@a11ign/screenreader-fleet 0.0.0-reserved.0 → 0.1.0

package/dist/fleet-env.mjs

@@ -0,0 +1,509 @@
+// @ts-check
+/**
+ * `A11Y_WORKERS`, derived from the Ansible inventory — so a machine is added in ONE place.
+ *
+ *     eval "$(npm run --silent fleet:env)"
+ *     npm run fleet:env -- --list        # just the URLs, one per line
+ *
+ * ## Why derive rather than maintain both
+ *
+ * The fleet was a comma-separated string in an environment variable, which was fine for two VMs and is the
+ * wrong shape for twelve boxes. Ansible needs an inventory regardless, so the choice is not "one format or
+ * two" but "one source of truth or two" — and two is how a box comes to be provisioned but never dispatched
+ * to, or dispatched to but never updated. Both of those are silent: the run simply never sends that box a
+ * case, and nothing reports a machine it does not know about.
+ *
+ * ## Why this reads the file rather than shelling out to `ansible-inventory`
+ *
+ * `ansible-inventory --list` is authoritative and would be the better answer if Ansible were always
+ * present. It is not: the control plane runs captures, and requiring an Ansible install before a capture
+ * run could start would make the fleet tooling a dependency of the thing it exists to serve.
+ *
+ * ## Strict on purpose
+ *
+ * A hand-rolled reader for a subset of YAML is exactly the sort of thing that quietly returns four hosts
+ * out of twelve after somebody reformats the file — and a SHORT fleet list is invisible, because a run with
+ * eight workers looks like a run with eight workers. So this refuses rather than guesses: anything that
+ * looks like a host entry but does not parse is an error naming the line, and finding no hosts at all is an
+ * error too.
+ */
+import { readFileSync } from "node:fs";
+import { assertWorkerUrl } from "./worker-http.mjs";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { refuseUnknownFlags } from "./cli-flags.mjs";
+/**
+ * its output is `eval`-ed by a shell, so a wrong shape is executed rather than read.
+ *
+ * An unrecognised flag is otherwise IGNORED, so it runs the default and reports success.
+ */
+refuseUnknownFlags(["--list"], { entry: import.meta.url, command: "npm run fleet:env" });
+export const DEFAULT_WORKER_PORT = 8765;
+/**
+ * The fleet named by the environment — ONE parser, because there were three that did not agree.
+ *
+ * `doctor.mjs` preferred `A11Y_WORKERS`, `check-worker-code.mjs` preferred `A11Y_WORKER`, and the
+ * dataset runner read only `A11Y_WORKERS`. With both variables set, `doctor` and `worker:code` reported
+ * on **different machines** — so "doctor says the fleet is fine" and "worker:code says a worker is
+ * stale" could be statements about two disjoint sets, with nothing to say so.
+ *
+ * `A11Y_WORKERS` wins, matching the dataset runner: the plural names the pool a run dispatches across,
+ * and a diagnostic that describes a different set from the one that will do the work is worse than no
+ * diagnostic. Each entry is trimmed and de-slashed, because `A11Y_WORKERS=a, b` otherwise yields a URL
+ * with a leading space — a configuration typo wearing a dead-machine costume.
+ *
+ * Returns `[]` rather than null when neither is set: "no worker was named" is a normal state that means
+ * "find the local VMs", and every caller already branches on emptiness.
+ *
+ * @returns {Array<{ name: string, url: string }>}
+ */
+export function configuredWorkers() {
+    const raw = process.env.A11Y_WORKERS ?? process.env.A11Y_WORKER ?? "";
+    const named = process.env.A11Y_WORKERS !== undefined ? "A11Y_WORKERS" : "A11Y_WORKER";
+    return raw.split(",")
+        .map((w) => w.trim())
+        .filter(Boolean)
+        // Validated, because this is the ENV route into the same defect the `--worker=` clients now refuse.
+        // `A11Y_WORKERS=http://:8765` used to pass straight through to every consumer of this function --
+        // `doctor`, `worker:code`, `fleet:status`, the dataset runner -- each of which would then report a
+        // machine that cannot be addressed as one that is not answering. Note the empty case is untouched:
+        // "no worker was named" is a normal state meaning "find the local VMs", and every caller branches on it.
+        .map((url) => assertWorkerUrl(url, { source: named }))
+        .map((url) => ({ name: url.replace(/^https?:\/\//, ""), url }));
+}
+// THE INVENTORY LIVES IN `packages/control`, because it describes the machines the CONTROL PLANE drives
+// and it is read by the ansible that runs there. `packages/worker-fleet` is PUBLISHED, and `control` is
+// never published (ADR 0012), so this constant is a real cycle -- audit §3.2 -- and NOT the sanctioned
+// direction: `control` reaching `worker-fleet` by relative import is fine (control has no
+// `node_modules`); this file, reaching back into a package that will not exist in an installed
+// `node_modules/@a11ign/screenreader-fleet`, is what the audit calls "ships code whose data file lives in
+// a package that is never published".
