKeys": [
+        "access",
+        "creds-github-app-id",
+        "creds-github-app-owner",
+        "github-environment-apply",
+        "github-environment-plan",
+        "scope",
+        "wish-path",
+      ],
+    },
     {
       "base": ".deploy-expo.yml",
       "job": "prep",
@@ -405,16 +415,6 @@ exports[`reusable workflows reconcile caller against callee (#573 · #580) given
         "creds-aws-role-arn",
       ],
     },
-    {
-      "base": ".test.yml",
-      "job": "suite",
-      "secretKeys": [],
-      "secretsInherit": true,
-      "withKeys": [
-        "creds-aws-region",
-        "creds-aws-role-arn",
-      ],
-    },
     {
       "base": ".test.yml",
       "job": "test",

package/dist/__snapshots__/workflowJobScopeIdToken.declapract.integration.test.ts.snap

@@ -0,0 +1,38 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`workflow templates grant id-token at job scope (#550) given: [case1] every workflow template under src/practices when: [t1] each workflow is read for its grants then: the grant table reads as declared 1`] = `
+[
+  "src/practices/cicd-app-react-native-expo/best-practice/.github/workflows/.deploy-expo.yml :: deploy-os",
+  "src/practices/cicd-app-react-native-expo/best-practice/.github/workflows/.deploy-expo.yml :: deploy-web",
+  "src/practices/cicd-common/best-practice/.github/workflows/.declastruct.yml :: plan",
+  "src/practices/cicd-common/best-practice/.github/workflows/.declastruct.yml :: apply",
+  "src/practices/cicd-common/best-practice/.github/workflows/.test.yml :: test-shards-integration",
+  "src/practices/cicd-common/best-practice/.github/workflows/.test.yml :: test-shards-acceptance",
+  "src/practices/cicd-common/best-practice/.github/workflows/.test.yml :: test-evaluation",
+  "src/practices/cicd-package/best-practice/.github/workflows/.publish-npm.yml :: publish",
+  "src/practices/cicd-service/best-practice/.github/workflows/.deploy-sls.yml :: deploy",
+  "src/practices/cicd-service/best-practice/.github/workflows/.deploy-sls.yml :: assure",
+  "src/practices/cicd-service/best-practice/.github/workflows/.deploy-sls.yml :: prune",
+  "src/practices/cicd-service/best-practice/.github/workflows/.sql-schema-control.yml :: plan",
+  "src/practices/cicd-service/best-practice/.github/workflows/.sql-schema-control.yml :: apply",
+  "src/practices/cicd-service/best-practice/.github/workflows/.terraform.yml :: plan",
+  "src/practices/cicd-service/best-practice/.github/workflows/.terraform.yml :: apply",
+]
+`;
+
+exports[`workflow templates grant id-token at job scope (#550) given: [case2] a corpus that is defective on purpose when: [t0] the corpus is read the way the walk reads a real one then: each report names its offender -- the text a maintainer meets on red 1`] = `
+{
+  "grantsWithoutMinter": [
+    "demo/.github/workflows/.demo.yml :: lint",
+  ],
+  "jobBlocksWithoutContentsRead": [
+    "demo/.github/workflows/.demo.yml :: lint",
+  ],
+  "mintersWithoutGrant": [
+    "demo/.github/workflows/.demo.yml :: deploy",
+  ],
+  "workflowScopeGrants": [
+    "demo/.github/workflows/.demo.yml",
+  ],
+}
+`;

package/dist/__snapshots__/workflowPrBuild.declapract.integration.test.ts.snap

@@ -0,0 +1,10 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`the pr gate runs the production build (#678) and the evaluation suite (#669) given: [case1] every workflow template under src/practices when: [t2] the jobs of .test.yml are read then: the jobs that build, in order, read as declared 1`] = `
+[
+  "test-types",
+  "test-shards-integration",
+  "test-shards-acceptance",
+  "test-evaluation",
+]
+`;

