@intentius/behold 0.19.0 → 0.21.0

package/example-argo-estate/README.md

@@ -3,7 +3,7 @@
 Three chant projects served as one composed estate, the Argo mirror of
 [example-flux-estate](../example-flux-estate):
 
-- **control-plane/** — the Argo machinery: an `AppProject` fencing which repo
+- **control-plane/.** The Argo machinery: an `AppProject` fencing which repo
   and which namespaces the estate may deploy, and one `Application` per app
   syncing that app's committed manifests from behold's own public repo. Argo's
   controller does the applying; this project never applies a workload itself.
@@ -14,13 +14,13 @@ Three chant projects served as one composed estate, the Argo mirror of
 npx @intentius/behold demo argo-estate
 ```
 
-The demo path is **declared only** — no cluster, no Argo install, no Docker. It
+The demo path is **declared only**, no cluster, no Argo install, no Docker. It
 copies out, `npm install`s, and serves. (There is a live lane, but it is an
 acceptance run rather than part of the demo: see "Live" below.) What to look
 at:
 
 - The **estate**: per-project boundary boxes, and the `project` edges joining
-  both Applications to the AppProject they name (behold#222) — the join chant
+  both Applications to the AppProject they name (behold#222), the join chant
   lints as ARGO002, so an estate whose lint passes cannot be drawn wrong.
   The entity graph carries them at the attributes tier (`?detail=3`).
 - The **logical lens** (zoom: logical): cluster ⊃ `namespace app-a` and
@@ -31,20 +31,20 @@ at:
   namespace Argo will own objects in is a namespace the estate is committed
   to, and behold#224 taught the composed estate to draw that projection.
   Serve `control-plane` alone (`behold serve control-plane`, zoom: logical)
-  and the same boxes appear empty — the destination harvest still names them,
+  and the same boxes appear empty, the destination harvest still names them,
   but there is nothing from app-a/app-b in the graph to fill them with.
 
 That alone-vs-composed split is the Argo/Flux difference worth noticing:
 flux-estate's control plane must declare the app namespaces itself (a
 Kustomization's `targetNamespace` must already exist), while here
-`CreateNamespace=true` means Argo makes them — so the box exists on the
+`CreateNamespace=true` means Argo makes them, so the box exists on the
 strength of the destination alone.
 
 Argo's ordering is the `argocd.argoproj.io/sync-wave` annotation, so unlike
 Flux's `dependsOn` (behold#223) there is no edge to draw for it: app-a is wave
 0, app-b wave 1, and the picture says nothing about it.
 
-The app `manifests/` are committed `chant build` output — the path each
+The app `manifests/` are committed `chant build` output, the path each
 Application syncs. Changing an app's source means a rebuild (`npm run build` in
 the app), and the rebuilt manifests have to be on `main` before Argo can sync
 them. `chant build` in the control plane warns ARGO005 on both Applications:
@@ -55,11 +55,11 @@ check's own message says so.
 ## Live
 
 Nothing above needs a cluster, but the estate as committed does reconcile
-against a real one — the Applications point at this repo on `main` and the app
+against a real one, the Applications point at this repo on `main` and the app
 `manifests/` are already there, so an Argo CD install has everything it needs.
 `just e2e-argo-estate` (behold#269) is that run: a scratch k3d cluster, Argo
 from the pinned `core-install` manifest, the control plane applied once, and
-then the composed estate served against the result — the destination-namespace
+then the composed estate served against the result, the destination-namespace
 boxes filled with live cards, #238's health verdicts read off each
 Application's health/sync pair, and the unhappy arm (an Application pointed at
 a path that does not exist, then restored). It creates and deletes its own

package/example-argo-estate/app-a/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.0",
-    "@intentius/chant-lexicon-k8s": "^0.54.0"
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-lexicon-k8s": "^0.95.0"
   }
 }

package/example-argo-estate/app-b/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.0",
-    "@intentius/chant-lexicon-k8s": "^0.54.0"
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-lexicon-k8s": "^0.95.0"
   }
 }

package/example-argo-estate/chant.workspace.json

@@ -0,0 +1,27 @@
+{
+  "name": "example-argo-estate",
+  "schema": 1,
+  "pins": [
+    {
+      "package": "@intentius/chant",
+      "version": "0.95.0"
+    }
+  ],
+  "members": [
+    {
+      "name": "control-plane",
+      "dir": "control-plane",
+      "kind": "chant"
+    },
+    {
+      "name": "app-a",
+      "dir": "app-a",
+      "kind": "chant"
+    },
+    {
+      "name": "app-b",
+      "dir": "app-b",
+      "kind": "chant"
+    }
+  ]
+}

package/example-argo-estate/control-plane/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o dist/control-plane.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.0",
-    "@intentius/chant-lexicon-k8s": "^0.54.0"
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-lexicon-k8s": "^0.95.0"
   }
 }

package/example-argo-estate/package-lock.json

@@ -14,22 +14,22 @@
     "app-a": {
       "name": "behold-example-argo-app-a",
       "dependencies": {
-        "@intentius/chant": "^0.54.0",
-        "@intentius/chant-lexicon-k8s": "^0.54.0"
+        "@intentius/chant": "^0.95.0",
