@intentius/behold 0.24.0 → 0.25.0

package/dist/cli.js

@@ -119,17 +119,17 @@ var init_read_scheduler = __esm({
             recordRefused();
             return Promise.reject(new Error("Chant read queue is full; retry after current reads finish"));
           }
-          let resolve24;
+          let resolve29;
           let reject;
           const promise = new Promise((yes, no) => {
-            resolve24 = yes;
+            resolve29 = yes;
             reject = no;
           });
           job = {
             key,
             run: run3,
             promise,
-            resolve: resolve24,
+            resolve: resolve29,
             reject,
             controller: new AbortController(),
             users: 0,
@@ -143,7 +143,7 @@ var init_read_scheduler = __esm({
         }
         const shared2 = job;
         shared2.users++;
-        const result = new Promise((resolve24, reject) => {
+        const result = new Promise((resolve29, reject) => {
           let done = false;
           const finish = (error, value, failed = false) => {
             if (done) return;
@@ -151,7 +151,7 @@ var init_read_scheduler = __esm({
             signal?.removeEventListener("abort", abort);
             shared2.users--;
             if (failed) reject(error);
-            else resolve24(value);
+            else resolve29(value);
           };
           const abort = () => {
             finish(signal?.reason, void 0, true);
@@ -240,8 +240,8 @@ function resolveSubstrateTargets(lexicons, env = process.env) {
 }
 function targetEnvOverrides(targets, chosen) {
   const overrides = {};
-  for (const t of targets) {
-    overrides[t.envVar] = chosen ?? t.endpoint;
+  for (const t2 of targets) {
+    overrides[t2.envVar] = chosen ?? t2.endpoint;
   }
   return overrides;
 }
@@ -329,13 +329,13 @@ var init_errors = __esm({
           }
         } catch {
         }
-        const message = status?.message ?? firstLine(body) ?? "";
-        return new _K8sApiError(statusCode, status?.reason, message, target, status);
+        const message2 = status?.message ?? firstLine(body) ?? "";
+        return new _K8sApiError(statusCode, status?.reason, message2, target, status);
       }
     };
     K8sTransportError = class extends Error {
-      constructor(message, target, options) {
-        super(target ? `${target}: ${message}` : message);
+      constructor(message2, target, options) {
+        super(target ? `${target}: ${message2}` : message2);
         this.target = target;
         this.name = "K8sTransportError";
         if (options && "cause" in options) this.cause = options.cause;
@@ -366,20 +366,20 @@ var init_errors = __esm({
       allowed;
     };
     FieldManagerError = class extends Error {
-      constructor(message) {
-        super(`k8s: ${message}`);
+      constructor(message2) {
+        super(`k8s: ${message2}`);
         this.name = "FieldManagerError";
       }
     };
     KubeConfigError = class extends Error {
-      constructor(message) {
-        super(`k8s: ${message}`);
+      constructor(message2) {
+        super(`k8s: ${message2}`);
         this.name = "KubeConfigError";
       }
     };
     UnknownResourceError = class extends Error {
-      constructor(selectorText2, message) {
-        super(message ?? `k8s: the cluster's API discovery reports no resource matching "${selectorText2}"`);
+      constructor(selectorText2, message2) {
+        super(message2 ?? `k8s: the cluster's API discovery reports no resource matching "${selectorText2}"`);
         this.selectorText = selectorText2;
         this.name = "UnknownResourceError";
       }
@@ -449,15 +449,15 @@ function renderConflictReport(report) {
     grouped.set(conflict.manager, list3);
   }
   const count = new Set(conflicts.map((c) => c.field)).size;
-  const lines = [
+  const lines2 = [
     `k8s: server-side apply of ${subject} was refused \u2014 ${count} ${count === 1 ? "field is" : "fields are"} owned by another field manager.`,
     ""
   ];
   for (const [manager, fields] of [...grouped].sort(([a], [b]) => a.localeCompare(b))) {
-    lines.push(`  "${manager}" owns:`);
-    for (const field of [...fields].sort()) lines.push(`    ${field}`);
+    lines2.push(`  "${manager}" owns:`);
+    for (const field of [...fields].sort()) lines2.push(`    ${field}`);
   }
-  lines.push(
+  lines2.push(
     "",
     `chant applied as field manager "${fieldManager}". Taking these fields means the managers above`,
     `stop owning them, and will contest them again on their next apply.`,
@@ -467,12 +467,12 @@ function renderConflictReport(report) {
     "  - re-run this apply with force-conflicts on, deliberately (the `force: true` activity argument,",
     "    or `forceConflicts: true` on ApplyOp), which transfers ownership to chant."
   );
-  return lines.join("\n");
+  return lines2.join("\n");
 }
-function parseFieldConflicts(status, message) {
+function parseFieldConflicts(status, message2) {
   const fromCauses = causesOf(status);
   if (fromCauses.length > 0) return fromCauses;
-  return parseConflictMessage(message ?? status?.message ?? "");
+  return parseConflictMessage(message2 ?? status?.message ?? "");
 }
 function causesOf(status) {
   const details = status?.details;
@@ -494,17 +494,17 @@ function causesOf(status) {
   }
   return out;
 }
-function parseCauseMessage(message) {
-  const manager = /conflicts? with "([^"]+)"/.exec(message)?.[1];
-  const apiVersion = /\busing ([^\s:]+)\b/.exec(message)?.[1];
+function parseCauseMessage(message2) {
+  const manager = /conflicts? with "([^"]+)"/.exec(message2)?.[1];
+  const apiVersion = /\busing ([^\s:]+)\b/.exec(message2)?.[1];
   return { ...manager ? { manager } : {}, ...apiVersion ? { apiVersion } : {} };
 }
-function parseConflictMessage(message) {
-  if (!message) return [];
+function parseConflictMessage(message2) {
+  if (!message2) return [];
   const out = [];
   let manager;
   let apiVersion;
-  for (const rawLine of message.split("\n")) {
+  for (const rawLine of message2.split("\n")) {
     const line = rawLine.trim();
     if (line.length === 0) continue;
     const header = /conflicts? with "([^"]+)"(?: using ([^\s:]+))?/.exec(line);
@@ -712,10 +712,10 @@ var init_kubeconfig = __esm({
 // node_modules/@intentius/chant-k8s-client/src/watch.ts
 function parseWatchFrames(chunk, carry = "") {
   const combined = carry + chunk;
-  const lines = combined.split("\n");
-  const rest = lines.pop() ?? "";
+  const lines2 = combined.split("\n");
+  const rest = lines2.pop() ?? "";
   const frames = [];
-  for (const line of lines) {
+  for (const line of lines2) {
     const trimmed = line.trim();
     if (!trimmed) continue;
     let parsed;
@@ -748,9 +748,9 @@ async function* streamLines(source2) {
   const decoder = new TextDecoder();
   let carry = "";
   const emit = function* (chunk) {
-    const lines = (carry + chunk).split("\n");
-    carry = lines.pop() ?? "";
-    for (const line of lines) yield line;
+    const lines2 = (carry + chunk).split("\n");
+    carry = lines2.pop() ?? "";
+    for (const line of lines2) yield line;
   };
   const decode = (value) => typeof value === "string" ? value : decoder.decode(value, { stream: true });
   if (source2 && typeof source2.getReader === "function") {
@@ -1039,11 +1039,11 @@ async function createK8sClient(options = {}) {
     }
     return void 0;
   }
-  async function resolve24(selector, signal) {
+  async function resolve29(selector, signal) {
     return "apiVersion" in selector ? resolveByGvk(selector.apiVersion, selector.kind, signal) : resolveByResourceString(selector.resource, selector.group, signal);
