fix: remove positional tag argument from tea releases create (#12)

Passing tag both as argument and --tag flag causes ambiguous args error.

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>

Reviewed-on: #12

.woodpecker/lint.yaml

@@ -0,0 +1,8 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: lint
+    image: golangci/golangci-lint:latest
+    commands:
+      - golangci-lint run ./...

.woodpecker/pre-commit.yaml

@@ -0,0 +1,8 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260325
+    commands:
+      - uvx pre-commit run --all-files

.woodpecker/release.yaml

@@ -0,0 +1,59 @@
+when:
+  - event: tag
+
+steps:
+  - name: test
+    image: golang:latest
+    commands:
+      - go test ./...
+
+  - name: build-linux-amd64
+    image: golang:latest
+    commands:
+      - GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-linux-amd64 ./...
+    depends_on: [test]
+
+  - name: build-linux-arm64
+    image: golang:latest
+    commands:
+      - GOOS=linux GOARCH=arm64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-linux-arm64 ./...
+    depends_on: [test]
+
+  - name: build-darwin-amd64
+    image: golang:latest
+    commands:
+      - GOOS=darwin GOARCH=amd64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-darwin-amd64 ./...
+    depends_on: [test]
+
+  - name: build-darwin-arm64
+    image: golang:latest
+    commands:
+      - GOOS=darwin GOARCH=arm64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-darwin-arm64 ./...
+    depends_on: [test]
+
+  - name: release
+    image: git.unkin.net/unkin/almalinux9-base:20260325
+    environment:
+      RELEASER_TOKEN:
+        from_secret: RELEASER_TOKEN
+    commands:
+      - |
+        curl --output /usr/local/bin/tea https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/0.12.0/tea-0.12.0-linux-amd64 && chmod +x /usr/local/bin/tea
+        tea logins add --name gitea --url https://git.unkin.net --token "$${RELEASER_TOKEN}" --no-version-check
+        PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+        if [ -n "$PREV_TAG" ]; then
+          NOTES=$(git log "${PREV_TAG}..${CI_COMMIT_TAG}" --pretty=format:"- %s")
+        else
+          NOTES=$(git log --pretty=format:"- %s")
+        fi
+        tea releases create --tag "${CI_COMMIT_TAG}" --title "${CI_COMMIT_TAG}" --note "${NOTES}" --login gitea --repo "${CI_REPO}"
+        tea releases assets create "${CI_COMMIT_TAG}" \
+          node-lookup-linux-amd64 \
+          node-lookup-linux-arm64 \
+          node-lookup-darwin-amd64 \
+          node-lookup-darwin-arm64 \
+          --login gitea --repo "${CI_REPO}"
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+    depends_on: [build-linux-amd64, build-linux-arm64, build-darwin-amd64, build-darwin-arm64]

.woodpecker/unit-tests.yaml

@@ -0,0 +1,8 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: unit-tests
+    image: golang:latest
+    commands:
+      - go test -v -race ./...

AGENTS.md

@@ -29,7 +29,7 @@ Requires Go 1.21+. Dependencies: `github.com/spf13/cobra` (CLI), `gopkg.in/yaml.
 ./node-lookup -n <hostname>               # lookup a specific node
 ./node-lookup -F <fact_name>              # filter by fact name
 ./node-lookup -m <value>                  # exact value match
-./node-lookup -p <pattern>                # partial/regex match on value (also --pm)
+./node-lookup --pm <pattern>              # partial/regex match on value
 ./node-lookup -R -1                       # node names only
 ./node-lookup -R -2                       # values only
 ./node-lookup -R -C                       # count occurrences
@@ -94,7 +94,6 @@ No test suite exists. Manual testing requires access to the Consul/PuppetDB envi
 ## Gotchas
 
 - `-1`, `-2`, `-C`, and `-A` all require `-R` or `-F`; the tool exits with an error otherwise.
-- `-C` (count) with stdin extracts the first field of each line as the node name, queries PuppetDB per node, then counts the resulting values.
+- `-C` (count) with stdin reads all lines as pre-fetched `"node value"` output for counting — it does **not** query PuppetDB per line.
 - JSON output (`-j`) builds `{ hostname: { factname: value } }` where the fact key is the `-F` value, the `role_fact` config value (if `-R`), or `"value"` as fallback.
 - `config init` fails if the config file already exists (will not overwrite).
-- `--pm` has shorthand `-p`. Use `-p <pattern>` or `--pm <pattern>` — not `-pm <pattern>` (pflag parses single-dash multi-char as combined shorthands).

