@a11ign/screenreader-fleet 0.1.0 → 0.3.0

package/dist/check-worker-code.mjs

@@ -1,128 +1,46 @@
 #!/usr/bin/env node
-// @ts-check
-// Is every worker running the code in this checkout?
-//
-//   npm run worker:code
-//
-// Deploying is push-then-restart and both halves fail silently: `utmctl exec` reports success
-// whether or not it ran, so a worker can serve the previous process indefinitely. Reading the
-// guest's file hash does not help, because that read goes through exec too -- when exec is
-// dead the check returns empty rather than mismatched, which reads as a flaky tool instead of a
-// failed deploy. That cost an hour, and the stale workers looked exactly like a logic bug.
-//
-// This asks each worker over HTTP, which is reachable exactly when the worker is usable and
-// involves no guest agent. Exit 0 when every worker matches, 1 otherwise.
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { execFileSync } from "node:child_process";
-import { sandboxGitEnv } from "./git-safe-env.mjs";
-// The WORKING-TREE value, imported rather than regex-scraped — architecture-audit.md §5, item 3.
-// `protocol-version.mjs` is dependency-free for exactly this: safe to import from a portable tree.
-import { CAPTURE_PROTOCOL_VERSION as PROTOCOL_IN_TREE } from "@a11ign/screenreader-worker/protocol-version";
-import { workerSourceDir } from "@a11ign/screenreader-worker/code-version";
-import { fleetScriptPaths } from "./fleet-scripts.mjs";
-import { configuredWorkers, inventoryWorkerUrls, resolveWorkerPool } from "./fleet-env.mjs";
-// The comparison, the remedy and the expected hash live in ONE place, because the capture entry points ask
-// the same question before every run and a second copy of "is this worker stale" is a second answer.
-import { expectedWorkerCode, codeDrift, remedyLines } from "./worker-code-check.mjs";
-import { refuseUnknownFlags } from "./cli-flags.mjs";
 import { errorText } from "@a11ign/screenreader-worker/error-text";
+import { fleetScriptPaths } from "./src_fleet-scripts_mjs.mjs";
+import { inventoryWorkerUrls, configuredWorkers, resolveWorkerPool } from "./fleet-env.mjs";
+import { expectedWorkerCode, remedyLines, codeDrift } from "./worker-code-check.mjs";
+import { refuseUnknownFlags } from "./cli-flags.mjs";
 import { requestJson } from "./worker-http.mjs";
-/**
- * takes NO flags — it asks every worker what code it is running and compares. Any flag passed to it
- * today is discarded in silence.
- *
- * An unrecognised flag is otherwise IGNORED, so it runs the default and reports success.
- */
-refuseUnknownFlags([], { entry: import.meta.url, command: "npm run worker:code" });
-// Resolved from THIS module: the fleet scripts ship with this package, so a cwd-relative path was only ever
-// right when run from the repo root.
+refuseUnknownFlags([], {
+    entry: import.meta.url,
+    command: "npm run worker:code"
+});
 const CTL = fleetScriptPaths().workerCtl;
-// /health now reports installed runtime versions as well as the code hash. The first
-// request after a Windows boot may need PowerShell file-version discovery, so four seconds
-// was too tight and made a healthy worker look unreachable.
 const HEALTH_TIMEOUT_MS = 15000;
-// The guest and the host now call the SAME function over the SAME list, so they cannot disagree by
-// construction. This used to be two copies of one loop kept in step by a comment.
-/**
- * A STALE report is usually a real stale guest — but not when the working tree carries an uncommitted
- * CAPTURE_PROTOCOL_VERSION bump. Then every worker reports stale because the LOCAL hash moved, and the
- * obvious remedy (redeploy) would ship the bump and invalidate every cached capture.
- *
- * Saying so here costs one line and saves someone an unexplained full recapture.