   }
   async function resolveOrThrow(selector, signal) {
-    const info = await resolve24(selector, signal);
+    const info = await resolve29(selector, signal);
     if (!info) throw new UnknownResourceError(selectorText(selector));
     return info;
   }
@@ -1055,7 +1055,7 @@ async function createK8sClient(options = {}) {
     return parts.join("/");
   }
   async function pathFor(ref2, signal) {
-    const info = await resolve24({ apiVersion: ref2.apiVersion, kind: ref2.kind }, signal);
+    const info = await resolve29({ apiVersion: ref2.apiVersion, kind: ref2.kind }, signal);
     if (!info) return void 0;
     return objectPath(info, ref2.name, ref2.namespace);
   }
@@ -1148,10 +1148,10 @@ async function createK8sClient(options = {}) {
       return page.metadata?.resourceVersion;
     }
     let ended = false;
-    const end = (message) => {
+    const end = (message2) => {
       if (ended) return;
       ended = true;
-      if (message !== void 0) opts.onError?.(message);
+      if (message2 !== void 0) opts.onError?.(message2);
     };
     const done = (async () => {
       try {
@@ -1166,11 +1166,11 @@ async function createK8sClient(options = {}) {
             allowWatchBookmarks: "true"
           };
           if (resourceVersion) query.resourceVersion = resourceVersion;
-          const { lines } = await openStream(listPath, query, controller.signal, target);
+          const { lines: lines2 } = await openStream(listPath, query, controller.signal, target);
           let expired = false;
-          const iterator = lines[Symbol.asyncIterator]();
-          const stopped = new Promise((resolve25) => {
-            const finish = () => resolve25({ done: true, value: void 0 });
+          const iterator = lines2[Symbol.asyncIterator]();
+          const stopped = new Promise((resolve30) => {
+            const finish = () => resolve30({ done: true, value: void 0 });
             if (controller.signal.aborted) finish();
             else controller.signal.addEventListener("abort", finish, { once: true });
           });
@@ -1197,11 +1197,11 @@ async function createK8sClient(options = {}) {
             resourceVersion = await listResourceVersion();
             continue;
           }
-          await new Promise((resolve25) => {
-            const timer = setTimeout(resolve25, reopenDelayMs);
+          await new Promise((resolve30) => {
+            const timer = setTimeout(resolve30, reopenDelayMs);
             controller.signal.addEventListener("abort", () => {
               clearTimeout(timer);
-              resolve25(void 0);
+              resolve30(void 0);
             }, { once: true });
           });
         }
@@ -1319,7 +1319,7 @@ async function createK8sClient(options = {}) {
   return {
     provenance,
     defaultNamespace,
-    resolve: resolve24,
+    resolve: resolve29,
     read,
     pathFor,
     readIfPresent,
@@ -1435,14 +1435,14 @@ function renderSegment(key) {
   if (key.startsWith("k:")) return renderKeySegment(key.slice(2));
   return void 0;
 }
-function renderKeySegment(json) {
+function renderKeySegment(json2) {
   let parsed;
   try {
-    parsed = JSON.parse(json);
+    parsed = JSON.parse(json2);
   } catch {
-    return `[${json}]`;
+    return `[${json2}]`;
   }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return `[${json}]`;
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return `[${json2}]`;
   const parts = Object.entries(parsed).map(
     ([name, value]) => `${name}=${JSON.stringify(value)}`
   );
@@ -1581,13 +1581,13 @@ function parseLiveCheckOutput(run3, dir) {
     const why = said4.find((l) => /^Error:/.test(l)) ?? said4[0] ?? `exit ${run3.code}`;
     return refuse(`choudoufu could not read ${dir}: ${why}`, "Fix the configuration until `choudoufu live-check` prints a document, then reload.");
   }
-  let json;
+  let json2;
   try {
-    json = JSON.parse(text);
+    json2 = JSON.parse(text);
   } catch (err) {
     return refuse(`choudoufu live-check printed something that is not JSON: ${err instanceof Error ? err.message : String(err)}`, INSTALL);
   }
-  return parseLiveCheck(json);
+  return parseLiveCheck(json2);
 }
 function tfFiles(dir) {
   try {
@@ -1703,19 +1703,19 @@ function choudoufuBinary() {
   return process.env.CHOUDOUFU_BIN || "choudoufu";
 }
 function parseChoudoufuVersion(stdout, bin = choudoufuBinary()) {
-  let json;
+  let json2;
   try {
-    json = JSON.parse(stdout);
+    json2 = JSON.parse(stdout);
   } catch {
     return void 0;
   }
-  if (!isRecord(json)) return void 0;
-  const forkField = "choudoufu_version" in json;
+  if (!isRecord(json2)) return void 0;
+  const forkField = "choudoufu_version" in json2;
   return {
     bin,
-    version: typeof json.choudoufu_version === "string" ? json.choudoufu_version : "",
+    version: typeof json2.choudoufu_version === "string" ? json2.choudoufu_version : "",
     forkField,
-    ...typeof json.terraform_version === "string" ? { upstream: json.terraform_version } : {}
+    ...typeof json2.terraform_version === "string" ? { upstream: json2.terraform_version } : {}
   };
 }
 function isDevBuild(version) {
@@ -1786,9 +1786,9 @@ var init_choudoufu_member = __esm({
     COMMON_RUNG = "tag-governable";
     versionCache = /* @__PURE__ */ new Map();
     ChoudoufuReadError = class extends Error {
-      constructor(refusal, dir) {
-        super(`choudoufu live-check ${dir} exited 1: ${refusal.error}`);
-        this.refusal = refusal;
+      constructor(refusal2, dir) {
+        super(`choudoufu live-check ${dir} exited 1: ${refusal2.error}`);
+        this.refusal = refusal2;
       }
       refusal;
     };
@@ -1837,16 +1837,16 @@ function readCarveReport(path, readFile2) {
       HOW_TO_GET_ONE
     );
   }
-  let json;
+  let json2;
   try {
-    json = JSON.parse(text);
+    json2 = JSON.parse(text);
   } catch (err) {
     return refuse2(
       `${path} isn't valid JSON: ${err instanceof Error ? err.message : String(err)}`,
       HOW_TO_GET_ONE
     );
   }
-  return parseCarveReport(json);
+  return parseCarveReport(json2);
 }
 function statusForBand(band, score) {
   switch (band) {
@@ -2043,8 +2043,8 @@ function groupTerraformByRoot(ir) {
     if (n.lexicon !== TERRAFORM_LEXICON) continue;
     const root = typeof n.attrs.root === "string" && n.attrs.root ? n.attrs.root : n.id.includes("/") ? n.id.slice(0, n.id.indexOf("/")) : void 0;
     if (!root) continue;
-    const at = n.id.indexOf(`/${root}/`);
-    const prefix = at > 0 ? n.id.slice(0, at) : "";
+    const at2 = n.id.indexOf(`/${root}/`);
+    const prefix = at2 > 0 ? n.id.slice(0, at2) : "";
     const key = `${prefix} ${root}`;
     (roots.get(key) ?? roots.set(key, { prefix, root, ids: [] }).get(key)).ids.push(n.id);
   }
@@ -2415,9 +2415,9 @@ var init_terraform_member = __esm({
     beholdDir = () => dirname2(fileURLToPath(import.meta.url));
     spec = (peer) => `${peer.pkg}@${peer.range ?? "latest"}`;
     TerraformReadError = class extends Error {
-      constructor(refusal, dir) {
-        super(`terraform reader ${dir} exited 1: ${refusal.error}`);
-        this.refusal = refusal;
+      constructor(refusal2, dir) {
+        super(`terraform reader ${dir} exited 1: ${refusal2.error}`);
+        this.refusal = refusal2;
       }
       refusal;
     };
@@ -2485,8 +2485,8 @@ function indexRoster(addresses) {
   const calls = /* @__PURE__ */ new Map();
   for (const address of addresses) {
     const { blockPath: blockPath2, ...instance } = decomposeAddress(address);
-    const at = blocks.get(blockPath2);