+        "@intentius/chant-lexicon-k8s": "^0.95.0"
       }
     },
     "app-b": {
       "name": "behold-example-argo-app-b",
       "dependencies": {
-        "@intentius/chant": "^0.54.0",
-        "@intentius/chant-lexicon-k8s": "^0.54.0"
+        "@intentius/chant": "^0.95.0",
+        "@intentius/chant-lexicon-k8s": "^0.95.0"
       }
     },
     "control-plane": {
       "name": "behold-example-argo-control-plane",
       "dependencies": {
-        "@intentius/chant": "^0.54.0",
-        "@intentius/chant-lexicon-k8s": "^0.54.0"
+        "@intentius/chant": "^0.95.0",
+        "@intentius/chant-lexicon-k8s": "^0.95.0"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -464,14 +464,16 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.54.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.54.0.tgz",
-      "integrity": "sha512-ETYVPvDWqJiEsaaaYK+1U2lGrZZqHPU6/bOH797oQNw5gd7ESkEoYZxlh0qO90FQGVdx1pQMvmlCWskWD4xIlA==",
+      "version": "0.95.0",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.95.0.tgz",
+      "integrity": "sha512-zhReqEbP7apFyI9bwHATxSKPbc9HK8W2lJvZpib0YNEgSafydm+dd31Hn+7o3AcHhYbAkLpHFQwlFYbM2uVYCg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
+        "ajv": "^8.20.0",
         "esbuild": "^0.28.1",
         "fflate": "^0.8.2",
+        "js-yaml": "^4.3.1",
         "picomatch": "^4.0.3",
         "tsx": "^4.0.0",
         "typescript": "^5.5.0",
@@ -479,12 +481,20 @@
       },
       "bin": {
         "chant": "bin/chant"
+      },
+      "peerDependencies": {
+        "vitest": ">=2"
+      },
+      "peerDependenciesMeta": {
+        "vitest": {
+          "optional": true
+        }
       }
     },
     "node_modules/@intentius/chant-k8s-client": {
-      "version": "0.54.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.54.0.tgz",
-      "integrity": "sha512-LzoPfOQ4tIy7QR3ohLi/OqRgoZU/NXZ5TU6WeXFVqzffSjEoZu9yonjkaALy30Dqqa77XGFMTcP/SMZkNSEdsQ==",
+      "version": "0.95.0",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.95.0.tgz",
+      "integrity": "sha512-AjLnvTNzAIHbwsOv8gszuLqzH0UeA16Dy8dWIdEICUDLRdmi0gGcX7qZ/VNzQMIHu9Bu1hSIJz+gbmR44a7tYA==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -492,23 +502,37 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-k8s": {
-      "version": "0.54.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.54.0.tgz",
-      "integrity": "sha512-Bz+UYEJmy6gCAhlTPXAsyeLG8B7B9KvBX/Cjt261z/nOc/0OwdOhZs3DkjD1UA1ZPKfkUxP/S1mJq8ux3ggNCw==",
+      "version": "0.95.0",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.95.0.tgz",
+      "integrity": "sha512-sanDVeXQYHXkwwQ5OZiVCbpHn25B6wt9XvW3uoBpzLv/lBhxrPfKGv5xhDyAfKaSktfCknWXlI2S0SV+6AOy8A==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@intentius/chant-lexicon-otel": "*",
         "@types/js-yaml": "^4.0.9",
         "js-yaml": "^4.3.1"
       },
       "optionalDependencies": {
-        "@intentius/chant-k8s-client": "^0.54.0"
+        "@intentius/chant-k8s-client": "^0.95.0"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.54.0",
+        "@intentius/chant": "^0.95.0",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }
     },
+    "node_modules/@intentius/chant-lexicon-otel": {
+      "version": "0.95.0",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-otel/-/chant-lexicon-otel-0.95.0.tgz",
+      "integrity": "sha512-TTydUPN3fStnkdsmAIWKZiA2gBahxOAz9ihcsHx5rupnkOTSHO8soxayqbUBaUxVbdbrwYT9zpAcc3W3KcXBaQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "js-yaml": "^4.3.1"
+      },
+      "peerDependencies": {
+        "@intentius/chant": "^0.95.0",
+        "typescript": "^5.9.3"
+      }
+    },
     "node_modules/@jsep-plugin/assignment": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/@jsep-plugin/assignment/-/assignment-1.3.0.tgz",
@@ -590,13 +614,13 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.4.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.4.1.tgz",
-      "integrity": "sha512-k97ENvZWtvA6yqz5/FS6a7duDgOPEeOQOc2iKS/nY6mX6qJUKtLnWzQS+Xj6tXweyj6ZcTAK2Qecetnvi9nCLA==",
+      "version": "26.6.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.3.tgz",
+      "integrity": "sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "undici-types": "~8.3.0"
+        "undici-types": "~8.9.0"
       }
     },
     "node_modules/@types/stream-buffers": {
@@ -619,6 +643,22 @@
         "node": ">= 20"
       }
     },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@@ -633,9 +673,9 @@
       "optional": true
     },
     "node_modules/b4a": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.1.tgz",
-      "integrity": "sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.9.0.tgz",
+      "integrity": "sha512-dpfcF9fDNR6++cthXR67iyhgqWy9CBouAvIWhIntzBG6cvK/cnIPiZQjBwi/ZqjjBEDGfoNDtmB0kTjroOJ3pQ==",
       "license": "Apache-2.0",
       "optional": true,
       "peerDependencies": {
@@ -663,9 +703,9 @@
       }
     },
     "node_modules/bare-fs": {
-      "version": "4.8.1",
-      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.8.1.tgz",
-      "integrity": "sha512-N1nnXdHZAOSstz0XiHikGS4HGMH4CnSwhqWdGQQMqqdvp4Jybm9sE3R1WVnpWVd4SFkc8ryPDBLViNLwiEqECg==",
+      "version": "4.8.2",
+      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.8.2.tgz",
+      "integrity": "sha512-+ZI68KHMUvosXfKbg/UOHK0tbCdRnegbvPEdEcZ3Nd6TetieQsJPRXBRXPdLyy8+3VSEbPXtsumTpEtt78xv9w==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -723,9 +763,9 @@
       }
     },
     "node_modules/bare-url": {
-      "version": "2.5.3",