- */
-function protocolBumpNote() {
-    try {
-        const inTree = String(PROTOCOL_IN_TREE);
-        const committed = /CAPTURE_PROTOCOL_VERSION = (\d+)/.exec(execFileSync("git", ["-C", workerSourceDir(), "show", "HEAD:./protocol-version.mjs"], { encoding: "utf8", env: sandboxGitEnv() }))?.[1];
-        if (inTree && committed && inTree !== committed) {
-            return `\nNOTE: your working tree has CAPTURE_PROTOCOL_VERSION = ${inTree} but HEAD has ${committed}.\n` +
-                "That alone changes the local hash, so the guests may not be stale at all. Deploying it would\n" +
-                "invalidate every cached capture — `npm run worker:deploy` refuses unless you pass\n" +
-                "--allow-protocol-change.\n";
-        }
-    }
-    catch { /* not a git checkout; nothing to add */ }
-    return "";
+function workerUrls({ named = configuredWorkers, local = localPoolUrls, inventory = inventoryWorkerUrls } = {}) {
+    return resolveWorkerPool({
+        named,
+        inventory,
+        local
+    });
 }
-/**
- * Which workers to ask, AND WHERE THAT LIST CAME FROM — the second half is not decoration.
- *
- * This used to answer the local UTM pool or nothing, and print "no worker is running — nothing to compare"
- * when it found neither. Measured 2026-08-28 with five bare-metal workers serving `/health` and all five
- * STALE against this checkout: the bare command reported nothing to compare, and the same command with
- * `A11Y_WORKERS` set reported `5 stale worker(s)`. One env var apart, and the quiet answer was the wrong one.
- *
- * That is `lab:inventory`'s lesson at a different layer — *"'none here' and 'none anywhere' are different
- * answers, and it now refuses to turn the first into the second"* — and it lands harder here, because this
- * command exists to stop a corpus being captured on the wrong code. A false clean from it is the failure it
- * was written to prevent, delivered by the tool itself.
- *
- * The inventory was already imported and already read, twelve lines below, to print the REMEDY. So the
- * command could name the five workers it should have checked while insisting it had none to check.
- *
- * Reading it here is safe in a way it would not be for a capture run: this probes `/health` and starts
- * nothing, so the rule that naming workers means you are managing them does not apply.
- */
-export function workerUrls({ named = configuredWorkers, local = localPoolUrls, inventory = inventoryWorkerUrls, } = {}) {
-    // ONE PRECEDENCE, in fleet-env.mjs. This function held its own -- named, then the LOCAL UTM POOL, then
-    // the inventory -- while `doctor` went named then inventory, so on any Mac with a registered guest the
-    // two commands described different fleets. That is the divergence the comment here used to claim it had
-    // closed; it closed the NAMED half only.
-    return resolveWorkerPool({ named, inventory, local });
-}
-/** The local UTM pool, or none — `utmctl` is absent on a machine that never had one. */
 function localPoolUrls() {
     try {
-        const pool = JSON.parse(execFileSync(CTL, ["pool"], { encoding: "utf8" }));
-        return pool.filter((/** @type {{ip?: string}} */ vm) => vm.ip)
-            .map((/** @type {{ip: string, port: number}} */ vm) => `http://${vm.ip}:${vm.port}`);
-    }
-    catch (e) {
-        // Never silent: "there is no UTM here" and "utmctl failed" are different, and the second is the one
-        // that would otherwise send somebody to the inventory believing the local pool was empty.
-        if (process.env.A11Y_DEBUG)
-            console.log(`  (local pool unavailable: ${errorText(e)})`);
+        const pool = JSON.parse(execFileSync(CTL, [
+            "pool"
+        ], {
+            encoding: "utf8"
+        }));
+        return pool.filter((vm)=>vm.ip).map((vm)=>`http://${vm.ip}:${vm.port}`);
+    } catch (e) {
+        if (process.env.A11Y_DEBUG) console.log(`  (local pool unavailable: ${errorText(e)})`);
         return [];
     }
 }
-/** @param {string} url */
 async function versionOf(url) {
-    // `requestJson`, not `fetch`: gains a real error CODE (`ECONNREFUSED`, `EHOSTUNREACH`) for the per-worker
-    // `errorText(e)` line below, in place of fetch's undifferentiated `TypeError: fetch failed`.
