@intentius/behold 0.23.0 → 0.25.0

package/example-choudoufu-estate/chant.workspace.json

@@ -4,7 +4,7 @@
   "pins": [
     {
       "package": "@intentius/chant-lexicon-terraform",
-      "version": "0.102.0"
+      "version": "0.121.0"
     }
   ],
   "members": [

package/example-terraform-estate/README.md

@@ -90,7 +90,7 @@ install them, so that every user who serves an ordinary chant project does not
 carry an HCL parser they will never run:
 
 ```sh
-npm install --no-save @intentius/chant-lexicon-terraform@^0.102.0 @cdktn/hcl2json@^0.24.0
+npm install --no-save @intentius/chant-lexicon-terraform@^0.121.0 @cdktn/hcl2json@^0.24.0
 ```
 
 Without them the demo refuses before it serves, naming both packages, the
@@ -101,7 +101,7 @@ the packages `chant.workspace.json` pins, looked up from the workspace's own
 `node_modules` at exactly the pinned version. A demo copy has no
 `node_modules`, so `behold demo` links the lexicon behold resolved into the
 copy and sets the copy's pin to that version (#484). It says so as it loads:
-`linked @intentius/chant-lexicon-terraform 0.102.0 into the copy`. Serving
+`linked @intentius/chant-lexicon-terraform 0.121.0 into the copy`. Serving
 your own declared workspace is different: install the pinned lexicon in its
 root, the way `chant workspace check` asks.
 

package/example-terraform-estate/chant.workspace.json

@@ -4,7 +4,7 @@
   "pins": [
     {
       "package": "@intentius/chant-lexicon-terraform",
-      "version": "0.102.0"
+      "version": "0.121.0"
     }
   ],
   "members": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "license": "Apache-2.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",
@@ -41,14 +41,14 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.5",
-    "@intentius/chant": "^0.102.0",
-    "@intentius/chant-k8s-client": "^0.102.0",
+    "@intentius/chant": "^0.121.1",
+    "@intentius/chant-k8s-client": "^0.121.1",
     "@intentius/pinhole": "^0.3.8",
     "ajv": "^8.20.0",
     "hono": "^4.12.34"
   },
   "peerDependencies": {
-    "@intentius/chant-lexicon-terraform": "^0.102.0",
+    "@intentius/chant-lexicon-terraform": "^0.121.0",
     "@cdktn/hcl2json": "^0.24.0"
   },
   "peerDependenciesMeta": {

package/web/app.js

@@ -13,8 +13,13 @@ import { readViewQuery, writeViewQuery, settleView, settlePlace, refusalLine } f
 import { readEmbed, selectMessage, viewFromMessage } from "./embed.js";
 import { gateCards } from "./workspace-gates.js";
 import { cornerOf, estateLine, hrefOf as tgHref, legend as tgLegend, markLine, rootRows as tgRootRows, waveCards } from "./terragucci.js";
+import { laneElement as tgLane, rootOfCard as tgRootOfCard } from "./terragucci-timeline.js";
+import { renderLane } from "./terragucci-lifecycle.js";
+import { initTerragucciEstate } from "./terragucci-estate.js";
+import { cardProgress as tgCardProgress, progressLines as tgProgressLines, progressSection as tgProgressSection, stampProgress as tgStampProgress } from "./terragucci-progress.js";
 import { seconds, whyQuery, whyView } from "./why.js";
 import { readCostLine } from "./read-cost.js";
+import { mountHistoryPicker } from "./history-picker.js";
 import { applyMemberFrame, pendingLine, stillPending } from "./pending.js";
 import { initTheme, setTheme, mountThemePicker, readableOn, colorForCategory, onThemeChange, getTokens, getTheme, pinTokensFor } from "./theme.js";
 // #399 M2 / #401 M4 of #397: the colour-by modes' arithmetic and the
@@ -903,6 +908,27 @@ function inspect(node) {
       panel.appendChild(p);
     }
   }
+  // #511: the newest apply's progress on this card, dated by the records read.
+  const tgProg = tgCardProgress(tgProgress && tgProgress.cards && tgProgress.cards[node.id]);
+  if (tgProg) {
+    const h = document.createElement("h3");
+    h.textContent = "terragucci apply progress (run view, not live)";
+    panel.appendChild(h);
+    for (const line of tgProgressLines(tgProg, new Date())) {
+      const p = document.createElement("p");
+      p.className = "tg-inspect";
+      p.textContent = line;
+      panel.appendChild(p);
+    }
+  }
+  // #506: the audit record's entries for this card's root (the record names
+  // roots, never a resource), newest first.
+  const tgRoot = tgTimeline && tgRootOfCard(tgAnswer, node.id);
+  if (tgRoot) {
+    const h = document.createElement("h3");
+    h.textContent = "terragucci timeline (audit record)";
+    panel.append(h, tgLane(tgTimeline, { root: tgRoot }));
+  }
 
