@intentius/behold 0.2.2

package/dist/cli.js

@@ -0,0 +1,4830 @@
+// src/cli.ts
+import { resolve as resolve2 } from "node:path";
+import { realpathSync, existsSync as existsSync9 } from "node:fs";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// src/server.ts
+import { Hono } from "hono";
+
+// src/targets.ts
+var SUBSTRATE_TARGET_VARS = [
+  { lexicon: "aws", label: "Floci", envVar: "AWS_ENDPOINT_URL" },
+  { lexicon: "fly", label: "Fly", envVar: "FLY_FLAPS_BASE_URL" },
+  { lexicon: "azure", label: "floci-az", envVar: "AZURE_ENDPOINT_URL" },
+  { lexicon: "gcp", label: "floci-gcp", envVar: "GCP_ENDPOINT_URL" }
+];
+function resolveSubstrateTargets(lexicons, env = process.env) {
+  const targets = [];
+  for (const { lexicon, label, envVar } of SUBSTRATE_TARGET_VARS) {
+    if (!lexicons.includes(lexicon)) continue;
+    const endpoint = env[envVar];
+    if (!endpoint) continue;
+    targets.push({ name: lexicon, label, endpoint, envVar });
+  }
+  return targets;
+}
+function targetEnvOverrides(targets, chosen) {
+  const overrides = {};
+  for (const t of targets) {
+    overrides[t.envVar] = chosen ?? t.endpoint;
+  }
+  return overrides;
+}
+
+// src/k8s-target.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var run = promisify(execFile);
+var EMPTY = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function readKubeconfigJson(json) {
+  const contexts = /* @__PURE__ */ new Map();
+  for (const entry of json.contexts ?? []) {
+    const name = str(entry?.name);
+    const cluster = str(entry?.context?.cluster);
+    if (name && cluster) contexts.set(name, cluster);
+  }
+  const servers = /* @__PURE__ */ new Map();
+  for (const entry of json.clusters ?? []) {
+    const name = str(entry?.name);
+    const server = str(entry?.cluster?.server);
+    if (name && server) servers.set(name, server);
+  }
+  const current = str(json["current-context"]);
+  return { contexts, servers, ...current ? { currentContext: current } : {} };
+}
+async function loadKubeconfig(exec = defaultExec) {
+  try {
+    const stdout = await exec("kubectl", ["config", "view", "--raw", "-o", "json"]);
+    return readKubeconfigJson(JSON.parse(stdout));
+  } catch {
+    return EMPTY;
+  }
+}
+async function defaultExec(cmd, args) {
+  const { stdout } = await run(cmd, args, { encoding: "utf8", timeout: 1e4 });
+  return stdout;
+}
+function resolveK8sTarget(profiles, env, kubeconfig) {
+  const declared = env ? profiles?.[env]?.context : void 0;
+  const context = declared ?? kubeconfig.currentContext;
+  if (!context) return void 0;
+  const cluster = kubeconfig.contexts.get(context);
+  const endpoint = cluster ? kubeconfig.servers.get(cluster) : void 0;
+  if (!endpoint) return void 0;
+  return { name: "k8s", label: context, endpoint, source: declared ? "profile" : "current-context" };
+}
+function contextBindsCluster(context, clusterName) {
+  if (!clusterName) return void 0;
+  if (context === `k3d-${clusterName}`) return true;
+  return context.split(/[/_:@]/).includes(clusterName);
+}
+
+// src/server.ts
+import { streamSSE } from "hono/streaming";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { serve } from "@hono/node-server";
+import { fileURLToPath } from "node:url";
+import { execFile as execFile4 } from "node:child_process";
+import { promisify as promisify4 } from "node:util";
+import { existsSync as existsSync8 } from "node:fs";
+import { dirname as dirname2, join as join9, relative } from "node:path";
+
+// src/chant.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join as join2, resolve } from "node:path";
+
+// src/project.ts
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+var CONFIG_NAMES = ["chant.config.ts", "chant.config.mts", "chant.config.js", "chant.config.mjs"];
+var BEHOLD_CONFIG_NAME = ".behold.json";
+function configPath(projectDir) {
+  for (const name of CONFIG_NAMES) {
+    const p = join(projectDir, name);
+    if (existsSync(p)) return p;
+  }
+  return void 0;
+}
+function readStacks(v) {
+  if (!Array.isArray(v)) return void 0;
+  const stacks = v.filter(
+    (s) => !!s && typeof s === "object" && typeof s.name === "string" && typeof s.src === "string"
+  );
+  return stacks.length ? stacks : void 0;
+}
+function readK8sProfiles(k8s) {
+  const profiles = k8s?.profiles;
+  if (!profiles || typeof profiles !== "object" || Array.isArray(profiles)) return void 0;
+  const out = {};
+  for (const [env, value] of Object.entries(profiles)) {
+    const context = value?.context;
+    if (typeof context === "string" && context.length > 0) out[env] = { context };
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+function readInfo(cfg) {
+  const arr = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+  const envNames = (v) => Array.isArray(v) ? v.map((x) => typeof x === "string" ? x : typeof x?.name === "string" ? x.name : void 0).filter((x) => !!x) : [];
+  const stacks = readStacks(cfg?.stacks);
+  const k8sProfiles = readK8sProfiles(cfg?.k8s);
+  return {
+    environments: envNames(cfg?.environments),
+    lexicons: arr(cfg?.lexicons),
+    ...k8sProfiles ? { k8sProfiles } : {},
+    ...typeof cfg?.sourceDir === "string" ? { sourceDir: cfg.sourceDir } : {},
+    ...stacks ? { stacks } : {}
+  };
+}
+function parseStringArray(content, key) {
+  const arr = content.match(new RegExp(`\\b${key}\\s*:\\s*\\[([^\\]]*)\\]`));
+  if (!arr) return [];
+  return [...arr[1].matchAll(/["'`]([^"'`]+)["'`]/g)].map((m) => m[1]);
+}
+function parseEnvironmentNames(content) {
+  const arr = content.match(/\benvironments\s*:\s*\[([^\]]*)\]/);
+  if (!arr) return [];
+  const body = arr[1];
+  if (body.includes("{")) {
+    return [...body.matchAll(/\bname\s*:\s*["'`]([^"'`]+)["'`]/g)].map((m) => m[1]);
+  }
+  return [...body.matchAll(/["'`]([^"'`]+)["'`]/g)].map((m) => m[1]);
+}
+function parseStringLiteral(content, key) {
+  const m = content.match(new RegExp(`\\b${key}\\s*:\\s*["'\`]([^"'\`]+)["'\`]`));
+  return m?.[1];
+}
+async function detectProject(projectDir) {
+  const path = configPath(projectDir);
+  if (!path) return { environments: [], lexicons: [] };
+  try {
+    const mod = await import(pathToFileURL(path).href);
+    const cfg = mod.default ?? mod.config ?? mod;
+    const info = readInfo(cfg);
+    if (info.environments.length || info.lexicons.length || info.sourceDir || info.stacks?.length) return info;
+  } catch {
+  }
+  const content = readFileSync(path, "utf8");
+  const sourceDir = parseStringLiteral(content, "sourceDir");
+  return {
+    environments: parseEnvironmentNames(content),
+    lexicons: parseStringArray(content, "lexicons"),
+    ...sourceDir ? { sourceDir } : {}
+  };
+}
+function readTiers(cfg) {
+  const tiers = cfg?.tiers;
+  if (!tiers || typeof tiers.envVar !== "string" || !tiers.envVar) return void 0;
+  const values = Array.isArray(tiers.values) ? tiers.values.filter((v) => typeof v === "string") : [];
+  if (!values.length) return void 0;
+  return { envVar: tiers.envVar, values };
+}
+function loadBeholdConfig(projectDir) {
+  const path = join(projectDir, BEHOLD_CONFIG_NAME);
+  if (!existsSync(path)) return {};
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    const tiers = readTiers(raw);
+    return tiers ? { tiers } : {};
+  } catch {
+    return {};
+  }
+}
+
+// node_modules/@intentius/chant/src/yaml.ts
+function parseYAML(content) {
+  try {
+    return JSON.parse(content);
+  } catch {
+  }
+  const lines = content.replace(/\r\n?/g, "\n").split("\n");
+  return parseYAMLLines(lines, 0, 0).value;
+}
+function blockScalarHeader(inline) {
+  const m = inline.match(/^([|>])([+-]?)(?:\s+#.*)?$/);
+  if (!m) return null;
+  return {
+    style: m[1] === "|" ? "literal" : "folded",
+    chomp: m[2] === "-" ? "strip" : m[2] === "+" ? "keep" : "clip"
+  };
+}
+function parseBlockScalar(lines, startIndex, parentIndent, header) {
+  const raw = [];
+  let blockIndent = -1;
+  let i = startIndex;
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === "") {
+      raw.push("");
+      continue;
+    }
+    const ni = line.search(/\S/);
+    if (ni <= parentIndent) break;
+    if (blockIndent === -1) blockIndent = ni;
+    if (ni < blockIndent) break;
+    raw.push(line.slice(blockIndent));
+  }
+  let text;
+  if (header.style === "folded") {
+    text = "";
+    let buf = [];
+    let blankRun = 0;
+    let wrote = false;
+    const flush = () => {
+      if (buf.length === 0) return;
+      if (wrote) text += "\n".repeat(blankRun);
+      text += buf.join(" ");
+      buf = [];
+      blankRun = 0;
+      wrote = true;
+    };
+    for (const l of raw) {
+      if (l === "") {
+        flush();
+        blankRun++;
+      } else buf.push(l);
+    }
+    flush();
+  } else {
+    text = raw.join("\n");
+  }
+  const trailing = text.match(/\n*$/)?.[0].length ?? 0;
+  const stripped = text.replace(/\n+$/, "");
+  if (header.chomp === "strip") text = stripped;
+  else if (header.chomp === "keep") text = stripped + "\n".repeat(Math.max(trailing, raw.length > 0 ? 1 : 0));
+  else text = stripped === "" ? "" : stripped + "\n";
+  return { value: text, endIndex: i };
+}
+function parseYAMLLines(lines, startIndex, baseIndent) {
+  const result = {};
+  let i = startIndex;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (line.trim() === "" || line.trim().startsWith("#")) {
+      i++;
+      continue;
+    }
+    const indent = line.search(/\S/);
+    if (indent < baseIndent) break;
+    if (indent > baseIndent && startIndex > 0) break;
+    const keyMatch = line.match(/^(\s*)([^\s:][^:]*?):\s*(.*)$/);
+    if (keyMatch) {
+      const key = keyMatch[2].trim();
+      const inlineValue = keyMatch[3].trim();
+      if (inlineValue === "" || inlineValue.startsWith("#")) {
+        if (i + 1 < lines.length) {
+          const nextLine = lines[i + 1];
+          const nextIndent = nextLine.search(/\S/);
+          if (nextLine.trimStart().startsWith("- ") && nextIndent >= indent) {
+            const arr = parseYAMLArray(lines, i + 1, nextIndent);
+            result[key] = arr.value;
+            i = arr.endIndex;
+            continue;
+          } else if (nextIndent > indent) {
+            const nested = parseYAMLLines(lines, i + 1, nextIndent);
+            result[key] = nested.value;
+            i = nested.endIndex;
+            continue;
+          }
+        }
+        result[key] = null;
+        i++;
+      } else if (inlineValue.startsWith("[")) {
+        try {
+          result[key] = JSON.parse(inlineValue);
+        } catch {
+          result[key] = inlineValue;
+        }
+        i++;
+      } else if (inlineValue.startsWith("{")) {
+        try {
+          result[key] = JSON.parse(inlineValue);
+        } catch {
+          result[key] = inlineValue;
+        }
+        i++;
+      } else {
+        const header = blockScalarHeader(inlineValue);
+        if (header) {
+          const block = parseBlockScalar(lines, i + 1, indent, header);
+          result[key] = block.value;
+          i = block.endIndex;
+        } else {
+          result[key] = parseScalar(inlineValue);
+          i++;
+        }
+      }
+    } else if (line.trimStart().startsWith("- ")) {
+      break;
+    } else {
+      i++;
+    }
+  }
+  return { value: result, endIndex: i };
+}
+function parseArrayItemValue(inlineValue, lines, currentIndex, keyIndent) {
+  if (inlineValue !== "" && !inlineValue.startsWith("#")) {
+    const header = blockScalarHeader(inlineValue);
+    if (header) {
+      const dash = lines[currentIndex].match(/^(\s*)- /);
+      const keyIndent2 = dash ? dash[1].length + 2 : lines[currentIndex].search(/\S/);
+      return parseBlockScalar(lines, currentIndex + 1, keyIndent2, header).value;
+    }
+    if (inlineValue.startsWith("[")) {
+      try {
+        return JSON.parse(inlineValue);
+      } catch {
+        return inlineValue;
+      }
+    }
+    if (inlineValue.startsWith("{")) {
+      try {
+        return JSON.parse(inlineValue);
+      } catch {
+        return inlineValue;
+      }
+    }
+    return parseScalar(inlineValue);
+  }
+  const nextIdx = currentIndex + 1;
+  if (nextIdx < lines.length) {
+    const nextLine = lines[nextIdx];
+    if (nextLine.trim() !== "" && !nextLine.trim().startsWith("#")) {
+      const ni = nextLine.search(/\S/);
+      if (nextLine.trimStart().startsWith("- ")) {
+        if (ni >= keyIndent) return parseYAMLArray(lines, nextIdx, ni).value;
+      } else if (ni > keyIndent) {
+        return parseYAMLLines(lines, nextIdx, ni).value;
+      }
+    }
+  }
+  return null;
+}
+function skipValueBlock(lines, startIndex, keyIndent) {
+  let k = startIndex;
+  while (k < lines.length && (lines[k].trim() === "" || lines[k].trim().startsWith("#"))) k++;
+  if (k < lines.length) {
+    const ni = lines[k].search(/\S/);
+    if (ni >= keyIndent && lines[k].trimStart().startsWith("- ")) {
+      return parseYAMLArray(lines, k, ni).endIndex;
+    }
+  }
+  return skipNestedBlock(lines, startIndex, keyIndent + 1);
+}
+function skipNestedBlock(lines, startIndex, childIndent) {
+  let j = startIndex;
+  while (j < lines.length) {
+    const l = lines[j];
+    if (l.trim() === "" || l.trim().startsWith("#")) {
+      j++;
+      continue;
+    }
+    const ni = l.search(/\S/);
+    if (ni < childIndent) break;
+    j++;
+  }
+  return j;
+}
+function parseYAMLArray(lines, startIndex, baseIndent) {
+  const result = [];
+  let i = startIndex;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (line.trim() === "" || line.trim().startsWith("#")) {
+      i++;
+      continue;
+    }
+    const indent = line.search(/\S/);
+    if (indent < baseIndent) break;
+    const itemMatch = line.match(/^(\s*)- (.*)$/);
+    if (itemMatch && indent === baseIndent) {
+      const itemValue = itemMatch[2].trim();
+      const isQuotedScalar = itemValue.startsWith('"') && itemValue.endsWith('"') || itemValue.startsWith("'") && itemValue.endsWith("'");
+      const kvMatch = !isQuotedScalar && itemValue.match(/^([^\s:][^:]*?):\s*(.*)$/);
+      if (kvMatch) {
+        const obj = {};
+        obj[kvMatch[1].trim()] = parseArrayItemValue(kvMatch[2].trim(), lines, i, indent + 2);
+        const nextIndent = indent + 2;
+        const firstVal = kvMatch[2].trim();
+        let j = firstVal === "" || firstVal.startsWith("#") ? skipValueBlock(lines, i + 1, nextIndent) : blockScalarHeader(firstVal) ? skipNestedBlock(lines, i + 1, nextIndent + 1) : i + 1;
+        while (j < lines.length) {
+          const nextLine = lines[j];
+          if (nextLine.trim() === "" || nextLine.trim().startsWith("#")) {
+            j++;
+            continue;
+          }
+          const ni = nextLine.search(/\S/);
+          if (ni < nextIndent) break;
+          if (ni > nextIndent) break;
+          const nextKV = nextLine.match(/^(\s*)([^\s:][^:]*?):\s*(.*)$/);
+          if (nextKV) {
+            const nextVal = nextKV[3].trim();
+            obj[nextKV[2].trim()] = parseArrayItemValue(nextVal, lines, j, ni);
+            if (nextVal === "" || nextVal.startsWith("#")) {
+              j = skipValueBlock(lines, j + 1, ni);
+            } else if (blockScalarHeader(nextVal)) {
+              j = skipNestedBlock(lines, j + 1, ni + 1);
+            } else {
+              j++;
+            }
+          } else {
+            break;
+          }
+        }
+        result.push(obj);
+        i = j;
+      } else {
+        result.push(parseScalar(itemValue));
+        i++;
+      }
+    } else {
+      break;
+    }
+  }
+  return { value: result, endIndex: i };
+}
+function parseScalar(value) {
+  if (value === "" || value === "~" || value === "null") return null;
+  if (value === "true" || value === "yes") return true;
+  if (value === "false" || value === "no") return false;
+  if (value.startsWith("'") && value.endsWith("'") || value.startsWith('"') && value.endsWith('"')) {
+    return value.slice(1, -1);
+  }
+  const num = Number(value);
+  if (!isNaN(num) && value !== "") return num;
+  return value;
+}
+
+// src/chant.ts
+function envOverridesFor(opts) {
+  const overrides = {};
+  if (opts.tier && opts.tierEnvVar) overrides[opts.tierEnvVar] = opts.tier;
+  if (opts.substrateTargets?.length) {
+    Object.assign(overrides, targetEnvOverrides(opts.substrateTargets, opts.target));
+  } else if (opts.target) {
+    overrides.AWS_ENDPOINT_URL = opts.target;
+  }
+  return Object.keys(overrides).length ? overrides : void 0;
+}
+function graphFlags(opts) {
+  const flags = [];
+  if (opts.detail !== void 0) flags.push("--detail", String(opts.detail));
+  if (opts.lens) flags.push("--lens", opts.lens);
+  if (opts.up) flags.push("--up");
+  if (opts.down) flags.push("--down");
+  if (opts.env) flags.push("--env", opts.env);
+  if (opts.live) flags.push("--live");
+  if (opts.overlay) flags.push("--overlay");
+  return flags;
+}
+function chantBinFrom(req) {
+  let entry;
+  try {
+    entry = req.resolve("@intentius/chant");
+  } catch {
+    return void 0;
+  }
+  let dir = dirname(entry);
+  for (; ; ) {
+    const manifest = join2(dir, "package.json");
+    try {
+      const pkg = createRequire(import.meta.url)(manifest);
+      if (pkg.name === "@intentius/chant") return join2(dir, pkg.bin?.chant ?? "bin/chant");
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
+}
+function chantBin(projectDir) {
+  if (projectDir) {
+    const fromProject = chantBinFrom(createRequire(join2(resolve(projectDir), "noop.js")));
+    if (fromProject) return fromProject;
+  }
+  const own = chantBinFrom(createRequire(import.meta.url));
+  if (own) return own;
+  return "chant";
+}
+function runChantRaw(args, projectDir, envOverride) {
+  return new Promise((resolvePromise, reject) => {
+    const proc = spawn(chantBin(projectDir), args, {
+      ...projectDir ? { cwd: projectDir } : {},
+      ...envOverride ? { env: { ...process.env, ...envOverride } } : {},
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const outChunks = [];
+    const errChunks = [];
+    proc.stdout.on("data", (d) => outChunks.push(d));
+    proc.stderr.on("data", (d) => errChunks.push(d));
+    proc.on("error", reject);
+    proc.on(
+      "close",
+      (code) => resolvePromise({
+        code: code ?? 1,
+        stdout: Buffer.concat(outChunks).toString("utf8"),
+        stderr: Buffer.concat(errChunks).toString("utf8")
+      })
+    );
+  });
+}
+var ANSI_RE = /\x1b\[[0-9;]*m/g;
+function stripAnsi(text) {
+  return text.replace(ANSI_RE, "");
+}
+function classifyChantFailure(stderr) {
+  const clean = stripAnsi(stderr).trim();
+  if (/refusing to emit graph: source has lint errors/i.test(clean)) {
+    return {
+      code: "lint",
+      message: clean || "chant refused to emit the graph: the project has lint errors.",
+      remedy: "Run `chant lint` in the project to see the errors, fix them, then reload."
+    };
+  }
+  if (/cannot find (package|module)\s+['"]/i.test(clean)) {
+    return {
+      code: "not-installed",
+      message: clean || "chant could not resolve a package the project's source imports.",
+      remedy: "Run `npm install && chant typegen` in the project directory, then reload."
+    };
+  }
+  return {
+    code: "eval",
+    message: clean || "chant failed to evaluate the project.",
+    remedy: "Check the project's chant source and environment \u2014 see the message above for chant's own error."
