fix(scripts): burn 25 of the 35 KNOWN_IMPORT_UNSAFE entry-guard debts down

scripts/ablation-dist-preflight.mjs

@@ -144,6 +144,7 @@ import { join, relative, resolve, extname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = resolve(fileURLToPath(import.meta.url), '..', '..');
 
@@ -394,5 +395,10 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else run(argv);

scripts/check-dispatcher-error-vocabulary.mjs

@@ -152,6 +152,7 @@
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative, dirname, resolve } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = resolve(new URL('..', import.meta.url).pathname);
 const SCAN_ROOT = 'packages';
@@ -1826,4 +1827,7 @@ function main() {
  console.log(bounds);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+ main();
+}

scripts/check-driver-memory-census.mjs

@@ -109,6 +109,7 @@ import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const LEDGER_PATH = join(ROOT, 'scripts', 'driver-memory-census.ledger.json');
@@ -683,5 +684,10 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else report({ list: argv.includes('--list') });

scripts/check-engine-split-ratio.mjs

@@ -74,6 +74,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { historyHorizon } from './pm/git-history.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -334,4 +335,7 @@ function selfTest() {
  return failures === 0 ? 0 : 1;
 }
 
-process.exit(process.argv.includes('--self-test') ? selfTest() : main(process.argv.slice(2)));
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+ process.exit(process.argv.includes('--self-test') ? selfTest() : main(process.argv.slice(2)));
+}

scripts/check-entry-guard.mjs

@@ -435,39 +435,14 @@ export function importUnsafeStatements(source) {
  * names itself, which is what stops this from rotting into an allowlist.
  */
 const KNOWN_IMPORT_UNSAFE = new Set([
- 'scripts/ablation-dist-preflight.mjs',
  'scripts/check-changeset-no-major.mjs',
- 'scripts/check-dispatcher-error-vocabulary.mjs',
- 'scripts/check-driver-memory-census.mjs',
  'scripts/check-empty-changeset.mjs',
- 'scripts/check-engine-split-ratio.mjs',
- 'scripts/check-error-code-casing.mjs',
  'scripts/check-error-status-conformance.mjs',
- 'scripts/check-examples-live-imports.mjs',
- 'scripts/check-filter-alias-parity.mjs',
- 'scripts/check-nul-bytes.mjs',
- 'scripts/check-org-identifier.mjs',
  'scripts/check-query-options-erasure-ratchet.mjs',
- 'scripts/check-quick-reference-counts.mjs',
- 'scripts/check-ratchet-remedy-authority.mjs',
  'scripts/check-release-page-status.mjs',
- 'scripts/check-required-contexts.mjs',
- 'scripts/check-route-envelope.mjs',
- 'scripts/check-runtime-services-index.mjs',
- 'scripts/check-shard-attestation.mjs',
- 'scripts/check-spec-parsed-alias.mjs',
- 'scripts/check-startup-registry-verdict.mjs',
- 'scripts/check-tenant-chokepoint.mjs',
- 'scripts/check-test-completeness.mjs',
- 'scripts/check-workflow-status-functions.mjs',
  'scripts/checklist-select.mjs',
- 'scripts/docs-audit/check-audit-scope.mjs',
- 'scripts/measure-test-shard-timings.mjs',
  'scripts/objectui-range.mjs',
  'scripts/pm/check-governed-prose.mjs',
- 'scripts/pm/check-label-desc-cap.mjs',
- 'scripts/pm/check-skill-id-lint.mjs',
- 'scripts/pm/check-skill-line-ratchet.mjs',
  'scripts/qa/qa-rollup.mjs',
  'scripts/ts-parse.mjs',
 ]);

scripts/check-error-code-casing.mjs

@@ -53,6 +53,7 @@
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative, sep } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const SCAN_ROOTS = ['packages'];
@@ -241,4 +242,7 @@ If this literal is NOT an error.code — a field/param-addressed validator code
  process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+ main();
+}

scripts/check-examples-live-imports.mjs

@@ -122,6 +122,7 @@ import { globToRegExp } from './check-cross-package-test-inputs.mjs';
 import { join, resolve, relative, dirname, sep, posix } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
@@ -759,7 +760,12 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else if (argv.includes('--list')) list();
 else if (argv.includes('--json')) {
  const { rows, unresolved } = collect();

scripts/check-filter-alias-parity.mjs

@@ -88,6 +88,7 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -648,4 +649,7 @@ function main() {
  process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+ main();
+}