+//
+// FIXED 2026-09-06 by injection, not by moving this module: `doctor.mjs` and `check-worker-code.mjs` are
+// PUBLISHED bins that must keep resolving a bare-metal fleet correctly when run as `npm run doctor` from
+// this checkout, so the functions below take the path as an optional PARAMETER, defaulting to this
+// constant. The default is not a fix in itself -- an installed tarball still ships one that points at a
+// package it will never find -- but `inventoryWorkerUrls`/`namedInventoryWorkers` already catch that and
+// return `[]`, which is this project's own supported "no bare-metal fleet declared here" answer (see their
+// own comments). What injection buys is that the assumption is now a NAMED, overridable default rather
+// than a hidden module constant -- a caller outside this monorepo (or a test) can supply its own path
+// instead of silently inheriting one that can only ever resolve here.
+const INVENTORY = fileURLToPath(new URL("../../control/ansible/inventory.yml", import.meta.url));
+const GROUP_VARS = fileURLToPath(new URL("../../control/ansible/group_vars/a11y_workers.yml", import.meta.url));
+/** A line that declares a host address, ignoring anything commented out. */
+const HOST_LINE = /^\s*ansible_host\s*:\s*(\S+)\s*$/;
+/** Anything that mentions the key but does not parse — a reformat, a quoted value, a list. */
+const SUSPECT = /ansible_host\s*:/;
+/** A mapping key, with or without an inline value. Indentation is the only thing that says where it sits. */
+const KEY_LINE = /^(\s*)([A-Za-z_][\w.-]*)\s*:/;
+/**
+ * A host var declaring whether the host is in the CAPTURE SET. Absent means in: the default is unchanged, so
+ * a host that says nothing needs no inventory edit.
+ */
+const CAPTURE_KEY = "a11y_capture";
+const CAPTURE_LINE = new RegExp(`^(\\s*)${CAPTURE_KEY}\\s*:\\s*(\\S+)\\s*$`);
+const CAPTURE_SUSPECT = new RegExp(`${CAPTURE_KEY}\\s*:`);
+/**
+ * The inventory group whose hosts are capture workers.
+ *
+ * This reader was GROUPLESS until 2026-08-21, and that was a live hazard rather than an untidiness: every
+ * `ansible_host:` in the file became `http://<addr>:8765`, so adding any non-worker host to `inventory.yml`
+ * -- the lab container, the control container, a switch -- would have silently added a phantom worker to
+ * `A11Y_WORKERS`, and a run would have dispatched capture cases to it. That is the exact failure this
+ * module's own header says it exists to prevent ("dispatched to but never updated", "both of those are
+ * silent"), arriving through the door nobody had shut.
+ */
+export const WORKER_GROUP = "a11y_workers";
+/**
+ * One frame of the indentation stack: a key and the column it started at.
+ *
+ * @typedef {{indent: number, key: string}} Frame
+ */
+/**
+ * A host as the inventory declares it — the ADDRESS and the NAME together.
+ *
+ * They travel as one value because separating them is what sent `fleet:sleep` at the wrong machine: every
+ * tool that ACTS on a worker takes the name, every tool that REPORTS on one printed the address, and
+ * nothing mapped between them. `collectHost` explains the incident.
+ *
+ * `capture` is false for a host that declares `a11y_capture: false`: enrolled, served, deployed to, and not
+ * handed corpus cases.
+ *
+ * @typedef {{name: string|undefined, host: string, capture: boolean}} Host
+ */
+/**
+ * The group a host sits in: the key directly beneath `children`.
+ *
+ * Ansible nests as `all.children.<group>.hosts.<name>`, so the group is positional rather than something
+ * to pattern-match on a name. Reading it from the path means a group added later needs no change here.
+ */
+/** @param {Array<string|undefined>} path @returns {string|undefined} */
+function groupOf(path) {
+    const children = path.indexOf("children");
+    return children === -1 ? undefined : path[children + 1];
+}
+/**
+ * Track the YAML path by indentation — a stack, not a parser.
+ *
+ * Deliberately not a YAML library, for the reason the header gives about `ansible-inventory`: the control
+ * plane must be able to read the fleet without installing anything. Indentation is sufficient because the
+ * only question asked of the path is which group a host is in.
+ */
+/** @param {Frame[]} stack @param {string} line */
+function descend(stack, line) {
+    const match = line.match(KEY_LINE);
+    if (!match)
+        return;
+    const indent = match[1].length;
+    while (stack.length && stack[stack.length - 1].indent >= indent)
+        stack.pop();
+    stack.push({ indent, key: match[2] });
+}
+/**
+ * Which group each line of the inventory sits in, index-aligned with `text.split(/\r?\n/)`.
+ *
+ * Exported so there is ONE group implementation. `fleet-discover.mjs` has its own host reader with its own
+ * regexes -- two readers of one file, which this repo's notes call its most expensive recurring shape -- and
+ * when this module became group-aware that one did not, so `fleet:discover` probed the lab container on
+ * :8765 and reported it "ASLEEP?". A phantom worker in the diagnostic instead of in the dispatch list is
+ * still a phantom worker. Rather than teach a second parser about groups, both now ask this.