+  };
+}
+var ChantCliError = class extends Error {
+  failure;
+  constructor(args, code, stderr) {
+    super(`chant ${args.join(" ")} exited ${code}: ${stderr.trim()}`);
+    this.name = "ChantCliError";
+    this.failure = classifyChantFailure(stderr);
+  }
+};
+async function runChantJson(args, projectDir, envOverride) {
+  const { code, stdout, stderr } = await runChantRaw(args, projectDir, envOverride);
+  if (code !== 0) throw new ChantCliError(args, code, stderr);
+  return JSON.parse(stdout);
+}
+function runChantStream(args, projectDir, onLine) {
+  const proc = spawn(chantBin(projectDir), args, { cwd: projectDir, stdio: ["ignore", "pipe", "pipe"] });
+  const feed = (buf) => {
+    for (const line of String(buf).split(/\r?\n/)) if (line.trim()) onLine(line);
+  };
+  proc.stdout.on("data", feed);
+  proc.stderr.on("data", feed);
+  const done = new Promise((res) => proc.on("close", (c) => res(c ?? 1)));
+  return { pid: proc.pid ?? -1, kill: () => proc.kill(), done };
+}
+function runCommandStream(cmd, args, cwd, onLine) {
+  const proc = spawn(cmd, args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+  const feed = (buf) => {
+    for (const line of String(buf).split(/\r?\n/)) if (line.trim()) onLine(line);
+  };
+  proc.stdout.on("data", feed);
+  proc.stderr.on("data", feed);
+  const done = new Promise((res) => {
+    proc.on("error", () => res(127));
+    proc.on("close", (c) => res(c ?? 1));
+  });
+  return { pid: proc.pid ?? -1, kill: () => proc.kill(), done };
+}
+function legacyGraphPath(projectDir) {
+  const src = join2(projectDir, "src");
+  return existsSync2(src) ? src : projectDir;
+}
+async function graphPath(projectDir, opts = {}) {
+  let info;
+  try {
+    info = await detectProject(projectDir);
+  } catch {
+    return legacyGraphPath(projectDir);
+  }
+  if (info.stacks?.length) {
+    const picked = opts.stack ? info.stacks.find((s) => s.name === opts.stack) : void 0;
+    return resolve(projectDir, (picked ?? info.stacks[0]).src);
+  }
+  if (info.sourceDir) return resolve(projectDir, info.sourceDir);
+  return legacyGraphPath(projectDir);
+}
+function graphArgs(src, format, opts, components) {
+  return ["graph", src, ...components ? ["--components"] : [], "--format", format, ...graphFlags(opts)];
+}
+async function graphIr(projectDir, opts = {}) {
+  const src = await graphPath(projectDir, opts);
+  return runChantJson(graphArgs(src, "ir", opts, false), projectDir, envOverridesFor(opts));
+}
+async function clusterRootGraphIr(projectDir, opts = {}) {
+  if (!existsSync2(join2(projectDir, "cluster"))) return void 0;
+  const { live: _live, overlay: _overlay, env: _env, ...sourceOnly } = opts;
+  try {
+    return await runChantJson(graphArgs("cluster", "ir", sourceOnly, false), projectDir, envOverridesFor(sourceOnly));
+  } catch {
+    return void 0;
+  }
+}
+async function componentGraphIr(projectDir, opts = {}) {
+  const src = await graphPath(projectDir, opts);
+  return runChantJson(graphArgs(src, "ir", opts, true), projectDir, envOverridesFor(opts));
+}
+function componentStatusArgs(env) {
+  return ["components", "status", env, "--live", "--json"];
+}
+function componentStatus(projectDir, env, opts = {}) {
+  return runChantJson(componentStatusArgs(env), projectDir, envOverridesFor(opts));
+}
+var CI_FORGES = ["gitlab", "github", "forgejo"];
+function ciForgeFor(lexicons) {
+  return CI_FORGES.find((forge) => lexicons.includes(forge));
+}
+function ciPipelineArgs(opts = {}, forge = "gitlab") {
+  const args = ["build", "--components", "--generate", forge, "--format", "json"];
+  if (opts.env) args.push("--env", opts.env);
+  return args;
+}
+function parseCiPipeline(stdout) {
+  const parsed = JSON.parse(stdout);
+  const doc = parseYAML(parsed.yaml);
+  const jobs = parsed.jobs.map((j) => {
+    const props = doc[j.jobName];
+    const script = Array.isArray(props?.script) ? props.script.map(String) : [];
+    return { ...j, script };
+  });
+  return { stages: parsed.stages, jobs };
+}
+function ciPipeline(projectDir, opts = {}, forge = "gitlab") {
+  const args = ciPipelineArgs(opts, forge);
+  return runChantRaw(args, projectDir, envOverridesFor(opts)).then(({ code, stdout, stderr }) => {
+    if (code !== 0) throw new ChantCliError(args, code, stderr);
+    return parseCiPipeline(stdout);
+  });
+}
+function lifecyclePlanArgs(env) {
+  return ["lifecycle", "plan", env, "--live", "--json"];
+}
+function lifecyclePlan(projectDir, env, opts = {}) {
+  return runChantJson(lifecyclePlanArgs(env), projectDir, envOverridesFor(opts));
+}
+function lifecycleDiffArgs(env) {
+  return ["lifecycle", "diff", env, "--live", "--json"];
+}
+function lifecycleDiffLive(projectDir, env, opts = {}) {
+  return runChantJson(lifecycleDiffArgs(env), projectDir, envOverridesFor(opts));
+}
+function applyArgs(target, env) {
+  return ["run", target, "--components", "--env", env, "--progress-json"];
+}
+
+// src/cluster-root.ts
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var run2 = promisify2(execFile2);
+async function runningK3dClusters(exec = defaultExec2) {
+  try {
+    const out = await exec("k3d", ["cluster", "list", "--no-headers"]);
+    const clusters = /* @__PURE__ */ new Map();
+    for (const line of out.split(/\r?\n/)) {
+      const cols = line.trim().split(/\s+/);
+      if (!cols[0]) continue;
+      const servers = cols[1] ?? "";
+      const m = /^(\d+)\/(\d+)$/.exec(servers);
+      clusters.set(cols[0], m ? Number(m[1]) > 0 : true);
+    }
+    return clusters;
+  } catch {
+    return void 0;
+  }
+}
+async function defaultExec2(cmd, args) {
+  const { stdout } = await run2(cmd, args, { encoding: "utf8", timeout: 1e4 });
+  return stdout;
+}
+function k3dClusterName(node) {
+  const meta = node.attrs?.metadata;
+  const name = meta?.name;
+  return typeof name === "string" && name.length > 0 ? name : node.id;
+}
+function mergeClusterRoot(ir, clusterIr, running) {
+  if (!clusterIr) return ir;
+  const have = new Set(ir.nodes.map((n) => n.id));
+  for (const node of clusterIr.nodes) {
+    if (have.has(node.id)) continue;
+    if (node.kind === "K3d::Cluster" && running !== void 0) {
+      const attrs = node.attrs ??= {};
+      const up = running.get(k3dClusterName(node));
+      attrs._status = up ? "good" : "accent";
+    }
+    ir.nodes.push(node);
+    have.add(node.id);
+  }
+  const haveEdges = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
+  for (const edge of clusterIr.edges) {
+    const key = `${edge.from}\0${edge.to}`;
+    if (haveEdges.has(key)) continue;
+    haveEdges.add(key);
+    ir.edges.push(edge);
+  }
+  return ir;
+}
+
+// src/helm-releases.ts
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
+import { join as join3 } from "node:path";
+var RELEASE_KEY = /^release\/([^/]+)\/(.+)$/;
+function declaredChartNames(ir) {
+  const names = /* @__PURE__ */ new Set();
+  for (const n of ir.nodes) {
+    if (n.lexicon !== "helm" || n.kind !== "Helm::Chart") continue;
+    const name = n.attrs?.name;
+    if (typeof name === "string" && name.length > 0) names.add(name);
+  }
+  return names;
+}
+function matchesDeclaredChart(chart, declared) {
+  if (typeof chart !== "string" || chart.length === 0) return false;
+  for (const name of declared) {
+    if (chart === name || chart.startsWith(`${name}-`)) return true;
+  }
+  return false;
+}
+function discoverReleaseUnits(projectDir) {
+  const owners = /* @__PURE__ */ new Map();
+  const roots = [join3(projectDir, "src"), join3(projectDir, "ops")];
+  const files = [];
+  const walk = (dir, depth) => {
+    if (depth > 4 || !existsSync3(dir)) return;
+    for (const f of readdirSync(dir)) {
+      const p = join3(dir, f);
+      let s;
+      try {
+        s = statSync(p);
+      } catch {
+        continue;
+      }
+      if (s.isDirectory()) walk(p, depth + 1);
+      else if (f.endsWith(".component.ts")) files.push(p);
+    }
+  };
+  for (const root of roots) walk(root, 0);
+  for (const file of files) {
+    let content;
+    try {
+      content = readFileSync2(file, "utf8");
+    } catch {
+      continue;
+    }
+    const component = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
+    if (!component) continue;
+    for (const m of content.matchAll(/helmUpgrade\(\s*\{[^}]*?\brelease:\s*["'`]([^"'`]+)["'`]/gs)) {
+      if (!owners.has(m[1])) owners.set(m[1], component);
+    }
+  }
+  return owners;
+}
+function synthesizeHelmReleases(ir, observed, owners) {
+  if (!observed) return 0;
+  const declared = declaredChartNames(ir);
+  const have = new Set(ir.nodes.map((n) => n.id));
+  let added = 0;
+  for (const [key, o] of Object.entries(observed)) {
+    const m = RELEASE_KEY.exec(key);
+    if (!m || have.has(key)) continue;
+    const [, namespace, name] = m;
+    if (matchesDeclaredChart(o.attributes?.chart, declared)) continue;
+    const component = owners.get(name);
+    const deployed = o.status === "deployed";
+    const node = {
+      id: key,
+      kind: "Helm::Release",
+      lexicon: "helm",
+      attrs: {
+        name,
+        namespace,
+        ...typeof o.attributes?.chart === "string" ? { chart: o.attributes.chart } : {},
+        ...typeof o.attributes?.revision === "string" ? { revision: o.attributes.revision } : {},
+        ...component ? { component } : {},
+        _status: deployed && component ? "good" : "warn",
+        _artifact: {
+          release: `${namespace}/${name}`,
+          ...o.status ? { status: o.status } : {},
+          ...typeof o.attributes?.revision === "string" ? { revision: o.attributes.revision } : {},
+          ...typeof o.attributes?.chart === "string" ? { chart: o.attributes.chart } : {}
+        },
+        ...component ? {} : { _foreignRelease: true }
+      }
+    };
+    ir.nodes.push(node);
+    have.add(key);
+    added++;
+  }
+  return added;
+}
+
+// src/gh-run.ts
+import { spawn as spawn2 } from "node:child_process";
+import { readdirSync as readdirSync2, readFileSync as readFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
+
+// src/ci-run.ts
+function pipelineProgress(pipeline) {
+  const stageIndex = new Map(pipeline.stages.map((s, i) => [s, i + 1]));
+  const components = pipeline.jobs.map((j) => ({
+    component: j.jobName,
+    wave: stageIndex.get(j.stage) ?? 0,
+    status: "pending",
+    phase: j.component
+  }));
+  const waves = pipeline.stages.map((stage, i) => ({
+    wave: i + 1,
+    components: pipeline.jobs.filter((j) => j.stage === stage).map((j) => j.jobName),
+    status: "pending"
+  }));
+  return { kind: "pipeline", status: "running", waves, components };
+}
+function withJobStatus(state, job, status) {
+  const components = state.components.map((c) => {
+    if (c.component !== job) return c;
+    if ((c.status === "ok" || c.status === "failed") && status === "running") return c;
+    return { ...c, status };
+  });
+  const waves = state.waves.map((w) => {
+    const members = components.filter((c) => w.components.includes(c.component));
+    const status2 = members.some((c) => c.status === "failed") ? "failed" : members.every((c) => c.status === "ok") ? "ok" : members.some((c) => c.status !== "pending") ? "running" : "pending";
+    return { ...w, status: status2 };
+  });
+  return { ...state, components, waves };
+}
+function foldPipelineLine(state, line) {
+  let out = state;
+  for (const c of state.components) {
+    const job = c.component;
+    const escaped = job.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const mentioned = new RegExp(`(^|[^\\w-])${escaped}($|[^\\w-])`).test(line);
+    if (!mentioned) continue;
+    if (/\b(FAIL(?:ED)?|ERROR)\b|✘|✗/i.test(line)) out = withJobStatus(out, job, "failed");
+    else if (/\b(PASS(?:ED)?|OK|SUCCESS(?:FUL)?)\b|✔|✓/i.test(line)) out = withJobStatus(out, job, "ok");
+    else if (c.status === "pending") out = withJobStatus(out, job, "running");
+  }
+  return out;
+}
+function finishPipelineProgress(state, exitCode) {
+  const terminal = exitCode === 0 ? "ok" : "failed";
+  let out = state;
+  for (const c of state.components) {
+    if (c.status === "pending" || c.status === "running") out = withJobStatus(out, c.component, terminal);
+  }
+  return { ...out, status: exitCode === 0 ? "ok" : "failed" };
+}
+
+// src/gh-run.ts
+var defaultGhExec = (args) => new Promise((resolve3) => {
+  let out = "";
+  let proc;
+  try {
+    proc = spawn2("gh", args, { stdio: ["ignore", "pipe", "pipe"] });
+  } catch {
+    resolve3({ code: 127, out: "" });
+    return;
+  }
+  proc.stdout.on("data", (d) => out += d);
+  proc.stderr.on("data", (d) => out += d);
+  proc.on("error", () => resolve3({ code: 127, out }));
+  proc.on("close", (code) => resolve3({ code: code ?? 1, out }));
+});
+async function ghReady(exec = defaultGhExec) {
+  const { code, out } = await exec(["auth", "status"]);
+  if (code === 127) return { ok: false, reason: "gh not installed \u2014 the trigger runs through YOUR gh login" };
+  if (code !== 0) return { ok: false, reason: `gh not authenticated \u2014 run \`gh auth login\` (${out.trim().split("\n")[0] ?? ""})` };
+  return { ok: true };
+}
+function parseWorkflow(file, text) {
+  let doc;
+  try {
+    doc = parseYAML(text);
+  } catch {
+    return { file, jobIds: [], dispatchable: false };
+  }
+  const d = doc ?? {};
+  const jobs = d.jobs && typeof d.jobs === "object" && !Array.isArray(d.jobs) ? Object.keys(d.jobs) : [];
+  const on = d.on ?? d[true];
+  const dispatchable = on === "workflow_dispatch" || Array.isArray(on) && on.includes("workflow_dispatch") || !!on && typeof on === "object" && "workflow_dispatch" in on || /^\s{2,}workflow_dispatch\s*:?\s*$/m.test(text);
+  return { file, jobIds: jobs, dispatchable };
+}
+function pickWorkflow(projectDir, pipeline) {
+  const dir = join4(projectDir, ".github", "workflows");
+  let files;
+  try {
+    files = readdirSync2(dir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
+  } catch {
+    return void 0;
+  }
+  const wanted = new Set(pipeline.jobs.map((j) => j.jobName));
+  let best;
+  for (const f of files) {
+    let text;
+    try {
+      text = readFileSync3(join4(dir, f), "utf8");
+    } catch {
+      continue;
+    }
+    const info = parseWorkflow(f, text);
+    if (!info.dispatchable) continue;
+    const overlap = info.jobIds.filter((id) => wanted.has(id)).length;
+    if (overlap > 0 && (!best || overlap > best.overlap)) best = { info, overlap };
+  }
+  return best?.info;
+}
+async function latestRunId(workflowFile, exec = defaultGhExec) {
+  const { code, out } = await exec(["run", "list", "--workflow", workflowFile, "--limit", "1", "--json", "databaseId"]);
+  if (code !== 0) return void 0;
+  try {
+    const rows = JSON.parse(out);
+    return typeof rows[0]?.databaseId === "number" ? rows[0].databaseId : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function ghJobStatus(job) {
+  if (job.status !== "completed") return job.status === "queued" || job.status === void 0 ? "pending" : "running";
+  return job.conclusion === "success" ? "ok" : "failed";
+}
+function runViewToProgress(pipeline, view) {
+  let state = pipelineProgress(pipeline);
+  const byName = new Map((view.jobs ?? []).map((j) => [j.name, j]));
+  state = {
+    ...state,
+    components: state.components.map((c) => {
+      const job = byName.get(c.component);
+      return job ? { ...c, status: ghJobStatus(job) } : c;
+    })
+  };
+  state = {
+    ...state,
+    waves: state.waves.map((w) => {
+      const members = state.components.filter((c) => w.components.includes(c.component));
+      const status = members.some((c) => c.status === "failed") ? "failed" : members.every((c) => c.status === "ok") ? "ok" : members.some((c) => c.status !== "pending") ? "running" : "pending";
+      return { ...w, status };
+    })
+  };
+  if (view.status === "completed") {
+    return { ...state, status: view.conclusion === "success" ? "ok" : "failed" };
+  }
+  return state;
+}
+async function dispatchAndFollow(workflow, pipeline, ref, deps) {
+  const exec = deps.exec ?? defaultGhExec;
+  const pollMs = deps.pollMs ?? 5e3;
+  const appearTimeoutMs = deps.appearTimeoutMs ?? 6e4;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const watermark = await latestRunId(workflow.file, exec);
+  deps.onLine(`\u25B6 gh workflow run ${workflow.file} --ref ${ref}`);
+  const dispatched = await exec(["workflow", "run", workflow.file, "--ref", ref]);
+  if (dispatched.code !== 0) {
+    deps.onLine(`\u2717 dispatch failed: ${dispatched.out.trim().split("\n")[0] ?? `exit ${dispatched.code}`}`);
+    return dispatched.code || 1;
+  }
+  deps.onProgress(pipelineProgress(pipeline));
+  let runId;
+  const deadline = Date.now() + appearTimeoutMs;
+  while (Date.now() < deadline) {
+    await sleep(Math.min(pollMs, 3e3));
+    const id = await latestRunId(workflow.file, exec);
+    if (id !== void 0 && id !== watermark) {
+      runId = id;
+      break;
+    }
+  }
+  if (runId === void 0) {
+    deps.onLine("\u2717 dispatched, but the run never appeared in `gh run list` \u2014 check the Actions tab");
+    return 1;
+  }
+  deps.onLine(`\u25CF run ${runId} started \u2014 following`);
+  for (; ; ) {
+    const { code, out } = await exec(["run", "view", String(runId), "--json", "status,conclusion,jobs"]);
+    if (code === 0) {
+      let view;
+      try {
+        view = JSON.parse(out);
+      } catch {
+        view = void 0;
+      }
+      if (view) {
+        deps.onProgress(runViewToProgress(pipeline, view));
+        if (view.status === "completed") {
+          deps.onLine(`\u25A0 run ${runId} ${view.conclusion ?? "completed"}`);
+          return view.conclusion === "success" ? 0 : 1;
+        }
+      }
+    } else {
+      deps.onLine(`\u26A0 gh run view ${runId} failed (exit ${code}) \u2014 retrying`);
+    }
+    await sleep(pollMs);
+  }
+}
+function joinCiProgress(ir, state) {
+  if (!state || state.kind !== "pipeline" || !state.components?.length) return ir;
+  const byComponent = /* @__PURE__ */ new Map();
+  for (const entry of state.components) {
+    if (!entry.phase) continue;
+    const current = byComponent.get(entry.phase);
+    if (!current || entry.status === "failed" || entry.status === "running" && current.status === "ok") {
+      byComponent.set(entry.phase, { job: entry.component, status: entry.status });
+    }
+  }
+  for (const n of ir.nodes) {
+    if (n.kind !== "Component") continue;
+    const run4 = byComponent.get(n.id);
+    if (!run4) continue;
+    const attrs = n.attrs ??= {};
+    attrs.ci = run4.status;
+    attrs._ciJob = run4.job;
+  }
+  return ir;
+}
+
+// src/component-status.ts
+function componentStatusColor(row) {
+  if (row.stack && row.stack.healthy === false) {
+    if (row.stack.status && /ROLLBACK|FAILED/i.test(row.stack.status)) return "warn";
+    return "accent";
+  }
+  const rollup = row.resources;
+  if (rollup && rollup.total > 0) {
+    if (rollup.unobserved > 0) return "accent";
+    if (rollup.present === rollup.total) return "good";
+    if (rollup.present === 0) return "neutral";
+    return "warn";
+  }
+  if (row.live !== void 0) return row.live ? "good" : "neutral";
+  switch (row.reconciliation) {
+    case "reconciled":
+      return "good";
+    case "unrecorded":
+      return row.detail.startsWith("live") ? "good" : "neutral";
+    case "stale":
+    case "drifted":
+      return "warn";
+    case "unknown":
+    default:
+      return "neutral";
+  }
+}
+function joinComponentStatus(ir, rows) {
+  const byComponent = new Map(rows.map((r) => [r.component, r]));
+  return {
+    ...ir,
+    nodes: ir.nodes.map((n) => {
+      const row = byComponent.get(n.id);
+      if (!row) return n;
+      return {
+        ...n,
+        attrs: {
+          ...n.attrs,
+          _status: componentStatusColor(row),
+          _liveStatus: {
+            reconciliation: row.reconciliation,
+            detail: row.detail,
+            ...row.live !== void 0 ? { live: row.live } : {},
+            ...row.stack ? { stack: row.stack } : {},
+            ...row.resources ? { resources: row.resources } : {}
+          }
+        }
+      };
+    })
+  };
+}
+
+// src/overlay.ts
+function pruneImports(ir) {
+  const drop = new Set((ir.imports ?? []).map((i) => i.node));
+  if (drop.size === 0) return ir;
+  ir.nodes = ir.nodes.filter((n) => !drop.has(n.id));
+  if (ir.edges) ir.edges = ir.edges.filter((e) => !drop.has(e.from) && !drop.has(e.to));
+  return ir;
+}
+function componentDir(node) {
+  const parts = node.sourceLoc?.file?.split("/") ?? [];
+  if (parts[0] !== "src" || parts[1] === "examples" || parts.length < 3) return void 0;
+  return parts[1];
+}
+function reclassifyOverlay(ir) {
+  const deployedComponents = /* @__PURE__ */ new Set();
+  for (const n of ir.nodes) {
+    if (n.attrs?._status === "good") {
+      const c = componentDir(n);
+      if (c) deployedComponents.add(c);
+    }
+  }
+  for (const n of ir.nodes) {
+    const file = n.sourceLoc?.file ?? "";
+    if (file.startsWith("src/examples/")) {
+      n.attrs = { ...n.attrs, _byo: true };
+      delete n.attrs._status;
+    } else if (n.kind === "AWS::CloudFormation::Parameter") {
+      const c = componentDir(n);
+      if (c && deployedComponents.has(c)) {
+        n.attrs = { ...n.attrs, _status: "good" };
+      }
+    }
+  }
+  return ir;
+}
+function pruneRuntimeChildren(ir) {
+  const runtime = new Set(ir.nodes.filter((n) => n.runtimeOwner).map((n) => n.id));
+  if (runtime.size === 0) return ir;
+  ir.nodes = ir.nodes.filter((n) => !runtime.has(n.id));
+  ir.edges = ir.edges.filter((e) => !runtime.has(e.from) && !runtime.has(e.to));
+  return ir;
+}
+function attachRuntimeContainment(ir) {
+  const byOwner = /* @__PURE__ */ new Map();
+  for (const n of ir.nodes) {
+    if (!n.runtimeOwner) continue;
+    if (!byOwner.has(n.runtimeOwner)) byOwner.set(n.runtimeOwner, /* @__PURE__ */ new Set());
+    byOwner.get(n.runtimeOwner).add(n.id);
+  }
+  if (byOwner.size === 0) return ir;
+  const byContainer = { ...ir.groups.byContainer ?? {} };
+  for (const [owner, children] of byOwner) {
+    byContainer[owner] = [.../* @__PURE__ */ new Set([owner, ...byContainer[owner] ?? [], ...children])].sort();
+  }
+  ir.groups.byContainer = byContainer;
+  return ir;
+}
+
+// src/value-match.ts
+function typeSegment(kind) {
+  const parts = kind.split(kind.includes("::") ? "::" : "/");
+  return parts[parts.length - 1] ?? kind;
+}
+function isOwnNameAttr(kind, key) {
+  if (!/name$/i.test(key)) return false;
+  const prefix = key.slice(0, -4).toLowerCase();
+  if (prefix === "") return true;
+  return typeSegment(kind).toLowerCase().includes(prefix);
+}
+var MIN_NAME_LEN = 6;
+function addValueMatchEdges(ir) {
+  const nodes = ir.nodes;
+  const owner = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    for (const [k, v] of Object.entries(n.attrs ?? {})) {
+      if (typeof v !== "string" || v.length < MIN_NAME_LEN) continue;
+      if (!isOwnNameAttr(n.kind, k)) continue;
+      owner.set(v, owner.has(v) ? null : n.id);
+    }
+  }
+  if (owner.size === 0) return ir;
+  const declared = /* @__PURE__ */ new Set();
+  for (const e of ir.edges) declared.add(`${e.from}\0${e.to}`);
+  const added = /* @__PURE__ */ new Set();
+  for (const a of nodes) {
+    for (const [k, v] of Object.entries(a.attrs ?? {})) {
+      if (typeof v !== "string" || v.length < MIN_NAME_LEN) continue;
+      const b = owner.get(v);
+      if (!b || b === a.id) continue;
+      const key = `${a.id}\0${b}`;
+      if (declared.has(key) || added.has(key)) continue;
+      added.add(key);
+      ir.edges.push({ from: a.id, to: b, kind: "ref", viaAttr: k, inferred: true });
+    }
+  }
+  return ir;
+}
+
+// src/k8s-edges.ts
+var WORKLOAD_KINDS = /* @__PURE__ */ new Set([
+  "K8s::Apps::Deployment",
+  "K8s::Apps::StatefulSet",
+  "K8s::Apps::DaemonSet",
+  "K8s::Apps::ReplicaSet"
+]);
+function rec(v) {
+  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+}
+function str2(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function namespaceOf(n) {
+  return str2(rec(n.attrs?.metadata)?.namespace) ?? "default";
+}
+function nameOf(n) {
+  return str2(rec(n.attrs?.metadata)?.name);
+}
+function labelRecord(v) {
+  const r = rec(v);
+  if (!r) return void 0;
+  const out = {};
+  for (const [k, val] of Object.entries(r)) {
+    if (typeof val !== "string") return void 0;
+    out[k] = val;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function selects(selector, labels) {
+  return Object.entries(selector).every(([k, v]) => labels[k] === v);
+}
+function templateLabels(n) {
+  const template = rec(rec(n.attrs?.spec)?.template);
+  return labelRecord(rec(template?.metadata)?.labels);
+}
+function shortKind(kind) {
+  const parts = kind.split("::");
+  return parts[parts.length - 1] ?? kind;
+}
+var FLUX_SOURCE_KINDS = /* @__PURE__ */ new Set([
+  "K8s::Flux::GitRepository",
+  "K8s::Flux::OCIRepository",
+  "K8s::Flux::HelmRepository",
+  "K8s::Flux::HelmChart",
+  "K8s::Flux::Bucket"
+]);
+function sourceRefOf(refObj, referrer) {
+  const ref = rec(refObj);
+  const kind = str2(ref?.kind);
+  const name = str2(ref?.name);
+  if (!kind || !name) return void 0;
+  return { kind, name, namespace: str2(ref?.namespace) ?? namespaceOf(referrer) };
+}
+function helmReleaseSourceRef(n) {
+  return rec(rec(rec(n.attrs?.spec)?.chart)?.spec)?.sourceRef;
+}
+function ingressBackendServices(n) {
+  const spec = rec(n.attrs?.spec);
+  const out = [];
+  const backendName = (b) => str2(rec(rec(b)?.service)?.name);
+  const fromDefault = backendName(spec?.defaultBackend);
+  if (fromDefault) out.push(fromDefault);
+  const rules = Array.isArray(spec?.rules) ? spec.rules : [];
+  for (const rule of rules) {
+    const paths = rec(rec(rule)?.http)?.paths;
+    for (const p of Array.isArray(paths) ? paths : []) {
+      const name = backendName(rec(p)?.backend);
+      if (name) out.push(name);
+    }
+  }
+  return out;
+}
+function deriveK8sEdges(nodes) {
+  const k8s = nodes.filter((n) => n.lexicon === "k8s");
+  if (k8s.length === 0) return [];
+  const out = [];
+  const add = (from, to, viaAttr) => {
+    if (from !== to) out.push({ from, to, kind: "ref", viaAttr, inferred: true });
+  };
+  const workloads = k8s.filter((n) => WORKLOAD_KINDS.has(n.kind));
+  const servicesByNsName = /* @__PURE__ */ new Map();
+  const sourcesByKindNsName = /* @__PURE__ */ new Map();
+  for (const n of k8s) {
+    const name = nameOf(n);
+    if (!name) continue;
+    if (n.kind === "K8s::Core::Service") servicesByNsName.set(`${namespaceOf(n)}/${name}`, n);
+    if (FLUX_SOURCE_KINDS.has(n.kind)) sourcesByKindNsName.set(`${shortKind(n.kind)}/${namespaceOf(n)}/${name}`, n);
+  }
+  const addSourceRef = (n, refObj, viaAttr) => {
+    const ref = sourceRefOf(refObj, n);
+    if (!ref) return;
+    const source = sourcesByKindNsName.get(`${ref.kind}/${ref.namespace}/${ref.name}`);
+    if (source) add(n.id, source.id, viaAttr);
+  };
+  for (const n of k8s) {
+    if (n.kind === "K8s::Core::Service") {
+      const selector = labelRecord(rec(n.attrs?.spec)?.selector);
+      if (!selector) continue;
+      for (const w of workloads) {
+        if (namespaceOf(w) !== namespaceOf(n)) continue;
+        const labels = templateLabels(w);
+        if (labels && selects(selector, labels)) add(n.id, w.id, "selector");
+      }
+      continue;
+    }
+    if (n.kind === "K8s::Networking::Ingress") {
+      for (const svcName of ingressBackendServices(n)) {
+        const svc = servicesByNsName.get(`${namespaceOf(n)}/${svcName}`);
+        if (svc) add(n.id, svc.id, "ingress backend");
+      }
+      continue;
+    }
+    if (n.kind === "K8s::Autoscaling::HorizontalPodAutoscaler") {
+      const ref = rec(rec(n.attrs?.spec)?.scaleTargetRef);
+      const refKind = str2(ref?.kind);
+      const refName = str2(ref?.name);
+      if (!refKind || !refName) continue;
+      for (const w of workloads) {
+        if (namespaceOf(w) !== namespaceOf(n)) continue;
+        if (shortKind(w.kind) === refKind && nameOf(w) === refName) add(n.id, w.id, "scaleTargetRef");
+      }
+      continue;
+    }
+    if (n.kind === "K8s::Flux::Kustomization") {
+      addSourceRef(n, rec(n.attrs?.spec)?.sourceRef, "sourceRef");
+      continue;
+    }
+    if (n.kind === "K8s::Flux::HelmRelease") {
+      addSourceRef(n, helmReleaseSourceRef(n), "chart sourceRef");
+    }
+  }
+  return out;
+}
+function addK8sDeclaredEdges(ir) {
+  const existing = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
+  for (const e of deriveK8sEdges(ir.nodes)) {
+    const key = `${e.from}\0${e.to}`;
+    if (existing.has(key)) continue;
+    existing.add(key);
+    ir.edges.push(e);
+  }
+  return ir;
+}
+
+// src/helm-artifacts.ts
+function chartNameOf(node) {
+  const name = node.attrs?.name;
+  return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+function releaseMatchesChart(observed, chartName) {
+  const chart = observed.attributes?.chart;
+  if (typeof chart !== "string") return false;
+  return chart === chartName || chart.startsWith(`${chartName}-`);
+}
+function applyHelmArtifacts(ir, observed) {
+  let charts = 0;
+  let installed = 0;
+  for (const node of ir.nodes) {
+    if (node.lexicon !== "helm" || node.kind !== "Helm::Chart") continue;
+    charts++;
+    const attrs = node.attrs ??= {};
+    if (observed === void 0) {
+      attrs._status = "neutral";
+      attrs._unobserved = "artifact-observation-unavailable";
+      continue;
+    }
+    const chartName = chartNameOf(node);
+    const entry = chartName ? Object.entries(observed).find(([key2, o2]) => key2.startsWith("release/") && releaseMatchesChart(o2, chartName)) : void 0;
+    if (!entry) {
+      attrs._status = "accent";
+      continue;
+    }
+    const [key, o] = entry;
+    const match = {
+      release: key.replace(/^release\//, ""),
+      ...o.status ? { status: o.status } : {},
+      ...typeof o.attributes?.revision === "string" ? { revision: o.attributes.revision } : {},
+      ...typeof o.attributes?.chart === "string" ? { chart: o.attributes.chart } : {}
+    };
+    attrs._artifact = match;
+    attrs._status = o.status === "deployed" ? "good" : "warn";
+    if (o.status === "deployed") installed++;
+  }
+  return { charts, installed };
+}
+
+// src/cluster-anchor.ts
+var MANAGED_CLUSTER_KINDS = /* @__PURE__ */ new Set([
+  "AWS::EKS::Cluster",
+  "GCP::Container::Cluster",
+  "Microsoft.ContainerService/managedClusters",
+  "K3d::Cluster"
+]);
+var ANCHOR_VIA = "runs-on";
+function metadata(node) {
+  const m = node.attrs?.metadata;
+  return m && typeof m === "object" && !Array.isArray(m) ? m : void 0;
+}
+function metaString(node, key) {
+  const v = metadata(node)?.[key];
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function isK8s(node) {
+  return node.lexicon === "k8s";
+}
+function isNamespace(node) {
+  return node.kind === "K8s::Core::Namespace";
+}
+function managedClusterName(node) {
+  const metaName = metaString(node, "name");
+  if (metaName) return metaName;
+  for (const key of ["name", "clusterName"]) {
+    const v = node.attrs?.[key];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return node.id;
+}
+function boundManagedCluster(nodes, boundContext) {
+  const clusters = nodes.filter((n) => MANAGED_CLUSTER_KINDS.has(n.kind));
+  if (clusters.length === 1) return clusters[0];
+  if (clusters.length === 0 || !boundContext) return void 0;
+  const bound = clusters.filter((n) => contextBindsCluster(boundContext, managedClusterName(n)));
+  return bound.length === 1 ? bound[0] : void 0;
+}
+function addClusterAnchorEdges(ir, boundContext) {
+  const nodes = ir.nodes;
+  const cluster = boundManagedCluster(ir.nodes, boundContext);
+  if (!cluster) return ir;
+  const k8sNodes = nodes.filter(isK8s);
+  if (k8sNodes.length === 0) return ir;
+  const namespaceByName = /* @__PURE__ */ new Map();
+  for (const n of k8sNodes) {
+    if (!isNamespace(n)) continue;
+    const name = metaString(n, "name");
+    if (name && !namespaceByName.has(name)) namespaceByName.set(name, n.id);
+  }
+  const existing = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
+  const add = (from, to) => {
+    if (from === to) return;
+    const key = `${from}\0${to}`;
+    if (existing.has(key)) return;
+    existing.add(key);
+    ir.edges.push({ from, to, kind: "ref", viaAttr: ANCHOR_VIA, inferred: true });
+  };
+  for (const n of k8sNodes) {
+    if (isNamespace(n)) {
+      add(cluster.id, n.id);
+      continue;
+    }
+    const ns = metaString(n, "namespace");
+    const nsNode = ns ? namespaceByName.get(ns) : void 0;
+    add(nsNode ?? cluster.id, n.id);
+  }
+  return ir;
+}
+
+// src/logical-azure.ts
+var AZURE_HEADLINE_KINDS = /* @__PURE__ */ new Set([
+  // compute / workloads
+  "Microsoft.Compute/virtualMachines",
+  "Microsoft.Compute/virtualMachineScaleSets",
+  "Microsoft.ContainerService/managedClusters",
+  "Microsoft.ContainerInstance/containerGroups",
+  "Microsoft.Web/sites",
+  // network edge
+  "Microsoft.Network/publicIPAddresses",
+  "Microsoft.Network/loadBalancers",
+  "Microsoft.Network/applicationGateways",
+  "Microsoft.Network/natGateways",
+  "Microsoft.Network/dnsZones",
+  // data stores
+  "Microsoft.Storage/storageAccounts",
+  "Microsoft.Sql/servers",
+  "Microsoft.DocumentDB/databaseAccounts",
+  "Microsoft.Cache/redis",
+  "Microsoft.DBforPostgreSQL/flexibleServers",
+  // registry / identity edge
+  "Microsoft.ContainerRegistry/registries"
+]);
+var AZURE_FABRIC_KINDS = /* @__PURE__ */ new Set([
+  "Microsoft.Network/virtualNetworks",
+  "Microsoft.Network/virtualNetworks_subnets",
+  "Microsoft.Network/networkSecurityGroups",
+  "Microsoft.Network/routeTables",
+  "Microsoft.Network/networkInterfaces",
+  // identity/authorization hubs — a role assignment or managed identity is
+  // referenced by half the estate, so contracting through one invents edges
+  // between unrelated resources.