scripts/check-nul-bytes.mjs

@@ -269,6 +269,7 @@ import { lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, w
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /**
  * The scanned set as a 256-entry lookup: every ASCII control character except
@@ -1155,7 +1156,12 @@ function selfTest() {
  console.log(`✓ check-nul-bytes --self-test: ${checked} assertions over a temp git repo (real scan() path)`);
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
  selfTest();
 } else if (process.argv.includes('--list')) {
  const result = scan(repoRoot());

scripts/check-org-identifier.mjs

@@ -271,6 +271,7 @@ import { join } from 'node:path';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
 import { maskComments } from './js-comment-mask.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOTS = ['examples', 'apps', 'packages'];
 const EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.cts', '.mts'];
@@ -785,4 +786,7 @@ cheapest way to silence it while leaving the dead read in place.`);
  process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+ main();
+}

scripts/check-quick-reference-counts.mjs

@@ -101,6 +101,7 @@
 
 import { readFileSync, readdirSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const TARGET = 'content/docs/getting-started/quick-reference.mdx';
@@ -855,4 +856,7 @@ quietly stops recognising its page reports success forever.
  process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+ main();
+}

scripts/check-ratchet-remedy-authority.mjs

@@ -107,6 +107,7 @@ import { readFileSync, readdirSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
@@ -982,6 +983,11 @@ function selfTest() {
  process.exit(0);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else if (process.argv.includes('--list')) list();
 else main();

scripts/check-required-contexts.mjs

@@ -181,6 +181,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /**
  * The branch-protection-required check contexts, as this repository declares
@@ -2266,7 +2267,12 @@ async function selfTest() {
  );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
  await selfTest();
 } else if (process.argv.includes('--verify-required-set')) {
  // Report-only, off the required path (#9642). Exit 0 = swept (0 or N

scripts/check-route-envelope.mjs

@@ -144,6 +144,7 @@ import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -2582,5 +2583,10 @@ function selfTest() {
  console.log('✓ check-route-envelope self-test passed');
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else audit();

scripts/check-runtime-services-index.mjs

@@ -229,6 +229,7 @@ import { readFileSync, readdirSync, statSync, existsSync, mkdtempSync, mkdirSync
 import { join, dirname, relative, sep } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const repoRoot = () => join(HERE, '..');
@@ -1064,5 +1065,10 @@ function selfTest() {
  console.log(`✓ check-runtime-services-index --self-test: ${checked} assertions over a temp fixture (real run() path); every limb -- chapter list, kernel table, meta.json, order, href, title premise, registry slot (incl. the split-line registration), stability matrix (missing row, stale row, order) and stability LABEL on both tables, canonical-source rows (page-less row, page with no row, prose label, duplicate, missing path, and never read as a stability claim), label VOCABULARY (undefined label named with its allowed set and reported only against the page, every defined label accepted, the two legends drifting apart from EACH OTHER while every label they name is still in the enum, a legend widening it alone, legend order, section scoping past a decoy in each file, and a missing legend refused), empty tree, missing versioning.mdx, empty Source-of-Truth list -- observed FAILING and observed silent.`);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else main();

scripts/check-shard-attestation.mjs

@@ -122,6 +122,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /** Artifact-name prefix shared by every shard credential. */
 const ARTIFACT_PREFIX = 'shard-attest-';
@@ -948,7 +949,12 @@ async function selfTest() {
  );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
  await selfTest();
 } else if (process.argv.includes('--emit')) {
  emit();

scripts/check-spec-parsed-alias.mjs

@@ -94,6 +94,7 @@
 
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const SPEC_SRC = join(ROOT, 'packages/spec/src');
@@ -461,7 +462,12 @@ export type Iso0 = Assert<Eq< z.input< typeof M0.ColourSchema >, z.infer< typeof
  console.log('check-spec-parsed-alias --self-test: 18 assertions passed');
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
  selfTest();
 } else {
  const pins = readIsomorphicPins(readFileSync(PIN_FILE, 'utf8'));

scripts/check-startup-registry-verdict.mjs

@@ -150,6 +150,7 @@ import { join, relative, sep, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = fileURLToPath(new URL('..', import.meta.url));
 const BASELINE_PATH = join(ROOT, 'scripts', 'startup-registry-verdict.baseline.json');
@@ -1436,7 +1437,12 @@ function selfTest() {
 }
 
 const args = process.argv.slice(2);
-if (args.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (args.includes('--self-test')) {
  process.exit(selfTest());
 } else {
  const dirFlag = args.indexOf('--packages-dir');

scripts/check-tenant-chokepoint.mjs

@@ -112,6 +112,7 @@ import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -554,9 +555,14 @@ above catches it" is not one: this asserts the chokepoint's own contract.`);
  );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+ // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
  selfTest();
  process.exit(0);
 }
 
-main();
+if (invokedDirectly) main();