+ *
+ * @param {string} text
+ * @returns {Array<string | undefined>}
+ */
+export function groupPerLine(text) {
+    /** @type {Frame[]} */
+    const stack = [];
+    return text.split(/\r?\n/).map((line) => {
+        if (!line.trim() || line.trimStart().startsWith("#"))
+            return groupOf(stack.map((f) => f.key));
+        if (!HOST_LINE.test(line))
+            descend(stack, line);
+        return groupOf(stack.map((f) => f.key));
+    });
+}
+/**
+ * The hosts of one inventory group, each with whether it is in the capture set.
+ *
+ * ONE reader for both questions ("the whole fleet" and "the capture set"), because a second pass over the
+ * file is a second parser, and this repo has paid for that shape already (`fleet-discover.mjs`).
+ *
+ * @param {string} text
+ * @param {string} group
+ * @returns {Host[]}
+ */
+function hostsInGroup(text, group) {
+    /** @type {Host[]} */
+    const hosts = [];
+    /** @type {Frame[]} */
+    const stack = [];
+    /** @type {Map<string, {capture: boolean, line: number}>} */
+    const declared = new Map();
+    text.split(/\r?\n/).forEach((line, index) => {
+        if (!line.trim() || line.trimStart().startsWith("#"))
+            return;
+        const match = line.match(HOST_LINE);
+        if (match) {
+            collectHost(hosts, { match, index, stack, group });
+            return;
+        }
+        if (CAPTURE_SUSPECT.test(line)) {
+            readCaptureDeclaration(declared, { line, index, stack });
+            return;
+        }
+        if (SUSPECT.test(line)) {
+            throw new Error(`inventory.yml:${index + 1} looks like a host entry but does not parse: ${line.trim()}\n`
+                + "This reader understands `ansible_host: <address>` and nothing else, deliberately — a fleet list "
+                + "that silently comes up short is invisible, because a run with fewer workers looks normal.");
+        }
+        descend(stack, line);
+    });
+    if (!hosts.length) {
+        throw new Error(`no hosts found under ${group}.hosts in inventory.yml. Add one before running.`);
+    }
+    return applyCaptureDeclarations(hosts, declared, group);
+}
+/**
+ * Record `a11y_capture: true|false` against the host whose var it is — the nearest enclosing key.
+ *
+ * Strict for the reason the header gives: `a11y_capture: no` or `"false"` that this reader took for "not
+ * declared" would leave a cold host in the capture set, and a capture guard would then refuse the run
+ * naming the wrong cause. Only the two literals are read; anything else names its line.
+ *
+ * @param {Map<string, {capture: boolean, line: number}>} declared
+ * @param {{line: string, index: number, stack: Frame[]}} at
+ */
+function readCaptureDeclaration(declared, { line, index, stack }) {
+    const match = line.match(CAPTURE_LINE);
+    const value = match?.[2];
+    if (value !== "true" && value !== "false") {
+        throw new Error(`inventory.yml:${index + 1} declares ${CAPTURE_KEY} but not as \`true\` or \`false\`: ${line.trim()}\n`
+            + "This reader takes those two literals and nothing else, so a host is never left in or out of the "
+            + "capture set by a spelling it did not understand.");
+    }
+    const indent = /** @type {RegExpMatchArray} */ (match)[1].length;
+    const owner = [...stack].reverse().find((frame) => frame.indent < indent)?.key;
+    declared.set(owner ?? "", { capture: value === "true", line: index + 1 });
+}
+/**
+ * Attach each declaration to its host, and refuse one that belongs to no host of the group.
+ *
+ * A declaration on a group or on a host in another group would otherwise be read and dropped, which is the
+ * silent shape this module exists to refuse: somebody believes a machine is out of the capture set and it is
+ * not.
+ *
+ * @param {Host[]} hosts
+ * @param {Map<string, {capture: boolean, line: number}>} declared
+ * @param {string} group
+ * @returns {Host[]}
+ */
+function applyCaptureDeclarations(hosts, declared, group) {
+    const names = new Set(hosts.map((host) => host.name));
+    for (const [owner, { line }] of declared) {
+        if (!names.has(owner)) {
+            throw new Error(`inventory.yml:${line} declares ${CAPTURE_KEY} on \`${owner}\`, which is not a host in ${group}.\n`
+                + `Declare it directly under the host (\`${group}.hosts.<name>.${CAPTURE_KEY}\`); it is not read anywhere else.`);
+        }
+    }
+    return hosts.map((host) => ({ ...host, capture: declared.get(host.name ?? "")?.capture ?? true }));
+}
+/**
+ * Worker URLs from the text of an inventory file.
+ *
+ * `scope` says which question is asked. `"fleet"` (the default) is every enrolled worker -- what `doctor`,
+ * `worker:code`, `fleet:status` and the deploy tooling mean, and they must keep seeing a worker that is
+ * serving but not capturing. `"capture"` is the fleet minus every host that declares `a11y_capture: false`
+ * -- what `A11Y_WORKERS` means. It is a string and not a flag because a boolean argument does not say
+ * which of the two you got.