+  "Microsoft.Authorization/roleAssignments",
+  "Microsoft.ManagedIdentity/userAssignedIdentities",
+  "Microsoft.KeyVault/vaults"
+]);
+var VNET_KIND = "Microsoft.Network/virtualNetworks";
+var SUBNET_KIND = "Microsoft.Network/virtualNetworks_subnets";
+var NSG_KIND = "Microsoft.Network/networkSecurityGroups";
+var RESOURCE_ID_RE = /resourceId\(\s*([^)]*)\)/g;
+var QUOTED_RE = /'([^']*)'/g;
+function resourceIdNames(value) {
+  if (typeof value !== "string" || !value.includes("resourceId(")) return [];
+  const out = [];
+  for (const call of value.matchAll(RESOURCE_ID_RE)) {
+    const args = [...call[1].matchAll(QUOTED_RE)].map((m) => m[1]);
+    if (args.length >= 2) out.push(args[args.length - 1]);
+  }
+  return out;
+}
+function collectAzureRefs(value, out) {
+  if (value === null || typeof value !== "object") {
+    for (const name of resourceIdNames(value)) out.add(name);
+    return;
+  }
+  const ref = value.$ref;
+  if (typeof ref === "string") out.add(ref.split(".")[0]);
+  for (const v of Object.values(value)) collectAzureRefs(v, out);
+}
+function strAttr(node, key) {
+  const v = node.attrs?.[key];
+  return typeof v === "string" ? v : void 0;
+}
+function resourceName(node) {
+  return strAttr(node, "name");
+}
+function subnetVnetName(node) {
+  const name = resourceName(node);
+  if (!name || !name.includes("/")) return void 0;
+  return name.split("/")[0];
+}
+function subnetShortName(node) {
+  const name = resourceName(node);
+  return name?.includes("/") ? name.split("/").slice(1).join("/") : name;
+}
+function vnetCidr(node) {
+  const space = node.attrs?.addressSpace;
+  const prefixes = space?.addressPrefixes;
+  return Array.isArray(prefixes) && typeof prefixes[0] === "string" ? prefixes[0] : void 0;
+}
+function projectAzureLogical(ir, env) {
+  const azure = ir.nodes.filter((n) => n.lexicon === "azure");
+  if (azure.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
+  const componentOf = componentNamer(azure);
+  const byId = new Map(azure.map((n) => [n.id, n]));
+  const byName = /* @__PURE__ */ new Map();
+  for (const n of azure) {
+    const name = resourceName(n);
+    if (name && !byName.has(name)) byName.set(name, n);
+  }
+  const vnets = azure.filter((n) => n.kind === VNET_KIND);
+  const subnets = azure.filter((n) => n.kind === SUBNET_KIND);
+  const vnetByName = new Map(vnets.map((v) => [resourceName(v) ?? v.id, v]));
+  const refOut = /* @__PURE__ */ new Map();
+  for (const n of azure) {
+    const names = /* @__PURE__ */ new Set();
+    collectAzureRefs(n.attrs, names);
+    const targets = /* @__PURE__ */ new Set();
+    for (const name of names) {
+      const target = byName.get(name) ?? byId.get(name);
+      if (target && target.id !== n.id) targets.add(target.id);
+    }
+    if (targets.size) refOut.set(n.id, targets);
+  }
+  for (const e of ir.edges) {
+    if (!byId.has(e.from) || !byId.has(e.to)) continue;
+    (refOut.get(e.from) ?? refOut.set(e.from, /* @__PURE__ */ new Set()).get(e.from)).add(e.to);
+  }
+  const RG_TITLE = env ? `resource group ${env}` : "resource group";
+  const vnetTitle = (v) => `VNet ${vnetCidr(v) ?? resourceName(v) ?? v.id}`;
+  const subnetTitle = (s) => `subnet ${strAttr(s, "addressPrefix") ?? subnetShortName(s) ?? s.id}`;
+  const guardedBy = /* @__PURE__ */ new Map();
+  for (const s of subnets) {
+    const names = /* @__PURE__ */ new Set();
+    collectAzureRefs(s.attrs?.networkSecurityGroup, names);
+    for (const name of names) {
+      if (byName.get(name)?.kind === NSG_KIND) guardedBy.set(s.id, name);
+    }
+  }
+  const headline = azure.filter((n) => AZURE_HEADLINE_KINDS.has(n.kind));
+  const subnetIds = new Set(subnets.map((s) => s.id));
+  const vnetIds = new Set(vnets.map((v) => v.id));
+  const nearest = (start, want, maxDepth = 6) => {
+    const seen = /* @__PURE__ */ new Set([start]);
+    let frontier = [...refOut.get(start) ?? []];
+    for (let depth = 0; depth < maxDepth && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        if (want.has(id)) return id;
+        for (const r of refOut.get(id) ?? []) if (!seen.has(r)) next.push(r);
+      }
+      frontier = next;
+    }
+    return void 0;
+  };
+  const byContainer = {};
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  for (const v of vnets) child(RG_TITLE, vnetTitle(v));
+  for (const s of subnets) {
+    const parentVnet = subnetVnetName(s);
+    const v = parentVnet ? vnetByName.get(parentVnet) : void 0;
+    child(v ? vnetTitle(v) : RG_TITLE, subnetTitle(s));
+  }
+  const placeOf = /* @__PURE__ */ new Map();
+  for (const n of headline) {
+    const subnetId = nearest(n.id, subnetIds);
+    if (subnetId) {
+      placeOf.set(n.id, subnetTitle(byId.get(subnetId)));
+      continue;
+    }
+    const vnetId = nearest(n.id, vnetIds);
+    placeOf.set(n.id, vnetId ? vnetTitle(byId.get(vnetId)) : RG_TITLE);
+  }
+  const byComponent = /* @__PURE__ */ new Map();
+  for (const n of headline) {
+    const c = componentOf(n);
+    (byComponent.get(c) ?? byComponent.set(c, []).get(c)).push(n);
+  }
+  for (const [component, members] of byComponent) {
+    const places = new Set(members.map((m) => placeOf.get(m.id)));
+    child(places.size === 1 ? [...places][0] : RG_TITLE, component);
+    for (const m of members) child(component, m.id);
+  }
+  const kept = new Set(headline.map((n) => n.id));
+  const adj = /* @__PURE__ */ new Map();
+  const link = (a, b) => {
+    if (a === b) return;
+    (adj.get(a) ?? adj.set(a, /* @__PURE__ */ new Set()).get(a)).add(b);
+    (adj.get(b) ?? adj.set(b, /* @__PURE__ */ new Set()).get(b)).add(a);
+  };
+  for (const [from, tos] of refOut) for (const to of tos) link(from, to);
+  const edges = [];
+  const seenEdge = /* @__PURE__ */ new Set();
+  const addEdge = (a, b) => {
+    if (a === b || !kept.has(a) || !kept.has(b)) return;
+    const key = a < b ? `${a}|${b}` : `${b}|${a}`;
+    if (seenEdge.has(key)) return;
+    seenEdge.add(key);
+    edges.push({ from: a, to: b, kind: "ref" });
+  };
+  const contractable = (id) => !kept.has(id) && !AZURE_FABRIC_KINDS.has(byId.get(id)?.kind ?? "");
+  for (const start of kept) {
+    const seen = /* @__PURE__ */ new Set([start]);
+    let frontier = [...adj.get(start) ?? []];
+    for (let depth = 0; depth < 6 && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        if (kept.has(id)) {
+          addEdge(start, id);
+          continue;
+        }
+        if (!contractable(id)) continue;
+        for (const nb of adj.get(id) ?? []) if (!seen.has(nb)) next.push(nb);
+      }
+      frontier = next;
+    }
+  }
+  const nodes = headline.map((n) => {
+    const place = placeOf.get(n.id);
+    const guardedSubnet = subnets.find((s) => subnetTitle(s) === place);
+    const nsg = guardedSubnet ? guardedBy.get(guardedSubnet.id) : void 0;
+    return nsg ? { ...n, attrs: { ...n.attrs, _nsg: nsg } } : n;
+  });
+  return { ir: { nodes, edges, groups: {} }, byContainer };
+}
+
+// src/logical-gcp.ts
+var GCP_HEADLINE_KINDS = /* @__PURE__ */ new Set([
+  "GCP::Container::Cluster",
+  "GCP::Run::Service",
+  "GCP::Sql::Instance",
+  "GCP::Storage::Bucket",
+  "GCP::Compute::Instance",
+  "GCP::Dns::ManagedZone"
+]);
+var GCP_FABRIC_KINDS = /* @__PURE__ */ new Set([
+  // networking — declared, not emulated
+  "GCP::Compute::Network",
+  "GCP::Compute::Subnetwork",
+  "GCP::Compute::Firewall",
+  "GCP::Compute::Router",
+  "GCP::Compute::RouterNAT",
+  // identity hubs
+  "GCP::Iam::ServiceAccount",
+  "GCP::Iam::PolicyMember",
+  "GCP::Iam::CustomRole",
+  // capacity, not a workload host
+  "GCP::Container::NodePool",
+  // chant's own annotation carrier
+  "chant:gcp:defaultAnnotations"
+]);
+var PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
+function strAttr2(node, key) {
+  const v = node.attrs?.[key];
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function declaredProject(nodes) {
+  for (const n of nodes) {
+    const annotations = n.attrs?.annotations ?? n.attrs?.metadata?.annotations;
+    const value = annotations?.[PROJECT_ID_ANNOTATION];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+}
+function collectRefs(v, out) {
+  if (!v || typeof v !== "object") return;
+  const ref = v.$ref;
+  if (typeof ref === "string") out.add(ref.split(".")[0]);
+  for (const key of Object.keys(v)) collectRefs(v[key], out);
+}
+function projectGcpLogical(ir, env) {
+  const gcp = ir.nodes.filter((n) => n.lexicon === "gcp");
+  if (gcp.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
+  const componentOf = componentNamer(gcp);
+  const byId = new Map(gcp.map((n) => [n.id, n]));
+  const project = declaredProject(gcp) ?? env;
+  const PROJECT_TITLE = project ? `project ${project}` : "project";
+  const GLOBAL = "global";
+  const locationTitle = (loc) => `location ${loc}`;
+  const refOut = /* @__PURE__ */ new Map();
+  for (const n of gcp) {
+    const refs = /* @__PURE__ */ new Set();
+    collectRefs(n.attrs, refs);
+    const targets = /* @__PURE__ */ new Set();
+    for (const r of refs) if (byId.has(r) && r !== n.id) targets.add(r);
+    if (targets.size) refOut.set(n.id, targets);
+  }
+  for (const e of ir.edges) {
+    if (!byId.has(e.from) || !byId.has(e.to)) continue;
+    (refOut.get(e.from) ?? refOut.set(e.from, /* @__PURE__ */ new Set()).get(e.from)).add(e.to);
+  }
+  const headline = gcp.filter((n) => GCP_HEADLINE_KINDS.has(n.kind));
+  const byContainer = {};
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  const locations = /* @__PURE__ */ new Set();
+  for (const n of gcp) {
+    const loc = strAttr2(n, "location");
+    if (loc) locations.add(loc);
+  }
+  for (const loc of [...locations].sort()) child(PROJECT_TITLE, locationTitle(loc));
+  const placeOf = /* @__PURE__ */ new Map();
+  for (const n of headline) {
+    const loc = strAttr2(n, "location");
+    placeOf.set(n.id, loc ? locationTitle(loc) : GLOBAL);
+  }
+  const byComponent = /* @__PURE__ */ new Map();
+  for (const n of headline) {
+    const c = componentOf(n);
+    (byComponent.get(c) ?? byComponent.set(c, []).get(c)).push(n);
+  }
+  for (const [component, members] of byComponent) {
+    const places = new Set(members.map((m) => placeOf.get(m.id)));
+    const parent = places.size === 1 ? [...places][0] : PROJECT_TITLE;
+    if (parent === GLOBAL) child(PROJECT_TITLE, GLOBAL);
+    child(parent, component);
+    for (const m of members) child(component, m.id);
+  }
+  const kept = new Set(headline.map((n) => n.id));
+  const adj = /* @__PURE__ */ new Map();
+  const link = (a, b) => {
+    if (a === b) return;
+    (adj.get(a) ?? adj.set(a, /* @__PURE__ */ new Set()).get(a)).add(b);
+    (adj.get(b) ?? adj.set(b, /* @__PURE__ */ new Set()).get(b)).add(a);
+  };
+  for (const [from, tos] of refOut) for (const to of tos) link(from, to);
+  const edges = [];
+  const seen = /* @__PURE__ */ new Set();
+  const addEdge = (a, b) => {
+    if (a === b || !kept.has(a) || !kept.has(b)) return;
+    const key = a < b ? `${a}|${b}` : `${b}|${a}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    edges.push({ from: a, to: b, kind: "ref" });
+  };
+  const contractable = (id) => !kept.has(id) && !GCP_FABRIC_KINDS.has(byId.get(id)?.kind ?? "");
+  for (const start of kept) {
+    const walked = /* @__PURE__ */ new Set([start]);
+    let frontier = [...adj.get(start) ?? []];
+    for (let depth = 0; depth < 6 && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        if (walked.has(id)) continue;
+        walked.add(id);
+        if (kept.has(id)) {
+          addEdge(start, id);
+          continue;
+        }
+        if (!contractable(id)) continue;
+        for (const nb of adj.get(id) ?? []) if (!walked.has(nb)) next.push(nb);
+      }
+      frontier = next;
+    }
+  }
+  return { ir: { nodes: headline, edges, groups: {} }, byContainer };
+}
+
+// src/logical-k8s.ts
+var K8S_PLUMBING_KINDS = /* @__PURE__ */ new Set([
+  "K8s::Core::Namespace",
+  "K8s::Core::ConfigMap",
+  "K8s::Core::Secret",
+  "K8s::Core::ServiceAccount",
+  "K8s::Core::ResourceQuota",
+  "K8s::Core::LimitRange",
+  "K8s::Rbac::Role",
+  "K8s::Rbac::RoleBinding",
+  "K8s::Rbac::ClusterRole",
+  "K8s::Rbac::ClusterRoleBinding"
+]);
+function metaStr(node, key) {
+  const meta = node.attrs?.metadata;
+  const v = meta?.[key];
+  return typeof v === "string" ? v : void 0;
+}
+function declaredNamespaces(nodes) {
+  const out = /* @__PURE__ */ new Set();
+  for (const n of nodes) {
+    if (n.kind === "K8s::Core::Namespace") {
+      const own = metaStr(n, "name");
+      if (own) out.add(own);
+      continue;
+    }
+    const ns = metaStr(n, "namespace");
+    if (ns) out.add(ns);
+  }
+  return out;
+}
+function projectK8sLogical(ir, env, boundContext) {
+  const k8s = ir.nodes.filter((n) => n.lexicon === "k8s");
+  if (k8s.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
+  const cluster = boundManagedCluster(ir.nodes, boundContext);
+  const CLUSTER_TITLE = cluster ? cluster.id : env ? `cluster ${env}` : "cluster";
+  const CLUSTER_SCOPED = "cluster-scoped";
+  const namespaceTitle = (ns) => `namespace ${ns}`;
+  const byContainer = {};
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  for (const ns of [...declaredNamespaces(k8s)].sort()) child(CLUSTER_TITLE, namespaceTitle(ns));
+  const headline = k8s.filter((n) => !K8S_PLUMBING_KINDS.has(n.kind));
+  let clusterScoped = false;
+  for (const n of headline) {
+    const ns = metaStr(n, "namespace");
+    if (ns) {
+      child(namespaceTitle(ns), n.id);
+    } else {
+      clusterScoped = true;
+      child(CLUSTER_SCOPED, n.id);
+    }
+  }
+  if (clusterScoped) child(CLUSTER_TITLE, CLUSTER_SCOPED);
+  const kept = new Set(headline.map((n) => n.id));
+  const edges = ir.edges.filter((e) => kept.has(e.from) && kept.has(e.to));
+  return { ir: { nodes: headline, edges, groups: {} }, byContainer };
+}
+
+// src/logical-helm.ts
+function releaseBoxTitle(chartName) {
+  return `release ${chartName}`;
+}
+function chartNameOf2(node) {
+  const name = node.attrs?.name;
+  return typeof name === "string" && name.length > 0 ? name : node.id;
+}
+function dirOf(node) {
+  const file = node.sourceLoc?.file;
+  if (typeof file !== "string") return "";
+  const slash = file.lastIndexOf("/");
+  return slash >= 0 ? file.slice(0, slash) : "";
+}
+function projectHelmLogical(ir) {
+  const charts = ir.nodes.filter((n) => n.lexicon === "helm" && n.kind === "Helm::Chart");
+  const releases = ir.nodes.filter((n) => n.lexicon === "helm" && n.kind === "Helm::Release");
+  if (charts.length === 0 && releases.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
+  const byContainer = {};
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  const k8s = ir.nodes.filter((n) => n.lexicon === "k8s");
+  for (const chart of charts) {
+    const box = releaseBoxTitle(chartNameOf2(chart));
+    child(box, chart.id);
+    const chartDir = dirOf(chart);
+    if (chartDir === "") continue;
+    for (const n of k8s) {
+      const d = dirOf(n);
+      if (d === chartDir || d.startsWith(`${chartDir}/`)) child(box, n.id);
+    }
+  }
+  const cards = [...charts, ...releases];
+  const kept = new Set(cards.map((n) => n.id));
+  const edges = ir.edges.filter((e) => kept.has(e.from) && kept.has(e.to));
+  return { ir: { nodes: cards, edges, groups: {} }, byContainer };
+}
+
+// src/logical-kustomize.ts
+import { existsSync as existsSync4 } from "node:fs";
+import { join as join5 } from "node:path";
+function overlayBoxTitle(name) {
+  return `overlay ${name}`;
+}
+function dirOf2(node) {
+  const file = node.sourceLoc?.file;
+  if (typeof file !== "string") return "";
+  const slash = file.lastIndexOf("/");
+  return slash >= 0 ? file.slice(0, slash) : "";
+}
+function kustomizationRoot(bases, dir, exists) {
+  let current = dir;
+  for (let i = 0; i < 4 && current; i++) {
+    for (const base of bases) {
+      if (exists(join5(base, current, "kustomization.yaml")) || exists(join5(base, current, "kustomization.yml"))) {
+        return current;
+      }
+    }
+    const slash = current.lastIndexOf("/");
+    current = slash >= 0 ? current.slice(0, slash) : "";
+  }
+  return void 0;
+}
+function projectKustomizeLogical(ir, sourceRoots, exists = existsSync4) {
+  const bases = Array.isArray(sourceRoots) ? sourceRoots : [sourceRoots];
+  const k8s = ir.nodes.filter((n) => n.lexicon === "k8s");
+  if (k8s.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
+  const byContainer = {};
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  const rootCache = /* @__PURE__ */ new Map();
+  for (const n of k8s) {
+    const dir = dirOf2(n);
+    if (dir === "") continue;
+    if (!rootCache.has(dir)) rootCache.set(dir, kustomizationRoot(bases, dir, exists));
+    const root = rootCache.get(dir);
+    if (root === void 0) continue;
+    const name = root.split("/").pop() || root;
+    child(overlayBoxTitle(name), n.id);
+  }
+  return { ir: { nodes: [], edges: [], groups: {} }, byContainer };
+}
+
+// src/logical-fly.ts
+function appBoxTitle(appName) {
+  return `app ${appName}`;
+}
+var APP_KIND = "Fly::Machines::App";
+var FLY_CARD_KINDS = /* @__PURE__ */ new Set([
+  APP_KIND,
+  "Fly::Machines::Machine",
+  "Fly::Machines::Volume",
+  "Fly::Machines::IPAddress",
+  "Fly::Machines::Certificate"
+]);
+function appNameOf(node) {
+  const name = node.attrs?.name;
+  return typeof name === "string" && name.length > 0 ? name : node.id;
+}
+function collectRefs2(v, out) {
+  if (!v || typeof v !== "object") return;
+  const ref = v.$ref;
+  if (typeof ref === "string") out.add(ref.split(".")[0]);
+  for (const key of Object.keys(v)) collectRefs2(v[key], out);
+}
+function projectFlyLogical(ir) {
+  const fly = ir.nodes.filter((n) => n.lexicon === "fly");
+  if (fly.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
+  const cards = fly.filter((n) => FLY_CARD_KINDS.has(n.kind));
+  const apps = cards.filter((n) => n.kind === APP_KIND);
+  const appIds = new Set(apps.map((n) => n.id));
+  const kept = new Set(cards.map((n) => n.id));
+  const refOut = /* @__PURE__ */ new Map();
+  const addRef = (from, to) => {
+    if (from === to) return;
+    (refOut.get(from) ?? refOut.set(from, /* @__PURE__ */ new Set()).get(from)).add(to);
+  };
+  for (const n of fly) {
+    const refs = /* @__PURE__ */ new Set();
+    collectRefs2(n.attrs, refs);
+    for (const r of refs) addRef(n.id, r);
+  }
+  for (const e of ir.edges) addRef(e.from, e.to);
+  const byContainer = {};
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  const boxOf = /* @__PURE__ */ new Map();
+  for (const app of apps) {
+    const box = appBoxTitle(appNameOf(app));
+    boxOf.set(app.id, box);
+    child(box, app.id);
+  }
+  const soleApp = apps.length === 1 ? apps[0].id : void 0;
+  for (const n of cards) {
+    if (appIds.has(n.id)) continue;
+    const referenced = [...refOut.get(n.id) ?? []].find((r) => appIds.has(r));
+    const owner = referenced ?? soleApp;
+    if (owner) child(boxOf.get(owner), n.id);
+  }
+  const edges = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [from, tos] of refOut) {
+    if (!kept.has(from)) continue;
+    for (const to of tos) {
+      if (!kept.has(to) || appIds.has(from) || appIds.has(to)) continue;
+      const key = from < to ? `${from}|${to}` : `${to}|${from}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      edges.push({ from, to, kind: "ref" });
+    }
+  }
+  return { ir: { nodes: cards, edges, groups: {} }, byContainer };
+}
+
+// src/logical.ts
+var HEADLINE_KINDS = /* @__PURE__ */ new Set([
+  // network edge / gateways
+  "AWS::ElasticLoadBalancingV2::LoadBalancer",
+  "AWS::EC2::InternetGateway",
+  "AWS::EC2::NatGateway",
+  "AWS::EC2::VPCEndpoint",
+  "AWS::EC2::VPCEndpointService",
+  "AWS::Route53::RecordSet",
+  "AWS::CloudFront::Distribution",
+  "AWS::ApiGatewayV2::Api",
+  "AWS::ApiGateway::RestApi",
+  // compute / workloads
+  "AWS::ECS::Service",
+  "AWS::EC2::Instance",
+  "AWS::Lambda::Function",
+  "AWS::EKS::Cluster",
+  "AWS::BedrockAgentCore::Runtime",
+  // data stores
+  "AWS::RDS::DBInstance",
+  "AWS::RDS::DBCluster",
+  "AWS::ElastiCache::CacheCluster",
+  "AWS::ElastiCache::ReplicationGroup",
+  "AWS::DynamoDB::Table",
+  "AWS::EFS::FileSystem",
+  "AWS::OpenSearchService::Domain",
+  "AWS::S3::Bucket",
+  // identity / edge
+  "AWS::Cognito::UserPool"
+]);
+var WORKLOAD_KINDS2 = /* @__PURE__ */ new Set([
+  "AWS::ECS::Service",
+  "AWS::EC2::Instance",
+  "AWS::Lambda::Function",
+  "AWS::EKS::Cluster",
+  "AWS::BedrockAgentCore::Runtime"
+]);
+var DATA_STORE_KINDS = /* @__PURE__ */ new Set([
+  "AWS::RDS::DBInstance",
+  "AWS::RDS::DBCluster",
+  "AWS::S3::Bucket",
+  "AWS::DynamoDB::Table",
+  "AWS::ElastiCache::CacheCluster",
+  "AWS::ElastiCache::ReplicationGroup",
+  "AWS::EFS::FileSystem",
+  "AWS::OpenSearchService::Domain"
+]);
+var NO_CONTRACT_KINDS = /* @__PURE__ */ new Set([
+  // property hubs
+  "AWS::IAM::Role",
+  "AWS::IAM::Policy",
+  "AWS::IAM::ManagedPolicy",
+  "AWS::IAM::InstanceProfile",
+  "AWS::KMS::Key",
+  "AWS::KMS::Alias",
+  "AWS::Logs::LogGroup",
+  "AWS::SecretsManager::Secret",
+  "AWS::SSM::Parameter",
+  // containment fabric
+  "AWS::EC2::VPC",
+  "AWS::EC2::Subnet",
+  "AWS::EC2::RouteTable",
+  "AWS::EC2::Route",
+  "AWS::EC2::SubnetRouteTableAssociation",
+  "AWS::EC2::VPCGatewayAttachment",
+  // security groups — membership isn't traffic (two workloads sharing an SG
+  // don't necessarily talk); the directional ingress rules ARE traffic and are
+  // derived explicitly below, so contraction must not also bridge through them.