-      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.5.3.tgz",
-      "integrity": "sha512-3absfEzoyFosWT8v83ZcJgbTJxv+S/sI7jBfeCMlUVatSaefRmwweqBhFpMllQv+HTxs/FbbToVOw1c05NORkQ==",
+      "version": "2.5.4",
+      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.5.4.tgz",
+      "integrity": "sha512-Gxa7UVWBr0/edU1b+TJhn/AZvMQUj9OGspvYsaTYQrAbZA4BOTZGL3LiZxvD+CeMlDH4juwD84+eTAp/bLYW5g==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -924,6 +964,12 @@
         "bare-events": "^2.7.0"
       }
     },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "license": "MIT"
+    },
     "node_modules/fast-fifo": {
       "version": "1.3.2",
       "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
@@ -931,6 +977,22 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/fast-uri": {
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/fflate": {
       "version": "0.8.3",
       "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz",
@@ -1083,9 +1145,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.7.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.0.tgz",
-      "integrity": "sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==",
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -1103,9 +1165,9 @@
       }
     },
     "node_modules/jose": {
-      "version": "6.2.10",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.10.tgz",
-      "integrity": "sha512-iiW7J9qRFlGxvCOIBDBDxFePQSn7ZMAnrYGhrrOo6siO/MIqwfyilLR27pkfDgUk+raLuzADS8A3S/KLBisc0g==",
+      "version": "6.2.12",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz",
+      "integrity": "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==",
       "license": "MIT",
       "optional": true,
       "funding": {
@@ -1144,6 +1206,12 @@
         "node": ">= 10.16.0"
       }
     },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
+    },
     "node_modules/jsonpath-plus": {
       "version": "10.4.0",
       "resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-10.4.0.tgz",
@@ -1204,9 +1272,9 @@
       "optional": true
     },
     "node_modules/oauth4webapi": {
-      "version": "3.8.7",
-      "resolved": "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-3.8.7.tgz",
-      "integrity": "sha512-4RxcKxXjuItDFZ20RRPf4YTw3kpeXJyCgJFxVzJ068A7PNJ18st2Dg90tlC1LkSDS0GecroagCLHYEIVUhCAkw==",
+      "version": "3.8.8",
+      "resolved": "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-3.8.8.tgz",
+      "integrity": "sha512-8N28E+a/oxfXWBgOMt+ZP/JUf/XR+IFbvkAEPP3gznXOMv9BpAAwiIj0TFNz3tGTPc0ZQ8zmWBNgN1nAys0gng==",
       "license": "MIT",
       "optional": true,
       "funding": {
@@ -1224,14 +1292,14 @@
       }
     },
     "node_modules/openid-client": {
-      "version": "6.8.7",
-      "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-6.8.7.tgz",
-      "integrity": "sha512-gtKthNu7evSBvTdrrlHb4F3Fi9dcwlb5QaITlCs+9mfpvuOi0Q3qtBf5+iY4sEP8hy1qCoAdxBNPDcmZeVSDzQ==",
+      "version": "6.8.8",
+      "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-6.8.8.tgz",
+      "integrity": "sha512-ZsucJA5Ad04Uv7YN4ql+s4GXNmb9uAYQwyJTsJx7CH/MX3JZioLE2pVKi1SC+YrbSLA4Px3Gi30dMjgOZtb6pA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "jose": "^6.2.8",
-        "oauth4webapi": "^3.8.7"
+        "jose": "^6.2.12",
+        "oauth4webapi": "^3.8.8"
       },
       "funding": {
         "url": "https://github.com/sponsors/panva"
@@ -1260,6 +1328,15 @@
         "once": "^1.3.1"
       }
     },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/rfc4648": {
       "version": "1.5.4",
       "resolved": "https://registry.npmjs.org/rfc4648/-/rfc4648-1.5.4.tgz",
@@ -1279,9 +1356,9 @@
       }
     },
     "node_modules/socks": {
-      "version": "2.8.9",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz",
-      "integrity": "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==",
+      "version": "2.8.10",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.10.tgz",
+      "integrity": "sha512-e0VyvkVTwVYViNovRkZ9aodhxVlyoMn7eJhVUPxZ+eK9P/7CBkxvvsBOHqFPEH416726W8tLXXXjKwqgTErrCQ==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1410,9 +1487,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.10.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.1.tgz",
-      "integrity": "sha512-YQ3WlbqjYMmNpdvDH64jAgLjxuAR9+649calDWhbshYaeQGO2bR4nI94ORJmwI3J9YhoKQnpyGOK+0zlWS5N5Q==",
+      "version": "8.11.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",
+      "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -1420,9 +1497,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
-      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
       "license": "MIT",
       "optional": true
     },
@@ -1434,9 +1511,9 @@
       "optional": true
     },
     "node_modules/ws": {
-      "version": "8.21.3",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
-      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
+      "integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
       "license": "MIT",
       "optional": true,
       "engines": {

package/example-carve/README.md

@@ -1,4 +1,4 @@
-# example-carve — the mixed estate the peeling demo runs on
+# example-carve, the mixed estate the peeling demo runs on
 
 A migration caught half-done. `app/` is chant; `legacy-tf/` is Terraform; both
 describe one AWS account, and the walkthrough carves one more resource across
@@ -11,9 +11,9 @@ behold demo carve          # copies this directory, installs, advises, serves
 ```
 