package/dist/actionPinsBump.declapract.integration.test.ts

@@ -0,0 +1,54 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { given, then, useBeforeAll, when } from 'test-fns';
+import yaml from 'yaml';
+
+/**
+ * .what = holds this repo's OWN scheduled bump path for the sha-pinned actions (#556)
+ * .why  = every workflow template here is delivered by EQUALS, so a consumer that bumps a pin by
+ *         hand is reverted on its next apply. the bump must happen at the source, on a schedule,
+ *         or the pins rot in place. this asserts the schedule exists, runs the bump command over
+ *         both surfaces, re-records the pin table, and gates its pr on the actionPins clamp.
+ * .note = the pin choice itself is unit-tested in `utils/actionPins/asActionPinTargetTag`;
+ *         the shape (40-hex sha, tag tail, one sha per repo) is held by `actionPins`.
+ */
+
+const WORKFLOW_PATH = join(__dirname, '..', '.github/workflows/bump-action-pins.yml');
+
+describe("this repo's scheduled action-pin bump (#556)", () => {
+  given('[case1] the bump workflow under .github/workflows', () => {
+    const scene = useBeforeAll(() => {
+      const present = existsSync(WORKFLOW_PATH);
+      const parsed = present ? yaml.parse(readFileSync(WORKFLOW_PATH, 'utf-8')) : null;
+      const runs: string[] = Object.values(
+        (parsed?.jobs ?? {}) as Record<string, { steps?: { run?: string }[] }>,
+      ).flatMap((job) => (job.steps ?? []).map((step) => step.run ?? ''));
+      return { present, parsed, runs };
+    });
+
+    when('[t0] it is read', () => {
+      then('it exists -- if red, the pins have no bump path', () => {
+        expect(scene.present).toEqual(true);
+      });
+
+      then('it runs on a schedule and on demand', () => {
+        const on = scene.parsed?.on ?? scene.parsed?.[true as unknown as string] ?? {};
+        expect(Object.keys(on)).toEqual(expect.arrayContaining(['schedule', 'workflow_dispatch']));
+      });
+
+      then('it runs the bump command in apply mode', () => {
+        expect(scene.runs.join('\n')).toContain(
+          'src/utils/actionPins/bumpActionPins.ts --mode apply',
+        );
+      });
+
+      then('it re-records the pin table and holds the actionPins clamp before the pr opens', () => {
+        const text = scene.runs.join('\n');
+        expect(text).toContain('--testPathPatterns=actionPins');
+        expect(text).toContain('RESNAP=true');
+        expect(text.indexOf('actionPins')).toBeLessThan(text.indexOf('gh pr create'));
+      });
+    });
+  });
+});

package/dist/ancientTargetPublished.declapract.integration.test.ts

@@ -1,12 +1,13 @@
 import { readFileSync } from 'node:fs';
 
+import { MalfunctionError } from 'helpful-errors';
 import { given, then, useBeforeAll, when } from 'test-fns';
-import ts from 'typescript';
+import { getModuleExportsFromTsSource } from './utils/getModuleExportsFromTsSource';
 
 /**
  * .what = exercises case=2's no-404 promise at the reachable grain: the fleet slug an
- *         `sdkAwsLambdaEnvAccess{Ancient,Contemp}` target op RETURNS, for any DEPLOYED access
- *         tier, must be a stage the serverless dual-publish scaffold actually deploys under —
+ *         `sdkAwsLambdaEnvAccess{Ancient,Contemp}` target op RETURNS, for any DEPLOYED access,
+ *         must be a stage the serverless dual-publish scaffold actually deploys under —
  *         so a caller that builds `${service}-${slug}-${fn}` addresses a name a fleet answers
  *         to, never a 404.
  * .why  = case=2 (cross-service-call-never-404s) is a demoed critipath whose core promise is
@@ -51,25 +52,25 @@ const runTargetSlug = (input: {
   name: string;
   access: 'test' | 'prep' | 'prod';
 }): string => {
-  const source = readFileSync(input.path, 'utf8');
-  const transpiled = ts.transpileModule(source, {
-    compilerOptions: {
-      module: ts.ModuleKind.CommonJS,
-      target: ts.ScriptTarget.ES2020,
-    },
-  }).outputText;
-  const moduleExports: Record<string, () => string> = {};
   const requireStub = (id: string): unknown =>
     id.includes('environment') ? { envStatic: { access: input.access } } : {};
-  // eslint-disable-next-line no-new-func
-  new Function('exports', 'require', transpiled)(moduleExports, requireStub);
-  return moduleExports[input.name]();
+  const moduleExports = getModuleExportsFromTsSource<Record<string, () => string>>({
+    source: readFileSync(input.path, 'utf8'),
+    requireStub,
+  });
+  const targetOp =
+    moduleExports[input.name] ??
+    MalfunctionError.throw('the target-op template no longer exports this op', {
+      path: input.path,
+      name: input.name,
+    });
+  return targetOp();
 };
 