   // Containment hierarchy: a resource shows its parent chain UP (composite →
   // component); a collapsed composite (detail 1: `attrs.members` is a count)
@@ -3223,26 +3249,83 @@ function markDriftedCards(ir) {
 // of this is live. A waiting wave offers its approve line to copy, no button.
 let tgAnswer = null;
 let tgHost = null;
+let tgTimeline = null; // #506: /api/terragucci/timeline, the audit record's lane
 async function initTerragucci() {
   const project = await apiFetch("/api/project").then((r) => r.json()).catch(() => ({}));
   if (!project.terragucciReports) return;
   await loadTerragucci();
+  // #505: the chant/lifecycle lane, and what moved while this page is open.
+  if (staticMode) return;
+  await loadTerragucciLane();
+  watchTerragucci();
+}
+let tgLifecycle = null;
+let tgPolled = null;
+async function loadTerragucciLane({ fresh = false } = {}) {
+  tgLifecycle = await apiFetch(`/api/terragucci/lifecycle${fresh ? "?fresh=1" : ""}`)
+    .then((r) => r.json())
+    .catch((e) => ({ error: String(e) }));
+  renderTerragucciPanel();
+}
+// The server polls only while this stream is open, and stops when the page goes.
+function watchTerragucci() {
+  if (typeof EventSource === "undefined") return;
+  const es = new EventSource("/api/terragucci/events");
+  es.addEventListener("reports", () => loadTerragucci({ fresh: true }));
+  // #511: the run view moved while a wave applies.
+  es.addEventListener("progress", (e) => {
+    tgProgress = JSON.parse(e.data);
+    paintTgProgress();
+  });
+  es.addEventListener("lifecycle", (e) => {
+    tgLifecycle = JSON.parse(e.data);
+    renderTerragucciPanel();
+  });
+  es.addEventListener("polled", (e) => {
+    tgPolled = JSON.parse(e.data);
+    renderTerragucciPanel();
+  });
+}
+function renderTerragucciLane(host, now) {
+  if (staticMode || (!tgLifecycle && !tgPolled)) return;
+  renderLane(host, tgLifecycle, tgPolled, now, { button, copy: copyToClipboard, link: tgLink });
 }
 async function loadTerragucci({ fresh = false } = {}) {
   const answer = await apiFetch(`/api/terragucci${fresh ? "?fresh=1" : ""}`)
     .then((r) => r.json())
     .catch((e) => ({ error: String(e), code: "terragucci-report", remedy: "" }));
   tgAnswer = answer;
+  // #506: the timeline, whole; the inspect pane filters it by a card's root.
+  tgTimeline = await apiFetch(`/api/terragucci/timeline${fresh ? "?fresh=1" : ""}`)
+    .then((r) => r.json())
+    .catch((e) => ({ error: String(e), code: "terragucci-report", remedy: "" }));
   renderTerragucciPanel();
   markTerragucciCards();
+  if (!staticMode) await loadTgProgress({ fresh });
+}
+// #511: /api/terragucci/progress, the newest apply's run view on the cards.
+let tgProgress = null;
+async function loadTgProgress({ fresh = false } = {}) {
+  tgProgress = await apiFetch(`/api/terragucci/progress${fresh ? "?fresh=1" : ""}`)
+    .then((r) => r.json())
+    .catch((e) => ({ error: String(e) }));
+  paintTgProgress();
+}
+function paintTgProgress() {