 The boot does three things before a port opens: `npm install` in `app/` (whose
-chant every step of the walkthrough shells), `@cdktf/hcl2json` into the copy's
+chant every step of the walkthrough shells), `@cdktn/hcl2json` into the copy's
 root `node_modules` (chant lazy-loads the HCL parser from its own install
-upward, so `<copy>/node_modules` is where it resolves — not beside the `.tf`
+upward, so `<copy>/node_modules` is where it resolves rather than beside the `.tf`
 files), and `chant carve advise --report` over the copy's own Terraform. If any
 of that fails, the committed `carve-report.json` is served instead and the
 reason is on screen; a blank graph is the one outcome that's never allowed.
@@ -53,7 +53,7 @@ Real output, from `chant carve advise` (first cut at chant 0.44.7, verified
 identical at 0.52.1). Reproduce it with:
 
 ```sh
-npm install -D @cdktf/hcl2json          # once, anywhere on your PATH resolution
+npm install -D @cdktn/hcl2json          # once, anywhere on your PATH resolution
 chant carve advise --from example-carve/legacy-tf \
                    --state example-carve/legacy-tf/terraform.tfstate
 ```
@@ -61,7 +61,7 @@ chant carve advise --from example-carve/legacy-tf \
 | score | address | band | why | role in the script |
 |---|---|---|---|---|
 | 100 | `aws_cloudwatch_log_group.worker` | clean leaf | clean 1:1 native map, no boundary edges | the free first move: named, not carved |
-| 84 | `aws_s3_bucket.assets` | clean leaf | 1 inbound, 1 output | **the star** — the resource we carve on camera |
+| 84 | `aws_s3_bucket.assets` | clean leaf | 1 inbound, 1 output | **the star**, the resource we carve on camera |
 | 71 | `module.cdn` | carvable w/ edits | 1 outbound, tier 2, data present | one module, so module scoring appears |
 | 69 | `aws_iam_role.api` | carvable w/ edits | 1 inbound, 1 outbound, tier 2 | what an inbound edge costs |
 | 69 | `aws_vpc_endpoint.ssm` | carvable w/ edits | 4 outbound, tier 2 | outbound edges are cheap, but they add up |
@@ -85,7 +85,7 @@ above is that arithmetic on the edges in `legacy-tf/`, which is why the estate
 is shaped the way it is:
 