 /**
  * .what = the `accessByStage` map, read from the serverless template as { stage: access }.
  * .why  = its KEYS are the `--stage` slugs the scaffold deploys under (the published fleet
- *         slugs); its VALUES are the accesses those deploys reach (the deployed tiers).
+ *         slugs); its VALUES are the accesses those deploys run with (the deployed accesses).
  *         serverless.yml carries `@declapract{...}` vars elsewhere, so a full yaml parse would
  *         choke — the block is clean, so a scoped line-scan reads it exactly.
  */
@@ -93,8 +94,8 @@ describe('the EnvAccess target op emits only slugs the dual-publish scaffold pub
     const state = useBeforeAll(() => {
       const accessByStage = readAccessByStage();
       const publishedStages = Object.keys(accessByStage); // the --stage slugs a deploy publishes
-      const deployedTiers = [...new Set(Object.values(accessByStage))]; // accesses that reach a fleet
-      return { accessByStage, publishedStages, deployedTiers };
+      const deployedAccesses = [...new Set(Object.values(accessByStage))]; // accesses that reach a fleet
+      return { accessByStage, publishedStages, deployedAccesses };
     });
 
     when('the scaffold is read', () => {
@@ -110,18 +111,18 @@ describe('the EnvAccess target op emits only slugs the dual-publish scaffold pub
         expect({
           accessByStage: state.accessByStage,
           publishedStages: [...state.publishedStages].sort(),
-          deployedTiers: [...state.deployedTiers].sort(),
+          deployedAccesses: [...state.deployedAccesses].sort(),
         }).toMatchSnapshot('dual-publish scaffold shape');
       });
     });
 
     when('each deployed access is walked through the ancient target op', () => {
       then('the emitted slug is a stage the scaffold publishes (no 404 by construction)', () => {
-        for (const tier of state.deployedTiers) {
+        for (const deployedAccess of state.deployedAccesses) {
           const slug = runTargetSlug({
             path: ANCIENT_PATH,
             name: 'sdkAwsLambdaEnvAccessAncient',
-            access: tier as 'test' | 'prep' | 'prod',
+            access: deployedAccess as 'test' | 'prep' | 'prod',
           });
           // slug ∈ publishedStages ⟺ the caller's target `${service}-${slug}-${fn}` names a
           // fleet the scaffold actually deploys ⟺ the invoke lands, never a 404
@@ -132,42 +133,42 @@ describe('the EnvAccess target op emits only slugs the dual-publish scaffold pub
 
     when('each deployed access is walked through the contemp target op', () => {
       then('the emitted slug is a stage the scaffold publishes (no 404 by construction)', () => {
-        for (const tier of state.deployedTiers) {
+        for (const deployedAccess of state.deployedAccesses) {
           const slug = runTargetSlug({
             path: CONTEMP_PATH,
             name: 'sdkAwsLambdaEnvAccessContemp',
-            access: tier as 'test' | 'prep' | 'prod',
+            access: deployedAccess as 'test' | 'prep' | 'prod',
           });
           expect(state.publishedStages).toContain(slug);
         }
       });
     });
 
-    when('the per-tier emitted slugs are derived for both target ops', () => {
+    when('the per-access emitted slugs are derived for both target ops', () => {
       // the caller-faced contract of the no-404 invariant: which slug each op emits per deployed
-      // tier, and the published set it must land within. snapshot so a reword that keeps the
-      // membership green (a re-mapped tier, a re-shaped scaffold) reddens a vibecheck.
+      // access, and the published set it must land within. snapshot so a reword that keeps the
+      // membership green (a re-mapped access, a re-shaped scaffold) reddens a vibecheck.
       then('the target-slug shape matches snapshot', () => {
-        const perTier = state.deployedTiers
+        const perAccess = state.deployedAccesses
           .slice()
           .sort()
-          .map((tier) => ({
-            access: tier,
+          .map((deployedAccess) => ({
+            access: deployedAccess,
             ancient: runTargetSlug({
               path: ANCIENT_PATH,
               name: 'sdkAwsLambdaEnvAccessAncient',
-              access: tier as 'test' | 'prep' | 'prod',
+              access: deployedAccess as 'test' | 'prep' | 'prod',
             }),
             contemp: runTargetSlug({
               path: CONTEMP_PATH,
               name: 'sdkAwsLambdaEnvAccessContemp',
-              access: tier as 'test' | 'prep' | 'prod',
+              access: deployedAccess as 'test' | 'prep' | 'prod',
             }),
           }));
         expect({
-          perTier,
+          perAccess,
           publishedStages: [...state.publishedStages].sort(),
-        }).toMatchSnapshot('per-tier target slug vs published stages');
+        }).toMatchSnapshot('per-access target slug vs published stages');
       });
     });
   });