-    const response = await requestJson(`${url.replace(/\/$/, "")}/health`, { timeoutMs: HEALTH_TIMEOUT_MS });
-    // `requestJson` returns `undefined` for unparseable JSON rather than throwing (its own docstring: a cache
-    // miss is a normal outcome for its usual callers) -- `fetch`'s `.json()` threw, and the caller here relies
-    // on that to report "unreachable" for a worker that answered garbage. Restored explicitly.
-    if (response.json === undefined)
-        throw new Error(`invalid JSON from ${url}`);
+    const response = await requestJson(`${url.replace(/\/$/, "")}/health`, {
+        timeoutMs: HEALTH_TIMEOUT_MS
+    });
+    if (void 0 === response.json) throw new Error(`invalid JSON from ${url}`);
     return response.json.code ?? "absent";
 }
-/**
- * Nothing here runs on import, for the same reason as `deploy-worker.mjs`: a module that probes every worker
- * over HTTP should be invoked, not merely mentioned. It also lets `code-version.test.ts` import this rather
- * than parse its source as text.
- */
 async function main() {
     const expected = expectedWorkerCode();
     const { urls, source } = workerUrls();
@@ -131,43 +49,26 @@ async function main() {
         console.log("no worker configured, running locally, or listed in inventory.yml — nothing to compare");
         process.exit(0);
     }
-    // Say which list this is. A reading of "all current" means nothing until you know whether it examined
-    // the fleet you are about to capture on or the empty pool on your laptop.
     console.log(`checking ${urls.length} worker(s) from ${source}`);
-    // Read first, CLASSIFY second, and the classifier is the one the capture preflight uses. This loop used
-    // to decide staleness itself with `actual === expected` — the same judgement in a second place, which is
-    // exactly what `worker-code-check.mjs` exists to stop. `versionOf` stays only because the CLI reports the
-    // network error text per worker, which a preflight has no use for.
     const readings = [];
-    for (const url of urls) {
-        try {
-            // "absent" means the worker predates /health.code, which is itself a stale deploy.
-            readings.push({ worker: url, code: await versionOf(url) });
-        }
-        catch (e) {
-            console.log(`  ${url}  unreachable (${errorText(e)})`);
-            readings.push({ worker: url, code: null });
-        }
+    for (const url of urls)try {
+        readings.push({
+            worker: url,
+            code: await versionOf(url)
+        });
+    } catch (e) {
+        console.log(`  ${url}  unreachable (${errorText(e)})`);
+        readings.push({
+            worker: url,
+            code: null
+        });
     }
     const { stale } = codeDrift(expected, readings);
-    const staleUrls = stale.map((s) => s.worker);
+    const staleUrls = stale.map((s)=>s.worker);
     const isStale = new Set(staleUrls);
-    for (const { worker, code } of readings.filter((r) => r.code !== null)) {
-        console.log(`  ${worker}  ${code}  ${isStale.has(worker) ? "STALE — redeploy and REBOOT the guest" : "matches"}`);
-    }
-    if (staleUrls.length) {
-        for (const line of remedyLines(staleUrls, inventoryWorkerUrls()))
-            console.log(line);
-        const note = protocolBumpNote();
-        if (note)
-            console.log(note);
-    }
+    for (const { worker, code } of readings.filter((r)=>null !== r.code))console.log(`  ${worker}  ${code}  ${isStale.has(worker) ? "STALE — redeploy and REBOOT the guest" : "matches"}`);
+    if (staleUrls.length) for (const line of remedyLines(staleUrls, inventoryWorkerUrls()))console.log(line);
     process.exit(staleUrls.length ? 1 : 0);
 }
-// REALPATH'D: `import.meta.url` is resolved through symlinks by Node's ESM loader and `process.argv[1]`
-// is not, so a bin reached via its `.bin` symlink (which is how npm always installs one) mismatched here
-// and this guard silently read false — the tool loaded, did nothing, and exited 0. `/var` and `/tmp` are
-// themselves symlinks on macOS, so this fired every time. Same defect, same fix, as `cli.ts`'s `isProgram`.