-    if (at) at.push(instance);
+    const at2 = blocks.get(blockPath2);
+    if (at2) at2.push(instance);
     else blocks.set(blockPath2, [instance]);
     const segments = blockPath2.split("/");
     for (let depth = 1; depth < segments.length; depth++) {
@@ -2506,8 +2506,8 @@ function endOf(path, index) {
   const found = index.blocks.get(path) ?? (isModuleCall(path) ? index.calls.get(path) : void 0);
   const byScope = /* @__PURE__ */ new Map();
   for (const i of found ?? []) {
-    const at = byScope.get(i.scope);
-    if (at) at.push(i);
+    const at2 = byScope.get(i.scope);
+    if (at2) at2.push(i);
     else byScope.set(i.scope, [i]);
   }
   return byScope;
@@ -2545,7 +2545,7 @@ function joinLexiconEdges(edges, index, root = LEXICON_ROOT) {
         for (const f of fromCards) add(f.address, byKey.get(f.key), e.viaAttr);
         continue;
       }
-      for (const f of fromCards) for (const t of toCards) add(f.address, t.address, e.viaAttr);
+      for (const f of fromCards) for (const t2 of toCards) add(f.address, t2.address, e.viaAttr);
     }
   }
   return out;
@@ -2596,41 +2596,41 @@ var init_choudoufu_refs = __esm({
 
 // src/choudoufu-live.ts
 function said(run3, fallback) {
-  const lines = stripAnsiLines(run3.stderr);
-  return lines.find((l) => /^Error:/.test(l)) ?? lines[0] ?? fallback;
+  const lines2 = stripAnsiLines(run3.stderr);
+  return lines2.find((l) => /^Error:/.test(l)) ?? lines2[0] ?? fallback;
 }
 function parseLiveLs(run3, dir) {
   if (run3.code === 127) return refuse3("choudoufu is not on PATH.", "Install choudoufu and put it on PATH.");
   const text = run3.stdout.trim();
   if (!text) return refuse3(`choudoufu live-ls could not list ${dir}: ${said(run3, `exit ${run3.code}`)}`, CREDS);
-  let json;
+  let json2;
   try {
-    json = JSON.parse(text);
+    json2 = JSON.parse(text);
   } catch {
     return refuse3(`choudoufu live-ls printed something that is not JSON in ${dir}: ${said(run3, "unparseable stdout")}`, CREDS);
   }
-  if (!isRecord3(json) || typeof json.estate !== "string" || !Array.isArray(json.items)) {
+  if (!isRecord3(json2) || typeof json2.estate !== "string" || !Array.isArray(json2.items)) {
     return refuse3("That is not a live-ls document \u2014 no `estate` and `items`.", CREDS);
   }
-  if (typeof json.schemas !== "string") {
+  if (typeof json2.schemas !== "string") {
     return refuse3("This live-ls document carries no `schemas` field: it was written by a choudoufu older than 0.16.0.", "Upgrade choudoufu to 0.16.0 or newer.");
   }
-  return { ok: true, doc: json };
+  return { ok: true, doc: json2 };
 }
 function parseLivePlan(run3, dir) {
   if (run3.code === 127) return refuse3("choudoufu is not on PATH.", "Install choudoufu and put it on PATH.");
   const text = run3.stdout.trim();
   if (!text) return refuse3(`choudoufu live-plan could not plan ${dir}: ${said(run3, `exit ${run3.code}`)}`, CREDS);
-  let json;
+  let json2;
   try {
-    json = JSON.parse(text);
+    json2 = JSON.parse(text);
   } catch {
     return refuse3(`choudoufu live-plan printed something that is not JSON in ${dir}: ${said(run3, "unparseable stdout")}`, CREDS);
   }
-  if (!isRecord3(json) || typeof json.estate !== "string" || !("bound" in json)) {
+  if (!isRecord3(json2) || typeof json2.estate !== "string" || !("bound" in json2)) {
     return refuse3("That is not a live-plan document \u2014 no `estate` and `bound`.", CREDS);
   }
-  return { ok: true, doc: json };
+  return { ok: true, doc: json2 };
 }
 function adoptLine(u) {
   const composed = u.hint || u.adopt_command;
@@ -3191,11 +3191,11 @@ function memberSourceStamp(dir) {
   const skipDirs = exclusions.get(root);
   const h = createHash2("sha1");
   let any = false;
-  const walk = (at) => {
-    const entries = readdirSync3(at, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
+  const walk = (at2) => {
+    const entries = readdirSync3(at2, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
     for (const e of entries) {
       if (SKIP.has(e.name)) continue;
-      const path = join5(at, e.name);
+      const path = join5(at2, e.name);
       if (e.isDirectory()) {
         if (!skipDirs?.has(path)) walk(path);
         continue;
@@ -3414,7 +3414,7 @@ function State(input, types) {
   this.documents = [];
   this.anchorMapTransactions = [];
 }
-function generateError(state, message) {
+function generateError(state, message2) {
   const mark = {
     name: null,
     buffer: state.input.slice(0, -1),
@@ -3423,10 +3423,10 @@ function generateError(state, message) {
     line: state.line,
     column: state.position - state.lineStart
   };
-  return new YAMLException(message, mark);
+  return new YAMLException(message2, mark);
 }
-function throwError(state, message) {
-  throw generateError(state, message);
+function throwError(state, message2) {
+  throw generateError(state, message2);
 }
 function storeAnchor(state, name, value) {
   const transactions = state.anchorMapTransactions;
@@ -4571,8 +4571,8 @@ var init_js_yaml_load = __esm({
     STR_TYPE = { tag: "tag:yaml.org,2002:str", kind: "scalar", construct: (data) => data !== null ? data : "" };
     SEQ_TYPE = { tag: "tag:yaml.org,2002:seq", kind: "sequence", construct: (data) => data !== null ? data : [] };
     MAP_TYPE = { tag: "tag:yaml.org,2002:map", kind: "mapping", construct: (data) => data !== null ? data : {} };
-    for (const t of [NULL_TYPE, INT_TYPE, FLOAT_TYPE, STR_TYPE, SEQ_TYPE, MAP_TYPE]) {
-      t.resolve ??= () => true;
+    for (const t2 of [NULL_TYPE, INT_TYPE, FLOAT_TYPE, STR_TYPE, SEQ_TYPE, MAP_TYPE]) {
+      t2.resolve ??= () => true;
     }
     _hasOwnProperty = Object.prototype.hasOwnProperty;
     CONTEXT_FLOW_IN = 1;
@@ -4657,12 +4657,12 @@ function unshareAliases(value, seen = /* @__PURE__ */ new Set()) {
   }
   return value;
 }
-function errorLine(lines, err) {
+function errorLine(lines2, err) {
   let line = err.mark?.line ?? 0;
   if (/multiline key may not be an implicit key/.test(err.reason)) {
-    const indent = lines[line]?.search(/\S/) ?? -1;
+    const indent = lines2[line]?.search(/\S/) ?? -1;
     for (let k = line - 1; k >= 0; k--) {
-      const prev = lines[k];
+      const prev = lines2[k];
       if (prev.trim() === "" || prev.trim().startsWith("#")) continue;
       if (prev.search(/\S/) !== indent || /:(?:\s|$)/.test(prev) || /^\s*-(?:\s|$)/.test(prev)) break;
       line = k;
@@ -4696,6 +4696,13 @@ function parseYAML(content) {
   const value = loadDocument(content);
   return Array.isArray(value) ? {} : value;
 }
+function parseYAMLDocument(content) {
+  try {
+    return JSON.parse(content);
+  } catch {
+  }
+  return loadDocument(content);
+}
 var YAMLParseError, DOCUMENT_MARKER, BOOL, TAGGED_SCALAR, TAGGED_SEQUENCE, MERGE, SCHEMA;
 var init_yaml = __esm({
   "node_modules/@intentius/chant/src/yaml.ts"() {
@@ -4703,8 +4710,8 @@ var init_yaml = __esm({
     YAMLParseError = class extends Error {
       /** 1-based line number within the text handed to the parser. */
       line;
-      constructor(line, message) {
-        super(`YAML line ${line}: ${message}`);
+      constructor(line, message2) {
+        super(`YAML line ${line}: ${message2}`);
         this.name = "YAMLParseError";
         this.line = line;
       }
@@ -5576,9 +5583,9 @@ var init_chant = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve23, dirname as dirname14, join as join34 } from "node:path";
-import { realpathSync as realpathSync3, existsSync as existsSync23, readFileSync as readFileSync25, rmSync as rmSync4 } from "node:fs";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { resolve as resolve28, dirname as dirname17, join as join40 } from "node:path";