package/dist/bestPracticeTemplateParse.declapract.integration.test.ts

@@ -79,7 +79,40 @@ const asParseErrorLabel = (input: {
  *         literals in every ts template, so they parse as ordinary string content.
  */
 const getAllParseErrors = (input: { path: string; source: string }): string[] =>
-  (
+  getAllSyntacticDiagnostics(input)
+    .filter((diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error)
+    .map((diagnostic) => asParseErrorLabel({ path: input.path, diagnostic }));
+
+/**
+ * .what = the parser's diagnostics for one template, by the route its kind allows.
+ * .why  = `transpileModule` cannot emit a declaration file, so a `.d.ts` template (an ambient
+ *         module, e.g. tests-expo `src/.test/assets/test-fns.autoprune.d.ts`) throws "Output generation failed"
+ *         rather than report. a one-file program's `getSyntacticDiagnostics` reads the same parser
+ *         and accepts a `.d.ts`; it still resolves no module and checks no type.
+ */
+const getAllSyntacticDiagnostics = (input: {
+  path: string;
+  source: string;
+}): readonly ts.Diagnostic[] => {
+  // a declaration file: parse via a one-file program, since it has no emit
+  if (input.path.endsWith('.d.ts')) {
+    const host = ts.createCompilerHost({});
+    const program = ts.createProgram({
+      rootNames: [input.path],
+      options: { noResolve: true, noLib: true },
+      host: {
+        ...host,
+        getSourceFile: (fileName, languageVersion) =>
+          fileName === input.path
+            ? ts.createSourceFile(fileName, input.source, languageVersion)
+            : undefined,
+      },
+    });
+    return program.getSyntacticDiagnostics();
+  }
+
+  // every other template: parse via transpile, which runs the parser only
+  return (
     ts.transpileModule(input.source, {
       fileName: input.path,
       reportDiagnostics: true,
@@ -88,9 +121,8 @@ const getAllParseErrors = (input: { path: string; source: string }): string[] =>
         jsx: ts.JsxEmit.Preserve,
       },
     }).diagnostics ?? []
-  )
-    .filter((diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error)
-    .map((diagnostic) => asParseErrorLabel({ path: input.path, diagnostic }));
+  );
+};
 
 const asLineNumber = (input: { source: string; at: number }): number =>
   input.source.slice(0, input.at).split('\n').length;
@@ -158,6 +190,28 @@ describe('every shipped ts template parses as valid typescript (#613)', () => {
     });
   });
 
+  given('[case3] a declaration-file template (no emit, so no transpile)', () => {
+    when('[t0] a valid ambient module is parsed', () => {
+      then('it reports no error, rather than throw "Output generation failed"', () => {
+        const offenders = getAllParseErrors({
+          path: '/virtual/ok.d.ts',
+          source: "declare module 'x' {\n  export const y: number;\n}\n",
+        });
+        expect(offenders).toEqual([]);
+      });
+    });
+    when('[t1] a broken ambient module is parsed', () => {
+      then('the parser still reports its syntactic error', () => {
+        const offenders = getAllParseErrors({
+          path: '/virtual/broken.d.ts',
+          source: "declare module 'x' {\n  export const y: number\n",
+        });
+        expect(offenders.length).toBeGreaterThan(0);
+        expect(offenders.join('\n')).toContain("'}' expected");
+      });
+    });
+  });
+
   given('[case2] every multi-line jsdoc inside a shipped ts template', () => {
     when('[t0] each block comment is located', () => {
       then('none closes itself mid-line', () => {