+ *
+ * Exported and pure so the strictness above is testable: a reader that has never been shown to reject
+ * anything is a reader nobody knows the limits of.
+ *
+ * @param {string} text
+ * @param {{ port?: number, group?: string, scope?: "fleet" | "capture" }} [options]
+ * @returns {string[]}
+ */
+export function workersFromInventory(text, { port = DEFAULT_WORKER_PORT, group = WORKER_GROUP, scope = "fleet" } = {}) {
+    const hosts = hostsInGroup(text, group);
+    const chosen = scope === "capture" ? hosts.filter((host) => host.capture) : hosts;
+    if (!chosen.length) {
+        // An empty A11Y_WORKERS means "find the local VMs", which do not exist on the control plane -- so an
+        // inventory with every host excluded must fail HERE, naming the cause, not as something unrelated.
+        throw new Error(`every host under ${group}.hosts declares ${CAPTURE_KEY}: false, so the capture set is empty.`);
+    }
+    return chosen.map(({ host }) => `http://${host}:${port}`);
+}
+/**
+ * The hosts left OUT of the capture set, so the command that leaves them out can say so.
+ *
+ * @param {string} text
+ * @param {{ port?: number, group?: string }} [options]
+ * @returns {{name: string, url: string}[]}
+ */
+export function hostsOutOfCaptureSet(text, { port = DEFAULT_WORKER_PORT, group = WORKER_GROUP } = {}) {
+    return hostsInGroup(text, group)
+        .filter((host) => !host.capture)
+        .map(({ name, host }) => ({ name: name ?? host, url: `http://${host}:${port}` }));
+}
+/**
+ * The inventory as `{ url -> name }`, so a report can say which machine a command would act on.
+ *
+ * Same parser, same group rules — deliberately not a second reader of the same file, which this repo
+ * calls its most expensive recurring shape and has already paid for once in `fleet-discover.mjs`.
+ *
+ * @param {string} text
+ * @param {{ port?: number, group?: string }} [options]
+ * @returns {Record<string, string>}
+ */
+export function workerNamesFromInventory(text, { port = DEFAULT_WORKER_PORT, group = WORKER_GROUP } = {}) {
+    /** @type {Host[]} */
+    const hosts = [];
+    /** @type {Frame[]} */
+    const stack = [];
+    text.split(/\r?\n/).forEach((line, index) => {
+        if (!line.trim() || line.trimStart().startsWith("#"))
+            return;
+        const match = line.match(HOST_LINE);
+        if (match)
+            return collectHost(hosts, { match, index, stack, group });
+        descend(stack, line);
+    });
+    // Falls back to the ADDRESS when the inventory nests a host without a name. That cannot happen in a
+    // well-formed inventory — Ansible keys hosts by name — but `undefined` reaching a report would print as
+    // the string "undefined", which is this repo's worst failure shape: a value that looks like an answer.
+    // An address is a worse label than a name and still identifies the machine, which is what this map is for.
+    return Object.fromEntries(hosts.map(({ name, host }) => [`http://${host}:${port}`, name ?? host]));
+}
+/**
+ * Keep this host if it is in the worker group; refuse it if it is in no group at all.
+ *
+ * A host outside every group is the ambiguous case, and it gets an error rather than a default. Including
+ * it recreates the phantom-worker bug; dropping it silently is how a fleet list comes up short — and this
+ * module exists because both of those are invisible. So it says which line, and which group it expected.
+ *
+ * @param {Host[]} hosts
+ * @param {{match: RegExpMatchArray, index: number, stack: Frame[], group: string}} found
+ */
+function collectHost(hosts, { match, index, stack, group }) {
+    const found = groupOf(stack.map((frame) => frame.key));
+    if (found === group) {
+        // The inventory NAME comes along with the address. Ansible nests the host as
+        // `...hosts.<name>.ansible_host`, so the name is the innermost frame the stack is still holding.
+        //
+        // Carried because every tool that ACTS on a worker takes the name (`-l a11y-worker-4`) while every
+        // tool that REPORTS on one printed only the address — and nothing mapped them. On 2026-08-24 that
+        // sent `fleet:sleep` at the wrong machine: `fleet:status` named .224 as the Edge-drifted box, and
+        // .224 is a11y-worker-FIVE. Two commands, one fleet, no shared vocabulary.
+        hosts.push({ name: stack[stack.length - 1]?.key, host: match[1].replace(/^["']|["']$/g, ""), capture: true });
+        return;
+    }
+    if (found === undefined) {
+        throw new Error(`inventory.yml:${index + 1} declares a host outside any group: ${match[0].trim()}\n`
+            + `This reader takes workers from \`${group}\` only, so it cannot tell whether an ungrouped host is a `
+            + "capture worker or something else on the network. Nest it under `all.children.<group>.hosts`.");
+    }
+}
+/** The port the group vars declare, so it is stated once and not guessed here. */
+/** @param {string} text @returns {number} */
+export function portFromGroupVars(text) {
+    const match = text.match(/^\s*a11y_port\s*:\s*(\d+)\s*$/m);
+    return match ? Number(match[1]) : DEFAULT_WORKER_PORT;
+}
+/**
+ * The workers declared in `inventory.yml` — i.e. the BARE-METAL fleet.