Makefile

@@ -1,7 +1,8 @@
 BINARY   := node-lookup
-GOFLAGS  := -ldflags="-s -w"
+VERSION  := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+GOFLAGS  := -ldflags="-s -w -X main.version=$(VERSION)"
 
-.PHONY: all build test lint clean install
+.PHONY: all build test lint clean install patch minor major _tag
 
 all: build
 
@@ -19,3 +20,26 @@ clean:
 
 install:
 	go install $(GOFLAGS) ./...
+
+# Bump helpers — reads the latest semver tag and creates the next one.
+# If no tag exists yet, starts from v0.0.0.
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+_tag:
+	git push origin $(TAG)

main.go

@@ -25,6 +25,8 @@ const (
 	appName            = "node-lookup"
 )
 
+var version = "dev"
+
 // config holds all configurable values. Fields map 1:1 to config file keys,
 // env vars (NODE_LOOKUP_*), and (where applicable) CLI flags.
 type config struct {
@@ -108,7 +110,7 @@ type fact struct {
 	Value    json.RawMessage `json:"value"`
 }
 
-func buildQuery(node, factName, match, partialMatch, inverseMatch, roleFact string, showRole bool) string {
+func buildQuery(node, factName, match, partialMatch, roleFact string, showRole bool) string {
 	type filter = []interface{}
 	var filters []filter
 
@@ -125,8 +127,6 @@ func buildQuery(node, factName, match, partialMatch, inverseMatch, roleFact stri
 		filters = append(filters, filter{"=", "value", match})
 	} else if partialMatch != "" {
 		filters = append(filters, filter{"~", "value", partialMatch})
-	} else if inverseMatch != "" {
-		filters = append(filters, filter{"not", filter{"~", "value", inverseMatch}})
 	}
 
 	if len(filters) == 0 {
@@ -150,7 +150,7 @@ func queryPuppetDB(puppetDBURL, query string) ([]fact, error) {
 	if err != nil {
 		return nil, fmt.Errorf("request failed: %w", err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(resp.Body)
@@ -176,7 +176,7 @@ func valueString(raw json.RawMessage) string {
 
 func valueAny(raw json.RawMessage) interface{} {
 	var v interface{}
-	json.Unmarshal(raw, &v)
+	_ = json.Unmarshal(raw, &v)
 	return v
 }
 
@@ -215,27 +215,53 @@ func isTerminal(f *os.File) bool {
 	return (fi.Mode() & os.ModeCharDevice) != 0
 }
 
-func run(cfg config, nodeName, factName, match, partialMatch, inverseMatch string, showRole, nodeOnly, valueOnly, count, ansible, jsonMode bool) error {
+func allFactsForNode(puppetDBURL, node string) ([]fact, error) {
+	query, _ := json.Marshal([]interface{}{"=", "certname", node})
+	return queryPuppetDB(puppetDBURL, string(query))
+}
+
+func run(cfg config, nodeName, factName, match, partialMatch string, showRole, nodeOnly, valueOnly, count, ansible, jsonMode, allFacts bool) error {
 	signal.Ignore(syscall.SIGPIPE)
 