+  tgStampProgress(document.querySelector("#graph svg"), tgProgress, new Date());
+  renderTerragucciPanel();
 }
 function markTerragucciCards() {
   const svg = document.querySelector("#graph svg");
+  tgStampProgress(svg, tgProgress, new Date()); // #511
   if (!svg || !tgAnswer || !tgAnswer.cards) return;
   const now = new Date();
+  // #505: a pushed read replaces the marks, so the old ones go first.
+  for (const old of svg.querySelectorAll("[data-tg-mark]")) old.remove();
+  for (const g of svg.querySelectorAll(".tg-marked")) g.classList.remove("tg-marked", "tg-drift", "tg-wave", "tg-plan");
   for (const [id, marks] of Object.entries(tgAnswer.cards)) {
     const g = svg.querySelector('[data-node-id="' + CSS.escape(id) + '"]');
-    if (!g || g.querySelector('[data-tg-mark="1"]')) continue;
+    if (!g) continue;
     const corner = cornerOf(marks);
     g.classList.add("tg-marked", `tg-${corner.tone}`);
     const rect = g.querySelector("rect");
@@ -3257,6 +3340,7 @@ function markTerragucciCards() {
     tag.setAttribute("fill", corner.tone === "drift" ? "var(--degraded)" : corner.tone === "wave" ? "var(--pending)" : "var(--muted)");
     tag.textContent = `${corner.text} · ${markAge(marks)}`;
     const title = document.createElementNS("http://www.w3.org/2000/svg", "title");
+    title.setAttribute("data-tg-mark", "title");
     title.textContent = marks.map((m) => markLine(m, now)).join("\n") + "\n(from terragucci reports, not live: the Terragucci tab links each run)";
     g.append(title, tag);
   }
@@ -3292,6 +3376,7 @@ function renderTerragucciPanel() {
     fix.className = "tg-legend";
     fix.textContent = (a && a.remedy) || "";
     host.append(err, fix);
+    renderTerragucciLane(host, new Date());
     return;
   }
   const now = new Date();
@@ -3308,6 +3393,8 @@ function renderTerragucciPanel() {
     line.appendChild(tgLink(est.text, est.href));
     host.appendChild(line);
   }
+  renderTerragucciLane(host, now);
+  if (tgProgress) host.appendChild(tgProgressSection(tgProgress, now, tgLink)); // #511
   for (const w of waveCards(a, now)) {
     const box = document.createElement("div");
     box.className = "ws-gate tg-wave";
@@ -3369,12 +3456,23 @@ function renderTerragucciPanel() {
     ].filter(Boolean).join(" · ");
     host.appendChild(um);
   }
+  if (tgTimeline) {
+    const h = document.createElement("div");
+    h.className = "tg-timeline-title";
+    h.textContent = "Timeline";
+    host.append(h, tgLane(tgTimeline));
+  }
   if (!staticMode) {
-    const again = button("Read the reports again", "", () => loadTerragucci({ fresh: true }));
+    const again = button("Read the reports again", "", () => {
+      loadTerragucci({ fresh: true });
+      loadTerragucciLane({ fresh: true }); // #505: and chant/lifecycle
+    });
     host.appendChild(again);
   }
 }
 initTerragucci();
+// #509: a control repo draws its projects from estate.json and their run views.
+initTerragucciEstate({ fetchUrl: apiFetch, copy: copyToClipboard });
 