+import { realpathSync as realpathSync3, existsSync as existsSync25, readFileSync as readFileSync29, rmSync as rmSync4 } from "node:fs";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { spawn as spawn8, spawnSync as spawnSync3 } from "node:child_process";
 
 // src/server.ts
@@ -5629,14 +5636,14 @@ function contextBindsCluster(context, clusterName) {
 }
 
 // src/server.ts
-import { streamSSE } from "hono/streaming";
+import { streamSSE as streamSSE2 } from "hono/streaming";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { serve } from "@hono/node-server";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { execFile as execFile3 } from "node:child_process";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { existsSync as existsSync20, readFileSync as readFileSync22 } from "node:fs";
-import { basename as basename3, dirname as dirname11, join as join31, relative as relative9, resolve as resolve20, sep as sep8 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync25 } from "node:fs";
+import { basename as basename4, dirname as dirname14, join as join36, relative as relative9, resolve as resolve25, sep as sep8 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -5878,19 +5885,19 @@ function finishPipelineProgress(state, exitCode) {
 }
 
 // src/gh-run.ts
-var defaultGhExec = (args) => new Promise((resolve24) => {
+var defaultGhExec = (args) => new Promise((resolve29) => {
   let out = "";
   let proc;
   try {
     proc = spawn3("gh", args, { stdio: ["ignore", "pipe", "pipe"] });
   } catch {
-    resolve24({ code: 127, out: "" });
+    resolve29({ code: 127, out: "" });
     return;
   }
   proc.stdout.on("data", (d) => out += d);
   proc.stderr.on("data", (d) => out += d);
-  proc.on("error", () => resolve24({ code: 127, out }));
-  proc.on("close", (code) => resolve24({ code: code ?? 1, out }));
+  proc.on("error", () => resolve29({ code: 127, out }));
+  proc.on("close", (code) => resolve29({ code: code ?? 1, out }));
 });
 async function ghReady(exec = defaultGhExec) {
   const { code, out } = await exec(["auth", "status"]);
@@ -6152,10 +6159,10 @@ function readDispatchedRun(projectDir, root) {
     return void 0;
   }
 }
-function concludeDispatchedRun(projectDir, runId, verdict2, root) {
+function concludeDispatchedRun(projectDir, runId, verdict3, root) {
   const current = readDispatchedRun(projectDir, root);
   if (!current || current.runId !== runId) return;
-  saveDispatchedRun({ ...current, concluded: { verdict: verdict2, at: (/* @__PURE__ */ new Date()).toISOString() } }, root);
+  saveDispatchedRun({ ...current, concluded: { verdict: verdict3, at: (/* @__PURE__ */ new Date()).toISOString() } }, root);
 }
 
 // src/operator.ts
@@ -6196,9 +6203,9 @@ function readOperatorStatus(run3) {
   const err = strip(run3.stderr);
   const out = strip(run3.stdout).trim();
   if (run3.code !== 0) {
-    const message = err.trim() || out || `chant operator status exited ${run3.code}`;
-    const first = message.split("\n")[0].replace(/^error:\s*/i, "");
-    if (/Unknown command|Unknown operator subcommand/i.test(message)) {
+    const message2 = err.trim() || out || `chant operator status exited ${run3.code}`;
+    const first = message2.split("\n")[0].replace(/^error:\s*/i, "");
+    if (/Unknown command|Unknown operator subcommand/i.test(message2)) {
       return {
         ok: false,
         refusal: {
@@ -6285,7 +6292,7 @@ var rec = (v) => isRecord5(v) ? v : void 0;
 var str = (v) => typeof v === "string" && v ? v : void 0;
 var labelsOf = (n) => rec(rec(n.attrs?.metadata)?.labels) ?? {};
 function operatorIdentity(home) {
-  const names = [...new Set(home.ticks.flatMap((t) => t.serviceAccount ? [t.serviceAccount] : []))].sort();
+  const names = [...new Set(home.ticks.flatMap((t2) => t2.serviceAccount ? [t2.serviceAccount] : []))].sort();
   if (names.length === 0) return { kind: "unknown" };
   if (names.length === 1) return { kind: "one", name: names[0] };
   return { kind: "many", count: names.length };
@@ -6341,7 +6348,7 @@ function markOperatorHome(ir) {
         role: "home",
         namespace: home.namespace,
         ...home.stack ? { stack: home.stack } : {},
-        ticks: home.ticks.map((t) => t.op),
+        ticks: home.ticks.map((t2) => t2.op),
         identity: operatorIdentity(home)
       });
     }
@@ -6404,10 +6411,10 @@ function operatorStrip(rows, now = Date.now()) {
 }
 var OPERATOR_INTERVAL_MS = 6e4;
 var TICK_VERDICT_TTL_MS = 15 * OPERATOR_INTERVAL_MS;
-function tickFreshness(at, now = Date.now()) {
-  const t = at ? Date.parse(at) : NaN;
-  if (!Number.isFinite(t)) return { ageMs: null, fresh: false };
-  const age = now - t;
+function tickFreshness(at2, now = Date.now()) {
+  const t2 = at2 ? Date.parse(at2) : NaN;
+  if (!Number.isFinite(t2)) return { ageMs: null, fresh: false };
+  const age = now - t2;
   if (age < 0) return { ageMs: null, fresh: false };
   return { ageMs: age, fresh: age <= TICK_VERDICT_TTL_MS };
 }
@@ -6437,8 +6444,8 @@ function tickComponentVerdicts(rows) {
     if (!tick || !Array.isArray(tick.components)) continue;
     const verdicts = [];
     for (const value of tick.components) {
-      const verdict2 = readVerdict(value);
-      if (verdict2) verdicts.push(verdict2);
+      const verdict3 = readVerdict(value);
+      if (verdict3) verdicts.push(verdict3);
     }
     out.push({
       op: row.op,
@@ -6451,14 +6458,14 @@ function tickComponentVerdicts(rows) {
   return out;
 }
 function verdictsForEnv(all, env) {
-  const when = (t) => {
-    const ms = Date.parse(t.at);
+  const when = (t2) => {
+    const ms = Date.parse(t2.at);
     return Number.isFinite(ms) ? ms : -Infinity;
   };
   let best = null;
-  for (const t of all) {
-    if (t.env !== env) continue;
-    if (!best || when(t) > when(best)) best = t;
+  for (const t2 of all) {
+    if (t2.env !== env) continue;
+    if (!best || when(t2) > when(best)) best = t2;
   }
   return best;
 }
@@ -6541,9 +6548,9 @@ function readOperatorLog(run3) {
   const err = strip(run3.stderr);
   const out = strip(run3.stdout).trim();
   if (run3.code !== 0) {
-    const message = err.trim() || out || `chant operator log exited ${run3.code}`;
-    const first = message.split("\n")[0].replace(/^error:\s*/i, "");
-    if (/Unknown command|Unknown operator subcommand|Unknown flag/i.test(message)) {
+    const message2 = err.trim() || out || `chant operator log exited ${run3.code}`;
+    const first = message2.split("\n")[0].replace(/^error:\s*/i, "");
+    if (/Unknown command|Unknown operator subcommand|Unknown flag/i.test(message2)) {
       return {
         ok: false,
         refusal: {
@@ -6627,15 +6634,15 @@ function operatorTimeline(entries) {
         url: approvalLink(r.url) ?? null
       };
     }
-    const t = entry.record;
+    const t2 = entry.record;
     return {
       kind: "tick",
-      at: t.timestamp,
-      op: t.op,
-      env: typeof t.env === "string" ? t.env : null,
-      id: typeof t.id === "string" && t.id ? t.id : null,
-      log: t.log,
-      gated: (Array.isArray(t.outcomes) ? t.outcomes : []).filter((o) => o && o.action === "gated" && typeof o.gateName === "string").map((o) => ({
+      at: t2.timestamp,
+      op: t2.op,
+      env: typeof t2.env === "string" ? t2.env : null,
+      id: typeof t2.id === "string" && t2.id ? t2.id : null,
+      log: t2.log,
+      gated: (Array.isArray(t2.outcomes) ? t2.outcomes : []).filter((o) => o && o.action === "gated" && typeof o.gateName === "string").map((o) => ({
         rule: o.ruleId,