-if (import.meta.url === pathToFileURL(process.argv[1] ? realpathSync(process.argv[1]) : "").href)
-    await main();
-//# sourceMappingURL=check-worker-code.mjs.map
+if (import.meta.url === pathToFileURL(process.argv[1] ? realpathSync(process.argv[1]) : "").href) await main();
+export { workerUrls };

package/dist/cli-flags.d.mts

@@ -68,4 +68,3 @@ export function refuseUnknownFlags(known: string[], { entry, argv, command }: {
     argv?: string[];
     command?: string;
 }): void;
-//# sourceMappingURL=cli-flags.d.mts.map

package/dist/cli-flags.mjs

@@ -1,207 +1,61 @@
-// @ts-check
-/**
- * Refuse a flag this command does not read.
- *
- * Every CLI here parses argv the same way — `process.argv.find((a) => a.startsWith("--only="))` or
- * `process.argv.includes("--resume")` — and every one of them therefore IGNORES anything it does not
- * recognise. A mistyped, renamed or hallucinated flag runs the default and reports success, and the
- * operator believes their value was applied. That is the same defect as an Ansible extra var a job does
- * not read, one layer out, and this repo has paid for it twice:
- *
- *   - a blocker's own message told the reader to run `--write-baseline`; the flag is `--update-baseline`
- *   - `--only=route-title-stale` covered 1 of the 7 cases in that family, because the match was exact-id
- *
- * Neither produced an error. Both produced a plausible wrong answer, which this file's governing rule
- * says to replace with a refusal that names the cause.
- *
- * ## Why the known list is passed in rather than read from the caller's source
- *
- * Deriving it at runtime — reading the calling module and regexing out its `--flags` — needs no
- * maintenance, and is wrong for one reason that matters: a CLI whose flags are consumed by a HELPER in
- * another module would refuse them, so the guard would break exactly the commands with the most moving
- * parts. The list is explicit here and `cli-flags.test.ts` derives the same set from source and pins the
- * two equal, which is this repo's remedy when a duplication is forced.
- */
 import { basename } from "node:path";
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
-/** How far apart two flags may be and still be worth suggesting. One typo, or one word. */
 const NEAR = 4;
-/**
- * Levenshtein, small and iterative — the inputs are flag names, never long strings.
- * @param {string} a @param {string} b @returns {number}
- */
 function distance(a, b) {
-    let previous = Array.from({ length: b.length + 1 }, (_unused, index) => index);
-    for (let i = 1; i <= a.length; i += 1) {
-        const row = [i];
-        for (let j = 1; j <= b.length; j += 1) {
-            row[j] = Math.min(row[j - 1] + 1, previous[j] + 1, previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
-        }
+    let previous = Array.from({
+        length: b.length + 1
+    }, (_unused, index)=>index);
+    for(let i = 1; i <= a.length; i += 1){
+        const row = [
+            i
+        ];
+        for(let j = 1; j <= b.length; j += 1)row[j] = Math.min(row[j - 1] + 1, previous[j] + 1, previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
         previous = row;
     }
     return previous[b.length];
 }
-/**
- * The flag name alone: `--shard=0/4` and `--shard` both name `--shard`.