 function renderPanelCarve() {
   if (!carveMode()) return;
@@ -6110,6 +6208,7 @@ async function initActions() {
     pill.title = "An exported, read-only snapshot — no live observe or deploy.";
     pill.style.cssText = "align-self:center;font:var(--t-caption)/1.4 var(--font-mono);color:var(--muted);border:1px solid var(--line);border-radius:var(--r-ctl);padding:2px 8px";
     bar.appendChild(pill);
+    mountHistoryPicker(bar); // #510: other commits' views, when ../history.json sits beside this one
     previewMode = true;
     return; // nothing else in the bar is a read
   }

package/web/history-picker.js

@@ -0,0 +1,85 @@
+// #510: a published view lives at views/<name>/<commit>/, with
+// views/<name>/history.json beside the commits (newest first, {commit, at,
+// project, generated}). Inside one, this picker reads ../history.json and
+// opens another commit's view. It only reads: switching is a navigation, and
+// a bundle served anywhere without a history.json beside it shows no picker.
+
+const COMMIT_SHAPE = /^[0-9a-f]{7,64}$/;
+
+/** The rows of a history.json document worth offering, in its order. */
+export function historyRows(doc) {
+  if (!Array.isArray(doc)) return [];
+  return doc.filter((e) => e && typeof e === "object" && typeof e.commit === "string" && COMMIT_SHAPE.test(e.commit));
+}
+
+/** Which row the page at `pathname` is: the commit named by one of its path segments, or null. */
+export function commitOfPath(pathname, rows) {
+  const segs = String(pathname || "").split("/").filter(Boolean);
+  for (let i = segs.length - 1; i >= 0; i--) {
+    const hit = rows.find((r) => r.commit === segs[i]);
+    if (hit) return hit.commit;
+  }
+  return null;
+}
+
+const stamp = (iso) => (typeof iso === "string" && iso.length >= 16 ? iso.slice(0, 16).replace("T", " ") : "");
+
+/** One option's words: the commit, and when its view was exported. */
+export function historyLabel(row) {
+  const when = stamp(row.generated) || stamp(row.at);
+  return `${row.commit.slice(0, 12)}${when ? ` · exported ${when}` : ""}`;
+}
+
+/** One option's tooltip. */
+export function historyTitle(row) {
+  return [`commit ${row.commit}`, row.at ? `committed ${row.at}` : "", row.generated ? `exported ${row.generated}` : "", row.project ? `project ${row.project}` : ""].filter(Boolean).join("\n");
+}
+
+/** Where a pick goes: the sibling commit's view, keeping the lens in the query and the fragment. */
+export function commitHref(commit, search = "", hash = "") {
+  return `../${commit}/index.html${search || ""}${hash || ""}`;
+}
+
+/**
+ * Read ../history.json and put a commit picker into `host`. Resolves to the
+ * <select>, or null when there is no history to pick from.
+ */
+export async function mountHistoryPicker(host, env = {}) {
+  const fetchFn = env.fetch || ((u, o) => fetch(u, o));
+  const loc = env.location || location;
+  const doc = env.document || document;
+  let rows;
+  try {
+    const r = await fetchFn("../history.json", { cache: "no-cache" });
+    if (!r.ok) return null;
+    rows = historyRows(await r.json());
+  } catch {
+    return null;
+  }
+  if (!rows.length) return null;
+  const current = commitOfPath(loc.pathname, rows);
+  const select = doc.createElement("select");
+  select.title = "Published views, newest first: open the view exported at another commit";
+  select.setAttribute("aria-label", "Published view history");
+  select.style.cssText = "align-self:center;font:var(--t-caption)/1.4 var(--font-mono);color:var(--fg);background:var(--panel);border:1px solid var(--line);border-radius:var(--r-ctl);padding:1px 4px;margin-left:6px;max-width:16em";
+  if (!current) {
+    const here = doc.createElement("option");
+    here.value = "";
+    here.textContent = "this view (not in history)";
+    here.selected = true;
+    select.appendChild(here);
+  }
+  for (const row of rows) {
+    const o = doc.createElement("option");
+    o.value = row.commit;
+    o.textContent = historyLabel(row);
+    o.title = historyTitle(row);
+    if (row.commit === current) o.selected = true;
+    select.appendChild(o);
+  }
+  select.addEventListener("change", () => {
+    if (select.value && select.value !== current) loc.assign(commitHref(select.value, loc.search, loc.hash));
+  });
+  host.appendChild(select);
+  return select;
+}