         op: typeof o.op === "string" ? o.op : null,
         gate: o.gateName,
@@ -6668,9 +6675,9 @@ var initialOperatorState = {
   code: null,
   readAt: null
 };
-function operatorRead(state, result, at, now = Date.now()) {
+function operatorRead(state, result, at2, now = Date.now()) {
   if (!result.ok) {
-    return { ...state, strip: null, gates: [], verdicts: [], note: result.refusal.error, code: result.refusal.code, readAt: at };
+    return { ...state, strip: null, gates: [], verdicts: [], note: result.refusal.error, code: result.refusal.code, readAt: at2 };
   }
   return {
     ...state,
@@ -6679,7 +6686,7 @@ function operatorRead(state, result, at, now = Date.now()) {
     verdicts: tickComponentVerdicts(result.rows),
     note: null,
     code: null,
-    readAt: at
+    readAt: at2
   };
 }
 function operatorNote(state, now = Date.now()) {
@@ -6695,10 +6702,10 @@ function operatorNote(state, now = Date.now()) {
   bits.push(
     ticked ? `last tick per loop \u2014 the status surface answers with one tick each, and the history is its own read (chant#2029) reached from the strip` : `no tick recorded yet on any loop`
   );
-  const named = state.verdicts.reduce((n, t) => n + t.verdicts.length, 0);
+  const named = state.verdicts.reduce((n, t2) => n + t2.verdicts.length, 0);
   if (named) {
-    const stale = state.verdicts.filter((t) => t.verdicts.length && !tickFreshness(t.at, now).fresh);
-    const painted = named - stale.reduce((n, t) => n + t.verdicts.length, 0);
+    const stale = state.verdicts.filter((t2) => t2.verdicts.length && !tickFreshness(t2.at, now).fresh);
+    const painted = named - stale.reduce((n, t2) => n + t2.verdicts.length, 0);
     bits.push(
       painted ? `${painted} component verdict${painted === 1 ? "" : "s"} from that tick \u2014 joined onto the component DAG by component name, under the live read (never over it) and only while the tick is younger than ${Math.round(TICK_VERDICT_TTL_MS / 6e4)}m` : `${named} component verdict${named === 1 ? "" : "s"} from that tick, all older than ${Math.round(TICK_VERDICT_TTL_MS / 6e4)}m \u2014 named on the node, not painted: a colour would read as the estate's state now`
     );
@@ -7538,9 +7545,9 @@ var JSON_FLAGS = {
   "graph --intent": ["--json"]
 };
 var WorkspaceReadError = class extends Error {
-  constructor(refusal) {
-    super(`${refusal.error} ${refusal.remedy}`);
-    this.refusal = refusal;
+  constructor(refusal2) {
+    super(`${refusal2.error} ${refusal2.remedy}`);
+    this.refusal = refusal2;
   }
   refusal;
 };
@@ -8017,10 +8024,10 @@ function joinNamespaceBindings(members, isDir = realIsDir) {
     if (!winner || tied) continue;
     const prev = best.get(winner.dir);
     if (prev === "ambiguous") continue;
-    const join35 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join35 });
+    const join41 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join41 });
     else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join35 });
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join41 });
   }
   return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
 }
@@ -9260,9 +9267,9 @@ function projectLogical(ir) {
     if (!arr.includes(c)) arr.push(c);
   };
   const ensureSubnet = (subnetId, vpcId) => {
-    const t = subnetTitle(subnetId);
-    if (vpcId) child(vpcTitle(vpcId), t);
-    return t;
+    const t2 = subnetTitle(subnetId);
+    if (vpcId) child(vpcTitle(vpcId), t2);
+    return t2;
   };
   const byComponent = /* @__PURE__ */ new Map();
   for (const n of headline) (byComponent.get(componentOf(n)) ?? byComponent.set(componentOf(n), []).get(componentOf(n))).push(n);
@@ -9784,13 +9791,13 @@ function readOpIr(path, readFile2) {
   } catch (err) {
     return refuse5(`Couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_EMIT);
   }
-  let json;
+  let json2;
   try {
-    json = JSON.parse(text);
+    json2 = JSON.parse(text);
   } catch (err) {
     return refuse5(`${path} isn't valid JSON: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_EMIT);
   }
-  return parseOpIr(json);
+  return parseOpIr(json2);
 }
 function receiptName(step) {
   const r = step.receipt;
@@ -10539,7 +10546,7 @@ function applyBadges(boxes, badges, marks) {
 function addBandBoxes(layout, grids, sizes) {
   const boxes = layout.groups;
   if (!boxes || grids.size === 0) return;
-  const at = new Map((layout.nodes ?? []).map((n) => [n.id, n]));
+  const at2 = new Map((layout.nodes ?? []).map((n) => [n.id, n]));
   const added = [];
   for (const box of boxes) {
     const grid = box.id !== void 0 ? grids.get(box.id) : void 0;
@@ -10547,7 +10554,7 @@ function addBandBoxes(layout, grids, sizes) {
     for (const band of grid.bands) {
       if (band.key === void 0) continue;
       const cards = band.ids.flatMap((id) => {
-        const p = at.get(id);
+        const p = at2.get(id);
         const s = sizes.get(id) ?? { w: NODE_W, h: NODE_H };
         return p ? [{ x: p.x, y: p.y, w: s.w, h: s.h }] : [];
       });
@@ -11088,10 +11095,10 @@ function packBoxComponents(layout, ir, boxes, bandOf) {
           shelfH = 0;
         }
         for (const n of c.ns) {
-          const at = c.local.get(n.id);
-          if (!at) continue;
-          n.x = originX + shelfX + at.x;
-          n.y = originY + shelfY + at.y;
+          const at2 = c.local.get(n.id);
+          if (!at2) continue;
+          n.x = originX + shelfX + at2.x;
+          n.y = originY + shelfY + at2.y;
           ids2.push(n.id);
         }
         shelfX += c.w + COMPONENT_GAP;
@@ -11500,14 +11507,14 @@ async function applyIntoFloci(fromDir, step) {
   if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
   const apply = await step(
     "terraform",
-    ["apply", "-input=false", "-auto-approve", "-no-color", ...LIVE_TARGETS.map((t) => `-target=${t}`)],
+    ["apply", "-input=false", "-auto-approve", "-no-color", ...LIVE_TARGETS.map((t2) => `-target=${t2}`)],
     fromDir
   );
   if (apply !== 0) return `terraform apply exited ${apply}`;
   return void 0;
 }
 async function runLivePlan(fromDir) {
-  const r = await capture("terraform", ["plan", "-input=false", "-no-color", "-detailed-exitcode", ...LIVE_TARGETS.map((t) => `-target=${t}`)], fromDir);
+  const r = await capture("terraform", ["plan", "-input=false", "-no-color", "-detailed-exitcode", ...LIVE_TARGETS.map((t2) => `-target=${t2}`)], fromDir);
   if (r.code !== 0 && r.code !== 2) {
     const tail = r.stdout.trim().split("\n").slice(-8).join("\n");
     return { error: `terraform plan failed (exit ${r.code}):
@@ -11917,22 +11924,22 @@ function parseGateLine(line) {
 }
 function readRunStatus(op, run3) {
   if (run3.code !== 0) {
-    const message = strip2(run3.stderr).trim() || strip2(run3.stdout).trim() || `chant run status exited ${run3.code}`;
-    if (/not available in local mode|@temporalio\/client is not installed/.test(message)) {
+    const message2 = strip2(run3.stderr).trim() || strip2(run3.stdout).trim() || `chant run status exited ${run3.code}`;
+    if (/not available in local mode|@temporalio\/client is not installed/.test(message2)) {
       return {
         ok: false,
         refusal: {
-          error: `No Temporal run state for "${op}" \u2014 ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+          error: `No Temporal run state for "${op}" \u2014 ${message2.split("\n")[0].replace(/^error:\s*/, "")}`,
           code: "no-temporal",
           remedy: "Gate state and per-step run records come from a durable run. Configure a Temporal profile in chant.config.ts (and `npm install @temporalio/client`), then run the Op with --temporal."
