@intentius/behold 0.19.0 → 0.21.0

package/example-carve/app/package-lock.json

@@ -6,8 +6,8 @@
     "": {
       "name": "behold-example-carve-app",
       "dependencies": {
-        "@intentius/chant": "^0.54.0",
-        "@intentius/chant-lexicon-aws": "^0.54.0"
+        "@intentius/chant": "^0.95.0",
+        "@intentius/chant-lexicon-aws": "^0.95.0"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -442,14 +442,16 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.54.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.54.0.tgz",
-      "integrity": "sha512-ETYVPvDWqJiEsaaaYK+1U2lGrZZqHPU6/bOH797oQNw5gd7ESkEoYZxlh0qO90FQGVdx1pQMvmlCWskWD4xIlA==",
+      "version": "0.95.0",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.95.0.tgz",
+      "integrity": "sha512-zhReqEbP7apFyI9bwHATxSKPbc9HK8W2lJvZpib0YNEgSafydm+dd31Hn+7o3AcHhYbAkLpHFQwlFYbM2uVYCg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
+        "ajv": "^8.20.0",
         "esbuild": "^0.28.1",
         "fflate": "^0.8.2",
+        "js-yaml": "^4.3.1",
         "picomatch": "^4.0.3",
         "tsx": "^4.0.0",
         "typescript": "^5.5.0",
@@ -457,22 +459,46 @@
       },
       "bin": {
         "chant": "bin/chant"
+      },
+      "peerDependencies": {
+        "vitest": ">=2"
+      },
+      "peerDependenciesMeta": {
+        "vitest": {
+          "optional": true
+        }
       }
     },
     "node_modules/@intentius/chant-lexicon-aws": {
-      "version": "0.54.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.54.0.tgz",
-      "integrity": "sha512-HVyTEmOu73WJXpVpI9C/TyVo34Rbms9uKohb6sob5Y9Oa/T4yly9P5aqsuE6fMDyLwoLZmknW4v7qxENilrFLg==",
+      "version": "0.95.0",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.95.0.tgz",
+      "integrity": "sha512-DHW/cHL4JEU1foEvFK1i2/1Ur4O9meu4dpuyh1o+rnr8DJwW2Ktf7g+84nVDhTjcPVPGE1DROnnQlSuAlu4u8g==",
       "license": "Apache-2.0",
       "dependencies": {
         "fflate": "^0.8.2",
         "js-yaml": "^4.3.1"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.54.0",
+        "@intentius/chant": "^0.95.0",
         "typescript": "^5.9.3"
       }
     },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@@ -520,6 +546,28 @@
         "@esbuild/win32-x64": "0.28.2"
       }
     },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "license": "MIT"
+    },
+    "node_modules/fast-uri": {
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/fflate": {
       "version": "0.8.3",
       "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz",
@@ -562,6 +610,12 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
+    },
     "node_modules/picomatch": {
       "version": "4.0.5",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
@@ -574,6 +628,15 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/tsx": {
       "version": "4.23.12",
       "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.12.tgz",

package/example-carve/app/package.json

@@ -7,7 +7,7 @@
     "build": "./node_modules/.bin/chant build src --lexicon aws -o template.json"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.0",
-    "@intentius/chant-lexicon-aws": "^0.54.0"
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-lexicon-aws": "^0.95.0"
   }
 }

package/example-carve/legacy-tf/versions.tf

@@ -8,7 +8,7 @@
 # the account id in it is 000000000000, and every ARN is fake. Values are
 # boring-realistic on purpose: the walkthrough video pauses on the inspect pane.
 #
-# `chant carve advise` parses these files with @cdktf/hcl2json — no terraform
+# `chant carve advise` parses these files with @cdktn/hcl2json — no terraform
 # binary, no provider download, no network. See ../README.md for the scores this
 # estate is tuned to produce and why each one lands where it does.
 

package/example-choudoufu-estate/README.md

@@ -7,18 +7,18 @@ cache that is allowed to be stale, and an estate is split by retagging. The
 estates here are the live-mv workbench's own fixture (`examples/live-mv-workbench`
 in the choudoufu repo), copied:
 
-- **monolith/** — the terralith: three teams' IAM roles, policies, inline
+- **monolith/.** The terralith: three teams' IAM roles, policies, inline
   policies, attachments and log groups in one estate. `scripts/choudoufu-up.sh`
   applies it, so every one of its 21 resources is live and marked
   `tofu-estate = tlmig-sample-monolith`.
-- **team-a/**, **team-b/**, **team-c/** — the estates the teams would own.
+- **team-a/**, **team-b/**, **team-c/** are the estates the teams would own.
   Each declares its own seven resources, which are the monolith's: served
   live, every card reads *owned by tlmig-sample-monolith*, with a dashed
   edge to the monolith's card of the same address. team-a also declares a VPC
   the monolith does not, and team-b reads it through a data source filtered
-  on team-a's marker tags — the cross-estate reference `live-check -json`
+  on team-a's marker tags, the cross-estate reference `live-check -json`
   states, drawn as an edge between the two boxes.
-- **monolith/carve.json** — the plan: team-a's five taggable resources move to
+- **monolith/carve.json.** The plan: team-a's five taggable resources move to
   `tlmig-sample-team-a`. The scope panel shows each move with the
   `choudoufu live-mv` line to run and a link to the morph; behold never runs
   the write.