+	if allFacts {
+		if nodeName == "" {
+			return fmt.Errorf("-a requires -n")
+		}
+		facts, err := allFactsForNode(cfg.PuppetDBURL, nodeName)
+		if err != nil {
+			return err
+		}
+		sort.Slice(facts, func(i, j int) bool { return facts[i].Name < facts[j].Name })
+		for _, f := range facts {
+			fmt.Printf("%-40s %s\n", f.Name, valueString(f.Value))
+		}
+		return nil
+	}
+
 	if (nodeOnly || valueOnly || count || ansible) && !showRole && factName == "" {
 		return fmt.Errorf("-R or -F must be used with -1, -2, -C, or -A")
 	}
 
-	var allFacts []fact
+	var collected []fact
+	var stdinLines []string
 
 	doQuery := func(node string) error {
-		query := buildQuery(node, factName, match, partialMatch, inverseMatch, cfg.RoleFact, showRole)
+		query := buildQuery(node, factName, match, partialMatch, cfg.RoleFact, showRole)
 		facts, err := queryPuppetDB(cfg.PuppetDBURL, query)
 		if err != nil {
 			return err
 		}
-		allFacts = append(allFacts, facts...)
+		collected = append(collected, facts...)
 		return nil
 	}
 
 	if nodeName == "" && !isTerminal(os.Stdin) {
 		scanner := bufio.NewScanner(os.Stdin)
+		if count {
+			for scanner.Scan() {
+				stdinLines = append(stdinLines, scanner.Text())
+			}
+		} else {
 			for scanner.Scan() {
 				fields := strings.Fields(scanner.Text())
 				if len(fields) == 0 {
@@ -245,18 +271,19 @@ func run(cfg config, nodeName, factName, match, partialMatch, inverseMatch strin
 					fmt.Fprintln(os.Stderr, "error:", err)
 				}
 			}
+		}
 	} else {
 		if err := doQuery(nodeName); err != nil {
 			return err
 		}
 	}
 
-	returnData := processResults(allFacts)
+	returnData := processResults(collected)
 
 	switch {
 	case jsonMode:
 		hostFactMap := map[string]map[string]interface{}{}
-		for _, f := range allFacts {
+		for _, f := range collected {
 			if _, ok := hostFactMap[f.Certname]; !ok {
 				hostFactMap[f.Certname] = map[string]interface{}{}
 			}
@@ -273,10 +300,14 @@ func run(cfg config, nodeName, factName, match, partialMatch, inverseMatch strin
 		enc := json.NewEncoder(os.Stdout)
 		enc.SetIndent("", "  ")
 		enc.SetEscapeHTML(false)
-		enc.Encode(hostFactMap)
+		_ = enc.Encode(hostFactMap)
 
 	case count:
-		fmt.Println(strings.Join(countResults(returnData), "\n"))
+		values := stdinLines
+		if len(values) == 0 {
+			values = returnData
+		}
+		fmt.Println(strings.Join(countResults(values), "\n"))
 
 	case ansible:
 		hosts := map[string]interface{}{}
@@ -288,7 +319,7 @@ func run(cfg config, nodeName, factName, match, partialMatch, inverseMatch strin
 			"all": map[string]interface{}{"hosts": hosts},
 		}
 		b, _ := yaml.Marshal(inventory)
-		os.Stdout.Write(b)
+		_, _ = os.Stdout.Write(b)
 
 	case nodeOnly:
 		for _, line := range returnData {
@@ -311,18 +342,6 @@ func run(cfg config, nodeName, factName, match, partialMatch, inverseMatch strin
 }
 
 func main() {
-	for i, arg := range os.Args {
-		if arg == "-pm" {
-			os.Args[i] = "--pm"
-		} else if strings.HasPrefix(arg, "-pm=") {
-			os.Args[i] = "--pm=" + arg[4:]
-		} else if arg == "-im" {
-			os.Args[i] = "--im"
-		} else if strings.HasPrefix(arg, "-im=") {
-			os.Args[i] = "--im=" + arg[4:]
-		}
-	}
-
 	cfg, err := loadConfig()
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "config error:", err)
@@ -335,12 +354,12 @@ func main() {
 		showRole     bool
 		match        string
 		partialMatch string
-		inverseMatch string
 		nodeOnly     bool
 		valueOnly    bool
 		count        bool
 		ansible      bool
 		jsonMode     bool
+		allFacts     bool
 		puppetDBURL  string
 	)
 