+  "AWS::EC2::SecurityGroup",
+  "AWS::EC2::SecurityGroupIngress"
+]);
+var REGION_RE = /\b([a-z]{2}-[a-z]+-\d)\b/;
+var WORD_RE = /[A-Za-z][A-Za-z0-9]*/g;
+function isExample(node) {
+  return (node.sourceLoc?.file ?? "").includes("examples/");
+}
+function dirSegments(node) {
+  const parts = (node.sourceLoc?.file ?? "").split("/");
+  return parts.slice(0, -1).filter((s) => s.length > 0);
+}
+function componentNamer(nodes) {
+  const all = nodes.map(dirSegments).filter((d) => d.length > 0);
+  let shared = 0;
+  if (all.length > 0) {
+    const first = all[0];
+    outer: for (; shared < first.length; shared++) {
+      for (const d of all) {
+        if (d.length <= shared || d[shared] !== first[shared]) break outer;
+      }
+    }
+  }
+  return (node) => {
+    const dirs = dirSegments(node);
+    return dirs[shared] ?? dirs[dirs.length - 1] ?? "other";
+  };
+}
+function collectRefs3(v, out) {
+  if (!v || typeof v !== "object") return;
+  const ref = v.$ref;
+  if (typeof ref === "string") out.add(ref.split(".")[0]);
+  for (const key of Object.keys(v)) collectRefs3(v[key], out);
+}
+function regionOf(node) {
+  for (const v of Object.values(node.attrs ?? {})) {
+    const m = JSON.stringify(v).match(REGION_RE);
+    if (m) return m[1];
+  }
+  return void 0;
+}
+function strAttr3(node, key) {
+  const v = node.attrs?.[key];
+  return typeof v === "string" ? v : void 0;
+}
+function enrichedRefs(ir, aws, byId) {
+  const refOut = /* @__PURE__ */ new Map();
+  const add = (from, to) => {
+    if (!byId.has(from) || !byId.has(to) || from === to) return;
+    (refOut.get(from) ?? refOut.set(from, /* @__PURE__ */ new Set()).get(from)).add(to);
+  };
+  for (const n of aws) {
+    const refs = /* @__PURE__ */ new Set();
+    collectRefs3(n.attrs, refs);
+    for (const r of refs) add(n.id, r);
+  }
+  for (const e of ir.edges) add(e.from, e.to);
+  const producersByName = /* @__PURE__ */ new Map();
+  for (const ex of ir.exports ?? []) {
+    if (!ex.node || !byId.has(ex.node)) continue;
+    const list = producersByName.get(ex.name) ?? producersByName.set(ex.name, []).get(ex.name);
+    if (isExample(byId.get(ex.node))) list.push(ex.node);
+    else list.unshift(ex.node);
+  }
+  const exportNames = [...producersByName.keys()].sort((a, b) => b.length - a.length);
+  const bridge = (paramId, producers) => {
+    if (producers && producers.length) add(paramId, producers[0]);
+  };
+  for (const imp of ir.imports ?? []) {
+    const handle = imp.name.toLowerCase();
+    bridge(imp.node, producersByName.get(imp.name) ?? [...producersByName].find(([k]) => k.toLowerCase() === handle || k.toLowerCase() === "o" + handle)?.[1]);
+  }
+  for (const n of aws) {
+    if (n.kind !== "AWS::CloudFormation::Parameter") continue;
+    const desc = strAttr3(n, "description");
+    if (!desc) continue;
+    const toks = new Set(desc.match(WORD_RE) ?? []);
+    const hit = exportNames.find((name) => toks.has(name));
+    if (hit) bridge(n.id, producersByName.get(hit));
+  }
+  return refOut;
+}
+function nearestByRef(start, want, refOut, maxDepth = 8) {
+  const seen = /* @__PURE__ */ new Set([start]);
+  let frontier = [...refOut.get(start) ?? []];
+  for (let depth = 0; depth < maxDepth && frontier.length; depth++) {
+    const next = [];
+    for (const id of frontier) {
+      if (seen.has(id)) continue;
+      seen.add(id);
+      if (want.has(id)) return id;
+      for (const r of refOut.get(id) ?? []) if (!seen.has(r)) next.push(r);
+    }
+    frontier = next;
+  }
+  return void 0;
+}
+function projectTopology(ir, env, boundContext, sourceRoots) {
+  const projections = [
+    projectLogical(ir),
+    projectAzureLogical(ir, env),
+    projectGcpLogical(ir, env),
+    projectK8sLogical(ir, env, boundContext),
+    projectHelmLogical(ir),
+    projectFlyLogical(ir),
+    // The kustomize lens probes for kustomization roots relative to whatever
+    // base `sourceLoc.file` was reported against — the graphed root on the
+    // declared path, the project dir on the live overlay path (see the lens's
+    // doc); a caller without one (tests, composition paths) just skips it.
+    ...sourceRoots && (!Array.isArray(sourceRoots) || sourceRoots.length) ? [projectKustomizeLogical(ir, sourceRoots)] : []
+  ];
+  const nodes = [];
+  const edges = [];
+  const byContainer = {};
+  for (const p of projections) {
+    nodes.push(...p.ir.nodes);
+    edges.push(...p.ir.edges);
+    for (const [parent, children] of Object.entries(p.byContainer)) {
+      const arr = byContainer[parent] ?? (byContainer[parent] = []);
+      for (const c of children) if (!arr.includes(c)) arr.push(c);
+    }
+  }
+  placeHelmReleases(nodes, byContainer, ir, env, boundContext);
+  nestReleaseBoxes(byContainer);
+  return { ir: { nodes, edges, groups: {} }, byContainer };
+}
+function placeHelmReleases(nodes, byContainer, ir, env, boundContext) {
+  const releases = nodes.filter((n) => n.kind === "Helm::Release");
+  if (releases.length === 0) return;
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  const cluster = boundManagedCluster(ir.nodes, boundContext);
+  const clusterTitle = cluster ? cluster.id : env ? `cluster ${env}` : "cluster";
+  const clusterBoxExists = byContainer[clusterTitle] !== void 0;
+  for (const r of releases) {
+    const ns = r.attrs?.namespace;
+    if (typeof ns !== "string" || ns.length === 0) continue;
+    const nsBox = `namespace ${ns}`;
+    if (byContainer[nsBox] === void 0 && !clusterBoxExists) continue;
+    if (byContainer[nsBox] === void 0) child(clusterTitle, nsBox);
+    child(nsBox, r.id);
+  }
+}
+function nestReleaseBoxes(byContainer) {
+  for (const [box, members] of Object.entries(byContainer)) {
+    if (!box.startsWith("release ") && !box.startsWith("overlay ")) continue;
+    const claimed = members;
+    const parents = /* @__PURE__ */ new Set();
+    for (const [parent2, children2] of Object.entries(byContainer)) {
+      if (parent2 === box) continue;
+      if (claimed.some((m) => children2.includes(m))) parents.add(parent2);
+    }
+    if (parents.size !== 1) continue;
+    const [parent] = parents;
+    const children = byContainer[parent];
+    byContainer[parent] = children.filter((c) => !claimed.includes(c));
+    if (!byContainer[parent].includes(box)) byContainer[parent].push(box);
+  }
+}
+function projectLogical(ir) {
+  const aws = ir.nodes.filter((n) => n.lexicon === "aws" && !isExample(n));
+  const componentOf = componentNamer(aws);
+  const byId = new Map(aws.map((n) => [n.id, n]));
+  const refOut = enrichedRefs(ir, aws, byId);
+  const vpcIds = new Set(aws.filter((n) => n.kind === "AWS::EC2::VPC").map((n) => n.id));
+  const subnetIds = new Set(aws.filter((n) => n.kind === "AWS::EC2::Subnet").map((n) => n.id));
+  const igwIds = new Set(aws.filter((n) => n.kind === "AWS::EC2::InternetGateway").map((n) => n.id));
+  const igwToVpc = /* @__PURE__ */ new Map();
+  for (const n of aws) {
+    if (n.kind !== "AWS::EC2::VPCGatewayAttachment") continue;
+    const refs = refOut.get(n.id) ?? /* @__PURE__ */ new Set();
+    const igw = [...refs].find((r) => igwIds.has(r));
+    const vpc = [...refs].find((r) => vpcIds.has(r));
+    if (igw && vpc) igwToVpc.set(igw, vpc);
+  }
+  const publicRouteTables = /* @__PURE__ */ new Set();
+  for (const n of aws) {
+    if (n.kind !== "AWS::EC2::Route") continue;
+    const refs = refOut.get(n.id) ?? /* @__PURE__ */ new Set();
+    if (![...refs].some((r) => igwIds.has(r))) continue;
+    for (const r of refs) if (byId.get(r)?.kind === "AWS::EC2::RouteTable") publicRouteTables.add(r);
+  }
+  const publicSubnets = /* @__PURE__ */ new Set();
+  for (const n of aws) {
+    if (n.kind !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+    const refs = refOut.get(n.id) ?? /* @__PURE__ */ new Set();
+    const subnet = [...refs].find((r) => subnetIds.has(r));
+    const rt = [...refs].find((r) => byId.get(r)?.kind === "AWS::EC2::RouteTable");
+    if (subnet && rt && publicRouteTables.has(rt)) publicSubnets.add(subnet);
+  }
+  const subnetScope = (id) => publicSubnets.has(id) || /public/i.test(id) ? "public" : /private/i.test(id) ? "private" : "subnet";
+  const defaultRegion = aws.map(regionOf).find(Boolean);
+  const regionForVpc = (vpcId) => byId.has(vpcId) ? regionOf(byId.get(vpcId)) ?? defaultRegion : defaultRegion;
+  const vpcTitle = (vpcId) => {
+    const region = regionForVpc(vpcId);
+    return `${region ? region + " \xB7 " : ""}VPC ${strAttr3(byId.get(vpcId), "CidrBlock") ?? vpcId}`;
+  };
+  const subnetTitle = (subnetId) => `${subnetScope(subnetId)} subnet ${strAttr3(byId.get(subnetId), "CidrBlock") ?? subnetId}`;
+  const GLOBAL = "regional & global";
+  const headline = aws.filter((n) => HEADLINE_KINDS.has(n.kind));
+  const placeOf = /* @__PURE__ */ new Map();
+  for (const n of headline) {
+    const subnet = nearestByRef(n.id, subnetIds, refOut);
+    if (subnet) placeOf.set(n.id, { kind: "subnet", subnet, vpc: nearestByRef(subnet, vpcIds, refOut) });
+    else {
+      const vpc = nearestByRef(n.id, vpcIds, refOut) ?? igwToVpc.get(n.id);
+      placeOf.set(n.id, vpc ? { kind: "vpc", vpc } : { kind: "global" });
+    }
+  }
+  const byContainer = {};
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  const ensureSubnet = (subnetId, vpcId) => {
+    const t = subnetTitle(subnetId);
+    if (vpcId) child(vpcTitle(vpcId), t);
+    return t;
+  };
+  const byComponent = /* @__PURE__ */ new Map();
+  for (const n of headline) (byComponent.get(componentOf(n)) ?? byComponent.set(componentOf(n), []).get(componentOf(n))).push(n);
+  for (const [component, members] of byComponent) {
+    const places = members.map((m) => placeOf.get(m.id));
+    const subnets = new Set(places.map((p) => p.kind === "subnet" ? p.subnet : ""));
+    const vpcs = new Set(places.map((p) => p.kind === "subnet" ? p.vpc : p.kind === "vpc" ? p.vpc : void 0).filter((v) => !!v));
+    let parent;
+    if (subnets.size === 1 && !subnets.has("")) {
+      const p = places[0];
+      parent = ensureSubnet(p.subnet, p.vpc);
+    } else if (vpcs.size >= 1) {
+      parent = vpcTitle([...vpcs][0]);
+    } else {
+      parent = GLOBAL;
+    }
+    child(parent, component);
+    for (const m of members) child(component, m.id);
+  }
+  const keptSet = new Set(headline.map((n) => n.id));
+  const adj = /* @__PURE__ */ new Map();
+  const link = (a, b) => {
+    if (a === b) return;
+    (adj.get(a) ?? adj.set(a, /* @__PURE__ */ new Set()).get(a)).add(b);
+    (adj.get(b) ?? adj.set(b, /* @__PURE__ */ new Set()).get(b)).add(a);
+  };
+  for (const [from, tos] of refOut) for (const to of tos) link(from, to);
+  const edges = [];
+  const seenEdge = /* @__PURE__ */ new Set();
+  const addEdge = (a, b, via) => {
+    if (a === b || !keptSet.has(a) || !keptSet.has(b)) return;
+    const key = a < b ? `${a}|${b}` : `${b}|${a}`;
+    if (seenEdge.has(key)) return;
+    seenEdge.add(key);
+    edges.push({ from: a, to: b, kind: "ref", ...via ? { viaAttr: via } : {} });
+  };
+  const isSg = (id) => byId.get(id)?.kind === "AWS::EC2::SecurityGroup";
+  const firstRef = (v) => {
+    const s = /* @__PURE__ */ new Set();
+    collectRefs3(v, s);
+    return [...s].find((id) => byId.has(id));
+  };
+  const sgsOf = (start) => {
+    const out = /* @__PURE__ */ new Set();
+    const seen = /* @__PURE__ */ new Set([start]);
+    let frontier = [...refOut.get(start) ?? []];
+    for (let depth = 0; depth < 3 && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        if (isSg(id)) out.add(id);
+        else if (byId.get(id)?.kind === "AWS::CloudFormation::Parameter") for (const r of refOut.get(id) ?? []) next.push(r);
+      }
+      frontier = next;
+    }
+    return out;
+  };
+  const sgMembers = /* @__PURE__ */ new Map();
+  for (const n of headline) for (const sg of sgsOf(n.id)) (sgMembers.get(sg) ?? sgMembers.set(sg, /* @__PURE__ */ new Set()).get(sg)).add(n.id);
+  const ingress = [];
+  for (const n of aws) {
+    if (n.kind === "AWS::EC2::SecurityGroup") {
+      const rules = n.attrs?.SecurityGroupIngress;
+      for (const r of Array.isArray(rules) ? rules : rules ? [rules] : []) {
+        const src = firstRef(r?.SourceSecurityGroupId);
+        if (src && isSg(src)) ingress.push([src, n.id]);
+      }
+    } else if (n.kind === "AWS::EC2::SecurityGroupIngress") {
+      const src = firstRef(n.attrs?.SourceSecurityGroupId);
+      const tgt = firstRef(n.attrs?.GroupId);
+      if (src && tgt && isSg(src) && isSg(tgt)) ingress.push([src, tgt]);
+    }
+  }
+  for (const [src, tgt] of ingress)
+    for (const rs of sgMembers.get(src) ?? []) for (const rt of sgMembers.get(tgt) ?? []) addEdge(rs, rt, "security-group ingress");
+  const contractable = (id) => !keptSet.has(id) && !NO_CONTRACT_KINDS.has(byId.get(id)?.kind ?? "");
+  for (const start of keptSet) {
+    const seen = /* @__PURE__ */ new Set([start]);
+    let frontier = [...adj.get(start) ?? []];
+    for (let depth = 0; depth < 8 && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        if (keptSet.has(id)) {
+          addEdge(start, id);
+          continue;
+        }
+        if (!contractable(id)) continue;
+        for (const nb of adj.get(id) ?? []) if (!seen.has(nb)) next.push(nb);
+      }
+      frontier = next;
+    }
+  }
+  for (const w of headline) {
+    if (!WORKLOAD_KINDS2.has(w.kind)) continue;
+    const seen = /* @__PURE__ */ new Set([w.id]);
+    let frontier = [...adj.get(w.id) ?? []];
+    for (let depth = 0; depth < 6 && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        if (keptSet.has(id)) {
+          if (DATA_STORE_KINDS.has(byId.get(id)?.kind ?? "")) addEdge(w.id, id, "data dependency");
+          continue;
+        }
+        for (const nb of adj.get(id) ?? []) if (!seen.has(nb)) next.push(nb);
+      }
+      frontier = next;
+    }
+  }
+  return { ir: { nodes: headline, edges, groups: {} }, byContainer };
+}
+
+// src/composite-deps.ts
+function kebabKind(kind) {
+  return kind.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function componentRepresentatives(ir, dag) {
+  const nodeById = new Map(ir.nodes.map((n) => [n.id, n]));
+  const knownComponents2 = new Set((dag.nodes ?? []).map((c) => c.id));
+  const compToNode = /* @__PURE__ */ new Map();
+  const sourceComponent = (id) => {
+    const parts = nodeById.get(id)?.sourceLoc?.file?.split("/") ?? [];
+    return parts.slice(0, -1).find((p) => knownComponents2.has(p));
+  };
+  for (const comp of dag.nodes ?? []) {
+    const liveNames = comp.attrs?.liveNames;
+    if (!Array.isArray(liveNames)) continue;
+    const fallbackShaped = liveNames.length === 1 && liveNames[0] === comp.id;
+    const owned = liveNames.filter((n) => {
+      if (typeof n !== "string" || !nodeById.has(n)) return false;
+      const src = sourceComponent(n);
+      return fallbackShaped ? src === comp.id : src === void 0 || src === comp.id;
+    });
+    if (owned.length === 0) continue;
+    compToNode.set(comp.id, owned.find((n) => !n.startsWith("byo")) ?? owned[0]);
+  }
+  for (const n of ir.nodes) {
+    const component = n.attrs?.component;
+    if (typeof component !== "string" || !knownComponents2.has(component) || compToNode.has(component)) continue;
+    compToNode.set(component, n.id);
+  }
+  const unmapped = /* @__PURE__ */ new Set();
+  for (const e of dag.edges) {
+    if (!compToNode.has(e.from)) unmapped.add(e.from);
+    if (!compToNode.has(e.to)) unmapped.add(e.to);
+  }
+  if (unmapped.size > 0) {
+    for (const n of ir.nodes) {
+      if (n.kind.includes("::")) continue;
+      const comp = kebabKind(n.kind);
+      if (!unmapped.has(comp)) continue;
+      const current = compToNode.get(comp);
+      if (!current || current.startsWith("byo") && !n.id.startsWith("byo")) compToNode.set(comp, n.id);
+    }
+  }
+  return compToNode;
+}
+function addCompositeDeps(ir, dag) {
+  const compToNode = componentRepresentatives(ir, dag);
+  const declared = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
+  for (const e of dag.edges) {
+    const from = compToNode.get(e.from);
+    const to = compToNode.get(e.to);
+    if (!from || !to || from === to) continue;
+    const key = `${from}\0${to}`;
+    if (declared.has(key)) continue;
+    declared.add(key);
+    ir.edges.push({ from, to, kind: "ref", viaAttr: "dependsOn", inferred: true });
+  }
+  return ir;
+}
+function addCompositeDepsCounted(ir, dag) {
+  const before = ir.edges.length;
+  const out = addCompositeDeps(ir, dag);
+  return { ir: out, attached: out.edges.length - before };
+}
+
+// src/zoom-notes.ts
+function zoomNote(zoom, ir, compositeEdgesAttached) {
+  const empty = ir.nodes.length === 0;
+  if (zoom === "components") {
+    return empty ? "no components discovered \u2014 nothing declares one in this project" : void 0;
+  }
+  if (zoom === "logical") {
+    return empty ? "logical is an AWS projection \u2014 no AWS resources in this estate" : void 0;
+  }
+  if (zoom === "composites") {
+    return compositeEdgesAttached === 0 ? "no component ownership to join \u2014 showing the resource graph unchanged" : void 0;
+  }
+  if (zoom === "runtime") {
+    const children = ir.nodes.filter((n) => n.runtimeOwner).length;
+    return children === 0 ? "nothing below the declaration boundary \u2014 no owner-referenced children on this substrate" : void 0;
+  }
+  return void 0;
+}
+function logicalKept(before, after) {
+  if (after > 0 && after * 3 >= before) return void 0;
+  return after === 0 ? `logical projected nothing from ${before} resources \u2014 it is a cloud-topology lens, and this estate declares none of the kinds it nests (behold#74)` : `logical kept ${after} of ${before} resources \u2014 it is a cloud-topology lens, and the rest are kinds it does not nest (behold#74)`;
+}
+function edgelessNote(zoom, ir) {
+  if (zoom === "components" || zoom === "logical") return void 0;
+  if (ir.nodes.length === 0 || ir.edges.length > 0) return void 0;
+  return "no edges \u2014 nothing in this estate references anything else";
+}
+function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore) {
+  const primary = zoom === "logical" && logicalBefore !== void 0 ? logicalKept(logicalBefore, ir.nodes.length) : zoomNote(zoom, ir, compositeEdgesAttached);
+  const notes = [primary, edgelessNote(zoom, ir)].filter((n) => n !== void 0);
+  return notes.length ? notes.join(" \xB7 ") : void 0;
+}
+function tierMismatchNote(ir, tiers, currentTier) {
+  const values = tiers?.values ?? [];
+  if (values.length < 2) return void 0;
+  const byLexicon = /* @__PURE__ */ new Map();
+  for (const n of ir.nodes) {
+    const status = n.attrs?._status;
+    if (status !== "good" && status !== "accent") continue;
+    const lexicon = n.lexicon ?? "?";
+    const c = byLexicon.get(lexicon) ?? { good: 0, accent: 0 };
+    c[status === "good" ? "good" : "accent"]++;
+    byLexicon.set(lexicon, c);
+  }
+  for (const [lexicon, { good, accent }] of [...byLexicon].sort()) {
+    if (accent < 2 || accent * 2 < good + accent) continue;
+    const here = currentTier ? `tier "${currentTier}"` : "the default tier";
+    const others = values.filter((v) => v !== currentTier).join(", ");
+    return `${accent} of ${good + accent} ${lexicon} resources read "declared, not deployed" at ${here} \u2014 if the estate runs another declared tier (${others}), pick it (\u2318K \u2192 tier)`;
+  }
+  return void 0;
+}
+
+// src/resources.ts
+var NON_RESOURCE_KINDS = /* @__PURE__ */ new Set(["AWS::CloudFormation::Parameter", "chant:output"]);
+function nonResourceEntities(ir) {
+  const out = /* @__PURE__ */ new Set();
+  for (const n of ir.nodes) if (NON_RESOURCE_KINDS.has(n.kind)) out.add(n.id);
+  return out;
+}
+function componentSegment(parts, known) {
+  if (known) {
+    return parts.slice(0, -1).find((p) => known.has(p));
+  }
+  return parts[0] === "src" && parts.length >= 3 ? parts[1] : void 0;
+}
+function resourcesByComponent(ir, known) {
+  const byComponent = {};
+  for (const n of ir.nodes) {
+    const parts = n.sourceLoc?.file?.split("/") ?? [];
+    const component = componentSegment(parts, known);
+    if (!component) continue;
+    (byComponent[component] ??= []).push({
+      id: n.id,
+      kind: n.kind,
+      lexicon: n.lexicon,
+      physicalId: n.physicalId,
+      ownership: n.ownership
+    });
+  }
+  return byComponent;
+}
+
+// src/reconcile.ts
+function summarizePlan(plan, byComponent, nonResource) {
+  const componentByEntity = /* @__PURE__ */ new Map();
+  for (const [component, resources] of Object.entries(byComponent)) {
+    for (const r of resources) componentByEntity.set(r.id, component);
+  }
+  const counts = {};
+  const unobservedCounts = {};
+  const runtimeCounts = {};
+  let uncorrelated = 0;
+  let unobservedUncorrelated = 0;
+  let runtimeUncorrelated = 0;
+  let total = 0;
+  let unobserved = 0;
+  let runtime = 0;
+  for (const entry of plan.entries) {
+    if (entry.action === "noop") continue;
+    if (nonResource?.has(entry.name)) continue;
+    const component = componentByEntity.get(entry.name);
+    if (entry.action === "unobserved") {
+      unobserved++;
+      if (component) unobservedCounts[component] = (unobservedCounts[component] ?? 0) + 1;
+      else unobservedUncorrelated++;
+      continue;
+    }
+    if (entry.action === "runtime") {
+      runtime++;
+      if (component) runtimeCounts[component] = (runtimeCounts[component] ?? 0) + 1;
+      else runtimeUncorrelated++;
+      continue;
+    }
+    total++;
+    if (component) counts[component] = (counts[component] ?? 0) + 1;
+    else uncorrelated++;
+  }
+  return {
+    env: plan.env,
+    total,
+    byComponent: counts,
+    uncorrelated,
+    unobserved,
+    unobservedByComponent: unobservedCounts,