+ *
+ * Exists so a caller can tell a physical box from a local UTM VM, which decides how it is deployed to and
+ * therefore what remedy to print. `worker:code` used to tell every stale worker to run `utmctl` and
+ * `npm run worker:deploy`, which CANNOT reach a bare-metal box — it is a `utmctl file push` keyed on a VM
+ * UUID and fails immediately off macOS. Following that advice on this fleet wastes the time it takes to
+ * discover the tool was describing a different kind of machine.
+ *
+ * Reads the same file through the same parser as `main()`, rather than a second copy of the knowledge.
+ *
+ * `inventoryPath`/`groupVarsPath` are INJECTED, defaulting to this monorepo's own control-plane files —
+ * see the comment above `INVENTORY` for why the default exists and what it does not fix on its own.
+ *
+ * @param {{ inventoryPath?: string, groupVarsPath?: string }} [paths]
+ */
+export function inventoryWorkerUrls({ inventoryPath = INVENTORY, groupVarsPath = GROUP_VARS } = {}) {
+    try {
+        const port = portFromGroupVars(readFileSync(groupVarsPath, "utf8"));
+        return workersFromInventory(readFileSync(inventoryPath, "utf8"), { port });
+    }
+    catch {
+        // No inventory, or one that does not parse, means "no bare-metal fleet declared here" — a local-VM-only
+        // checkout is a supported setup. Rethrowing would make a hint fail the command it is only advising.
+        return [];
+    }
+}
+/**
+ * The bare-metal fleet as `{name, url}` — the shape a REPORT needs.
+ *
+ * `fleet-status.mjs` already pairs the two, and its comment records what the address alone cost: "this
+ * table named .224 as the box whose Edge had drifted, and .224 is a11y-worker-FIVE — so
+ * `fleet:sleep --limit=a11y-worker-4` put a healthy machine to sleep and left the drifted one serving. A
+ * report and a command that cannot be matched up is a report you have to translate, and translation is
+ * where the mistake goes."
+ *
+ * Here rather than in each reporter, because that is the same pairing and a second copy would drift.
+ *
+ * `inventoryPath`/`groupVarsPath` are INJECTED, same reason and same default as `inventoryWorkerUrls`.
+ *
+ * @param {{ inventoryPath?: string, groupVarsPath?: string }} [paths]
+ * @returns {{name: string, url: string}[]} empty when no inventory is declared, like `inventoryWorkerUrls`
+ */
+export function namedInventoryWorkers({ inventoryPath = INVENTORY, groupVarsPath = GROUP_VARS } = {}) {
+    try {
+        const port = portFromGroupVars(readFileSync(groupVarsPath, "utf8"));
+        const inventory = readFileSync(inventoryPath, "utf8");
+        const names = workerNamesFromInventory(inventory, { port });
+        return workersFromInventory(inventory, { port })
+            .map((url) => ({ name: names[url] ?? url.replace(/^https?:\/\//, ""), url }));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * WHICH WORKERS TO USE, AND WHERE THAT LIST CAME FROM — the one precedence, in one place.
+ *
+ * THREE MODULES HELD THREE DIFFERENT ANSWERS, and one of them carried a comment saying they had been
+ * unified. Measured 2026-08-29:
+ *
+ *   doctor.mjs                        named -> inventory
+ *   check-worker-code.mjs             named -> LOCAL UTM POOL -> inventory
+ *   capture-screenreader-dataset.mjs  named -> LOCAL UTM POOL -> single-VM lease   (never reads inventory)
+ *
+ * The corpus capture path's own comment reads "One parser, in fleet-env.mjs. This copy and doctor's and
+ * check-worker-code's had drifted apart on precedence, which meant a diagnostic could describe a different
+ * fleet from the one about to run." That unification covered the NAMED half only; the fallback order below
+ * it stayed three separate answers, so the sentence describes a fix that was half applied.
+ *
+ * The consequence is the one the comment predicted: on a Mac with any registered UTM guest, `worker:code`
+ * reports the local VM while `doctor` reports the five bare-metal boxes, and a capture dispatches to
+ * whichever the entry point happened to prefer.
+ *
+ * ## THE LOCAL UTM POOL IS LAST, and that is a deprecation, not a preference
+ *
+ * The local guests were a testing arrangement and are deprecated; `inventory.yml` is the fleet, and ADR
+ * 0012 already calls it the single source of truth. So the pool is a fallback for a checkout with NO
+ * inventory — a supported setup for an outside contributor with one Mac and no hardware — and never a
+ * contender with one. Any other order reproduces the divergence above on every Mac that still has a bundle
+ * registered.
+ *
+ * `local` is injected rather than imported: reading the UTM pool means shelling out to `utmctl`, and this
+ * module is imported by everything that needs a worker list, including on Linux. A caller that has no
+ * local-pool reader simply omits it.