- * @param {string} argument @returns {string}
- */
-export function nameOf(argument) {
+function nameOf(argument) {
     const equals = argument.indexOf("=");
-    return equals === -1 ? argument : argument.slice(0, equals);
+    return -1 === equals ? argument : argument.slice(0, equals);
 }
-/**
- * `--name=value`'s value, or `undefined` if `--name=` was never passed. audit §9's "argv parsing" row:
- * VALIDATION is owned here (`refuseUnknownFlags`), but 15+ files each hand-rolled this exact three-line
- * idiom for EXTRACTION, and one of them had already drifted from the rest.
- *
- * MEASURED before writing this, across all fifteen, against five vectors (a normal value, a missing flag,
- * an empty value, a repeated flag, and a value containing its own `=`): fourteen agreed on all five —
- * `argv.find((a) => a.startsWith("--name=")).slice("--name=".length)`, verbatim or with `name` templated
- * in. `fleet-discover.mjs`'s `arg()` used `.split("=")[1]` instead, which is identical on four vectors and
- * silently WRONG on the fifth: `--url=http://host?a=b` came back as `"http://host?a"`, truncated at the
- * value's own `=`. Dormant today — that helper is only ever asked for `--cidr=` and `--port=`, neither of
- * which can contain one — but a live discrepancy the day it is asked for a URL or a `key=value` pair.
- *
- * Kept as `.slice`, matching the fourteen rather than the one, and `fleet-discover.mjs` converted to it.
- *
- * @param {readonly string[]} argv @param {string} name
- * @returns {string | undefined}
- */
-export function flagValue(argv, name) {
+function flagValue(argv, name) {
     const prefix = `--${name}=`;
-    const hit = argv.find((a) => a.startsWith(prefix));
-    return hit === undefined ? undefined : hit.slice(prefix.length);
+    const hit = argv.find((a)=>a.startsWith(prefix));
+    return void 0 === hit ? void 0 : hit.slice(prefix.length);
 }
-/**
- * Which of `argv` are flags this command does not know. PURE, so it is testable without a process.
- *
- * A bare `--` is npm's separator and never a flag. Anything not starting with `-` is positional — a URL,
- * a worker address, a page path — and is not this guard's business.
- *
- * SINGLE-DASH FLAGS ARE INSPECTED TOO, AND THE OMISSION COST A 14-MINUTE FLEET OPERATION.
- *
- * This read `startsWith("--")`, on the reasoning that only long flags are ever this repo's own. But an
- * ANSIBLE-shaped argument is single-dash, and several of these commands wrap `ansible-playbook` — so
- * `npm run fleet:provision -- -e worker_edge_allow_downgrade=true` passed straight through the guard,
- * was never forwarded by the wrapper, and the whole fleet was provisioned WITHOUT the authorisation the
- * operator believed they had given. Measured 2026-09-05. The role then refused, correctly, with a message
- * telling the operator to pass the very flag they had just passed.
- *
- * That is precisely the defect this file exists to prevent — "an ignored flag runs the default and reports
- * success" — surviving inside its own remedy, because the remedy was written to match one flag SHAPE
- * rather than the idea of a flag. `-e` is not a URL and not a page path; nothing positional here begins
- * with a dash followed by a letter, which is what makes this safe to refuse rather than merely warn on.
- */
-/**
- * @param {string[]} argv @param {string[]} known @returns {string[]}
- */
-export function unknownFlags(argv, known) {
+function unknownFlags(argv, known) {
     const accepted = new Set(known.map(nameOf));
-    return argv
-        .filter((argument) => argument !== "--" && (argument.startsWith("--") || /^-[A-Za-z]/.test(argument)))
-        .map(nameOf)
-        .filter((flag) => !accepted.has(flag));
+    return argv.filter((argument)=>"--" !== argument && (argument.startsWith("--") || /^-[A-Za-z]/.test(argument))).map(nameOf).filter((flag)=>!accepted.has(flag));
 }
-/**
- * The closest known flag, when there is one close enough to be a likely typo rather than a guess.