+    unobservedUncorrelated,
+    runtime,
+    runtimeByComponent: runtimeCounts,
+    runtimeUncorrelated
+  };
+}
+
+// src/render.ts
+import { layoutIr, layoutArchitecture, renderSvg, cardSizes } from "@intentius/pinhole";
+function renderArchitecture(ir, byContainer, opts = {}) {
+  const spread = Math.min(1.5, ir.edges.length / Math.max(ir.nodes.length, 1));
+  const layout = layoutArchitecture(ir, byContainer, {
+    fit: true,
+    nodesep: Math.round(48 + spread * 48),
+    ranksep: Math.round(60 + spread * 56)
+  });
+  const svg = renderSvg(ir, layout, {
+    fit: true,
+    hideTitle: true,
+    groups: layout.groups,
+    ...opts.theme ? { theme: opts.theme } : {}
+  });
+  return { svg };
+}
+function renderGraph(ir, opts = {}) {
+  const groups = ir.groups;
+  const boxKey = groups.byWave ? "byWave" : opts.boxes;
+  const boxes = boxKey ? groups[boxKey] : void 0;
+  const layout = layoutIr(ir, { fit: true, ...boxes ? { groups: boxes } : {} });
+  if (opts.radial && !boxes) radializeLayout(layout, groupKeyByNode(ir), footprints(ir));
+  else if (!boxes) packComponents(layout, ir);
+  const svg = renderSvg(ir, layout, {
+    fit: true,
+    hideTitle: true,
+    ...boxes ? { groups: layout.groups } : {},
+    ...opts.theme ? { theme: opts.theme } : {}
+  });
+  return { svg };
+}
+var NODE_W = 175;
+var NODE_H = 104;
+function footprints(ir) {
+  const sizes = cardSizes(ir, { fit: true });
+  return new Map(Object.entries(sizes));
+}
+function packComponents(layout, ir) {
+  const nodes = layout.nodes;
+  if (!Array.isArray(nodes) || nodes.length < 2) return;
+  const idxOf = new Map(nodes.map((n, i) => [n.id, i]));
+  const parent = nodes.map((_, i) => i);
+  const find = (x) => {
+    while (parent[x] !== x) x = parent[x] = parent[parent[x]];
+    return x;
+  };
+  for (const e of ir.edges) {
+    const a = idxOf.get(e.from);
+    const b = idxOf.get(e.to);
+    if (a != null && b != null) parent[find(a)] = find(b);
+  }
+  const comps = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => (comps.get(find(i)) ?? comps.set(find(i), []).get(find(i))).push(n));
+  if (comps.size < 2) return;
+  const size = footprints(ir);
+  const halfW = (n) => (size.get(n.id)?.w ?? NODE_W) / 2;
+  const halfH = (n) => (size.get(n.id)?.h ?? NODE_H) / 2;
+  const boxes = [...comps.values()].map((ns) => {
+    const minX2 = Math.min(...ns.map((n) => n.x - halfW(n)));
+    const minY2 = Math.min(...ns.map((n) => n.y - halfH(n)));
+    return {
+      ns,
+      minX: minX2,
+      minY: minY2,
+      w: Math.max(...ns.map((n) => n.x + halfW(n))) - minX2,
+      h: Math.max(...ns.map((n) => n.y + halfH(n))) - minY2
+    };
+  });
+  boxes.sort((a, b) => b.w * b.h - a.w * a.h);
+  const gap = 56;
+  const totalArea = boxes.reduce((s, b) => s + (b.w + gap) * (b.h + gap), 0);
+  const targetW = Math.max(boxes[0].w, Math.sqrt(totalArea) * 1.3);
+  let shelfX = 0;
+  let shelfY = 0;
+  let shelfH = 0;
+  for (const b of boxes) {
+    if (shelfX > 0 && shelfX + b.w > targetW) {
+      shelfX = 0;
+      shelfY += shelfH + gap;
+      shelfH = 0;
+    }
+    const dx = shelfX - b.minX;
+    const dy = shelfY - b.minY;
+    for (const n of b.ns) {
+      n.x += dx;
+      n.y += dy;
+    }
+    shelfX += b.w + gap;
+    shelfH = Math.max(shelfH, b.h);
+  }
+  const minX = Math.min(...nodes.map((n) => n.x - halfW(n)));
+  const minY = Math.min(...nodes.map((n) => n.y - halfH(n)));
+  const pad = 60;
+  for (const n of nodes) {
+    n.x = n.x - minX + pad;
+    n.y = n.y - minY + pad;
+  }
+  layout.width = Math.max(...nodes.map((n) => n.x + halfW(n))) + pad;
+  layout.height = Math.max(...nodes.map((n) => n.y + halfH(n))) + pad;
+}
+function groupKeyByNode(ir) {
+  const out = /* @__PURE__ */ new Map();
+  for (const n of ir.nodes) {
+    const parts = (n.sourceLoc?.file ?? "").split("/");
+    let key;
+    if (parts[0] === "src" && parts[1] === "examples") key = "examples";
+    else if (parts[0] === "src" && parts.length >= 3) key = parts[1];
+    else key = n.lexicon || "other";
+    out.set(n.id, key);
+  }
+  return out;
+}
+function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
+  const nodes = layout.nodes;
+  if (!Array.isArray(nodes) || nodes.length < 3) return;
+  const wOf = (n) => size.get(n.id)?.w ?? NODE_W;
+  const hOf = (n) => size.get(n.id)?.h ?? NODE_H;
+  const bucket = (y) => Math.round(y / 8) * 8;
+  const levels = [...new Set(nodes.map((n) => bucket(n.y)))].sort((a, b) => a - b);
+  const rankOf = new Map(levels.map((y, i) => [y, i]));
+  const r0 = 380;
+  const groups = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    const k = groupOf.get(n.id) ?? "other";
+    (groups.get(k) ?? groups.set(k, []).get(k)).push(n);
+  }
+  const order = [...groups.keys()].sort();
+  const gapAngle = 0.08;
+  const usable = 2 * Math.PI - gapAngle * order.length;
+  const minWidth = Math.min(0.4, usable / order.length * 0.7);
+  const flexible = usable - minWidth * order.length;
+  const gap = 55;
+  const rowStep = 190;
+  let angle = -Math.PI / 2;
+  for (const key of order) {
+    const gnodes = groups.get(key).slice().sort((a, b) => (rankOf.get(bucket(a.y)) ?? 0) - (rankOf.get(bucket(b.y)) ?? 0) || a.x - b.x);
+    const width = minWidth + flexible * (gnodes.length / nodes.length);
+    const start = angle;
+    let radius = r0;
+    let i = 0;
+    while (i < gnodes.length) {
+      const capacity = Math.max(1, Math.floor(radius * width / (NODE_W + gap)));
+      const arc = gnodes.slice(i, i + capacity);
+      const c = arc.length;
+      arc.forEach((n, j) => {
+        const a = c === 1 ? start + width / 2 : start + width * ((j + 0.5) / c);
+        n.x = radius * Math.cos(a);
+        n.y = radius * Math.sin(a);
+      });
+      radius += rowStep;
+      i += capacity;
+    }
+    angle = start + width + gapAngle;
+  }
+  const MARGIN_W = 45;
+  const MARGIN_H = 12;
+  nodes.forEach((n, k) => {
+    n.x += (k * 13 % 7 - 3) * 0.4;
+    n.y += (k * 7 % 5 - 2) * 0.4;
+  });
+  for (let iter = 0; iter < 2500; iter++) {
+    let overlaps = 0;
+    for (let a = 0; a < nodes.length; a++) {
+      for (let b = a + 1; b < nodes.length; b++) {
+        const dx = nodes[b].x - nodes[a].x;
+        const dy = nodes[b].y - nodes[a].y;
+        const sepW = (wOf(nodes[a]) + wOf(nodes[b])) / 2 + MARGIN_W;
+        const sepH = (hOf(nodes[a]) + hOf(nodes[b])) / 2 + MARGIN_H;
+        const ox = sepW - Math.abs(dx);
+        const oy = sepH - Math.abs(dy);
+        if (ox <= 0 || oy <= 0) continue;
+        overlaps++;
+        const d = Math.hypot(dx, dy) || 0.01;
+        const push = Math.min(ox, oy) * 0.75 + 2;
+        const ux = dx / d;
+        const uy = dy / d;
+        nodes[a].x -= ux * push;
+        nodes[a].y -= uy * push;
+        nodes[b].x += ux * push;
+        nodes[b].y += uy * push;
+      }
+    }
+    if (overlaps === 0) break;
+  }
+  const minX = Math.min(...nodes.map((n) => n.x - wOf(n) / 2));
+  const minY = Math.min(...nodes.map((n) => n.y - hOf(n) / 2));
+  const pad = 60;
+  for (const n of nodes) {
+    n.x = n.x - minX + pad;
+    n.y = n.y - minY + pad;
+  }
+  layout.width = Math.max(...nodes.map((n) => n.x + wOf(n) / 2)) + pad;
+  layout.height = Math.max(...nodes.map((n) => n.y + hOf(n) / 2)) + pad;
+}
+
+// src/ops.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync4, existsSync as existsSync5 } from "node:fs";
+import { join as join6 } from "node:path";
+var APPLY_TARGET_LEXICON = {
+  cloudformation: "aws",
+  kubectl: "k8s",
+  // kustomize renders then applies through the same k8s pipeline
+  // (chant#1548), so it scopes to the same lexicon. Note the auto-sync
+  // wrinkle this creates on purpose: a kustomize Op AND a kubectl Op in one
+  // project both exact-match `k8s`, and two exact matches decline — two Ops
+  // claiming the k8s half genuinely is ambiguous.
+  kustomize: "k8s",
+  arm: "azure"
+};
+function kindOf(content) {
+  if (/\bApplyOp\b/.test(content)) return "apply";
+  if (/\bReconcileOp\b/.test(content)) return "reconcile";
+  if (/AuditOp\b/.test(content)) return "audit";
+  return "op";
+}
+function discoverOps(projectDir) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const sub of ["ops", "src", "."]) {
+    const dir = join6(projectDir, sub);
+    if (!existsSync5(dir)) continue;
+    for (const f of readdirSync3(dir)) {
+      if (!f.endsWith(".op.ts")) continue;
+      const content = readFileSync4(join6(dir, f), "utf8");
+      const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      if (!name || seen.has(name)) continue;
+      seen.add(name);
+      const gate = content.match(/signalName:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const env = content.match(/\benv:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const target = content.match(/\btarget:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const substrate = target ? APPLY_TARGET_LEXICON[target] : void 0;
+      out.push({
+        name,
+        kind: kindOf(content),
+        dir: projectDir,
+        ...gate ? { gate } : {},
+        ...env ? { env } : {},
+        ...substrate ? { substrate } : {}
+      });
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function discoverEstateOps(projectDirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const dir of projectDirs) {
+    for (const op of discoverOps(dir)) {
+      if (seen.has(op.name)) continue;
+      seen.add(op.name);
+      out.push(op);
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// src/adopt.ts
+var LIVE_IMPORT_LEXICONS = ["aws", "azure", "gcp", "k8s"];
+var LIVE = new Set(LIVE_IMPORT_LEXICONS);
+function extractPrUrl(line) {
+  const m = line.match(/https?:\/\/[^\s"'<>]+?\/(?:pull|pulls|merge_requests)\/\d+/);
+  return m ? m[0] : void 0;
+}
+
+// src/diff.ts
+function nodeObserved(json, nodeId) {
+  for (const lex of Object.values(json.lexicons ?? {})) {
+    const o = lex.observed?.[nodeId];
+    if (o) return o;
+  }
+  return null;
+}
+function nodeDiff(json, nodeId) {
+  for (const lex of Object.values(json.lexicons ?? {})) {
+    const r = lex.resources;
+    if (!r) continue;
+    const drift = r.driftedSinceSnapshot?.find((d) => d.name === nodeId);
+    if (drift) return { category: "drifted", changes: drift.changes ?? [] };
+    const unobserved = r.unobserved?.find((u) => u.name === nodeId);
+    if (unobserved) {
+      return {
+        category: "unobserved",
+        changes: [],
+        unobservedReason: unobserved.reason,
+        ...unobserved.detail ? { unobservedDetail: unobserved.detail } : {}
+      };
+    }
+    const runtimeChild = r.runtimeChildren?.find((rc) => rc.name === nodeId);
+    if (runtimeChild) return { category: "runtime", changes: [], runtimeOwner: runtimeChild.owner };
+    if (r.missing?.includes(nodeId)) return { category: "missing", changes: [] };
+    if (r.orphan?.includes(nodeId)) return { category: "orphan", changes: [] };
+    if (r.disappeared?.includes(nodeId)) return { category: "disappeared", changes: [] };
+    if (r.newlyObserved?.includes(nodeId)) return { category: "newlyObserved", changes: [] };
+    if (r.unchanged?.includes(nodeId)) return { category: "unchanged", changes: [] };
+  }
+  return null;
+}
+function nodeFieldDrift(json, nodeId) {
+  let sawDeep = false;
+  for (const lex of Object.values(json.lexicons ?? {})) {
+    const deep = lex.deep;
+    if (!deep) continue;
+    sawDeep = true;
+    const drifted = deep.drifted.find((e) => e.name === nodeId)?.changes;
+    const accepted = deep.accepted.find((e) => e.name === nodeId)?.changes;
+    if (drifted || accepted) return { drifted: drifted ?? [], accepted: accepted ?? [] };
+    if (deep.unchanged.includes(nodeId)) return { drifted: [], accepted: [] };
+  }
+  return sawDeep ? { drifted: [], accepted: [] } : null;
+}
+
+// src/health.ts
+var DEGRADED = /fail|error|rollback|crash|backoff|degraded|unhealthy|terminat|delete|denied|timeout|evicted|imagepull|cancel|unschedulable/i;
+var PROGRESSING = /in[_-]?progress|pending|creating|updating|provisioning|initializ|deploying|scaling|waiting|containercreating|accepted/i;
+var HEALTHY = /complete|running|active|ready|available|succeed|healthy|\bok\b|bound|synced|current|present/i;
+function neutralizeNegations(lower) {
+  let negated = false;
+  const mark = () => {
+    negated = true;
+    return " ";
+  };
+  const text = lower.replace(/\bnot[_\-\s]?[a-z]+\b/g, mark).replace(/\b[a-z]+\s*[=:]\s*false\b/g, mark);
+  return { text, negated };
+}
+function classifyHealth(status) {
+  if (!status) return "unknown";
+  const { text, negated } = neutralizeNegations(status.toLowerCase());
+  if (DEGRADED.test(text)) return "degraded";
+  if (PROGRESSING.test(text)) return "progressing";
+  if (negated) return "degraded";
+  if (HEALTHY.test(text)) return "healthy";
+  return "unknown";
+}
+
+// src/apply.ts
+var PROGRESS_EVENT_TYPES = /* @__PURE__ */ new Set([
+  "run-start",
+  "wave-start",
+  "component-start",
+  "phase-start",
+  "step",
+  "phase-done",
+  "component-done",
+  "wave-done",
+  "run-done"
+]);
+function parseProgressLine(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const type = parsed.type;
+  if (typeof type !== "string" || !PROGRESS_EVENT_TYPES.has(type)) return null;
+  return parsed;
+}
+var initialApplyProgress = { status: "idle", waves: [], components: [] };
+function applyProgressReducer(state, event) {
+  switch (event.type) {
+    case "run-start": {
+      const waves = event.waves.map((components2, i) => ({
+        wave: i + 1,
+        components: components2,
+        status: "pending"
+      }));
+      const components = waves.flatMap(
+        (w) => w.components.map((component) => ({ component, wave: w.wave, status: "pending" }))
+      );
+      return { status: "running", waves, components };
+    }
+    case "wave-start":
+      return {
+        ...state,
+        waves: state.waves.map((w) => w.wave === event.wave ? { ...w, status: "running" } : w)
+      };
+    case "component-start":
+      return {
+        ...state,
+        components: state.components.map(
+          (c) => c.component === event.component ? { ...c, status: "running" } : c
+        )
+      };
+    case "phase-start":
+      return {
+        ...state,
+        components: state.components.map(
+          (c) => c.component === event.component ? { ...c, phase: event.phase, step: void 0 } : c
+        )
+      };
+    case "step":
+      return {
+        ...state,
+        components: state.components.map(
+          (c) => c.component === event.component ? {
+            ...c,
+            phase: event.phase,
+            step: event.step,
+            ...event.status === "failed" ? { status: "failed", error: event.error } : {}
+          } : c
+        )
+      };
+    case "phase-done":
+      return {
+        ...state,
+        components: state.components.map(
+          (c) => c.component === event.component && event.status === "failed" ? { ...c, status: "failed" } : c
+        )
+      };
+    case "component-done":
+      return {
+        ...state,
+        components: state.components.map(
+          (c) => c.component === event.component ? { ...c, status: event.status } : c
+        )
+      };
+    case "wave-done":
+      return {
+        ...state,
+        waves: state.waves.map((w) => w.wave === event.wave ? { ...w, status: event.status } : w)
+      };
+    case "run-done":
+      return { ...state, status: event.status };
+    default:
+      return state;
+  }
+}
+
+// src/op-runner.ts
+var OpRunner = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  current = null;
+  /** The last known apply progress (M3): kept around after the run ends (and
+   * across dial re-renders) so a client that opens `/api/ops` mid-run — or
+   * after a page reload — can hydrate the structured view instead of starting
+   * blank. Reset to a fresh idle state at the start of each new `apply()`
+   * call (the reducer would clear it on `run-start` anyway; this seeds it
+   * before the first event lands so a reload between trigger and first event
+   * doesn't show the PREVIOUS run's stale terminal state). */
+  lastApplyProgress = initialApplyProgress;
+  /** Name of the running op, or null. */
+  get running() {
+    return this.current;
+  }
+  /** The last known apply progress model (M3) — `initialApplyProgress` if no
+   * apply has run yet this session. */
+  get applyProgress() {
+    return this.lastApplyProgress;
+  }
+  /**
+   * Start `chant run <name>` unless one is already running (the Sync/Adopt/auto-
+   * sync path). `cwd` is the Op's own project dir (#31 multi-estate); defaults to
+   * the primary. Returns true if it started, false if busy.
+   */
+  trigger(name, opEnv, cwd) {
+    return this.start(["run", name], name, opEnv, cwd);
+  }
+  /**
+   * Run an arbitrary `chant` invocation through the same guard/stream/PR/capture
+   * path — used by the delegated rollback command (#28), which is a lifecycle
+   * command, not an Op. `label` is the display name (the running-guard key).
+   */
+  run(args, label, opEnv) {
+    return this.start(args, label, opEnv);
+  }
+  /**
+   * Delegated write (M3, #54's apply step): `chant run <target> --components
+   * --env <env> --progress-json`, guarded the same way as `trigger`/`run` —
+   * only one write in flight at a time; returns false (the caller answers
+   * 409) when something else is already running. `target` is a component
+   * name or `"all"`.
+   *
+   * Each streamed line is checked with `parseProgressLine`: a recognized
+   * `RunProgressEvent` folds into the structured progress model
+   * (`applyProgressReducer`) and broadcasts as an `apply` SSE event — the
+   * primary surface the SPA renders (web/app.js's live wave/phase view).
+   * Everything else (chant's human-readable driver summary, a warning, a
+   * release-record line) still reaches the `op` channel as a raw-log
+   * fallback, exactly like any other Op — `start()`'s default behaviour,
+   * skipped only for the lines this consumes.
+   */
+  apply(target, env) {
+    if (this.current) return false;
+    this.lastApplyProgress = initialApplyProgress;
+    return this.start(applyArgs(target, env), `apply ${target}`, env, void 0, (line) => {
+      const event = parseProgressLine(line);
+      if (!event) return false;
+      this.lastApplyProgress = applyProgressReducer(this.lastApplyProgress, event);
+      this.deps.broadcaster.emit("apply", JSON.stringify(this.lastApplyProgress));
+      return true;
+    });
+  }
+  /**
+   * A local pipeline run as a first-class action (#163, the first slice of
+   * #61): the same guarded/streamed shell-out as `bringUp`, but the run's
+   * structure is KNOWN — `pipeline` is `/api/ci`'s parsed stages/jobs — so
+   * progress renders on the dial exactly like an apply: stages as waves, jobs
+   * correlated to their components (src/ci-run.ts). Every line still reaches
+   * the `op` now-line (a pipeline log is worth reading raw); the classifier
+   * only decides whether the structured model ALSO moved. The exit code, not
+   * the log, settles the verdict.
+   */
+  pipeline(label, cmd, args, cwd, pipeline) {
+    if (this.current) return false;
+    const { broadcaster } = this.deps;
+    let state = pipelineProgress(pipeline);
+    this.lastApplyProgress = state;
+    broadcaster.emit("op", `\u25B6 ${cmd} ${args.join(" ")}`);
+    broadcaster.emit("apply", JSON.stringify(state));
+    const op = runCommandStream(cmd, args, cwd, (line) => {
+      broadcaster.emit("op", line);
+      const next = foldPipelineLine(state, line);
+      if (next === state) return;
+      state = next;
+      this.lastApplyProgress = state;
+      broadcaster.emit("apply", JSON.stringify(state));
+    });
+    this.current = label;
+    void op.done.then((code) => {
+      state = finishPipelineProgress(state, code);
+      this.lastApplyProgress = state;
+      broadcaster.emit("apply", JSON.stringify(state));
+      broadcaster.emit("op", `\u25A0 ${label} exited ${code}`);
+      this.current = null;
+      Promise.resolve(this.deps.onDone(void 0)).then(() => broadcaster.emit("changed")).catch((err) => broadcaster.emit("op", `\u26A0 post-op capture: ${err instanceof Error ? err.message : String(err)}`));
+    });
+    return true;
+  }
+  /**
+   * A tracked async action (#164): holds the same single-writer guard while a
+   * code-driven loop (not a child process) does the work — the GitHub Actions
+   * dispatch-and-follow, whose "stream" is polled structured JSON rather than
+   * a process's stdout. The task reports lines for the now-line and
+   * apply-shaped progress for the dial, and resolves to an exit code. The
+   * guard releases the moment the task settles; a thrown task reads exit 1.
+   */
+  track(label, task) {
+    if (this.current) return false;
+    const { broadcaster } = this.deps;
+    this.current = label;
+    this.lastApplyProgress = initialApplyProgress;
+    const io = {
+      line: (s) => broadcaster.emit("op", s),
+      progress: (s) => {
+        this.lastApplyProgress = s;
+        broadcaster.emit("apply", JSON.stringify(s));
+      }
+    };
+    void task(io).catch((err) => {
+      io.line(`\u2717 ${label}: ${err instanceof Error ? err.message : String(err)}`);
+      return 1;
+    }).then((code) => {
+      broadcaster.emit("op", `\u25A0 ${label} exited ${code}`);
+      this.current = null;
+      Promise.resolve(this.deps.onDone(void 0)).then(() => broadcaster.emit("changed")).catch((err) => broadcaster.emit("op", `\u26A0 post-op capture: ${err instanceof Error ? err.message : String(err)}`));
+    });
+    return true;
+  }
+  /**
+   * Substrate bring-up (M5, #54): run a project's local bring-up script (e.g.
