refactor: fold duplicated code into shared helpers, remove dead code

[likeBloodMoon]

A behaviour-preserving cleanup pass over src/. No report, exit code, error message or public export changes.

src/ goes from 8,599 to 8,378 lines (-221), with 911 lines deleted against 700 added — the new lines are mostly the shared helpers and their documentation.

Duplication folded into shared helpers

What was duplicated	Copies	Now
try/stat/catch for exists / is-file / is-directory, and toPosix	8	src/fs.ts
Escaping, pluralising, collapsing markup, WCAG x, EN 301 549 y	9	src/text.ts (was src/escape.ts)
pageUrl, the nodes-or-one-empty placeholder, the all-outcomes list	8	audit/result.ts
Impact ranking and the unclassified label	8	audit/impact.ts
Unevaluated-rule grouping, the coverage line	4	audit/issues.ts
Engine selection, BrowserUnavailableError handling, write-or-stdout, pc.red('error') plumbing	many	cli/command.ts

Two of these were duplication the code already knew about: pageUrl carried the comment "Kept in step with the sequential runner's own URL derivation", and four separate sorters each re-derived by hand that an unclassified impact ranks with the most severe.

The HTML report now reads the JSON report's tally rather than recomputing it, so the two cannot disagree about what a run found.

Dead code removed

• vite: the info branch of the logger fallback was character-for-character its own else.
• cli: isOutputFormat and isStatementFormat had no callers; parsePositive and parseConcurrency were the same function twice; five flag parsers were one shape written five times.
• astro: EaaKitIntegrationOptions restated IntegrationOptions field for field. It is now an alias, so the Astro and Vite entries cannot drift apart.
• cli: the four command actions rebuilt their options key by key from a Record<string, unknown>, re-checking types commander had already parsed and enforced. Commander omits an option nobody passed, so the parsed flags are the command options — confirmed against commander directly, including --max-depth 0 and --no-build.

Verification

• All four report formats are byte-identical to the pre-refactor build (JSON, HTML, SARIF, console with --per-page --manual), as is a written baseline file, modulo timestamps.
• Same test results as before the change: 865 passed, 11 skipped. The one failing suite (playwright.test.ts) fails identically on master — this sandbox has Chromium at a path Playwright does not look in.
• pnpm lint, pnpm typecheck and pnpm smoke all clean.
• Built bundle is the same size (251,337 vs 251,339 bytes), and axe-core's static reachability from the CLI entry is unchanged — checked explicitly, since this package deliberately keeps jsdom and axe-core off the fast path.

The one behavioural detail

Unevaluated rules appearing on the same number of pages now tie-break by rule id in the console report's "Not evaluated" section, rather than by the order they happened to be encountered. Two runs of one site now order that section identically — the guarantee the rest of the reports already make. It is noted in the changelog.

Reviewed

Ran /simplify's four angles — reuse, simplification, efficiency, altitude — over the first commit. The second commit is what that found: cli/init.ts had been skipped by the writer pass; four sites shared an advisory shape distinct from a warning; component.ts collapsed whitespace by hand; and cli/report.ts was renamed cli/command.ts, since a report is a document everywhere else in this codebase and that module holds neither.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VvS86GmjhxyM8CYnkh3Xxg

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.