package/web/history-picker.test.js

@@ -0,0 +1,77 @@
+import { describe, expect, it } from "vitest";
+import { commitHref, commitOfPath, historyLabel, historyRows, mountHistoryPicker } from "./history-picker.js";
+
+// #510: the picker inside a published commit's view, reading ../history.json.
+const A = "a".repeat(40);
+const B = "b".repeat(40);
+const history = [
+  { commit: A, at: "2026-10-09T08:00:00.000Z", project: "shop", generated: "2026-10-10T12:00:00.000Z" },
+  { commit: B, at: "2026-10-08T08:00:00.000Z", project: "shop", generated: "2026-10-08T09:30:00.000Z" },
+  { commit: "../x", at: "", project: "", generated: "" },
+];
+
+/** Just enough of a document for the picker. */
+function fakeDocument() {
+  const make = (tag) => {
+    const el = {
+      tag,
+      children: [],
+      style: {},
+      attrs: {},
+      listeners: {},
+      appendChild: (c) => (el.children.push(c), c),
+      setAttribute: (k, v) => (el.attrs[k] = v),
+      addEventListener: (k, f) => (el.listeners[k] = f),
+    };
+    return el;
+  };
+  return { createElement: make, host: make("div") };
+}
+
+describe("the history picker (#510)", () => {
+  it("offers the rows with a commit, newest first, labeled with the commit and when it was exported", () => {
+    const rows = historyRows(history);
+    expect(rows.map((r) => r.commit)).toEqual([A, B]);
+    expect(historyLabel(rows[0])).toBe(`${A.slice(0, 12)} · exported 2026-10-10 12:00`);
+    expect(historyRows({})).toEqual([]);
+  });
+
+  it("knows which commit the page is from its path", () => {
+    const rows = historyRows(history);
+    expect(commitOfPath(`/r/views/behold/${B}/index.html`, rows)).toBe(B);
+    expect(commitOfPath(`/r/views/behold/${A}/`, rows)).toBe(A);
+    expect(commitOfPath("/somewhere/else/", rows)).toBeNull();
+  });
+
+  it("reads ../history.json, selects this commit, and opens another in place, keeping the query and fragment", async () => {
+    const asked = [];
+    const went = [];
+    const doc = fakeDocument();
+    const location = { pathname: `/r/views/behold/${A}/index.html`, search: "?env=prod", hash: "#x", assign: (u) => went.push(u) };
+    const fetch = async (u, o) => (asked.push([u, o]), { ok: true, json: async () => history });
+    const select = await mountHistoryPicker(doc.host, { fetch, location, document: doc });
+    expect(asked).toEqual([["../history.json", { cache: "no-cache" }]]);
+    expect(doc.host.children).toEqual([select]);
+    expect(select.children.map((o) => [o.value, !!o.selected])).toEqual([[A, true], [B, false]]);
+    select.value = B;
+    select.listeners.change();
+    expect(went).toEqual([`../${B}/index.html?env=prod#x`]);
+    expect(commitHref(A)).toBe(`../${A}/index.html`);
+  });
+
+  it("shows nothing when no history.json sits beside the view", async () => {
+    const doc = fakeDocument();
+    const location = { pathname: "/bundle/index.html", search: "", hash: "", assign: () => {} };
+    expect(await mountHistoryPicker(doc.host, { fetch: async () => ({ ok: false }), location, document: doc })).toBeNull();
+    expect(await mountHistoryPicker(doc.host, { fetch: async () => Promise.reject(new Error("offline")), location, document: doc })).toBeNull();
+    expect(doc.host.children).toEqual([]);
+  });
+
+  it("marks a view that is not in the history rather than claiming to be another commit", async () => {
+    const doc = fakeDocument();
+    const location = { pathname: `/r/views/behold/${"c".repeat(40)}/index.html`, search: "", hash: "", assign: () => {} };
+    const select = await mountHistoryPicker(doc.host, { fetch: async () => ({ ok: true, json: async () => history }), location, document: doc });
+    expect(select.children[0]).toMatchObject({ value: "", selected: true });
+    expect(select.children).toHaveLength(3);
+  });
+});