+   * `bash scripts/local/local-up.sh`, `test/gitlab-runtime-e2e.sh`) through the
+   * SAME running-guard + stream + post-run capture as an Op — behold triggers,
+   * the script does the work, its output streams to the `op` channel, and the
+   * post-run `changed` re-checks the graph (and lets the readiness strip
+   * re-detect). Returns false (→ 409) when something is already running. `cwd`
+   * is the served project's dir.
+   */
+  bringUp(label, cmd, args, cwd) {
+    if (this.current) return false;
+    const { broadcaster } = this.deps;
+    broadcaster.emit("op", `\u25B6 ${cmd} ${args.join(" ")}`);
+    const op = runCommandStream(cmd, args, cwd, (line) => broadcaster.emit("op", line));
+    this.current = label;
+    void op.done.then((code) => {
+      broadcaster.emit("op", `\u25A0 ${label} exited ${code}`);
+      this.current = null;
+      Promise.resolve(this.deps.onDone(void 0)).then(() => broadcaster.emit("changed")).catch((err) => broadcaster.emit("op", `\u26A0 post-op capture: ${err instanceof Error ? err.message : String(err)}`));
+    });
+    return true;
+  }
+  /**
+   * Shared runner: guard on a single in-flight invocation, stream output as `op`
+   * events, lift a PR URL to a `pr` event, and on completion capture a frame and
+   * emit `changed`. `onLine`, when given a streamed line, returns true if it
+   * fully handled that line (apply()'s progress-JSON parsing) — `start()` then
+   * skips its own `op`/`pr` broadcast for that one line, leaving every other
+   * line's raw-log fallback untouched.
+   */
+  start(args, label, opEnv, cwd, onLine) {
+    if (this.current) return false;
+    const { projectDir, broadcaster } = this.deps;
+    broadcaster.emit("op", `\u25B6 chant ${args.join(" ")}`);
+    const op = runChantStream(args, cwd ?? projectDir, (line) => {
+      if (onLine?.(line)) return;
+      broadcaster.emit("op", line);
+      const pr = extractPrUrl(line);
+      if (pr) broadcaster.emit("pr", pr);
+    });
+    this.current = label;
+    void op.done.then((code) => {
+      broadcaster.emit("op", `\u25A0 ${label} exited ${code}`);
+      this.current = null;
+      Promise.resolve(this.deps.onDone(opEnv)).then(() => broadcaster.emit("changed")).catch((err) => broadcaster.emit("op", `\u26A0 post-op capture: ${err instanceof Error ? err.message : String(err)}`));
+    });
+    return true;
+  }
+};
+
+// src/substrates.ts
+import { spawn as spawn3 } from "node:child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "node:fs";
+import { join as join7 } from "node:path";
+import { platform } from "node:os";
+function probe(cmd, args) {
+  return new Promise((resolve3) => {
+    let out = "";
+    let proc;
+    try {
+      proc = spawn3(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    } catch {
+      resolve3({ code: 127, out: "" });
+      return;
+    }
+    proc.stdout.on("data", (d) => out += d);
+    proc.stderr.on("data", (d) => out += d);
+    proc.on("error", () => resolve3({ code: 127, out }));
+    proc.on("close", (code) => resolve3({ code: code ?? 1, out }));
+  });
+}
+async function dockerAvailable() {
+  const { code } = await probe("docker", ["info", "--format", "{{.ServerVersion}}"]);
+  return code === 0;
+}
+async function dockerRunning(nameFilter) {
+  const { code, out } = await probe("docker", ["ps", "--filter", `name=${nameFilter}`, "--format", "{{.Names}}"]);
+  if (code !== 0) return [];
+  return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+}
+function scriptBringUp(projectDir, relPath, label) {
+  return existsSync6(join7(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+}
+function projectLexicons(projectDir) {
+  try {
+    const src = readFileSync5(join7(projectDir, "chant.config.ts"), "utf-8");
+    const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
+    if (!m) return [];
+    return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
+  } catch {
+    return [];
+  }
+}
+async function detectSubstrates(projectDir, preview = false, boundContext) {
+  const subs = [];
+  const lexicons = projectLexicons(projectDir);
+  const docker = await dockerAvailable();
+  subs.push({
+    name: "docker",
+    label: "Docker",
+    status: docker ? "up" : "down",
+    detail: docker ? "daemon running" : "daemon not running",
+    bringUp: docker || platform() !== "darwin" ? void 0 : { label: "open -a Docker", cmd: "open", args: ["-a", "Docker"] }
+  });
+  const dep = (up, upDetail, offDetail) => !docker ? { status: "blocked", detail: "waiting on Docker" } : { status: up ? "up" : offDetail === "on-demand (pipeline run)" ? "on-demand" : "down", detail: up ? upDetail : offDetail };
+  if (lexicons.includes("aws")) {
+    const floci = docker ? await dockerRunning("^floci$|^chant-floci$") : [];
+    const d = dep(floci.length > 0, "container up on :4566", "not running");
+    subs.push({
+      name: "floci",
+      label: "Floci",
+      ...d,
+      bringUp: docker && !floci.length ? scriptBringUp(projectDir, "scripts/local/local-up.sh", "local-up") : void 0
+    });
+  }
+  const emulators = [
+    ["azure", "floci-az", "floci-az", "^chant-floci-az$", 4577],
+    ["gcp", "floci-gcp", "floci-gcp", "^chant-floci-gcp$", 4588]
+  ];
+  for (const [lexicon, name, label, pattern, port] of emulators) {
+    if (!lexicons.includes(lexicon)) continue;
+    const running = docker ? await dockerRunning(pattern) : [];
+    subs.push({
+      name,
+      label,
+      ...dep(running.length > 0, `container up on :${port}`, "not running"),
+      bringUp: docker && !running.length ? scriptBringUp(projectDir, "scripts/local/local-up.sh", "local-up") : void 0
+    });
+  }
+  if (preview) return subs;
+  const forges = [
+    ["gitlab-ci", "GitLab CI", ".gitlab", "test/gitlab-runtime-e2e.sh"],
+    ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
+  ];
+  for (const [name, label, marker, script] of forges) {
+    if (!existsSync6(join7(projectDir, marker))) continue;
+    const c = docker ? await dockerRunning(name) : [];
+    const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
+    subs.push({
+      name,
+      label,
+      ...d,
+      bringUp: docker ? scriptBringUp(projectDir, script, `run ${label} pipeline`) : void 0
+    });
+  }
+  if (lexicons.includes("k8s")) {
+    const k3d = await probe("k3d", ["cluster", "list", "--no-headers"]);
+    const clusters = k3d.code === 0 ? k3d.out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean) : [];
+    subs.push({
+      name: "k3d",
+      label: "k3d",
+      status: k3d.code === 127 ? "unknown" : clusters.length ? "up" : "down",
+      detail: k3d.code === 127 ? "k3d not installed" : clusters.length ? `${clusters.length} cluster(s)` : "no clusters",
+      bringUp: docker && k3d.code !== 127 && !clusters.length ? scriptBringUp(projectDir, "scripts/local/local-up.sh", "local-up") : void 0
+    });
+  }
+  if (lexicons.includes("fly")) {
+    const endpoint = process.env.FLY_FLAPS_BASE_URL;
+    subs.push({
+      name: "fly",
+      label: "Fly",
+      status: "on-demand",
+      detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
+    });
+  }
+  if (existsSync6(join7(projectDir, ".github", "workflows"))) {
+    const gh = await probe("gh", ["auth", "status"]);
+    const ready = gh.code === 0;
+    subs.push({
+      name: "github",
+      label: "GitHub Actions",
+      status: ready ? "on-demand" : "blocked",
+      detail: ready ? "workflows committed \u2014 dispatch via your gh login (\u2318K)" : gh.code === 127 ? "gh not installed \u2014 the dispatch runs through YOUR gh login" : "gh not authenticated \u2014 run `gh auth login`"
+    });
+  }
+  if (lexicons.includes("temporal")) {
+    let hasProfiles = false;
+    try {
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync5(join7(projectDir, "chant.config.ts"), "utf-8"));
+    } catch {
+    }
+    subs.push({
+      name: "temporal",
+      label: "Temporal",
+      status: hasProfiles ? "on-demand" : "blocked",
+      detail: hasProfiles ? "profiles declared \u2014 Ops run on the bound Temporal" : "no temporal.profiles in chant.config.ts \u2014 chant run will refuse"
+    });
+  }
+  if (lexicons.includes("helm")) {
+    const helm = await probe("helm", ["version", "--short"]);
+    const ambient = helm.code === 0 && !boundContext ? await probe("kubectl", ["config", "current-context"]) : { code: 127, out: "" };
+    const ctx = boundContext ?? (ambient.code === 0 ? ambient.out.trim() : "");
+    subs.push({
+      name: "helm",
+      label: "Helm",
+      status: helm.code === 127 ? "unknown" : ctx ? "on-demand" : "blocked",
+      detail: helm.code === 127 ? "helm not installed" : ctx ? `${helm.out.trim()} \xB7 context ${ctx}${boundContext ? " (bound)" : ""}` : "no kube context"
+    });
+  }
+  return subs;
+}
+
+// src/autosync.ts
+var AUTO_SYNC_MODES = ["off", "apply", "pull-request"];
+function isAutoSyncMode(v) {
+  return AUTO_SYNC_MODES.includes(v);
+}
+function suspendedByRollback(rollbackBranches, movedLexicons) {
+  return rollbackBranches.length ? new Set(movedLexicons) : /* @__PURE__ */ new Set();
+}
+function pickAutoSyncOps(mode, ops, running, movedLexicons, suspended = /* @__PURE__ */ new Set()) {
+  if (mode === "off" || running) return { picks: [], declined: [] };
+  const kind = mode === "apply" ? "apply" : "reconcile";
+  const candidates = ops.filter((o) => o.kind === kind);
+  const declined = [];
+  const byOp = /* @__PURE__ */ new Map();
+  for (const lexicon of [...movedLexicons].sort()) {
+    if (mode === "pull-request" && suspended.has(lexicon)) {
+      declined.push({ lexicon, reason: "a rollback is open for this substrate" });
+      continue;
+    }
+    const exact = candidates.filter((o) => o.substrate === lexicon);
+    const pool = exact.length ? exact : candidates.filter((o) => !o.substrate);
+    if (pool.length === 0) {
+      declined.push({ lexicon, reason: `no ${kind} Op declares this substrate` });
+      continue;
+    }
+    if (pool.length > 1) {
+      const names = pool.map((o) => o.name).join(", ");
+      declined.push({ lexicon, reason: `${pool.length} ${kind} Ops match (${names})` });
+      continue;
+    }
+    const op = pool[0];
+    const pick = byOp.get(op.name);
+    if (pick) pick.lexicons.push(lexicon);
+    else byOp.set(op.name, { op, lexicons: [lexicon] });
+  }
+  return { picks: [...byOp.values()], declined };
+}
+
+// src/history.ts
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+var execFileAsync = promisify3(execFile3);
+var SEP = "";
+function parseGitLog(stdout) {
+  return stdout.split("\n").map((l) => l.trim()).filter(Boolean).map((line) => {
+    const [sha, subject, date, author] = line.split(SEP);
+    return { sha, subject: subject ?? "", date: date ?? "", author: author ?? "" };
+  }).filter((c) => c.sha);
+}
+async function sourceCommits(projectDir, limit = 20) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["log", `-n${limit}`, `--format=%h${SEP}%s${SEP}%cs${SEP}%an`],
+      { cwd: projectDir }
+    );
+    return parseGitLog(stdout);
+  } catch {
+    return [];
+  }
+}
+function parseRollbackBranches(stdout, env) {
+  const prefix = env ? `chant/rollback-${env}-` : "chant/rollback-";
+  return stdout.split("\n").map((l) => l.replace(/^[*+]?\s*/, "").trim()).filter((l) => l.startsWith(prefix)).sort();
+}
+async function openRollbackBranches(projectDir, env) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["branch", "--list", "--all", "--format=%(refname:short)"],
+      { cwd: projectDir }
+    );
+    const stripped = stdout.split("\n").map((l) => l.trim().replace(/^[^/]+\/(?=chant\/rollback-)/, "")).join("\n");
+    return [...new Set(parseRollbackBranches(stripped, env))];
+  } catch {
+    return [];
+  }
+}
+
+// src/estate.ts
+import { composeStacks, shortStackNames } from "@intentius/pinhole";
+async function composeEstate(projectDirs, opts = {}) {
+  const names = shortStackNames(projectDirs);
+  const stacks = await Promise.all(
+    projectDirs.map(async (dir, i) => ({ name: names[i], ir: await graphIr(dir, opts) }))
+  );
+  return composeStacks(stacks);
+}
+
+// src/events.ts
+import { watch, existsSync as existsSync7 } from "node:fs";
+import { join as join8 } from "node:path";
+var Broadcaster = class {
+  listeners = /* @__PURE__ */ new Set();
+  subscribe(fn) {
+    this.listeners.add(fn);
+    return () => {
+      this.listeners.delete(fn);
+    };
+  }
+  emit(type, data = "") {
+    for (const fn of [...this.listeners]) fn(type, data);
+  }
+  get size() {
+    return this.listeners.size;
+  }
+};
+var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
+function watchSource(projectDir, onChange, debounceMs = 200) {
+  const dir = existsSync7(join8(projectDir, "src")) ? join8(projectDir, "src") : projectDir;
+  let timer;
+  const watcher = watch(dir, { recursive: true }, (_event, file) => {
+    const name = typeof file === "string" ? file : "";
+    if (!name || IGNORE.test(name) || !name.endsWith(".ts")) return;
+    clearTimeout(timer);
+    timer = setTimeout(onChange, debounceMs);
+  });
+  return () => {
+    clearTimeout(timer);
+    watcher.close();
+  };
+}
+
+// src/poll.ts
+function digestOf(nodes) {
+  return nodes.map((n) => `${n.id}=${n.attrs?._status ?? ""}`).sort().join("\n");
+}
+var UNKNOWN_LEXICON = "";
+function driftDigestsByLexicon(ir) {
+  const byLexicon = /* @__PURE__ */ new Map();
+  for (const n of ir.nodes) {
+    const key = n.lexicon ?? UNKNOWN_LEXICON;
+    const bucket = byLexicon.get(key);
+    if (bucket) bucket.push(n);
+    else byLexicon.set(key, [n]);
+  }
+  const out = {};
+  for (const [lexicon, nodes] of byLexicon) out[lexicon] = digestOf(nodes);
+  return out;
+}
+function changedLexicons(prev, next) {
+  const moved = /* @__PURE__ */ new Set();
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(prev), ...Object.keys(next)])) {
+    if (prev[key] !== next[key]) moved.add(key);
+  }
+  return [...moved].sort();
+}
+function startDriftPoll(opts) {
+  let stopped = false;
+  let last;
+  let timer;
+  const tick = async () => {
+    try {
+      const digests = driftDigestsByLexicon(await opts.query());
+      if (last !== void 0) {
+        const moved = changedLexicons(last, digests);
+        if (moved.length) opts.onChange(moved);
+      }
+      last = digests;
+    } catch (err) {
+      opts.onError?.(err);
+    }
+    if (!stopped) timer = setTimeout(tick, opts.intervalMs);
+  };
+  timer = setTimeout(tick, opts.intervalMs);
+  return () => {
+    stopped = true;
+    clearTimeout(timer);
+  };
+}
+
+// src/frames.ts
+function frameDigest(ir) {
+  const nodes = ir.nodes.map((n) => `${n.id}:${n.kind}:${n.attrs?._status ?? ""}`).sort();
+  const edges = ir.edges.map((e) => `${e.from}>${e.to}`).sort();
+  return `${nodes.join("|")}#${edges.join("|")}`;
+}
+var FrameBuffer = class {
+  constructor(max = 100, now = () => Date.now()) {
+    this.max = max;
+    this.now = now;
+  }
+  max;
+  now;
+  frames = [];
+  /** Capture `ir` as a frame. Skips (returns null) if identical to the last
+   * frame's digest — only real state changes become keyframes. */
+  capture(ir) {
+    const digest = frameDigest(ir);
+    const last = this.frames[this.frames.length - 1];
+    if (last && last.digest === digest) return null;
+    const frame = { id: String(this.seq++), t: this.now(), digest, ir };
+    this.frames.push(frame);
+    if (this.frames.length > this.max) this.frames.shift();
+    return frame;
+  }
+  seq = 0;
+  all() {
+    return this.frames;
+  }
+  get size() {
+    return this.frames.length;
+  }
+  summaries() {
+    return this.frames.map((f) => {
+      const byLexicon = {};
+      for (const n of f.ir.nodes) byLexicon[n.lexicon] = (byLexicon[n.lexicon] ?? 0) + 1;
+      return { id: f.id, t: f.t, nodes: f.ir.nodes.length, edges: f.ir.edges.length, byLexicon };
+    });
+  }
+};
+
+// src/lanes.ts
+import { renderMorphHtml, layoutIr as layoutIr2 } from "@intentius/pinhole";
+function safeJson(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+var LANES_CSS = `
+#behold-lanes { position: fixed; left: 0; right: 0; bottom: 0; background: #0d1117;
+  border-top: 1px solid #30363d; padding: 8px 12px 10px; font: 12px ui-sans-serif, system-ui, sans-serif; color: #8b949e; }
+#behold-lanes .hd { display: flex; gap: 14px; align-items: baseline; margin-bottom: 4px; }
+#behold-lanes .hd .rt { color: #d29922; }
+#behold-lanes canvas { display: block; width: 100%; cursor: pointer; }
+#behold-diff { position: fixed; right: 12px; bottom: 156px; width: 260px; max-height: 40vh; overflow: auto;
+  background: #161b22; border: 1px solid #30363d; border-radius: 6px; padding: 10px 12px; font: 12px ui-sans-serif, system-ui, sans-serif;
+  color: #e6edf3; display: none; }
+#behold-diff h4 { margin: 0 0 6px; font-size: 12px; color: #8b949e; }
+#behold-diff .a { color: #3fb950; } #behold-diff .r { color: #f85149; } #behold-diff .c { color: #d29922; }
+body { padding-bottom: 150px; }`;
+function laneStripScript(frames) {
+  return `<script>
+const LF = ${safeJson(frames)};
+(function () {
+  const host = document.getElementById("behold-lanes-canvas");
+  if (!host || LF.length < 1) return;
+  const subs = [...new Set(LF.flatMap(f => Object.keys(f.byLexicon)))].sort();
+  const rowH = 22, padL = 96, padR = 16, padT = 6;
+  const H = padT + subs.length * rowH + 24;
+  const t0 = LF[0].t, tN = LF[LF.length - 1].t, span = Math.max(1, tN - t0);
+  const offset = {}; // per-substrate time offset (graph-inert)
+  let cur = LF.length - 1, focus = null, pair = null;
+
+  function baseX(i) { const W = host.clientWidth - padL - padR;
+    const frac = span > 1 ? (LF[i].t - t0) / span : (LF.length > 1 ? i / (LF.length - 1) : 0); return padL + frac * W; }
+  function xOf(i, sub) { const W = host.clientWidth - padL - padR; return baseX(i) + ((offset[sub] || 0) / span) * W; }
+  const anyOffset = () => subs.some(s => offset[s]);
+
+  function changedAt(id, i) { // node changed vs previous frame (appear/vanish/status)
+    const now = LF[i].status[id], prev = i > 0 ? LF[i-1].status[id] : undefined;
+    const inNow = now !== undefined, inPrev = prev !== undefined;
+    return inNow !== inPrev || (inNow && inPrev && now !== prev);
+  }
+  const color = s => s === "good" ? "#3fb950" : s === "warn" ? "#d29922" : s === "accent" ? "#58a6ff" : "#6e7681";
+
+  function draw() {
+    const dpr = window.devicePixelRatio || 1;
+    host.width = host.clientWidth * dpr; host.height = H * dpr; host.style.height = H + "px";
+    const c = host.getContext("2d"); c.setTransform(dpr, 0, 0, dpr, 0, 0);
+    c.clearRect(0, 0, host.clientWidth, H); c.font = "12px ui-sans-serif, system-ui, sans-serif";
+    subs.forEach((s, r) => {
+      const y = padT + r * rowH + rowH / 2;
+      c.fillStyle = offset[s] ? "#d29922" : "#8b949e"; c.textAlign = "left"; c.fillText(s, 8, y + 4);
+      c.strokeStyle = "#21262d"; c.beginPath(); c.moveTo(padL, y); c.lineTo(host.clientWidth - padR, y); c.stroke();
+      LF.forEach((f, i) => {
+        if (!f.byLexicon[s]) return;
+        // dot per substrate; brighter when a node in this substrate changed at i
+        const changed = Object.keys(f.status).some(id => f.lexicon[id] === s && changedAt(id, i));
+        const hi = focus && f.lexicon[focus] === s && changedAt(focus, i);
+        c.fillStyle = hi ? "#f0f6fc" : changed ? color(mode(f, s)) : "#30363d";
+        c.beginPath(); c.arc(xOf(i, s), y, i === cur ? 5 : hi ? 4.5 : 3.5, 0, 7); c.fill();
+      });
+    });
+    const px = baseX(cur); c.strokeStyle = "#58a6ff"; c.lineWidth = 1.5;
+    c.beginPath(); c.moveTo(px, padT - 2); c.lineTo(px, padT + subs.length * rowH); c.stroke();
+    if (pair != null) { const qx = baseX(pair); c.strokeStyle = "#d29922"; c.setLineDash([3,3]);
+      c.beginPath(); c.moveTo(qx, padT - 2); c.lineTo(qx, padT + subs.length * rowH); c.stroke(); c.setLineDash([]); }
+    c.fillStyle = "#e6edf3"; c.textAlign = "center"; c.fillText(LF[cur].name, px, padT + subs.length * rowH + 16);
+    document.getElementById("behold-lanes-meta").textContent =
+      LF.length + " frames \xB7 frame " + (cur + 1) + "/" + LF.length + (focus ? " \xB7 focus " + focus : "");
+    document.getElementById("behold-lanes-rt").style.display = anyOffset() ? "inline" : "none";
+  }
+  function mode(f, s) { for (const id in f.status) if (f.lexicon[id] === s) return f.status[id]; return ""; }
+
+  function nearest(clientX) { const rect = host.getBoundingClientRect(); const x = clientX - rect.left;
+    let best = 0, bd = Infinity; for (let i = 0; i < LF.length; i++) { const d = Math.abs(baseX(i) - x); if (d < bd) { bd = d; best = i; } } return best; }
+  function rowAt(clientY) { const rect = host.getBoundingClientRect(); const r = Math.floor((clientY - rect.top - padT) / rowH); return subs[r]; }
+  function go(i) { cur = Math.max(0, Math.min(LF.length - 1, i)); if (window.applyView) window.applyView(cur); draw(); }
+
+  function showDiff() {
+    const panel = document.getElementById("behold-diff");
+    if (pair == null) { panel.style.display = "none"; return; }
+    const a = LF[Math.min(cur, pair)].status, b = LF[Math.max(cur, pair)].status;
+    const added = [], removed = [], changed = [];
+    for (const id of new Set([...Object.keys(a), ...Object.keys(b)])) {
+      if (!(id in a)) added.push(id); else if (!(id in b)) removed.push(id); else if (a[id] !== b[id]) changed.push(id);
+    }
+    panel.innerHTML = "<h4>frame diff " + (Math.min(cur,pair)+1) + " \u2192 " + (Math.max(cur,pair)+1) + "</h4>" +
+      added.map(x => '<div class="a">+ ' + x + '</div>').join("") +
+      removed.map(x => '<div class="r">- ' + x + '</div>').join("") +
+      changed.map(x => '<div class="c">~ ' + x + '</div>').join("") ||
+      "<h4>frame diff</h4><div>no change</div>";
+    panel.style.display = "block";
+  }
+
+  // playhead (time cursor) + shift-click = pair diff + drag a row = offset (graph-inert)
+  let dragRow = null;
+  host.addEventListener("mousedown", (e) => {
+    if (e.clientX - host.getBoundingClientRect().left < padL) { dragRow = rowAt(e.clientY); return; } // label gutter \u2192 offset drag
+    if (e.shiftKey) { pair = nearest(e.clientX); showDiff(); draw(); }
+    else { pair = null; showDiff(); go(nearest(e.clientX)); }
+  });
+  window.addEventListener("mousemove", (e) => { if (dragRow) { const W = host.clientWidth - padL - padR;
+    offset[dragRow] = ((e.movementX) / W) * span + (offset[dragRow] || 0); draw(); } });
+  window.addEventListener("mouseup", () => (dragRow = null));
+  window.addEventListener("keydown", (e) => { if (e.key === "ArrowLeft") go(cur - 1); if (e.key === "ArrowRight") go(cur + 1);
+    if (e.key === "Escape") { focus = null; pair = null; showDiff(); draw(); } });
+  window.addEventListener("resize", draw);
+
+  // focus cursor: click a graph node \u2192 highlight where it changed (graph \u2192 lanes)
+  function wireNodes() { document.querySelectorAll("[data-node-id]").forEach(el => {
+    el.style.cursor = "pointer";
+    el.addEventListener("click", () => { focus = el.getAttribute("data-node-id"); draw(); }, true); }); }
+  wireNodes();
+
+  go(LF.length - 1);
+})();
+</script>`;
+}
+function renderLanes(frames, summaries) {
+  const views = frames.map((f, i) => ({
+    name: summaries[i]?.t ? new Date(summaries[i].t).toISOString().slice(11, 19) : `t${i}`,
+    ir: f.ir,
+    layout: layoutIr2(f.ir)
+  }));
+  const doc = renderMorphHtml(views, { title: "Deployment lanes" });
+  const laneFrames = frames.map((f, i) => ({
+    t: summaries[i].t,
+    name: new Date(summaries[i].t).toISOString().slice(11, 19),
+    byLexicon: summaries[i].byLexicon,
+    status: Object.fromEntries(f.ir.nodes.map((n) => [n.id, n.attrs?._status ?? ""])),
+    lexicon: Object.fromEntries(f.ir.nodes.map((n) => [n.id, n.lexicon]))
+  }));
+  const strip = `<style>${LANES_CSS}</style><div id="behold-diff"></div><div id="behold-lanes"><div class="hd"><span>deployment lanes</span><span id="behold-lanes-meta"></span><span class="rt" id="behold-lanes-rt" style="display:none">offset \u2014 graph shows real time</span></div><canvas id="behold-lanes-canvas"></canvas></div>` + laneStripScript(laneFrames);
+  return doc.includes("</body>") ? doc.replace("</body>", `${strip}</body>`) : doc + strip;
+}
+
+// src/emulator.ts
+function parseEmulators(stdout) {
+  const lines = stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (!lines[i].startsWith("{")) continue;
+    try {
+      const parsed = JSON.parse(lines[i]);
+      if (Array.isArray(parsed.emulators)) return parsed.emulators;
+    } catch {
+    }
+  }
+  return [];
+}
+function mergedEnv(emulators) {
+  return Object.assign({}, ...emulators.map((e) => e.env));
+}
+function dockerHint(stderr) {
+  const s = stderr.toLowerCase();
+  if (s.includes("docker") || s.includes("enoent") || s.includes("cannot connect") || s.includes("command not found")) {
+    return "behold serve --local needs Docker running (the emulator is a container). Start Docker and retry.";
+  }
+  return void 0;
+}
+async function emulatorUp(projectDir) {
+  const { code, stdout, stderr } = await runChantRaw(["emulator", "up", "--json"], projectDir);
+  if (code !== 0) {
+    throw new Error(dockerHint(stderr) ?? `chant emulator up failed (exit ${code}): ${stderr.trim() || "no output"}`);
+  }
+  return parseEmulators(stdout);
+}
+async function emulatorDown(projectDir) {
+  await runChantRaw(["emulator", "down"], projectDir);
+}
+
+// src/server.ts
+var webRoot = join9(dirname2(fileURLToPath(import.meta.url)), "..", "web");
+var execFileP = async (cmd, args) => (await promisify4(execFile4)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
+function optsFromQuery(url, tierEnvVar, projectDir) {
+  const q = url.searchParams;
+  const opts = {};
+  const detail = q.get("detail");
+  if (detail !== null) opts.detail = Number(detail);
+  const lens = q.get("lens");
+  if (lens) opts.lens = lens;
+  if (q.get("up") === "1") opts.up = true;
+  if (q.get("down") === "1") opts.down = true;
+  const env = q.get("env");
+  if (env) opts.env = env;
+  const stack = q.get("stack");
+  if (stack) opts.stack = stack;
+  const tier = q.get("tier");
+  if (tier) opts.tier = tier;
+  if (tierEnvVar) opts.tierEnvVar = tierEnvVar;
+  const target = q.get("target");
+  if (target) {
+    opts.target = target;
+    if (projectDir) opts.substrateTargets = resolveSubstrateTargets(projectLexicons(projectDir));
+  }
+  return opts;
+}
+function tierTargetOpts(opts) {
+  const out = {};
+  if (opts.tier) out.tier = opts.tier;
+  if (opts.tierEnvVar) out.tierEnvVar = opts.tierEnvVar;
+  if (opts.target) out.target = opts.target;
+  return out;
+}
+async function knownComponents(projectDir, opts) {
+  try {
+    const ir = await componentGraphIr(projectDir, { env: opts.env, ...tierTargetOpts(opts) });
+    return new Set(ir.nodes.map((n) => n.id));
+  } catch {
+    return void 0;
+  }
+}
+function tierFailure(tier, message) {
+  return {
+    code: "tier",
+    error: `chant couldn't evaluate the "${tier}" tier here: ${message}`,
+    remedy: `A non-default tier (e.g. a production-only one) can need parameters \u2014 real credentials, a different target \u2014 this environment doesn't have. Pick a different tier to see its graph.`
+  };
+}
+function errorResponse(c, opts, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  const failure = err instanceof ChantCliError ? err.failure : classifyChantFailure(message);
+  const routeError = opts.tier && failure.code !== "not-installed" ? tierFailure(opts.tier, failure.message) : { error: failure.message, code: failure.code, remedy: failure.remedy };
+  return c.json(routeError, 500);
+}
+function deployAxes(tierEnvVar, lexicons = [], k8sTarget) {
+  const axes = {};
+  if (tierEnvVar && process.env[tierEnvVar]) axes.tier = process.env[tierEnvVar];
+  const targets = [...resolveSubstrateTargets(lexicons), ...k8sTarget ? [k8sTarget] : []];
+  if (targets.length === 1) axes.target = targets[0].endpoint;
+  else if (targets.length > 1) axes.target = targets.map((t) => `${t.label}=${t.endpoint}`).join(" ");
+  return axes;
+}
+function deployTargets(lexicons = [], k8sTarget) {
+  return [...resolveSubstrateTargets(lexicons), ...k8sTarget ? [k8sTarget] : []].map((t) => ({
+    name: t.label,
+    endpoint: t.endpoint
+  }));
+}
+async function captureFrame(projectDir, env, frames, broadcaster) {
+  try {
+    const ir = await graphIr(projectDir, env ? { live: true, overlay: true, env } : {});
+    const captured = frames.capture(ir) !== null;
+    if (captured) broadcaster.emit("frames");
+    return { ir, captured };
+  } catch (err) {
+    process.stderr.write(`frame capture: ${err instanceof Error ? err.message : String(err)}
+`);
+    return null;
+  }
+}
+function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffer(), runner = new OpRunner({
+  projectDir: cfg.projectDir,
+  broadcaster,
+  onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
+})) {
+  const app = new Hono();
+  const beholdConfig = loadBeholdConfig(cfg.projectDir);
+  const tierEnvVar = beholdConfig.tiers?.envVar;
+  const boundK8sContext = async (env) => {
+    try {
+      const { lexicons, k8sProfiles } = await detectProject(cfg.projectDir);
+      if (!lexicons.includes("k8s")) return void 0;
+      return resolveK8sTarget(k8sProfiles, env ?? cfg.env, await loadKubeconfig())?.label;
+    } catch {
+      return void 0;
+    }
+  };
+  app.get("/healthz", (c) => c.json({ ok: true, projectDir: cfg.projectDir, env: cfg.env ?? null, frames: frames.size }));
+  app.get("/api/frames", (c) => c.json({ frames: frames.summaries() }));
+  app.get("/lanes", (c) => {
+    const all = frames.all();
+    if (all.length < 2) {
+      return c.html(
+        `<!doctype html><meta charset=utf-8><body style="font:14px system-ui;background:#0d1117;color:#8b949e;padding:2rem"><h3 style="color:#e6edf3">deployment lanes</h3><p>${all.length} frame(s) captured \u2014 need at least two to scrub.</p><p>Frames accrue when the estate moves: hit <b style="color:#e6edf3">\u21BB Refresh</b> (captures the current live state), run a <b style="color:#e6edf3">Sync</b>/Adopt, edit the source, or serve with <code>--poll</code> against a moving environment. Then reload.</p><p><a href="/" style="color:#58a6ff;text-decoration:none">\u2190 back to the graph</a></p></body>`
+      );
+    }
+    return c.html(renderLanes(all, frames.summaries()));
+  });
+  const estateDirs = cfg.projectDirs ?? [cfg.projectDir];
+  const estateOps = () => discoverEstateOps(estateDirs);
+  app.get(
+    "/api/ops",
+    (c) => c.json({
+      ops: estateOps(),
+      running: runner.running,
+      // The substrates Adopt is offered on — the SPA gates the per-node button on
+      // this so the "which lexicons live-import" truth stays server-side.