         }
       };
     }
-    if (/not found|NotFound/.test(message)) {
+    if (/not found|NotFound/.test(message2)) {
       return {
         ok: false,
         refusal: {
-          error: `No run of "${op}" to report \u2014 ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+          error: `No run of "${op}" to report \u2014 ${message2.split("\n")[0].replace(/^error:\s*/, "")}`,
           code: "no-run",
           remedy: "Start the Op (Run) and the playhead fills in as each step settles."
         }
@@ -11941,7 +11948,7 @@ function readRunStatus(op, run3) {
     return {
       ok: false,
       refusal: {
-        error: `chant run status ${op} failed: ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+        error: `chant run status ${op} failed: ${message2.split("\n")[0].replace(/^error:\s*/, "")}`,
         code: "run-status",
         remedy: "Run `chant run status " + op + " --temporal` in the project to see the whole error."
       }
@@ -11978,8 +11985,8 @@ var initialRunState = {
   endedAt: null,
   lost: null
 };
-function runStarted(op, mode, at) {
-  return { ...initialRunState, op, mode, status: "running", startedAt: at };
+function runStarted(op, mode, at2) {
+  return { ...initialRunState, op, mode, status: "running", startedAt: at2 };
 }
 function runRecord(state, record) {
   return { ...state, records: [...state.records, record] };
@@ -11987,14 +11994,14 @@ function runRecord(state, record) {
 function runGate(state, result) {
   return result.ok ? { ...state, gate: result.read.gate, gateNote: null } : { ...state, gate: null, gateNote: result.refusal.error };
 }
-function runEnded(state, exitCode, at) {
+function runEnded(state, exitCode, at2) {
   if (state.status !== "running") return state;
-  if (exitCode === 0) return { ...state, status: "ok", endedAt: at };
-  if (state.records.some((r) => r.status === "fail")) return { ...state, status: "failed", endedAt: at };
+  if (exitCode === 0) return { ...state, status: "ok", endedAt: at2 };
+  if (state.records.some((r) => r.status === "fail")) return { ...state, status: "failed", endedAt: at2 };
   return {
     ...state,
     status: "lost",
-    endedAt: at,
+    endedAt: at2,
     lost: `the progress stream ended (exit ${exitCode}) after ${state.records.length} settled step${state.records.length === 1 ? "" : "s"} without a failed step \u2014 behold does not know whether the Op failed or the stream broke, so the playhead stays at the last settled step.`
   };
 }
@@ -12081,11 +12088,11 @@ var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
 function tookLabel(ms) {
   return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
 }
-function paintPlayhead(ir, join35, gate) {
-  if (!join35.byNode.size && !join35.at) return ir;
+function paintPlayhead(ir, join41, gate) {
+  if (!join41.byNode.size && !join41.at) return ir;
   const nodes = ir.nodes.map((node) => {
-    const run3 = join35.byNode.get(node.id);
-    const here = join35.at === node.id;
+    const run3 = join41.byNode.get(node.id);
+    const here = join41.at === node.id;
     if (!run3 && !here) return node;
     const isGate = node.attrs?._step === "gate";
     const attrs = { ...node.attrs };
@@ -12100,7 +12107,7 @@ function paintPlayhead(ir, join35, gate) {
     if (here) {
       attrs._playhead = true;
       attrs._status = isGate && gate ? "warn" : "accent";
-      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join35.atReason ?? "here";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join41.atReason ?? "here";
       if (isGate && gate?.description) attrs.gateDescription = gate.description;
     }
     return { ...node, attrs };
@@ -12122,11 +12129,11 @@ function pendingGateCard(op, gate, ir) {
     }
   };
 }
-function playheadNote(state, join35) {
+function playheadNote(state, join41) {
   if (!state.op) {
     return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
-  const settled = join35 ? join35.byNode.size : state.records.length;
+  const settled = join41 ? join41.byNode.size : state.records.length;
   const bits = [];
   const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
   if (state.status === "running") {
@@ -12142,9 +12149,9 @@ function playheadNote(state, join35) {
   } else if (state.gateNote) {
     bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
   }
-  if (join35?.unplaced.length) {
+  if (join41?.unplaced.length) {
     bits.push(
-      `${join35.unplaced.length} record${join35.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join35.unplaced.length === 1 ? "is" : "are"} not painted`
+      `${join41.unplaced.length} record${join41.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join41.unplaced.length === 1 ? "is" : "are"} not painted`
     );
   }
   if (!bits.length) return `${head}.`;
@@ -12164,15 +12171,15 @@ function extractPrUrl(line) {
 init_project();
 
 // src/diff.ts
-function nodeObserved(json, nodeId) {
-  for (const lex of Object.values(json.lexicons ?? {})) {
+function nodeObserved(json2, nodeId) {
+  for (const lex of Object.values(json2.lexicons ?? {})) {
     const o = lex.observed?.[nodeId];
     if (o) return o;
   }
   return null;
 }
-function nodeDiff(json, nodeId) {
-  for (const lex of Object.values(json.lexicons ?? {})) {
+function nodeDiff(json2, nodeId) {
+  for (const lex of Object.values(json2.lexicons ?? {})) {
     const r = lex.resources;
     if (!r) continue;
     const drift = r.driftedSinceSnapshot?.find((d) => d.name === nodeId);
@@ -12199,9 +12206,9 @@ function nodeDiff(json, nodeId) {
   }
   return null;
 }
-function nodeFieldDrift(json, nodeId) {
+function nodeFieldDrift(json2, nodeId) {
   let sawDeep = false;
-  for (const lex of Object.values(json.lexicons ?? {})) {
+  for (const lex of Object.values(json2.lexicons ?? {})) {
     const deep = lex.deep;
     if (!deep) continue;
     sawDeep = true;
@@ -12277,8 +12284,8 @@ function argoErrorMessage(tree) {
     }
     const type = str4(rec4(c)?.type);
     if (!type || !ARGO_ERROR_CONDITION.test(type)) continue;
-    const message = str4(rec4(c)?.message);
-    if (message) return message;
+    const message2 = str4(rec4(c)?.message);
+    if (message2) return message2;
   }
   return void 0;
 }
@@ -12302,8 +12309,8 @@ function argoVerdict(o) {
   );
   if (verdicts.length === 0) return void 0;
   const pair = [health ? `health=${health}` : void 0, sync ? `sync=${sync}` : void 0].filter(Boolean).join(", ");
-  const message = argoErrorMessage(tree);
-  const detail = message ? `${pair}: ${message}` : pair;
+  const message2 = argoErrorMessage(tree);
+  const detail = message2 ? `${pair}: ${message2}` : pair;
   for (const rung of ["degraded", "progressing", "unknown"]) {
     if (verdicts.includes(rung)) return { health: rung, detail };
   }
@@ -12391,8 +12398,8 @@ function unhappyCondition(o, type) {
       const unhappy = type === "ReplicaFailure" ? status === "True" : status === "False";
       if (!unhappy) continue;
       const reason = str4(cond.reason);
-      const message = str4(cond.message);
-      return `${type}${reason ? `=${reason}` : ""}${message ? `: ${message}` : ""}`;
+      const message2 = str4(cond.message);
+      return `${type}${reason ? `=${reason}` : ""}${message2 ? `: ${message2}` : ""}`;
     }
   }
   return void 0;
@@ -12646,8 +12653,8 @@ var OpRunner = class {
    * it opens the ops lens and re-pulls the lens on the broadcast, so an
    * unchanged answer that still broadcast would have the two chasing each other.