@@ -354,7 +373,7 @@ func main() {
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return run(cfg, nodeName, factName, match, partialMatch, inverseMatch, showRole, nodeOnly, valueOnly, count, ansible, jsonMode)
+			return run(cfg, nodeName, factName, match, partialMatch, showRole, nodeOnly, valueOnly, count, ansible, jsonMode, allFacts)
 		},
 		SilenceUsage: true,
 	}
@@ -364,13 +383,13 @@ func main() {
 	f.StringVarP(&factName, "fact", "F", "", "Fact name")
 	f.BoolVarP(&showRole, "role", "R", false, "Show role fact ("+defaultRoleFact+" by default)")
 	f.StringVarP(&match, "match", "m", "", "Exact value match")
-	f.StringVar(&partialMatch, "pm", "", "Partial/regex match on value")
+	f.StringVar(&partialMatch, "pm", "", "Partial match on value")
-	f.StringVar(&inverseMatch, "im", "", "Inverse partial/regex match on value")
 	f.BoolVarP(&nodeOnly, "nodeonly", "1", false, "Show only the node name")
 	f.BoolVarP(&valueOnly, "valueonly", "2", false, "Show only the value")
 	f.BoolVarP(&count, "count", "C", false, "Count fact occurrences")
 	f.BoolVarP(&ansible, "ansible", "A", false, "Output as Ansible inventory")
 	f.BoolVarP(&jsonMode, "json", "j", false, "Emit valid JSON for all output")
+	f.BoolVarP(&allFacts, "all", "a", false, "Show all facts for a node (requires -n)")
 	rootCmd.PersistentFlags().StringVar(&puppetDBURL, "url", cfg.PuppetDBURL, "PuppetDB facts URL (overrides config and NODE_LOOKUP_URL)")
 
 	configCmd := &cobra.Command{
@@ -402,6 +421,14 @@ func main() {
 	configCmd.AddCommand(configInitCmd, configShowCmd)
 	rootCmd.AddCommand(configCmd)
 
+	versionCmd := &cobra.Command{
+		Use:          "version",
+		Short:        "Print the version",
+		Run:          func(cmd *cobra.Command, args []string) { fmt.Println(version) },
+		SilenceUsage: true,
+	}
+	rootCmd.AddCommand(versionCmd)
+
 	if err := rootCmd.Execute(); err != nil {
 		os.Exit(1)
 	}

main_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -12,19 +13,11 @@ import (
 
 // ---- helpers ----------------------------------------------------------------
 
-func mustMarshal(v interface{}) []byte {
-	b, err := json.Marshal(v)
-	if err != nil {
-		panic(err)
-	}
-	return b
-}
-
 func newTestServer(t *testing.T, facts []fact) *httptest.Server {
 	t.Helper()
 	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(facts)
+		_ = json.NewEncoder(w).Encode(facts)
 	}))
 }
 
@@ -36,42 +29,42 @@ func rawJSON(v interface{}) json.RawMessage {
 // ---- buildQuery -------------------------------------------------------------
 
 func TestBuildQuery_NoFilters(t *testing.T) {
-	q := buildQuery("", "", "", "", "", "enc_role", false)
+	q := buildQuery("", "", "", "", "enc_role", false)
 	if !strings.Contains(q, "enc_role") {
 		t.Fatalf("expected default role query, got %s", q)
 	}
 }
 
 func TestBuildQuery_Node(t *testing.T) {
-	q := buildQuery("host1", "", "", "", "", "enc_role", false)
+	q := buildQuery("host1", "", "", "", "enc_role", false)
 	if !strings.Contains(q, "certname") || !strings.Contains(q, "host1") {
 		t.Fatalf("unexpected query: %s", q)
 	}
 }
 