+ *
+ * @param {{ named?: () => {url: string}[], inventory?: () => string[], local?: () => string[] }} readers
+ * @returns {{ urls: string[], source: string }}
+ */
+export function resolveWorkerPool({ named = configuredWorkers, inventory = inventoryWorkerUrls, local = () => [], } = {}) {
+    const configured = named();
+    // Naming workers means you are managing them — nothing is started or stopped for you — so an explicit
+    // list always wins. That half was already consistent everywhere; it is the fallback below that was not.
+    if (configured.length)
+        return { urls: configured.map((w) => w.url), source: "A11Y_WORKER(S)" };
+    const fleet = inventory();
+    if (fleet.length)
+        return { urls: fleet, source: "inventory.yml" };
+    const pool = local();
+    if (pool.length)
+        return { urls: pool, source: "the local UTM pool (DEPRECATED — see inventory.yml)" };
+    // Names what it LOOKED IN, never a bare "nothing found". `lab:inventory`'s rule: "'none here' and 'none
+    // anywhere' are different answers, and it now refuses to turn the first into the second."
+    return { urls: [], source: "A11Y_WORKER(S), inventory.yml and the local UTM pool — all empty" };
+}
+/**
+ * What `fleet:env` prints, as data: `stdout` is what a shell reads, `stderr` is what the operator reads.
+ *
+ * `mode: "list"` is the WHOLE fleet, one URL per line, and leaves nobody out. The default is the capture
+ * set as an `export`, and it NAMES every host it left out on stderr -- an omission with no line is a
+ * machine nothing reports, which is the failure this module's header is about. stderr, because stdout is
+ * `eval`-ed.
+ *
+ * @param {string} text the inventory
+ * @param {{ port?: number, mode?: "env" | "list" }} [options]
+ * @returns {{stdout: string, stderr: string}}
+ */
+export function fleetEnvOutput(text, { port = DEFAULT_WORKER_PORT, mode = "env" } = {}) {
+    if (mode === "list") {
+        return { stdout: `${workersFromInventory(text, { port }).join("\n")}\n`, stderr: "" };
+    }
+    const workers = workersFromInventory(text, { port, scope: "capture" });
+    const stderr = hostsOutOfCaptureSet(text, { port })
+        .map(({ name, url }) => `fleet:env: ${name} (${url}) is NOT in A11Y_WORKERS -- its inventory entry declares ${CAPTURE_KEY}: false. `
+        + "It is still enrolled: `--list`, `doctor` and `fleet:status` name it.\n")
+        .join("");
+    // Shell-quoted, so `eval "$(npm run --silent fleet:env)"` is safe even if a hostname ever contains
+    // something the shell would otherwise split on.
+    return { stdout: `export A11Y_WORKERS='${workers.join(",")}'\n`, stderr };
+}
+function main() {
+    const port = portFromGroupVars(readFileSync(GROUP_VARS, "utf8"));
+    const { stdout, stderr } = fleetEnvOutput(readFileSync(INVENTORY, "utf8"), { port, mode: process.argv.includes("--list") ? "list" : "env" });
+    process.stderr.write(stderr);
+    process.stdout.write(stdout);
+}
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href)
+    main();
+//# sourceMappingURL=fleet-env.mjs.map

package/dist/fleet-env.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-env.mjs","sourceRoot":"","sources":["../src/fleet-env.mjs"],"names":[],"mappings":"AAAA,YAAY;AACZ;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;GAIG;AACH,kBAAkB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC;IACtF,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC;QAChB,oGAAoG;QACpG,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,yGAAyG;SACxG,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;SACrD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,wGAAwG;AACxG,wGAAwG;AACxG,uGAAuG;AACvG,0FAA0F;AAC1F,+FAA+F;AAC/F,0GAA0G;AAC1G,sCAAsC;AACtC,EAAE;AACF,yGAAyG;AACzG,yGAAyG;AACzG,mGAAmG;AACnG,wGAAwG;AACxG,yGAAyG;AACzG,2GAA2G;AAC3G,uGAAuG;AACvG,sGAAsG;AACtG,sEAAsE;AACtE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,qCAAqC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACjG,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,mDAAmD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEhH,4EAA4E;AAC5E,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,8FAA8F;AAC9F,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,6GAA6G;AAC7G,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAChD;;;GAGG;AACH,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,UAAU,WAAW,sBAAsB,CAAC,CAAC;AAC7E,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,GAAG,WAAW,OAAO,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C;;;;GAIG;AAEH;;;;;;;;;;;GAWG;AAEH;;;;;GAKG;AACH,wEAAwE;AACxE,SAAS,OAAO,CAAC,IAAI;IACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,kDAAkD;AAClD,SAAS,OAAO,CAAC,KAAK,EAAE,IAAI;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAI;IAC/B,sBAAsB;IACtB,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,IAAI,EAAE,KAAK;IAC/B,qBAAqB;IACrB,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,sBAAsB;IACtB,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,sBAAsB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