    */
-  noteOperator(result, at = (/* @__PURE__ */ new Date()).toISOString()) {
-    return this.foldOperator(operatorRead(this.lastOperatorState, result, at));
+  noteOperator(result, at2 = (/* @__PURE__ */ new Date()).toISOString()) {
+    return this.foldOperator(operatorRead(this.lastOperatorState, result, at2));
   }
   /** Compare-and-broadcast, ignoring `readAt` — the instant behold asked changes
    * on every poll and is not itself news; broadcasting on it would make the
@@ -12821,19 +12828,19 @@ import { join as join20 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve29) => {
     let out = "";
     let proc;
     try {
       proc = spawn5(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve24({ code: 127, out: "" });
+      resolve29({ code: 127, out: "" });
       return;
     }
     proc.stdout.on("data", (d) => out += d);
     proc.stderr.on("data", (d) => out += d);
-    proc.on("error", () => resolve24({ code: 127, out }));
-    proc.on("close", (code) => resolve24({ code: code ?? 1, out }));
+    proc.on("error", () => resolve29({ code: 127, out }));
+    proc.on("close", (code) => resolve29({ code: code ?? 1, out }));
   });
 }
 async function dockerAvailable(run3) {
@@ -13124,10 +13131,10 @@ function validateBehaviourBlock(v) {
   if (errorRate === void 0) return bad("errorRate is not a fraction 0..1");
   const res = rec5(b.resilience);
   const failure = str5(res?.failure);
-  const verdict2 = res?.verdict;
+  const verdict3 = res?.verdict;
   if (!failure) return bad("resilience.failure missing \u2014 a verdict with no named failure says nothing");
-  if (verdict2 !== "survives" && verdict2 !== "degrades" && verdict2 !== "fails") {
-    return bad(`resilience.verdict ${JSON.stringify(verdict2)} is not survives/degrades/fails`);
+  if (verdict3 !== "survives" && verdict3 !== "degrades" && verdict3 !== "fails") {
+    return bad(`resilience.verdict ${JSON.stringify(verdict3)} is not survives/degrades/fails`);
   }
   const note = str5(res?.note);
   let rightSize;
@@ -13154,7 +13161,7 @@ function validateBehaviourBlock(v) {
       cost: { perHour, currency },
       headroom: { ...cpu !== void 0 ? { cpu } : {}, ...latency !== void 0 ? { latency } : {} },
       errorRate,
-      resilience: { failure, verdict: verdict2, ...note ? { note } : {} },
+      resilience: { failure, verdict: verdict3, ...note ? { note } : {} },
       ...rightSize ? { rightSize } : {},
       provenance: { engine, version, tolerance, basis }
     }
@@ -13179,9 +13186,9 @@ function validateBehaviourMeta(v) {
   if (!traffic) return bad("meta.at.traffic missing");
   let total;
   if (m.total !== void 0) {
-    const t = rec5(m.total);
-    const perHour = num(t?.perHour);
-    const currency = str5(t?.currency);
+    const t2 = rec5(m.total);
+    const perHour = num(t2?.perHour);
+    const currency = str5(t2?.currency);
     if (perHour === void 0 || !currency) return bad("meta.total is not {perHour, currency}");
     total = { perHour, currency };
   }
@@ -13315,14 +13322,14 @@ function attachBehaviour(ir, members, env, readFile2 = realRead) {
   const first = metas[0]?.meta ?? {};
   const engines = [...new Set(metas.map((m) => `${m.meta.engine} ${m.meta.version}`))];
   if (engines.length > 1) diagnostics.push(`priced by ${engines.length} engines (${engines.join(", ")}) \u2014 every figure carries its own provenance`);
-  const trafficLevels = [...new Set(metas.map((m) => m.meta.at?.traffic).filter((t) => !!t))];
+  const trafficLevels = [...new Set(metas.map((m) => m.meta.at?.traffic).filter((t2) => !!t2))];
   if (trafficLevels.length > 1) diagnostics.push(`priced at ${trafficLevels.length} traffic levels (${trafficLevels.join("; ")}) \u2014 the sums add figures stated at different levels`);
   const meta = {
     ...first.engine ? { engine: first.engine } : {},
     ...first.version ? { version: first.version } : {},
     ...first.at ? { at: first.at } : {}
   };
-  const engineTotal = metas.map((m) => m.meta.total).find((t) => !!t);
+  const engineTotal = metas.map((m) => m.meta.total).find((t2) => !!t2);
   if (engineTotal) {
     meta.total = engineTotal;
     if (metas.filter((m) => m.meta.total).length > 1) diagnostics.push(FIRST_TOTAL_SHOWN);
@@ -13518,8 +13525,8 @@ function attachBehaviourDelta(ir, members, behaviour) {
   const stated = rows.filter((r) => r.live?.basis === "total").length;
   if (live2 && stated > 1) {
     delete out.total;
-    const at = diagnostics.indexOf(FIRST_TOTAL_SHOWN);
-    if (at >= 0) diagnostics.splice(at, 1);
+    const at2 = diagnostics.indexOf(FIRST_TOTAL_SHOWN);
+    if (at2 >= 0) diagnostics.splice(at2, 1);
   }
   if (live2) out.live = live2;
   if (declared) out.declared = declared;
@@ -13699,26 +13706,26 @@ var isRecord10 = (v) => typeof v === "object" && v !== null && !Array.isArray(v)
 var refuse7 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var CREDS2 = "Give behold the ambient read-only AWS credentials the estate's `plan` needs (AWS_PROFILE, or AWS_ENDPOINT_URL for an emulator), then re-check live with plan.";
 function said3(run3, fallback) {
-  const lines = stripAnsiLines(run3.stderr);
-  return lines.find((l) => /^Error:/.test(l)) ?? lines[0] ?? fallback;
+  const lines2 = stripAnsiLines(run3.stderr);
+  return lines2.find((l) => /^Error:/.test(l)) ?? lines2[0] ?? fallback;
 }
 function parsePlanShow(run3, dir) {
   if (run3.code === 127) return refuse7("choudoufu is not on PATH.", "Install choudoufu and put it on PATH.");
   const text = run3.stdout.trim();
   if (!text) return refuse7(`choudoufu show could not read the plan for ${dir}: ${said3(run3, `exit ${run3.code}`)}`, CREDS2);
-  let json;
+  let json2;
   try {
-    json = JSON.parse(text);
+    json2 = JSON.parse(text);
   } catch {
     return refuse7(`choudoufu show printed something that is not JSON for ${dir}: ${said3(run3, "unparseable stdout")}`, CREDS2);
   }
-  if (!isRecord10(json) || typeof json.format_version !== "string") {
+  if (!isRecord10(json2) || typeof json2.format_version !== "string") {
     return refuse7("That is not a plan document \u2014 no `format_version`.", CREDS2);
   }
-  if (json.resource_changes !== void 0 && json.resource_changes !== null && !Array.isArray(json.resource_changes)) {
+  if (json2.resource_changes !== void 0 && json2.resource_changes !== null && !Array.isArray(json2.resource_changes)) {
     return refuse7("That plan document's `resource_changes` is not a list.", CREDS2);
   }
-  return { ok: true, doc: json };
+  return { ok: true, doc: json2 };
 }
 var KNOWN_AFTER_APPLY = "(known after apply)";
 var SENSITIVE = "(sensitive)";
@@ -13847,16 +13854,16 @@ function parseLiveMv(run3, what) {
   if (run3.code === 127) return refuse8("choudoufu is not on PATH.", "Install choudoufu and put it on PATH.");
   const text = run3.stdout.trim();
   if (!text) return refuse8(`choudoufu live-mv printed no document for ${what} (exit ${run3.code}).`, "Run the line by hand to see choudoufu's own words.");
-  let json;
+  let json2;
   try {
-    json = JSON.parse(text);
+    json2 = JSON.parse(text);
   } catch {
     return refuse8(`choudoufu live-mv printed something that is not JSON for ${what}.`, "Run the line by hand to see choudoufu's own words.");
   }
-  if (!isRecord11(json) || !isRecord11(json.from) || !isRecord11(json.to) || typeof json.dry_run !== "boolean") {
+  if (!isRecord11(json2) || !isRecord11(json2.from) || !isRecord11(json2.to) || typeof json2.dry_run !== "boolean") {
     return refuse8(`That is not a live-mv document (${what}).`, "Upgrade choudoufu to 0.16.0 or newer.");
   }
-  return { ok: true, doc: json };
+  return { ok: true, doc: json2 };
 }
 function handoffLine(m) {
   return `choudoufu live-mv -from-estate=${m.from} ${m.address} ${m.new_address ?? m.address}`;
@@ -14212,16 +14219,16 @@ import { existsSync as existsSync16 } from "node:fs";
 import { dirname as dirname6, join as join24, resolve as resolve14 } from "node:path";
 var TERRAGUCCI_CONFIG_NAMES = ["terragucci.yml", "terragucci.yaml", "terragucci.json", "terragucci.ts"];
 function terragucciConfig(dir) {
-  let at = resolve14(dir);
+  let at2 = resolve14(dir);
   for (; ; ) {
     for (const name of TERRAGUCCI_CONFIG_NAMES) {
-      const file = join24(at, name);
+      const file = join24(at2, name);
       if (existsSync16(file)) return file;
     }
-    if (existsSync16(join24(at, ".git"))) return void 0;
-    const up = dirname6(at);
-    if (up === at) return void 0;
-    at = up;
+    if (existsSync16(join24(at2, ".git"))) return void 0;
+    const up = dirname6(at2);
+    if (up === at2) return void 0;
+    at2 = up;
   }
 }
 function servedTerragucciConfig(dirs) {
@@ -14288,7 +14295,7 @@ function labelFor(root, target, estate) {
 function chantCheck(root, targets, estate) {
   if (!targets.length) return { name: "chant", status: "pass", detail: "no chant members \u2014 nothing for behold to shell" };
   const floor = chantFloor();
-  const resolutions = targets.map((t) => ({ target: t, res: resolveChant(t) }));
+  const resolutions = targets.map((t2) => ({ target: t2, res: resolveChant(t2) }));
   const missing = resolutions.filter(({ res }) => res.source !== "project");
   const describe = ({ target, res }) => `${labelFor(root, target, estate)}${res.source === "project" ? `chant ${res.version ?? "(unknown version)"}` : "no chant installed"}`;
   if (missing.length) {
@@ -14335,7 +14342,7 @@ function lexiconCheck(root, declared, estate) {
 }
 function targetCheck(declared) {
   const lexicons = [...new Set([...declared.values()].flat())].sort();
-  const routable = new Set(SUBSTRATE_TARGET_VARS.map((t) => t.lexicon));
+  const routable = new Set(SUBSTRATE_TARGET_VARS.map((t2) => t2.lexicon));
   const unlisted = lexicons.filter((l) => !routable.has(l) && !(l in NO_AMBIENT_TARGET));
   if (!lexicons.length) return { name: "targets", status: "pass", detail: "no lexicon declared \u2014 nothing to aim" };
   if (!unlisted.length) {
@@ -14387,7 +14394,7 @@ function kubeCheck(lexicons, profiles, envs, kubeconfig) {
       fix: "Declare `k8s.profiles.<env>.context` in chant.config.ts so the cluster the reads hit is explicit, not ambient."