 func TestBuildQuery_FactAndMatch(t *testing.T) {
-	q := buildQuery("", "region", "syd1", "", "", "enc_role", false)
+	q := buildQuery("", "region", "syd1", "", "enc_role", false)
 	if !strings.Contains(q, "region") || !strings.Contains(q, "syd1") {
 		t.Fatalf("unexpected query: %s", q)
 	}
 }
 
 func TestBuildQuery_PartialMatch(t *testing.T) {
-	q := buildQuery("", "enc_role", "", "dns", "", "enc_role", false)
+	q := buildQuery("", "enc_role", "", "dns", "enc_role", false)
 	if !strings.Contains(q, "~") || !strings.Contains(q, "dns") {
 		t.Fatalf("expected partial match query, got %s", q)
 	}
 }
 
 func TestBuildQuery_ShowRole(t *testing.T) {
-	q := buildQuery("", "", "", "", "", "my_role_fact", true)
+	q := buildQuery("", "", "", "", "my_role_fact", true)
 	if !strings.Contains(q, "my_role_fact") {
 		t.Fatalf("expected role fact in query, got %s", q)
 	}
 }
 
 func TestBuildQuery_CustomRoleFact(t *testing.T) {
-	q := buildQuery("", "", "", "", "", "custom_role", true)
+	q := buildQuery("", "", "", "", "custom_role", true)
 	if !strings.Contains(q, "custom_role") {
 		t.Fatalf("expected custom role fact, got %s", q)
 	}
@@ -183,7 +176,7 @@ func TestQueryPuppetDB_HTTPError(t *testing.T) {
 
 func TestQueryPuppetDB_BadJSON(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte("not json"))
+		_, _ = w.Write([]byte("not json"))
 	}))
 	defer srv.Close()
 
@@ -243,8 +236,12 @@ func TestLoadConfig_FileOverride(t *testing.T) {
 	t.Setenv("NODE_LOOKUP_ROLE_FACT", "")
 
 	cfgDir := filepath.Join(dir, appName)
-	os.MkdirAll(cfgDir, 0o755)
+	if err := os.MkdirAll(cfgDir, 0o755); err != nil {
-	os.WriteFile(filepath.Join(cfgDir, configFileName), []byte("puppetdb_url: http://file:8080/facts\nrole_fact: file_role\n"), 0o644)
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cfgDir, configFileName), []byte("puppetdb_url: http://file:8080/facts\nrole_fact: file_role\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
 	cfg, err := loadConfig()
 	if err != nil {
@@ -265,8 +262,12 @@ func TestLoadConfig_EnvOverridesFile(t *testing.T) {
 	t.Setenv("NODE_LOOKUP_ROLE_FACT", "")
 
 	cfgDir := filepath.Join(dir, appName)
-	os.MkdirAll(cfgDir, 0o755)
+	if err := os.MkdirAll(cfgDir, 0o755); err != nil {
-	os.WriteFile(filepath.Join(cfgDir, configFileName), []byte("puppetdb_url: http://file:8080/facts\n"), 0o644)
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cfgDir, configFileName), []byte("puppetdb_url: http://file:8080/facts\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
 	cfg, err := loadConfig()
 	if err != nil {
@@ -284,8 +285,12 @@ func TestLoadConfig_InvalidYAML(t *testing.T) {
 	t.Setenv("NODE_LOOKUP_ROLE_FACT", "")
 
 	cfgDir := filepath.Join(dir, appName)
-	os.MkdirAll(cfgDir, 0o755)
+	if err := os.MkdirAll(cfgDir, 0o755); err != nil {
-	os.WriteFile(filepath.Join(cfgDir, configFileName), []byte(":\tinvalid: yaml:\n"), 0o644)
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cfgDir, configFileName), []byte(":\tinvalid: yaml:\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
 	_, err := loadConfig()
 	if err == nil {
@@ -315,9 +320,112 @@ func TestWriteDefaultConfig_AlreadyExists(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("XDG_CONFIG_HOME", dir)
 