- * @param {string} flag @param {string[]} known @returns {string | undefined}
- */
-export function didYouMean(flag, known) {
-    const ranked = known.map(nameOf)
-        .map((candidate) => ({ candidate, gap: distance(flag, candidate) }))
-        .sort((left, right) => left.gap - right.gap);
-    return ranked[0] && ranked[0].gap <= NEAR ? ranked[0].candidate : undefined;
+function didYouMean(flag, known) {
+    const ranked = known.map(nameOf).map((candidate)=>({
+            candidate,
+            gap: distance(flag, candidate)
+        })).sort((left, right)=>left.gap - right.gap);
+    return ranked[0] && ranked[0].gap <= NEAR ? ranked[0].candidate : void 0;
 }
-/**
- * Refuse, naming the flag and what this command does take. Exits 2; does not return on failure.
- *
- * `command` names the thing a human typed — the npm script, not the file — because that is what they will
- * retype. Defaults to the script's basename, which is right for the ones invoked directly.
- */
-/**
- * @param {string[]} known  Every flag this command reads, `--name` or `--name=`.
- * @param {{entry: string, argv?: string[], command?: string}} options
- *   `entry` is the caller's `import.meta.url`, and it is REQUIRED. `command` names the thing a HUMAN
- *   typed — the npm script, not the file — because that is what they will retype.
- */
-// NO `= {}` DEFAULT, because `entry` is required and the docstring above has always said so. A default
-// that lets the whole options object be omitted contradicts that: it produces `entry === undefined`, and
-// the guard below decides whether THIS module is the command by comparing `entry` against argv[1] -- so a
-// caller who forgot it would get a guard that silently never fires. Types found the contradiction the
-// moment this file entered the program. Every one of the 60 real call sites passes it.
-export function refuseUnknownFlags(known, { entry, argv = process.argv.slice(2), command }) {
-    // ONLY WHEN THIS MODULE IS THE COMMAND, never when it is imported.
-    //
-    // These calls sit at module top level, so they run on IMPORT — and then inspect the IMPORTING process's
-    // argv. Measured 2026-08-27, an hour after the guards went in: `capture-real-pages --role=calibration`
-    // imports `fleet-env.mjs`, whose guard woke up, saw `--role`, decided it did not know it, and killed a
-    // 50-page capture with "unknown flag --role — did you mean --list?". The guard was right about its own
-    // flags and asking the wrong process.
-    //
-    // `entry` is REQUIRED rather than defaulted, for the reason `createHostThrottle`'s `minGapMs` is: a
-    // default here would silently restore exactly this behaviour for any caller who forgot it, and the
-    // failure mode is a guard that fires on somebody else's command line.
-    if (!entry) {
-        throw new TypeError("refuseUnknownFlags needs { entry: import.meta.url } — without it the guard runs "
-            + "on import and inspects the importing process's flags");
-    }
-    // REALPATH'D, and without it this guard silently does not fire through a symlink — #237.
-    //
-    // An entry guard in the realpath'd form reads
-    // `import.meta.url === pathToFileURL(process.argv[1] ? realpathSync(process.argv[1]) : "").href`, and
-    // this comparison had no `realpathSync`. So when `argv[1]` reaches such a script through a symlink — npm's
-    // own `.bin` links are symlinks, which is why those call sites resolve — the OUTER condition is true and
-    // this one is FALSE. `main()` runs; the flag guard returns early and inspects nothing.
-    //
-    // NOT EVERY CALL SITE HAS THAT FORM (#1248). Some still compare the plain, symlink-blind
-    // `pathToFileURL(process.argv[1] ?? "")`, which fails the other way through a symlink: the OUTER condition is
-    // false, `main()` never runs, and the tool exits 0. Which files still do is `KNOWN_PLAIN_ENTRY_GUARDS` in
-    // `entry-points.test.ts` (#1086), a ratchet that may shrink and may not grow. It is the list of record, so no
-    // count is repeated here.