 - The bucket has one inbound edge — `aws_lambda_function.api`'s
-  `ASSETS_BUCKET` environment variable — and, since `outputs.tf`'s
+  `ASSETS_BUCKET` environment variable, and, since `outputs.tf`'s
   `assets_bucket` reads it too, one output edge. Two edges, two rewrites, 84.
   `assets_bucket` is deliberate: a downstream consumer of this state reads the
   bucket name today, so the carve has a second thing to bridge, not just the
@@ -98,7 +98,7 @@ is shaped the way it is:
   output, and 32 says so.
 - The subnets and the security group each read a data source, which costs 10.
   The subnets also feed `private_subnet_ids`, an existing output, which costs
-  4 more apiece and drops them under the security group's 43 — the one place
+  4 more apiece and drops them under the security group's 43, the one place
   the outputs term reorders the table, not just re-scores it.
 
 No resource uses `count` or `for_each`, so the instance-count penalty is zero
@@ -132,7 +132,7 @@ bucket scores 84 instead of 88 and the report's `patchOnCarve` list names
 fold is applied, not just reported (chant#1637), so the emitted bucket actually
 carries `VersioningConfiguration` and `PublicAccessBlockConfiguration` instead
 of leaving them in an "unmapped attributes" comment. The committed report above
-is byte-identical to what 0.44.7 regenerates — re-verified at 0.52.1 — which is
+is byte-identical to what 0.44.7 regenerates — re-verified at 0.52.1, which is
 why the demo's fallback path and its fresh-run path show the same picture.
 