-	writeDefaultConfig()
+	if err := writeDefaultConfig(); err != nil {
+		t.Fatal(err)
+	}
 	err := writeDefaultConfig()
 	if err == nil {
 		t.Fatal("expected error when config already exists")
 	}
 }
+
+// ---- allFactsForNode --------------------------------------------------------
+
+func TestAllFactsForNode_ReturnsSortedFacts(t *testing.T) {
+	facts := []fact{
+		{Certname: "node1", Name: "zebra", Value: rawJSON("z-val")},
+		{Certname: "node1", Name: "alpha", Value: rawJSON("a-val")},
+		{Certname: "node1", Name: "middle", Value: rawJSON(42)},
+	}
+	srv := newTestServer(t, facts)
+	defer srv.Close()
+
+	got, err := allFactsForNode(srv.URL+"/pdb/query/v4/facts", "node1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 3 {
+		t.Fatalf("expected 3 facts, got %d", len(got))
+	}
+}
+
+func TestAllFactsForNode_QueryContainsCertname(t *testing.T) {
+	var receivedQuery string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedQuery = r.URL.Query().Get("query")
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode([]fact{})
+	}))
+	defer srv.Close()
+
+	_, _ = allFactsForNode(srv.URL+"/pdb/query/v4/facts", "mynode.example.com")
+	if !strings.Contains(receivedQuery, "mynode.example.com") {
+		t.Fatalf("expected certname in query, got: %s", receivedQuery)
+	}
+	if !strings.Contains(receivedQuery, "certname") {
+		t.Fatalf("expected 'certname' in query, got: %s", receivedQuery)
+	}
+}
+
+func TestAllFactsForNode_HTTPError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	_, err := allFactsForNode(srv.URL+"/pdb/query/v4/facts", "node1")
+	if err == nil {
+		t.Fatal("expected error for HTTP 500")
+	}
+}
+
+// ---- run with -a flag -------------------------------------------------------
+
+func TestRun_AllFacts_RequiresNode(t *testing.T) {
+	cfg := config{PuppetDBURL: "http://unused", RoleFact: "enc_role"}
+	err := run(cfg, "", "", "", "", false, false, false, false, false, false, true)
+	if err == nil || !strings.Contains(err.Error(), "-a requires -n") {
+		t.Fatalf("expected -a requires -n error, got: %v", err)
+	}
+}
+
+func TestRun_AllFacts_PrintsSortedByName(t *testing.T) {
+	facts := []fact{
+		{Certname: "node1", Name: "zzz_fact", Value: rawJSON("last")},
+		{Certname: "node1", Name: "aaa_fact", Value: rawJSON("first")},
+		{Certname: "node1", Name: "mmm_fact", Value: rawJSON(true)},
+	}
+	srv := newTestServer(t, facts)
+	defer srv.Close()
+
+	old := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	cfg := config{PuppetDBURL: srv.URL + "/pdb/query/v4/facts", RoleFact: "enc_role"}
+	err := run(cfg, "node1", "", "", "", false, false, false, false, false, false, true)
+
+	_ = w.Close()
+	os.Stdout = old
+	var buf strings.Builder
+	_, _ = io.Copy(&buf, r)
+	out := buf.String()
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	lines := strings.Split(strings.TrimSpace(out), "\n")
+	if len(lines) != 3 {
+		t.Fatalf("expected 3 lines, got %d: %q", len(lines), out)
+	}
+	if !strings.HasPrefix(lines[0], "aaa_fact") {
+		t.Errorf("first line should be aaa_fact, got: %s", lines[0])
+	}
+	if !strings.HasPrefix(lines[1], "mmm_fact") {
+		t.Errorf("second line should be mmm_fact, got: %s", lines[1])
+	}
+	if !strings.HasPrefix(lines[2], "zzz_fact") {
+		t.Errorf("third line should be zzz_fact, got: %s", lines[2])
+	}
+}