package/example-choudoufu-estate/chant.workspace.json

@@ -0,0 +1,32 @@
+{
+  "name": "example-choudoufu-estate",
+  "schema": 1,
+  "pins": [
+    {
+      "package": "@intentius/chant-lexicon-terraform",
+      "version": "0.95.0"
+    }
+  ],
+  "members": [
+    {
+      "name": "monolith",
+      "dir": "monolith",
+      "kind": "choudoufu"
+    },
+    {
+      "name": "team-a",
+      "dir": "team-a",
+      "kind": "choudoufu"
+    },
+    {
+      "name": "team-b",
+      "dir": "team-b",
+      "kind": "choudoufu"
+    },
+    {
+      "name": "team-c",
+      "dir": "team-c",
+      "kind": "choudoufu"
+    }
+  ]
+}

package/example-choudoufu-estate/scripts/choudoufu-up.sh

@@ -59,4 +59,25 @@ done
 echo "→ choudoufu apply in monolith (the terralith: 21 resources, three teams in one estate)"
 (cd monolith && "$CHOUDOUFU" apply -auto-approve -input=false -no-color | tail -1)
 
+# behold#415: the adoptable card's subject. team-a declares `aws_vpc.main` at
+# 10.77.0.0/16 and nothing applies that estate, so it has no marker and no
+# identity a configuration can reconstruct — EC2 assigns the `vpc-…` id. That
+# makes it NEEDS_DISCOVERY, and `aws_vpc` is in choudoufu's content-match table
+# keyed on `cidr_block`, so the estate-wide sweep can match it to a live VPC
+# carrying the same cidr and no marker.
+#
+# Created out of band on purpose: a VPC choudoufu applied would wear the estate
+# markers and read `bound`, which is the opposite of what this demonstrates.
+# `aws` is not a requirement of this demo, so a machine without it gets the
+# whole estate minus one card and is told which one.
+if command -v aws >/dev/null 2>&1; then
+  echo "→ seeding an unmarked VPC at 10.77.0.0/16 (the adoptable card — behold#415)"
+  AWS_ENDPOINT_URL="http://127.0.0.1:${PORT}" AWS_ACCESS_KEY_ID=test \
+  AWS_SECRET_ACCESS_KEY=test AWS_REGION=us-east-1 \
+    aws ec2 create-vpc --cidr-block 10.77.0.0/16 --query 'Vpc.VpcId' --output text >/dev/null 2>&1 \
+    || echo "  (floci refused the create — the adoptable card will not appear)"
+else
+  echo "→ no 'aws' on PATH, so the adoptable card is skipped; everything else stands up"
+fi
+
 echo "choudoufu-estate demo: up. behold serves it next; the plan in monolith/carve.json moves team-a's resources out."

package/example-flux-estate/README.md

@@ -2,20 +2,20 @@
 
 Three chant projects served as one composed estate:
 
-- **control-plane/** — the Flux machinery: a `GitRepository` pointing at
+- **control-plane/.** The Flux machinery: a `GitRepository` pointing at
   behold's own public repo and one `Kustomization` per app, app-b's gated on
   app-a's with `dependsOn` (behold#223). The reconcilers deploy the apps; this
   project never applies a workload itself.
-- **app-a/** — a small web workload with explicit `metadata.namespace` on
+- **app-a/.** A small web workload with explicit `metadata.namespace` on
   every object: the fully-resolved half.
-- **app-b/** — the same workload with **no** namespace anywhere: the control
+- **app-b/.** The same workload with **no** namespace anywhere: the control
   plane's `targetNamespace` stamps it at apply time. Idiomatic Flux, and the
   deliberate exhibit of the estate namespace join (behold#221). Served alone,
   app-b's live read scopes to `default`, finds nothing, and behold explains
   the all-pending paint with the namespace-mismatch note (behold#192) instead
   of letting it read as "not deployed". Served composed, the estate reads the
   binding off the control plane's own `Kustomization` and scopes app-b's read
-  to `app-b` — the answer neither project holds by itself.
+  to `app-b`, the answer neither project holds by itself.
 
 ```sh
 npx @intentius/behold demo flux-estate
@@ -28,7 +28,7 @@ this repo, and serves the three projects composed. What to look at:
 
 - The **estate**: per-project boundary boxes, the `sourceRef` edges wiring
   Kustomization → GitRepository across stacks, and the `dependsOn` edge from
-  app-b's Kustomization to app-a's — the estate's reconcile ordering.
+  app-b's Kustomization to app-a's, the estate's reconcile ordering.
 - The **overlay** (env `local`): app-a green, the control plane's CRs green,
   and app-b green too — read in the namespace the control plane binds it to,
   with a note naming where it looked. Serve `app-b` on its own to see the

package/example-flux-estate/app-a/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.0",
-    "@intentius/chant-lexicon-k8s": "^0.54.0"
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-lexicon-k8s": "^0.95.0"
   }
 }

package/example-flux-estate/app-b/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.0",
-    "@intentius/chant-lexicon-k8s": "^0.54.0"
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-lexicon-k8s": "^0.95.0"
   }
 }

package/example-flux-estate/chant.workspace.json

@@ -0,0 +1,27 @@
+{
+  "name": "example-flux-estate",
+  "schema": 1,
+  "pins": [
+    {
+      "package": "@intentius/chant",
+      "version": "0.95.0"
+    }
+  ],
+  "members": [
+    {
+      "name": "control-plane",
+      "dir": "control-plane",
+      "kind": "chant"
+    },
+    {
+      "name": "app-a",
+      "dir": "app-a",
+      "kind": "chant"
+    },
+    {
+      "name": "app-b",
+      "dir": "app-b",
+      "kind": "chant"
+    }
+  ]
+}

package/example-flux-estate/control-plane/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o dist/control-plane.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.0",
-    "@intentius/chant-lexicon-k8s": "^0.54.0"
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-lexicon-k8s": "^0.95.0"
   }
 }