+      adoptLexicons: LIVE_IMPORT_LEXICONS,
+      // Auto-sync mode (#29), so the SPA can show the banner.
+      autoSync: cfg.autoSync ?? "off",
+      // Local mode (#46): the booted emulators, so the SPA shows a "local · up"
+      // banner. null when not in --local (or nothing to boot).
+      local: cfg.emulators && cfg.emulators.length ? { emulators: cfg.emulators.map((e) => ({ lexicon: e.lexicon, name: e.name, endpoint: e.endpoint })) } : null,
+      // M3 (#54): the last known apply progress model, so a client that opens
+      // (or reloads) mid-apply hydrates the structured wave/phase view instead
+      // of starting blank — the `apply` SSE event (below) carries every update
+      // after that. `status: "idle"` (initialApplyProgress) when nothing has
+      // applied yet this session.
+      applyProgress: runner.applyProgress
+    })
+  );
+  app.post("/api/ops/:name/run", (c) => {
+    if (cfg.previewMode) return c.json({ error: "disabled in preview mode" }, 403);
+    const name = c.req.param("name");
+    const info = estateOps().find((o) => o.name === name);
+    if (!info) {
+      return c.json({ error: `no Op named "${name}" in the estate` }, 404);
+    }
+    if (!runner.trigger(name, info.env, info.dir)) {
+      return c.json({ error: `an Op is already running (${runner.running})` }, 409);
+    }
+    return c.json({ started: true, name });
+  });
+  app.get("/api/substrates", async (c) => {
+    return c.json({ substrates: await detectSubstrates(cfg.projectDir, cfg.previewMode, await boundK8sContext(cfg.env)) });
+  });
+  app.post("/api/substrates/:name/up", async (c) => {
+    const name = c.req.param("name");
+    const sub = (await detectSubstrates(cfg.projectDir, cfg.previewMode)).find((s) => s.name === name);
+    if (!sub) return c.json({ error: `unknown substrate "${name}"` }, 404);
+    if (!sub.bringUp) return c.json({ error: `no bring-up available for "${name}"` }, 400);
+    const { label, cmd, args } = sub.bringUp;
+    const PIPELINE_FORGES = { "gitlab-ci": "gitlab", forgejo: "forgejo" };
+    const forge = PIPELINE_FORGES[name];
+    if (forge) {
+      const parsed = await ciPipeline(cfg.projectDir, { env: cfg.env }, forge).catch(() => void 0);
+      if (parsed && parsed.jobs.length > 0) {
+        if (!runner.pipeline(`${sub.label} pipeline`, cmd, args, cfg.projectDir, parsed)) {
+          return c.json({ error: `busy \u2014 ${runner.running} is running` }, 409);
+        }
+        return c.json({ started: true, name, ran: label, pipeline: { stages: parsed.stages.length, jobs: parsed.jobs.length } });
+      }
+    }
+    if (!runner.bringUp(`bring up ${sub.label}`, cmd, args, cfg.projectDir)) {
+      return c.json({ error: `busy \u2014 ${runner.running} is running` }, 409);
+    }
+    return c.json({ started: true, name, ran: label });
+  });
+  app.post("/api/local/reset", (c) => {
+    const down = join9(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join9(cfg.projectDir, "scripts/local/local-up.sh");
+    if (!existsSync8(down) || !existsSync8(up)) {
+      return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
+    }
+    if (!runner.bringUp("reset local emulator", "bash", ["-c", "bash scripts/local/local-down.sh && bash scripts/local/local-up.sh"], cfg.projectDir)) {
+      return c.json({ error: `busy \u2014 ${runner.running} is running` }, 409);
+    }
+    return c.json({ started: true, ran: "local-down + local-up" });
+  });
+  app.post("/api/ops/:name/signal/:gate", async (c) => {
+    const { name, gate } = c.req.param();
+    const info = estateOps().find((o) => o.name === name);
+    broadcaster.emit("op", `\u270E signal ${name} ${gate}`);
+    const { code, stderr } = await runChantRaw(["run", "signal", name, gate], info?.dir ?? cfg.projectDir);
+    if (code !== 0) return c.json({ error: stderr.trim() || `signal exited ${code}` }, 500);
+    return c.json({ signalled: true });
+  });
+  app.get(
+    "/api/events",
+    (c) => streamSSE(c, async (stream) => {
+      const unsubscribe = broadcaster.subscribe((type, data) => {
+        void stream.writeSSE({ event: type, data: data || String(Date.now()) });
+      });
+      stream.onAbort(unsubscribe);
+      while (!stream.aborted) {
+        await stream.writeSSE({ event: "ping", data: "" });
+        await stream.sleep(3e4);
+      }
+      unsubscribe();
+    })
+  );
+  app.get("/api/project", async (c) => {
+    const { environments, lexicons, stacks, k8sProfiles } = await detectProject(cfg.projectDir);
+    const k8sTarget = lexicons.includes("k8s") ? resolveK8sTarget(k8sProfiles, cfg.env, await loadKubeconfig()) : void 0;
+    const axes = deployAxes(tierEnvVar, lexicons, k8sTarget);
+    return c.json({
+      projectDir: cfg.projectDir,
+      environments,
+      lexicons,
+      currentEnv: cfg.env ?? null,
+      // v0.1.0 preview: the SPA hides git/PR ops + arbitrary-project affordances.
+      ...cfg.previewMode ? { previewMode: true } : {},
+      // The tier picker's options (M2 #54, sourced #70): gated on the served
+      // project's `.behold.json` declaring a `tiers` block at all — NOT on
+      // whether its env var happens to be set in behold's own launch env
+      // (that's `axes.tier`, the *current* value, below). No `.behold.json` (or
+      // no `tiers` key) → no `tiers` field → the SPA's picker doesn't render
+      // and the graph loads with no tier selected (web/app.js `initPickers`).
+      ...beholdConfig.tiers ? { tiers: beholdConfig.tiers.values } : {},
+      // The stack picker's options (#76, follow-up to #71): gated exactly like
+      // `tiers` above — only present when `chant.config.ts` declares `stacks[]`
+      // at all, so a single-stack/sourceDir-only/legacy project's SPA renders no
+      // picker (web/app.js `initPickers` mirrors the `info.tiers` gate). Just
+      // the names — `graphPath` (chant.ts) resolves a picked name to its `src`
+      // server-side; the SPA never needs the path.
+      ...stacks?.length ? { stacks: stacks.map((s) => s.name) } : {},
+      targets: deployTargets(lexicons, k8sTarget),
+      // Where the k8s binding came from, so the SPA never implies behold chose
+      // it (#106). Absent for a project with no k8s lexicon or no resolvable
+      // context.
+      ...k8sTarget ? { k8sBinding: { context: k8sTarget.label, endpoint: k8sTarget.endpoint, source: k8sTarget.source } } : {},
+      ...axes
+    });
+  });
+  app.get("/api/graph", async (c) => {
+    const url = new URL(c.req.url);
+    const opts = optsFromQuery(url, tierEnvVar, cfg.projectDir);
+    try {
+      const components = url.searchParams.get("components") === "1";
+      const logical = url.searchParams.get("logical") === "1";
+      const multi = cfg.projectDirs && cfg.projectDirs.length > 1;
+      let ir;
+      let mode;
+      let metaEnv = cfg.env ?? null;
+      if (multi) {
+        ir = await composeEstate(cfg.projectDirs, opts);
+      } else if (components) {
+        ir = await componentGraphIr(cfg.projectDir, opts);
+        const env = opts.env ?? cfg.env;
+        if (env) {
+          const rows = await componentStatus(cfg.projectDir, env, opts);
+          ir = joinComponentStatus(ir, rows);
+          mode = "component-status";
+          metaEnv = env;
+        }
+        ir = joinCiProgress(ir, runner.applyProgress);
+      } else if (logical) {
+        const raw = mergeClusterRoot(await graphIr(cfg.projectDir, { ...opts, detail: 3 }), await clusterRootGraphIr(cfg.projectDir, opts));
+        const base = addK8sDeclaredEdges(addValueMatchEdges(raw));
+        const { ir: projected, byContainer } = projectTopology(base, metaEnv ?? void 0, await boundK8sContext(metaEnv ?? void 0), [await graphPath(cfg.projectDir, opts), cfg.projectDir]);
+        const { svg: svg2 } = renderArchitecture(projected, byContainer);
+        const logicalNote = notesFor("logical", projected, void 0, base.nodes.length);
+        return c.json({ ir: projected, svg: svg2, byContainer, meta: { projectDir: cfg.projectDir, env: metaEnv, tier: opts.tier ?? null, target: opts.target ?? null, mode: "logical", ...logicalNote ? { note: logicalNote } : {} } });
+      } else {
+        ir = mergeClusterRoot(await graphIr(cfg.projectDir, opts), await clusterRootGraphIr(cfg.projectDir, opts));
+        if ((opts.detail ?? 2) < 3) ir = pruneImports(ir);
+        ir = addValueMatchEdges(ir);
+        ir = addK8sDeclaredEdges(ir);
+        ir = addClusterAnchorEdges(ir, await boundK8sContext(metaEnv ?? void 0));
+      }
+      let srcCompositeEdgesAttached;
+      if (!multi && !components && opts.detail === 1) {
+        try {
+          const dag = await componentGraphIr(cfg.projectDir, tierTargetOpts(opts));
+          const counted = addCompositeDepsCounted(ir, dag);
+          ir = counted.ir;
+          srcCompositeEdgesAttached = counted.attached;
+        } catch {
+          srcCompositeEdgesAttached = 0;
+        }
+      }
+      const radial = new URL(c.req.url).searchParams.get("radial") === "1";
+      const { svg } = renderGraph(ir, multi ? { boxes: "byStack" } : { radial });
+      const srcZoom = components ? "components" : logical ? "logical" : opts.detail === 1 ? "composites" : opts.detail === 3 ? "attributes" : "resources";
+      const srcNote = multi ? void 0 : notesFor(srcZoom, ir, srcCompositeEdgesAttached);
+      return c.json({
+        ir,
+        svg,
+        meta: {
+          projectDir: cfg.projectDir,
+          env: metaEnv,
+          ...srcNote ? { note: srcNote } : {},
+          // The picked tier/target (M2, #54), echoed back so the SPA can keep
+          // its header's axes display in sync with what it's actually looking
+          // at, not just the launch-time value. null when neither was picked.
+          tier: opts.tier ?? null,
+          target: opts.target ?? null,
+          ...multi ? { estate: cfg.projectDirs.length } : {},
+          ...!multi && components ? { components: true } : {},
+          ...mode ? { mode } : {}
+        }
+      });
+    } catch (err) {
+      return errorResponse(c, opts, err);
+    }
+  });
+  app.get("/api/ci", async (c) => {
+    const opts = optsFromQuery(new URL(c.req.url), tierEnvVar, cfg.projectDir);
+    const env = opts.env ?? cfg.env;
+    const { lexicons } = await detectProject(cfg.projectDir);
+    const forge = ciForgeFor(lexicons);
+    if (!forge) return c.json({ stages: [], jobs: [], forge: null });
+    try {
+      const { stages, jobs } = await ciPipeline(
+        cfg.projectDir,
+        { ...tierTargetOpts(opts), ...env ? { env } : {} },
+        forge
+      );
+      return c.json({ stages, jobs, forge });
+    } catch (err) {
+      return errorResponse(c, opts, err);
+    }
+  });
+  app.post("/api/ci/dispatch", async (c) => {
+    const ready = await ghReady();
+    if (!ready.ok) return c.json({ error: ready.reason }, 400);
+    const pipeline = await ciPipeline(cfg.projectDir, cfg.env ? { env: cfg.env } : {}, "github").catch(() => void 0);
+    if (!pipeline || pipeline.jobs.length === 0) {
+      return c.json({ error: "no generated GitHub pipeline \u2014 `chant build --components --generate github` produced no jobs" }, 400);
+    }
+    const workflow = pickWorkflow(cfg.projectDir, pipeline);
+    if (!workflow) {
+      return c.json({ error: "no committed workflow_dispatch workflow whose jobs match the generated pipeline \u2014 commit one (or add `workflow_dispatch:` to its `on:` block)" }, 400);
+    }
+    const ref = await execFileP("git", ["-C", cfg.projectDir, "branch", "--show-current"]).then((out) => out.trim() || "main").catch(() => "main");
+    const started = runner.track(
+      `GitHub Actions ${workflow.file}`,
+      (io) => dispatchAndFollow(workflow, pipeline, ref, { onLine: io.line, onProgress: io.progress })
+    );
+    if (!started) return c.json({ error: `busy \u2014 ${runner.running} is running` }, 409);
+    return c.json({ started: true, workflow: workflow.file, ref, jobs: pipeline.jobs.length });
+  });
+  app.get("/api/resources", async (c) => {
+    const opts = optsFromQuery(new URL(c.req.url), tierEnvVar, cfg.projectDir);
+    const env = opts.env ?? cfg.env;
+    try {
+      const [ir, known] = await Promise.all([
+        graphIr(
+          cfg.projectDir,
+          env ? { live: true, overlay: true, env, ...tierTargetOpts(opts) } : tierTargetOpts(opts)
+        ),
+        knownComponents(cfg.projectDir, opts)
+      ]);
+      return c.json({ byComponent: resourcesByComponent(ir, known) });
+    } catch (err) {
+      return errorResponse(c, opts, err);
+    }
+  });
+  app.get("/api/reconcile", async (c) => {
+    const opts = optsFromQuery(new URL(c.req.url), tierEnvVar, cfg.projectDir);
+    const env = opts.env ?? cfg.env;
+    if (!env) {
+      return c.json({ error: "reconcile needs an environment \u2014 pick one, or start behold with --env <name>" }, 400);
+    }
+    try {
+      const [plan, ir, known] = await Promise.all([
+        lifecyclePlan(cfg.projectDir, env, opts),
+        graphIr(cfg.projectDir, { live: true, overlay: true, env, ...tierTargetOpts(opts) }),
+        knownComponents(cfg.projectDir, opts)
+      ]);
+      return c.json(summarizePlan(plan, resourcesByComponent(ir, known), nonResourceEntities(ir)));
+    } catch (err) {
+      return errorResponse(c, opts, err);
+    }
+  });
+  app.get("/api/overlay", async (c) => {
+    const query = optsFromQuery(new URL(c.req.url), tierEnvVar, cfg.projectDir);
+    const env = query.env ?? cfg.env;
+    if (!env) {
+      return c.json({ error: "overlay needs an environment \u2014 pick one, or start behold with --env <name>" }, 400);
+    }
+    const logical = new URL(c.req.url).searchParams.get("logical") === "1";
+    try {
+      const opts = { ...query, live: true, overlay: true, env, ...logical ? { detail: 3 } : {} };
+      let ir = reclassifyOverlay(await graphIr(cfg.projectDir, opts));
+      const boundContext = await boundK8sContext(env);
+      ir = mergeClusterRoot(ir, await clusterRootGraphIr(cfg.projectDir, query), await runningK3dClusters());
+      const declaresHelm = await detectProject(cfg.projectDir).then((p) => p.lexicons.includes("helm")).catch(() => false);
+      if (declaresHelm || ir.nodes.some((n) => n.lexicon === "helm" && n.kind === "Helm::Chart")) {
+        const observed = await lifecycleDiffLive(cfg.projectDir, env, query).then((d) => d.lexicons?.helm?.observedArtifacts).catch(() => void 0);
+        applyHelmArtifacts(ir, observed);
+        synthesizeHelmReleases(ir, observed, discoverReleaseUnits(cfg.projectDir));
+      }
+      ir = new URL(c.req.url).searchParams.get("runtime") === "1" ? attachRuntimeContainment(ir) : pruneRuntimeChildren(ir);
+      if (logical) {
+        const logicalBefore = ir.nodes.length;
+        const { ir: projected, byContainer } = projectTopology(addK8sDeclaredEdges(addValueMatchEdges(ir)), env, boundContext, [await graphPath(cfg.projectDir, opts), cfg.projectDir]);
+        const { svg: svg2 } = renderArchitecture(projected, byContainer);
+        const logicalTierNote = tierMismatchNote(projected, beholdConfig.tiers, query.tier);
+        const logicalNote = [logicalTierNote, notesFor("logical", projected, void 0, logicalBefore)].filter(Boolean).join(" \xB7 ");
+        return c.json({ ir: projected, svg: svg2, byContainer, meta: { projectDir: cfg.projectDir, env, mode: "logical", ...logicalNote ? { note: logicalNote } : {} } });
+      }
+      if ((query.detail ?? 2) < 3) ir = pruneImports(ir);
+      ir = addValueMatchEdges(ir);
+      ir = addK8sDeclaredEdges(ir);
+      ir = addClusterAnchorEdges(ir, boundContext);
+      let compositeEdgesAttached;
+      if (query.detail === 1) {
+        try {
+          const dag = await componentGraphIr(cfg.projectDir, { env, ...tierTargetOpts(query) });
+          const counted = addCompositeDepsCounted(ir, dag);
+          ir = counted.ir;
+          compositeEdgesAttached = counted.attached;
+        } catch {
+          compositeEdgesAttached = 0;
+        }
+      }
+      const { svg } = renderGraph(ir, { boxes: "byContainer", radial: new URL(c.req.url).searchParams.get("radial") === "1" });
+      const zoom = new URL(c.req.url).searchParams.get("runtime") === "1" ? "runtime" : query.detail === 1 ? "composites" : query.detail === 3 ? "attributes" : "resources";
+      const tierNote = tierMismatchNote(ir, beholdConfig.tiers, query.tier);
+      const zoomNotes = notesFor(zoom, ir, compositeEdgesAttached);
+      const note = [tierNote, zoomNotes].filter(Boolean).join(" \xB7 ");
+      return c.json({ ir, svg, meta: { projectDir: cfg.projectDir, env, mode: "overlay", ...note ? { note } : {} } });
+    } catch (err) {
+      return errorResponse(c, query, err);
+    }
+  });
+  app.post("/api/refresh", async (c) => {
+    const env = optsFromQuery(new URL(c.req.url)).env ?? cfg.env;
+    const result = await captureFrame(cfg.projectDir, env, frames, broadcaster);
+    if (!result) return c.json({ error: "refresh failed \u2014 see server log" }, 500);
+    if (env) reclassifyOverlay(result.ir);
+    mergeClusterRoot(result.ir, await clusterRootGraphIr(cfg.projectDir), env ? await runningK3dClusters() : void 0);
+    if (env) {
+      const declaresHelm = await detectProject(cfg.projectDir).then((p) => p.lexicons.includes("helm")).catch(() => false);
+      if (declaresHelm || result.ir.nodes.some((n) => n.lexicon === "helm" && n.kind === "Helm::Chart")) {
+        const observed = await lifecycleDiffLive(cfg.projectDir, env).then((d) => d.lexicons?.helm?.observedArtifacts).catch(() => void 0);
+        applyHelmArtifacts(result.ir, observed);
+        synthesizeHelmReleases(result.ir, observed, discoverReleaseUnits(cfg.projectDir));
+      }
+    }
+    if (env) {
+      if (new URL(c.req.url).searchParams.get("runtime") === "1") attachRuntimeContainment(result.ir);
+      else pruneRuntimeChildren(result.ir);
+    }
+    if ((optsFromQuery(new URL(c.req.url)).detail ?? 2) < 3) pruneImports(result.ir);
+    addValueMatchEdges(result.ir);
+    addK8sDeclaredEdges(result.ir);
+    addClusterAnchorEdges(result.ir, await boundK8sContext(env));
+    const { svg } = renderGraph(result.ir, { boxes: "byContainer" });
+    return c.json({
+      ir: result.ir,
+      svg,
+      meta: { projectDir: cfg.projectDir, env: env ?? null, ...env ? { mode: "overlay" } : {} },
+      captured: result.captured
+    });
+  });
+  app.get("/api/diff", async (c) => {
+    const env = optsFromQuery(new URL(c.req.url)).env ?? cfg.env;
+    if (!env) return c.json({ error: "diff needs an environment \u2014 pick one, or start with --env" }, 400);
+    const { code, stdout, stderr } = await runChantRaw(["lifecycle", "diff", env, "--live", "--json"], cfg.projectDir);
+    if (code !== 0) return c.json({ error: stderr.trim() || `diff exited ${code}` }, 500);
+    let parsed;
+    try {
+      parsed = JSON.parse(stdout);
+    } catch {
+      return c.json({ error: "diff output was not JSON \u2014 chant may predate --live --json (needs 0.18.7+)" }, 500);
+    }
+    const ids = /* @__PURE__ */ new Set();
+    for (const lex of Object.values(parsed.lexicons ?? {})) {
+      for (const k of Object.keys(lex.observed ?? {})) ids.add(k);
+      const r = lex.resources;
+      if (!r) continue;
+      for (const arr of [r.missing, r.orphan, r.disappeared, r.newlyObserved, r.unchanged]) for (const n of arr ?? []) ids.add(n);
+      for (const d of r.driftedSinceSnapshot ?? []) ids.add(d.name);
+      for (const u of r.unobserved ?? []) ids.add(u.name);
+      for (const rc of r.runtimeChildren ?? []) ids.add(rc.name);
+    }
+    const nodes = {};
+    for (const id of ids) {
+      const observed = nodeObserved(parsed, id);
+      nodes[id] = {
+        observed,
+        diff: nodeDiff(parsed, id),
+        health: classifyHealth(observed?.status),
+        // Field-level (per-manager) drift (#87, chant#1181) — null when no
+        // lexicon in this diff carries a `deep` section at all.