package/web/index.html

@@ -158,9 +158,44 @@
       #tab-terragucci .tg-cells > span::before { content: attr(data-stage) ": "; color: var(--muted); }
       #tab-terragucci .tg-drift, #tab-terragucci .tg-failed { color: var(--degraded); }
       #tab-terragucci .tg-wave { color: var(--pending); }
+      /* #509: a control repo's projects, over the empty graph area. Dated, never live. */
+      #tg-estate { grid-row: 1; grid-column: 1; z-index: 2; overflow: auto; background: var(--bg); padding: 10px 14px; display: flex; flex-direction: column; gap: 10px; font-size: var(--t-caption); }
+      #tg-estate .tg-estate-head { display: flex; flex-wrap: wrap; gap: 6px 14px; align-items: baseline; }
+      #tg-estate .tg-legend, #tg-estate .tg-none, #tg-estate .ws-gate-facts, #tg-estate .ws-gate-note { color: var(--muted); overflow-wrap: anywhere; }
+      #tg-estate .tg-refusal, #tg-estate .tg-bad { color: var(--degraded); font-weight: 600; }
+      #tg-estate a { color: inherit; }
+      #tg-estate .tg-estate-graph { overflow: auto; }
+      #tg-estate svg text { fill: var(--fg); font-size: 11px; }
+      #tg-estate .tg-project-box { fill: var(--panel); stroke: var(--rule); }
+      #tg-estate .tg-project-box.tg-no-run { stroke-dasharray: 4 3; }
+      #tg-estate .tg-project-name { font-weight: 600; font-size: 12px; }
+      #tg-estate svg .tg-project-counts, #tg-estate svg .tg-project-run.tg-none, #tg-estate svg .tg-wave-label { fill: var(--muted); }
+      #tg-estate svg .tg-project-run.tg-bad { fill: var(--degraded); }
+      #tg-estate svg .tg-wave-waiting, #tg-estate svg .tg-wave-applying { fill: var(--pending); }
+      #tg-estate svg .tg-wave-failed, #tg-estate svg .tg-wave-refused { fill: var(--degraded); }
+      #tg-estate .tg-root-node rect { fill: var(--bg); stroke: var(--edge); }
+      #tg-estate .tg-root-node text { font-family: var(--font-mono); }
+      #tg-estate .tg-edge { fill: none; stroke: var(--edge); stroke-width: 1.3; }
+      #tg-estate .tg-edge-cross { stroke-dasharray: 5 4; stroke: var(--pending); }
+      #tg-estate .tg-estate-projects { display: grid; grid-template-columns: repeat(auto-fill, minmax(280px, 1fr)); gap: 10px; }
+      #tg-estate .tg-estate-project { border: 1px solid var(--rule); border-radius: var(--r-ctl); padding: 6px 8px; display: flex; flex-direction: column; gap: 4px; }
+      #tg-estate .tg-estate-title { font-weight: 600; overflow-wrap: anywhere; }
+      #tg-estate .ws-gate { border: 1px solid var(--pending, var(--rule)); border-radius: var(--r-ctl); padding: 4px 6px; }
+      #tg-estate .tg-estate-cmd { display: flex; gap: 6px; align-items: center; }
+      #tg-estate .tg-command { font-family: var(--font-mono); overflow-wrap: anywhere; }
       #tab-terragucci .tg-plan { color: var(--fg); }
       #tab-terragucci .tg-none, #tab-terragucci .tg-ok { color: var(--muted); }
       #tab-terragucci a { color: inherit; }
+      /* #506: the audit record's lane, in the tab and in a card's inspect pane. */
+      #tab-terragucci .tg-timeline-title { font-weight: 600; border-top: 1px solid var(--rule); padding-top: 6px; }
+      .tg-timeline { display: flex; flex-direction: column; gap: 3px; font-size: var(--t-caption); }
+      .tg-timeline .tg-legend { color: var(--muted); }
+      .tg-timeline .tg-refusal { color: var(--degraded); font-weight: 600; }
+      .tg-timeline .tg-entry { overflow-wrap: anywhere; }
+      .tg-timeline .tg-when { color: var(--muted); font-family: var(--font-mono); }
+      .tg-timeline .tg-failed, .tg-timeline .tg-drift { color: var(--degraded); }
+      .tg-timeline .tg-wave { color: var(--pending); }
+      .tg-timeline a { color: inherit; }
       /* Fit reset + a zoom hint, floating top-right of the graph pane. */
       #zoom-toggle { position: absolute; top: 8px; right: 8px; z-index: 2; background: var(--panel);
         color: var(--muted); border: 1px solid var(--rule); border-radius: var(--r-ctl); padding: 4px 10px;