 ## The six beats
@@ -177,7 +177,7 @@ still says so. Run `chant carve apply` yourself in the copy and the card leaves
 the Terraform bands for the `app — chant` box, keeping its Terraform address,
 and the panel counts `carved so far — 1 of 12 carved`.
 
-`carve apply` is the one beat that has no button — not in the stepper, not on
+`carve apply` is the one beat that has no button: not in the stepper, not on
 the API. It resolves the marker that makes chant the owner of a live resource,
 which is a decision that stays with the person at the terminal. The Handoff
 step echoes the command beside the two `terraform` ones, for the same reason
@@ -188,13 +188,13 @@ and in the same shape.
 **Offline is the default.** The synthetic `terraform.tfstate` is committed, so
 `carve advise` and `carve emit --state` run with no Docker, no terraform binary,
 no AWS account and no network. The only dependency beyond this directory is
-`@cdktf/hcl2json`, which chant lazy-loads and names in its error if absent. This
+`@cdktn/hcl2json`, which chant lazy-loads and names in its error if absent. This
 tier guarantees the first thirty seconds of the video.
 
 **`--live` is the full video.** `behold demo carve --live` boots a scratch
 Floci (`behold-carve-floci`, its own port, deleted on exit), arms
 `legacy-tf/floci-override.tf.disabled` (see its header) into the demo copy, and
-`terraform apply -target`s the starred resources into it — so the tfstate the
+`terraform apply -target`s the starred resources into it, so the tfstate the
 advisor reads is one terraform really wrote. At Handoff the stepper gains a
 read-only **terraform plan** button: before `state rm` it shows a no-op, after
 it the carved bucket is simply gone from Terraform's world — `0 to destroy`.
@@ -204,7 +204,7 @@ never blinked."
 The observe beat is footage now, not caption: after Emit, "▶ watch chant read
 it live" runs `chant lifecycle diff prod --live` in the carveout with the
 endpoint pointed at the scratch Floci, and the bucket reads OBSERVED —
-`EXTERNAL`, ownership `foreign` — while Terraform still owns it. That is
+`EXTERNAL`, ownership `foreign`, while Terraform still owns it. That is
 chant#1647's physical-identity read path (chant ≥ 0.44.12): stack-absent no
 longer means confirmed-absent when the declared `BucketName` names the
 resource precisely.
@@ -223,7 +223,7 @@ grey band, so expect `-target` rather than one apply of the whole estate.
 and as of chant 0.44.7 (chant#1637, chant PR #1640) the emitted `Bucket`
 actually carries both: `VersioningConfiguration` and
 `PublicAccessBlockConfiguration` come out as native props, not an "unmapped
-Terraform attributes" comment. That used to be the rough edge here — a fold
+Terraform attributes" comment. That used to be the rough edge here, a fold
 that was reported but not applied, so `chant build` failed two AWS policy
 rules on source the advisor called clean. It is fixed now.
 
@@ -237,7 +237,7 @@ here would show up scanning the `.tf` by eye, because there is nothing to
 find — only an absence.
 
 Verified against chant 0.44.7. The walkthrough's Emit beat still shows `lint`,
-not `build` — the step's "why lint and not build?" note says why on screen —
+not `build`, the step's "why lint and not build?" note says why on screen —
 but the reason changed: `build` doesn't fail because the fold is incomplete
 anymore, it fails because the estate really does have a policy gap. "chant
 found a policy gap Terraform never noticed" is the honest line to close the