,GAAG,CAAC,gDAAgD,IAAI,CAAC,IAAI,EAAE,IAAI;kBACvF,kGAAkG;kBAClG,2FAA2F,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,kDAAkD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,GAAG,CAAC,aAAa,WAAW,sCAAsC,IAAI,CAAC,IAAI,EAAE,IAAI;cACrG,kGAAkG;cAClG,kDAAkD,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC;IAC/E,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,wBAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,aAAa,WAAW,SAAS,KAAK,8BAA8B,KAAK,KAAK;kBACjG,yCAAyC,KAAK,iBAAiB,WAAW,oCAAoC,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,mBAAmB,EAAE,KAAK,GAAG,YAAY,EAAE,KAAK,GAAG,OAAO,EAAE,GAAG,EAAE;IACnH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,qGAAqG;QACrG,mGAAmG;QACnG,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,mBAAmB,WAAW,uCAAuC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,mBAAmB,EAAE,KAAK,GAAG,YAAY,EAAE,GAAG,EAAE;IAClG,OAAO,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;SAC7B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;SAC/B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,mBAAmB,EAAE,KAAK,GAAG,YAAY,EAAE,GAAG,EAAE;IACtG,qBAAqB;IACrB,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,sBAAsB;IACtB,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,OAAO,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,oGAAoG;IACpG,wGAAwG;IACxG,uGAAuG;IACvG,2GAA2G;IAC3G,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,6EAA6E;QAC7E,iGAAiG;QACjG,EAAE;QACF,mGAAmG;QACnG,kGAAkG;QAClG,kGAAkG;QAClG,2EAA2E;QAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,GAAG,CAAC,uCAAuC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI;cAClF,oCAAoC,KAAK,4DAA4D;cACrG,8FAA8F,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,6CAA6C;AAC7C,MAAM,UAAU,iBAAiB,CAAC,IAAI;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAE,aAAa,GAAG,SAAS,EAAE,aAAa,GAAG,UAAU,EAAE,GAAG,EAAE;IAChG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,OAAO,oBAAoB,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,wGAAwG;QACxG,oGAAoG;QACpG,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,aAAa,GAAG,SAAS,EAAE,aAAa,GAAG,UAAU,EAAE,GAAG,EAAE;IAClG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO,oBAAoB,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;aAC7C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,GAAG,iBAAiB,EAAE,SAAS,GAAG,mBAAmB,EAAE,KAAK,GAAG,GAAG,EAAE,CAAC,EAAE,GAC7E,GAAG,EAAE;IACJ,MAAM,UAAU,GAAG,KAAK,EAAE,CAAC;IAC3B,sGAAsG;IACtG,wGAAwG;IACxG,IAAI,UAAU,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE/F,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAElE,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;IACrB,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IAEtG,wGAAwG;IACxG,0FAA0F;IAC1F,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;AAClG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,mBAAmB,EAAE,IAAI,GAAG,KAAK,EAAE,GAAG,EAAE;IACpF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;SAChD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CACrB,cAAc,IAAI,KAAK,GAAG,4DAA4D,WAAW,WAAW;UAC1G,wEAAwE,CAAC;SAC5E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,mGAAmG;IACnG,gDAAgD;IAChD,OAAO,EAAE,MAAM,EAAE,wBAAwB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EACvE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC"}

package/dist/fleet-scripts.d.mts

@@ -0,0 +1,11 @@
+/** Absolute paths to the provisioning and lifecycle scripts. Absolute, because a consumer spawns them. */
+export function fleetScriptPaths(): {
+    dir: string;
+    workerCtl: string;
+    buildVm: string;
+    cloneWorker: string;
+    createUtmVm: string;
+    fetchWindowsIso: string;
+    provisioning: string;
+};
+//# sourceMappingURL=fleet-scripts.d.mts.map

package/dist/fleet-scripts.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-scripts.d.mts","sourceRoot":"","sources":["../src/fleet-scripts.mjs"],"names":[],"mappings":"AA6BA,0GAA0G;AAC1G;;;;;;;;EAWC"}

package/dist/fleet-scripts.mjs

@@ -0,0 +1,41 @@
+// @ts-check
+/**
+ * Where the fleet's shell, PowerShell and XML assets live — ONE definition.
+ *
+ * `worker-ctl.sh` was resolved independently in four modules: `local-vm.ts`, `doctor.mjs`,
+ * `deploy-worker.mjs` and `check-worker-code.mjs`. Three of them agreed and the fourth did not —
+ * `local-vm.ts` said `../../scripts/local-worker/…`, which after M6 pointed at `packages/scripts/…`, a
+ * directory that does not exist. So `leaseWorker`, the primary export of this package, could not find the
+ * script it drives.
+ *
+ * It went unnoticed because every check that exercised a lease set `A11Y_WORKER`, which short-circuits VM
+ * discovery — so the DEFAULT path, the one CLAUDE.md documents as "with no A11Y_WORKER set the run finds the
+ * local VM", was the one path never run. Four copies of a fact is three chances to be wrong about it.
+ *
+ * `.mjs` rather than `.ts` on purpose: the fleet's own scripts are `.mjs` and are run directly with
+ * `node packages/worker-fleet/src/doctor.mjs`, with nothing compiled first, so they can only import `.mjs`
+ * siblings.