-    //
-    // Measured on `piped-exit-status-guard.mjs`, same file, same flag:
-    //
-    //   node scripts/tmp-symlink-probe.mjs --bogus 'echo hi'   -> ran, exit 0, flag IGNORED
-    //   node packages/guards/src/piped-exit-status-guard.mjs --bogus '...'  -> refused, exit 2
-    //
-    // Through the symlink the mistyped flag is ignored and the command reports success — which is the
-    // sentence this refusal itself prints as the reason it exists.
-    //
-    // It is a remedy whose TRIGGER is narrower than the thing it guards, the `refreshBrowseBuffer` shape:
-    // reachable from the right path, with a condition that could not be true there. And the census
-    // (`cli-flags.test.ts`) cannot see it, because it asserts a file CONTAINS `refuseUnknownFlags(` — it
-    // cannot ask whether that call can FIRE, so every guarded CLI reads GUARDED either way.
-    //
-    // `realpathSync` THROWS on a path that does not exist, and `process.argv[1]` is absent for `node -e`
-    // and `node --eval`. Absent stays absent rather than becoming a throw: the guard must be inert when
-    // there is no script, never fatal.
-    /** The invoking script's REAL path as a URL, so a symlinked `argv[1]` still matches `entry`. */
+function refuseUnknownFlags(known, { entry, argv = process.argv.slice(2), command }) {
+    if (!entry) throw new TypeError("refuseUnknownFlags needs { entry: import.meta.url } — without it the guard runs on import and inspects the importing process's flags");
     let invoked;
     try {
         invoked = process.argv[1] ? pathToFileURL(realpathSync(process.argv[1])).href : "";
+    } catch  {
+        invoked = pathToFileURL(process.argv[1] ?? "").href;
     }
-    catch {
-        invoked = pathToFileURL(process.argv[1] ?? "").href; // unresolvable: compare what we were given
-    }
-    if (entry !== invoked)
-        return;
+    if (entry !== invoked) return;
     const unknown = unknownFlags(argv, known);
-    if (unknown.length === 0)
-        return;
+    if (0 === unknown.length) return;
     const name = command ?? basename(process.argv[1] ?? "this command");
-    for (const flag of unknown) {
+    for (const flag of unknown){
         const near = didYouMean(flag, known);
         console.error(`  ${name}: unknown flag ${flag}${near ? ` — did you mean ${near}?` : ""}`);
     }
-    // "It takes: " with nothing after it is what a command taking NO flags printed, and that reads like the
-    // guard failed to find its own list rather than like an answer. First hit by `release:provenance`, the
-    // first zero-flag CLI here -- the branch existed for months with no caller to exercise it.
-    const accepted = [...known].map(nameOf).sort();
-    console.error(accepted.length === 0
-        ? "  It takes no flags at all."
-        : `  It takes: ${accepted.join(" ")}`);
+    const accepted = [
+        ...known
+    ].map(nameOf).sort();
+    console.error(0 === accepted.length ? "  It takes no flags at all." : `  It takes: ${accepted.join(" ")}`);
     console.error("  Refusing rather than ignoring it: an ignored flag runs the default and reports success.");
     process.exit(2);
 }
-//# sourceMappingURL=cli-flags.mjs.map
+export { didYouMean, flagValue, nameOf, refuseUnknownFlags, unknownFlags };

package/dist/code-drift.d.mts

@@ -137,4 +137,3 @@ export function assertWorkersServe(expected: string, workers: string[], options:
     bareMetalUrls?: string[];
     sourceDir: string;
 }): Promise<void>;
-//# sourceMappingURL=code-drift.d.mts.map

package/dist/command-line-census.d.mts

@@ -30,4 +30,3 @@ export function readsArgv(rel: string, repoRoot: string): boolean;
  * @returns {string[]}
  */
 export function commandLineModules(repoRoot: string): string[];
-//# sourceMappingURL=command-line-census.d.mts.map

package/dist/compare-workers.d.mts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=compare-workers.d.mts.map