+        fieldDrift: nodeFieldDrift(parsed, id)
+      };
+    }
+    return c.json({ env, nodes });
+  });
+  app.get("/api/diff/:node", async (c) => {
+    const node = c.req.param("node");
+    const env = optsFromQuery(new URL(c.req.url)).env ?? cfg.env;
+    if (!env) return c.json({ error: "diff needs an environment \u2014 pick one, or start with --env" }, 400);
+    const { code, stdout, stderr } = await runChantRaw(
+      ["lifecycle", "diff", env, "--live", "--json"],
+      cfg.projectDir
+    );
+    if (code !== 0) return c.json({ error: stderr.trim() || `diff exited ${code}` }, 500);
+    let parsed;
+    try {
+      parsed = JSON.parse(stdout);
+    } catch {
+      return c.json({ error: "diff output was not JSON \u2014 chant may predate --live --json (needs 0.18.7+)" }, 500);
+    }
+    const observed = nodeObserved(parsed, node);
+    return c.json({
+      node,
+      env,
+      diff: nodeDiff(parsed, node),
+      observed,
+      health: classifyHealth(observed?.status),
+      // Field-level (per-manager) drift (#87, chant#1181) — null when no
+      // lexicon in this diff carries a `deep` section at all.
+      fieldDrift: nodeFieldDrift(parsed, node)
+    });
+  });
+  app.get("/api/history", async (c) => c.json({ commits: await sourceCommits(cfg.projectDir) }));
+  app.post("/api/rollback", (c) => {
+    if (cfg.previewMode) return c.json({ error: "disabled in preview mode" }, 403);
+    const to = new URL(c.req.url).searchParams.get("to");
+    if (!to) return c.json({ error: "rollback needs ?to=<git-ref>" }, 400);
+    const args = ["lifecycle", "rollback", ...cfg.env ? [cfg.env] : [], "--to", to];
+    if (!runner.run(args, `rollback \u2192 ${to}`, cfg.env)) {
+      return c.json({ error: `busy \u2014 ${runner.running} is running` }, 409);
+    }
+    return c.json({ started: true, to });
+  });
+  app.post("/api/apply", async (c) => {
+    const url = new URL(c.req.url);
+    const env = url.searchParams.get("env") ?? cfg.env;
+    if (!env) {
+      return c.json({ error: "apply needs an environment \u2014 pick one, or start behold with --env <name>" }, 400);
+    }
+    const component = url.searchParams.get("component") || "all";
+    const force = url.searchParams.get("force") === "1";
+    const flociTargeted = !!process.env.AWS_ENDPOINT_URL && await detectProject(cfg.projectDir).then((p) => p.lexicons.includes("aws")).catch(() => false);
+    if (!force && flociTargeted) {
+      try {
+        const rows = await componentStatus(cfg.projectDir, env);
+        const deployed = rows.filter((r) => componentStatusColor(r) !== "neutral").map((r) => r.component);
+        const blocked = component === "all" ? deployed : deployed.includes(component) ? [component] : [];
+        if (blocked.length) {
+          const who = component === "all" ? `${blocked.length} component(s) are` : `"${component}" is`;
+          return c.json(
+            {
+              error: `${who} already deployed \u2014 re-applying collides on the local emulator (Floci #16, github.com/lex00/floci/issues/16). Use Reset (reboots + redeploys clean), or retry with ?force=1.`,
+              blocked
+            },
+            409
+          );
+        }
+      } catch {
+      }
+    }
+    if (!runner.apply(component, env)) {
+      return c.json({ error: `busy \u2014 ${runner.running} is running` }, 409);
+    }
+    return c.json({ started: true, component, env });
+  });
+  const rel = relative(process.cwd(), webRoot) || ".";
+  app.use("/*", serveStatic({ root: rel }));
+  app.get("/", serveStatic({ path: join9(rel, "index.html") }));
+  return app;
+}
+async function startServer(cfg) {
+  if (cfg.local) {
+    try {
+      const emulators = await emulatorUp(cfg.projectDir);
+      cfg.emulators = emulators;
+      if (emulators.length === 0) {
+        process.stderr.write(
+          "behold serve --local: no configured lexicon has a local emulator \u2014 serving without one.\n"
+        );
+      } else {
+        Object.assign(process.env, mergedEnv(emulators));
+        for (const e of emulators) {
+          process.stdout.write(`  local: ${e.lexicon} ${e.name} up on ${e.endpoint}
+`);
+        }
+      }
+    } catch (err) {
+      cfg.emulators = [];
+      process.stderr.write(
+        `behold serve --local: ${err instanceof Error ? err.message : String(err)}
+  Serving the source graph without the emulator \u2014 start Docker and restart to enable local deploys.
+`
+      );
+    }
+  }
+  const broadcaster = new Broadcaster();
+  const frames = new FrameBuffer();
+  const runner = new OpRunner({
+    projectDir: cfg.projectDir,
+    broadcaster,
+    onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
+  });
+  const app = createApp(cfg, broadcaster, frames, runner);
+  const autoSync = cfg.autoSync ?? "off";
+  const capture = () => captureFrame(cfg.projectDir, cfg.env, frames, broadcaster);
+  const onEstateChange = () => {
+    broadcaster.emit("changed");
+    void capture();
+  };
+  const onPollDrift = (movedLexicons) => {
+    onEstateChange();
+    if (autoSync === "off") return;
+    void routeAutoSync(movedLexicons);
+  };
+  const routeAutoSync = async (movedLexicons) => {
+    const suspended = autoSync === "pull-request" ? suspendedByRollback(await openRollbackBranches(cfg.projectDir, cfg.env), movedLexicons) : /* @__PURE__ */ new Set();
+    const { picks, declined } = pickAutoSyncOps(
+      autoSync,
+      discoverEstateOps(cfg.projectDirs ?? [cfg.projectDir]),
+      runner.running,
+      movedLexicons,
+      suspended
+    );
+    for (const d of declined) {
+      broadcaster.emit("op", `\u27F3 auto-sync (${autoSync}) declined ${d.lexicon}: ${d.reason}`);
+    }
+    for (const { op, lexicons } of picks) {
+      const scope = lexicons.join("+");
+      if (runner.trigger(op.name, op.env, op.dir)) {
+        broadcaster.emit("op", `\u27F3 auto-sync (${autoSync}) ${scope} \u2192 ${op.name}`);
+      } else {
+        broadcaster.emit("op", `\u27F3 auto-sync (${autoSync}) ${scope} \u2192 ${op.name} waiting \u2014 ${runner.running} is running`);
+      }
+    }
+  };
+  const stopWatch = watchSource(cfg.projectDir, onEstateChange);
+  const stopPoll = cfg.env && cfg.pollSecs ? startDriftPoll({
+    intervalMs: cfg.pollSecs * 1e3,
+    query: () => graphIr(cfg.projectDir, { live: true, overlay: true, env: cfg.env }),
+    onChange: onPollDrift,
+    onError: (err) => process.stderr.write(`poll: ${err instanceof Error ? err.message : String(err)}
+`)
+  }) : () => {
+  };
+  void capture();
+  let shuttingDown = false;
+  const shutdown = () => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    stopWatch();
+    stopPoll();
+    const done = cfg.local && cfg.emulators && cfg.emulators.length ? emulatorDown(cfg.projectDir).catch((err) => process.stderr.write(`emulator down: ${err instanceof Error ? err.message : String(err)}
+`)) : Promise.resolve();
+    void done.finally(() => process.exit(0));
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  const server = serve({ fetch: app.fetch, port: cfg.port }, (info) => {
+    const poll = cfg.env && cfg.pollSecs ? `, polling drift every ${cfg.pollSecs}s` : "";
+    const auto = autoSync !== "off" ? `  auto-sync: ${autoSync}` : "";
+    const localTag = cfg.emulators && cfg.emulators.length ? `  local: ${cfg.emulators.map((e) => e.name).join(", ")} up (creds-free \u2014 deploys hit the emulator)` : "";
+    process.stdout.write(
+      `behold \u2192 http://localhost:${info.port}
+  project: ${cfg.projectDir}${cfg.env ? `  env: ${cfg.env}` : ""}${auto}${localTag}
+  read-only, watching for edits${poll}. lanes: /lanes. Ctrl-C to stop.
+`
+    );
+    void detectProject(cfg.projectDir).then(({ environments, lexicons }) => {
+      const envs = environments.length ? environments.join(", ") : "(none declared \u2014 env picker shows only source)";
+      process.stdout.write(`  detected: environments [${envs}]  lexicons [${lexicons.join(", ")}]
+`);
+    });
+  });
+  server.on("error", (err) => {
+    if (err.code === "EADDRINUSE") {
+      process.stderr.write(
+        `behold: port ${cfg.port} is already in use \u2014 another behold is probably running there.
+  Stop it (\`lsof -nP -iTCP:${cfg.port} -sTCP:LISTEN\` to find it), or pass --port <n>.
+`
+      );
+    } else {
+      process.stderr.write(`behold: server error: ${err.message}
+`);
+    }
+    process.exit(1);
+  });
+}
+
+// src/export.ts
+import { mkdirSync, writeFileSync, copyFileSync, readFileSync as readFileSync6, readdirSync as readdirSync4 } from "node:fs";
+import { join as join10, dirname as dirname3, basename } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var LENS_PARAMS = ["components", "detail", "env", "logical", "radial", "tier"];
+function canonicalKey(path, params) {
+  const flat = params.get("components") === "1" || params.get("logical") === "1";
+  const q = LENS_PARAMS.filter((k) => params.has(k) && !(flat && (k === "detail" || k === "radial"))).map((k) => `${k}=${params.get(k)}`).join("&");
+  return q ? `${path}?${q}` : path;
+}
+function slug(key) {
+  const base = key.replace(/^\//, "").replace(/[^a-zA-Z0-9=_.-]+/g, "_").slice(0, 120);
+  return `${base}.json`;
+}
+function captureKeys(axes) {
+  const keys = /* @__PURE__ */ new Set();
+  const add = (path, p) => keys.add(canonicalKey(path, new URLSearchParams(p)));
+  add("/api/project", {});
+  add("/api/substrates", {});
+  add("/api/ops", {});
+  const tiers = axes.tiers && axes.tiers.length ? axes.tiers : [""];
+  const envs = ["", ...axes.environments];
+  for (const env of envs) {
+    for (const tier of tiers) {
+      const lens = (extra) => {
+        const p = { ...extra };
+        if (env) p.env = env;
+        if (tier) p.tier = tier;
+        return p;
+      };
+      add("/api/graph", lens({ components: "1" }));
+      add(env ? "/api/overlay" : "/api/graph", lens({ logical: "1" }));
+      add("/api/ci", lens({}));
+      if (env) {
+        add("/api/reconcile", lens({}));
+        add("/api/resources", lens({}));
+        add("/api/diff", lens({}));
+      }
+      for (const detail of ["1", "2", "3"]) {
+        for (const radial of ["0", "1"]) {
+          const p = lens({ detail });
+          if (radial === "1") p.radial = "1";
+          add(env ? "/api/overlay" : "/api/graph", p);
+        }
+      }
+    }
+  }
+  return [...keys];
+}
+function webDir() {
+  return join10(dirname3(fileURLToPath2(import.meta.url)), "..", "web");
+}
+function workerName(project, override) {
+  const raw = override ?? `behold-${basename(project)}`;
+  const name = raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+  return name || "behold-export";
+}
+async function runExport(cfg, outDir, opts = {}) {
+  const app = createApp(cfg);
+  const proj = await (await app.request("/api/project")).json();
+  const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [] };
+  const snapDir = join10(outDir, "snapshots");
+  mkdirSync(snapDir, { recursive: true });
+  const keyToFile = {};
+  let ok = 0;
+  let failed = 0;
+  for (const key of captureKeys(axes)) {
+    const res = await app.request(key);
+    const body = await res.text();
+    const file = slug(key);
+    writeFileSync(join10(snapDir, file), body);
+    keyToFile[key] = `snapshots/${file}`;
+    if (res.ok) ok++;
+    else failed++;
+  }
+  const manifest = {
+    static: true,
+    capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    projectDir: cfg.projectDir,
+    axes,
+    keyToFile
+  };
+  writeFileSync(join10(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync6(join10(webDir(), "index.html"), "utf8").replace(
+    /<\/head>/i,
+    `  <script>window.__BEHOLD_STATIC__ = true;</script>
+  </head>`
+  );
+  writeFileSync(join10(outDir, "index.html"), html);
+  for (const f of readdirSync4(webDir())) {
+    if (f === "index.html") continue;
+    copyFileSync(join10(webDir(), f), join10(outDir, f));
+  }
+  writeFileSync(join10(outDir, "README.md"), BUNDLE_README);
+  const name = workerName(cfg.projectDir, opts.name);
+  writeFileSync(
+    join10(outDir, "wrangler.jsonc"),
+    JSON.stringify(
+      { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
+      null,
+      2
+    ) + "\n"
+  );
+  process.stdout.write(
+    `behold export \u2192 ${outDir}
+  ${ok} snapshots${failed ? ` (${failed} endpoint error(s) captured as-is)` : ""}
+  View:   npx serve ${outDir}
+  Deploy: cd ${outDir} && npx wrangler deploy   \u2192 https://${name}.<your-account>.workers.dev
+`
+  );
+}
+var BUNDLE_README = `# behold \u2014 static export
+
+An interactive, read-only snapshot of an estate captured by \`behold export\`.
+No server or backend \u2014 everything runs client-side from the bundled snapshots.
+Pan/zoom, the zoom dial, radial layout, the inspect pane, and the env/tier
+pickers all work; there's no live observe or deploy.
+
+## View it locally
+It must be served over http (not opened as a \`file://\` \u2014 browsers block the
+snapshot fetches on that protocol):
+\`\`\`sh
+npx serve .
+# or
+python3 -m http.server 8000
+\`\`\`
+
+## Deploy to Cloudflare (Workers Static Assets)
+This folder is deploy-ready \u2014 an assets-only \`wrangler.jsonc\` is included (no
+server code; the bundle is pure static). With [wrangler](https://developers.cloudflare.com/workers/wrangler/)
+installed and Cloudflare auth set:
+\`\`\`sh
+npx wrangler deploy
+# \u2192 https://<name>.<your-account>.workers.dev
+\`\`\`
+Auth: run \`npx wrangler login\`, or set \`CLOUDFLARE_API_TOKEN\` +
+\`CLOUDFLARE_ACCOUNT_ID\`. Rename by editing \`"name"\` in \`wrangler.jsonc\`.
+
+## Other static hosts
+It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
+(\`wrangler pages deploy .\`) all work.
+`;
+
+// src/cli.ts
+var USAGE = `behold \u2014 a live control plane on chant (read-only core)
+
+Usage:
+  behold preview [project-dir] [--port <n>] [--emulator]
+  behold export [project-dir] [--out <dir>] [--env <name>] [--name <worker>] [--emulator]
+  behold serve <project-dir\u2026> [--port <n>] [--env <name>] [--poll <secs>] [--local]
+
+  export  Capture the live estate into a self-contained, interactive STATIC
+          bundle (default ./behold-export) \u2014 every env/tier \xD7 zoom \xD7 radial,
+          replayable with no backend. Host it anywhere (Cloudflare Pages/Workers,
+          any static server). Read-only: no live observe, no deploy. Defaults the
+          project to the current directory; pass a dir for someone else's, and
+          --env for that project's live overlay. Bring the estate up first (e.g.
+          behold preview, or your creds/env) so the snapshot reflects live state.
+
+  preview Serve one project's graph in a browser at a single port \u2014 the quick
+          way to look at a chant project. Defaults the project to the current
+          directory; pass a path to look at another one.
+
+  serve   Start the server: the mixed-substrate graph of <project-dir> in a
+          browser, coloured by drift. Read-only \u2014 never mutates. Pass several
+          project dirs to compose them into one estate (#31): per-project
+          boundary boxes + cross-stack edges. The first is the primary (ops,
+          overlay, and rollback act on it).
+
+Options:
+  --port <n>          Port (default 4600). preview/serve.
+  --env <name>        Environment name \u2014 turns on the live drift overlay.
+                      export/serve.
+  --poll <secs>       Re-query live drift every <secs> and push updates (needs --env).
+                      serve only.
+  --auto-sync <mode>  On a polled drift, trigger a committed Op (needs --env + --poll).
+                      off (default) | apply (heal via ApplyOp) | pull-request
+                      (adopt via ReconcileOp). Gated applies still wait for Approve.
+                      Routes per substrate (#117): the substrate that drifted
+                      picks the Op declaring that target, and declines out loud
+                      rather than guessing when several match or none does.
+                      serve only.
+  --local             serve only: boot the *served project's own* local
+                      emulator(s) via chant (\`chant emulator up\`, chant #920)
+                      and observe them \u2014 the creds-free first apply. Deploys
+                      (Run/Sync) hit the emulator; torn down on exit. Needs
+                      Docker. Generic \u2014 works for any emulator-backed lexicon,
+                      not Loom-specific. Not the same thing as --emulator below.
+  --emulator          preview/export only: turnkey Loom-on-Floci demo (v0.1.0).
+                      Injects the env Loom's own Floci setup expects
+                      (AWS_ENDPOINT_URL=http://localhost:4566, dummy AWS creds,
+                      LOOM_ENV=local) and, for preview, locks the UI into
+                      previewMode (git/PR ops hidden, substrate strip scoped to
+                      Docker+Floci). Off by default \u2014 without it, preview/export
+                      just read the given project's declared source graph (plus
+                      --env's live overlay, for export). Reproduces the old
+                      default behavior on request: \`behold preview ../loomster
+                      --emulator\`. Needs Docker. Hardcoded to Loom's env-var
+                      names, unlike --local; kept separate because Loom's own
+                      \`scripts/local/local-up.sh\` Floci setup clashes on :4566
+                      with chant's generic \`chant emulator up\`.
+  --out <dir>         export only: output directory (default ./behold-export).
+  --name <worker>     export only: Cloudflare Worker name in the generated
+                      wrangler.jsonc.
+  -h, --help          This text.
+`;
+async function run3(argv) {
+  const [cmd, ...rest] = argv;
+  if (!cmd || cmd === "-h" || cmd === "--help") {
+    process.stdout.write(USAGE);
+    return;
+  }
+  if (cmd === "preview") {
+    await runPreview(rest);
+    return;
+  }
+  if (cmd === "export") {
+    await runExportCmd(rest);
+    return;
+  }
+  if (cmd !== "serve") {
+    process.stderr.write(`behold: unknown command '${cmd}'
+
+${USAGE}`);
+    process.exit(2);
+  }
+  const projectDirs = [];
+  let port = 4600;
+  let env;
+  let pollSecs;
+  let autoSync = "off";
+  let local = false;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--port") port = Number(rest[++i]);
+    else if (a === "--env") env = rest[++i];
+    else if (a === "--poll") pollSecs = Number(rest[++i]);
+    else if (a === "--local") local = true;
+    else if (a === "--auto-sync") {
+      const m = rest[++i];
+      if (!m || !isAutoSyncMode(m)) {
+        process.stderr.write("behold serve: --auto-sync must be off | apply | pull-request\n");
+        process.exit(2);
+      }
+      autoSync = m;
+    } else if (a === "-h" || a === "--help") {
+      process.stdout.write(USAGE);
+      return;
+    } else if (!a.startsWith("-")) projectDirs.push(a);
+    else {
+      process.stderr.write(`behold: unexpected argument '${a}'
+`);
+      process.exit(2);
+    }
+  }
+  if (projectDirs.length === 0) {
+    process.stderr.write("behold serve: missing <project-dir>\n\n" + USAGE);
+    process.exit(2);
+  }
+  if (!Number.isFinite(port)) {
+    process.stderr.write("behold serve: --port must be a number\n");
+    process.exit(2);
+  }
+  if (pollSecs !== void 0 && (!Number.isFinite(pollSecs) || pollSecs <= 0)) {
+    process.stderr.write("behold serve: --poll must be a positive number of seconds\n");
+    process.exit(2);
+  }
+  if (pollSecs !== void 0 && !env) {
+    process.stderr.write("behold serve: --poll needs --env (it polls the live overlay)\n");
+    process.exit(2);
+  }
+  if (autoSync !== "off" && (!env || pollSecs === void 0)) {
+    process.stderr.write("behold serve: --auto-sync needs --env and --poll (it acts on polled drift)\n");
+    process.exit(2);
+  }
+  const dirs = projectDirs.map((d) => resolve2(d));
+  await startServer({
+    projectDir: dirs[0],
+    // primary — ops/overlay/rollback act on it
+    ...dirs.length > 1 ? { projectDirs: dirs } : {},
+    port,
+    ...env ? { env } : {},
+    ...pollSecs !== void 0 ? { pollSecs } : {},
+    ...autoSync !== "off" ? { autoSync } : {},
+    ...local ? { local: true } : {}
+  });
+}
+function injectEmulatorEnv(env) {
+  process.env.LOOM_ENV ??= env ?? "local";
+  process.env.AWS_ENDPOINT_URL ??= "http://localhost:4566";
+  process.env.AWS_ACCESS_KEY_ID ??= "test";
+  process.env.AWS_SECRET_ACCESS_KEY ??= "test";
+  process.env.AWS_REGION ??= "us-east-1";
+}
+async function runPreview(rest) {
+  let port = 4600;
+  let dirArg;
+  let emulator = false;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--port") port = Number(rest[++i]);
+    else if (a === "--emulator") emulator = true;
+    else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
+    else if (!a.startsWith("-")) dirArg = a;
+  }
+  if (!Number.isFinite(port)) {
+    process.stderr.write("behold preview: --port must be a number\n");
+    process.exit(2);
+  }
+  const projectDir = resolve2(dirArg ?? process.cwd());
+  if (!existsSync9(projectDir)) {
+    process.stderr.write(`behold preview: project not found at ${projectDir}
+`);
+    process.exit(2);
+  }
+  if (!emulator) {
+    await startServer({ projectDir, port });
+    return;
+  }
+  injectEmulatorEnv("local");
+  process.stdout.write(
+    `behold preview --emulator \u2014 Loom on the local Floci emulator (read + local deploy only)
+  project: ${projectDir}
+  If Floci isn't up yet, use "Bring up" on the Floci substrate pill (boots + deploys Loom).
+`
+  );
+  await startServer({ projectDir, port, env: "local", previewMode: true });
+}
+async function runExportCmd(rest) {
+  let outDir = resolve2("behold-export");
+  let env;
+  let name;
+  let dirArg;
+  let emulator = false;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--out") outDir = resolve2(rest[++i]);
+    else if (a === "--env") env = rest[++i];
+    else if (a === "--name") name = rest[++i];
+    else if (a === "--emulator") emulator = true;
+    else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
+    else if (!a.startsWith("-")) dirArg = a;
+  }
+  const projectDir = resolve2(dirArg ?? process.cwd());
+  if (emulator) {
+    injectEmulatorEnv(env);
+    env ??= "local";
+  }
+  if (!existsSync9(projectDir)) {
+    process.stderr.write(`behold export: project not found at ${projectDir}
+`);
+    process.exit(2);
+  }
+  await runExport({ projectDir, port: 0, ...env ? { env } : {} }, outDir, name ? { name } : {});
+}
+function isMainModule() {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return realpathSync(entry) === realpathSync(fileURLToPath3(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isMainModule()) {
+  run3(process.argv.slice(2)).catch((err) => {
+    process.stderr.write(`behold: fatal: ${err?.message ?? err}
+`);
+    process.exit(3);
+  });
+}
+export {
+  run3 as run
+};