+ */
+import { fileURLToPath } from "node:url";
+import { join } from "node:path";
+/**
+ * `../src/local-worker/`, NOT `./local-worker/`. These assets are not JavaScript, so tsc does not copy them
+ * into `dist` — they ship from `src`. Resolving via the package root works from `src/…` under tsx and from
+ * `dist/…` when installed, because the two are siblings one level below it. Getting this wrong is not subtle:
+ * the isolation gate failed with `dist/local-worker/` missing.
+ */
+const assetDir = () => fileURLToPath(new URL("../src/local-worker/", import.meta.url));
+/** Absolute paths to the provisioning and lifecycle scripts. Absolute, because a consumer spawns them. */
+export function fleetScriptPaths() {
+    const dir = assetDir();
+    return {
+        dir,
+        workerCtl: join(dir, "worker-ctl.sh"),
+        buildVm: join(dir, "build-vm.sh"),
+        cloneWorker: join(dir, "clone-worker.sh"),
+        createUtmVm: join(dir, "create-utm-vm.sh"),
+        fetchWindowsIso: join(dir, "fetch-windows-iso.sh"),
+        provisioning: fileURLToPath(new URL("../src/provisioning/", import.meta.url)),
+    };
+}
+//# sourceMappingURL=fleet-scripts.mjs.map

package/dist/fleet-scripts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-scripts.mjs","sourceRoot":"","sources":["../src/fleet-scripts.mjs"],"names":[],"mappings":"AAAA,YAAY;AACZ;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEvF,0GAA0G;AAC1G,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,OAAO;QACL,GAAG;QACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;QACrC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QACjC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAC1C,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC;QAClD,YAAY,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/git-safe-env.d.mts

@@ -0,0 +1,10 @@
+/**
+ * `process.env` with every `GIT_*` key removed, `extra` applied on top. A prefix strip, never a list
+ * lookup, so a new `GIT_*` variable is caught without this file needing to know its name.
+ * @param {Record<string, string>} [extra]
+ * @returns {Record<string, string | undefined>}
+ */
+export function sandboxGitEnv(extra?: Record<string, string>): Record<string, string | undefined>;
+/** @type {readonly string[]} */
+export const KNOWN_GIT_REDIRECT_VARS: readonly string[];
+//# sourceMappingURL=git-safe-env.d.mts.map

package/dist/git-safe-env.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-safe-env.d.mts","sourceRoot":"","sources":["../src/git-safe-env.mjs"],"names":[],"mappings":"AA8BA;;;;;GAKG;AACH,sCAHW,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAS9C;AAxBD,gCAAgC;AAChC,sCADW,SAAS,MAAM,EAAE,CAS1B"}

package/dist/git-safe-env.mjs

@@ -0,0 +1,44 @@
+// A DELIBERATE, DISCLOSED DUPLICATE of `packages/guards/src/git-env.mjs` at the repo root.
+//
+// git EXPORTS `GIT_DIR`/`GIT_WORK_TREE`/`GIT_INDEX_FILE` into every hook environment, and a process that
+// spawns `git` with an inherited `env` operates on whatever `GIT_DIR` names, not on `cwd` -- see
+// `packages/guards/src/git-env.mjs`'s header for the incident that proved it (a pre-push-hook test forged 15 commits
+// across all refs of the real repo).
+//
+// This package publishes `check-worker-code.mjs` and `deploy-worker.mjs` as `bin` entries
+// (`package.json`), so every file they import -- `code-drift.mjs` among them -- ships in the published
+// tarball and can only import from INSIDE `@a11ign/screenreader-fleet`. The repo-root `scripts/` directory
+// does not exist once this package is installed from npm, so importing it here would work in this
+// monorepo and break for every real consumer. That is the entire reason this file exists rather than a
+// relative import to the root: not stylistic preference, a publish-boundary constraint (see ADR 0004).
+//
+// Kept textually identical to `packages/guards/src/git-env.mjs` and pinned equal to it by
+// `git-safe-env.test.ts`, which is this repo's own remedy #3 ("pin them equal with a test") for a fact
+// that CANNOT be stated once because the two copies cross a package-publishing boundary neither can
+// import through.
+/** @type {readonly string[]} */
+export const KNOWN_GIT_REDIRECT_VARS = [
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_CEILING_DIRECTORIES",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_COMMON_DIR",
+];
+/**
+ * `process.env` with every `GIT_*` key removed, `extra` applied on top. A prefix strip, never a list
+ * lookup, so a new `GIT_*` variable is caught without this file needing to know its name.
+ * @param {Record<string, string>} [extra]
+ * @returns {Record<string, string | undefined>}
+ */
+export function sandboxGitEnv(extra = {}) {
+    /** @type {Record<string, string | undefined>} */
+    const scrubbed = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (!key.startsWith("GIT_"))
+            scrubbed[key] = value;
+    }
+    return { ...scrubbed, ...extra };
+}
+//# sourceMappingURL=git-safe-env.mjs.map