     };
   }
-  const lines = [];
+  const lines2 = [];
   const unresolved = [];
   const mismatched = [];
   for (const env of bound) {
@@ -14397,14 +14404,14 @@ function kubeCheck(lexicons, profiles, envs, kubeconfig) {
       unresolved.push(`${env}: ${context}`);
       continue;
     }
-    lines.push(`${env}: ${target.label} at ${target.endpoint}`);
+    lines2.push(`${env}: ${target.label} at ${target.endpoint}`);
     if (ambient && ambient !== target.label) mismatched.push(`${env}: ${target.label}`);
   }
   if (unresolved.length) {
     return {
       name: "kube",
       status: "warn",
-      detail: `context not in the kubeconfig \u2014 ${list2(unresolved)}${lines.length ? `; bound: ${list2(lines)}` : ""}`,
+      detail: `context not in the kubeconfig \u2014 ${list2(unresolved)}${lines2.length ? `; bound: ${list2(lines2)}` : ""}`,
       fix: `Add the context to your kubeconfig, or point k8s.profiles at one you have (${summarize([...kubeconfig.contexts.keys()])}).`
     };
   }
@@ -14412,11 +14419,11 @@ function kubeCheck(lexicons, profiles, envs, kubeconfig) {
     return {
       name: "kube",
       status: "warn",
-      detail: `bound ${list2(lines)}, but the ambient current-context is ${ambient} \u2014 chant refuses a live read on a mismatch`,
+      detail: `bound ${list2(lines2)}, but the ambient current-context is ${ambient} \u2014 chant refuses a live read on a mismatch`,
       fix: `Run \`kubectl config use-context ${mismatched[0].split(": ")[1]}\` before the live overlay.`
     };
   }
-  return { name: "kube", status: "pass", detail: `bound ${list2(lines)}` };
+  return { name: "kube", status: "pass", detail: `bound ${list2(lines2)}` };
 }
 function substrateCheck(substrates) {
   if (!substrates.length) return { name: "substrates", status: "pass", detail: "none needed by this project" };
@@ -14584,7 +14591,7 @@ async function diagnose(dir, probes = {}) {
     detail: `${estateDetail}; invalid: ${list2(invalidDetail)}`,
     fix: kindsFix
   } : { name: "project", status: "pass", detail: `${emptyDeclaration}${estateDetail}` } : { name: "project", status: "pass", detail: `${emptyDeclaration}chant project (${relative6(root, shape.configFile)})` };
-  const infos = await Promise.all(chantTargets.map(async (t) => ({ target: t, info: await detectProject(t) })));
+  const infos = await Promise.all(chantTargets.map(async (t2) => ({ target: t2, info: await detectProject(t2) })));
   const declared = new Map(infos.map(({ target, info }) => [target, info.lexicons]));
   const lexicons = [...new Set(infos.flatMap(({ info }) => info.lexicons))];
   const envs = [...new Set(infos.flatMap(({ info }) => info.environments))];
@@ -14619,14 +14626,14 @@ async function diagnose(dir, probes = {}) {
   return { behold, dir: root, kind: shape.kind, ok: !checks.some((c) => c.status === "fail"), checks };
 }
 function formatReport(report) {
-  const lines = [`behold doctor ${report.behold} \u2014 ${report.dir}`, ""];
+  const lines2 = [`behold doctor ${report.behold} \u2014 ${report.dir}`, ""];
   for (const c of report.checks) {
-    lines.push(`  ${c.status.padEnd(4)}  ${c.name.padEnd(10)}  ${c.detail}`);
-    if (c.fix) lines.push(`        ${"fix".padEnd(10)}  ${c.fix}`);
+    lines2.push(`  ${c.status.padEnd(4)}  ${c.name.padEnd(10)}  ${c.detail}`);
+    if (c.fix) lines2.push(`        ${"fix".padEnd(10)}  ${c.fix}`);
   }
   const tally = (s) => report.checks.filter((c) => c.status === s).length;
-  lines.push("", `  ${tally("pass")} pass, ${tally("warn")} warn, ${tally("fail")} fail`, "");
-  return lines.join("\n");
+  lines2.push("", `  ${tally("pass")} pass, ${tally("warn")} warn, ${tally("fail")} fail`, "");
+  return lines2.join("\n");
 }
 
 // src/server.ts
@@ -14922,11 +14929,11 @@ function renderLanes(frames, summaries) {
 // src/emulator.ts
 init_chant();
 function parseEmulators(stdout) {
-  const lines = stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
-  for (let i = lines.length - 1; i >= 0; i--) {
-    if (!lines[i].startsWith("{")) continue;
+  const lines2 = stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+  for (let i = lines2.length - 1; i >= 0; i--) {
+    if (!lines2[i].startsWith("{")) continue;
     try {
-      const parsed = JSON.parse(lines[i]);
+      const parsed = JSON.parse(lines2[i]);
       if (Array.isArray(parsed.emulators)) return parsed.emulators;
     } catch {
     }
@@ -14956,7 +14963,7 @@ async function emulatorDown(projectDir) {
 
 // src/terragucci-view.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { dirname as dirname8, join as join28, relative as relative7, sep as sep6 } from "node:path";
+import { dirname as dirname10, join as join32, relative as relative7, sep as sep6 } from "node:path";
 init_terraform_member();
 
 // src/terragucci-reports.ts
@@ -14970,9 +14977,9 @@ var INDEX_SCHEMA = "terragucci.report-index/v1";
 var ESTATE_SCHEMA = "terragucci.estate/v1";
 var MAX_RUNS_PER_STAGE = 12;
 var TerragucciReadError = class extends Error {
-  constructor(refusal) {
-    super(refusal.error);
-    this.refusal = refusal;
+  constructor(refusal2) {
+    super(refusal2.error);
+    this.refusal = refusal2;
   }
   refusal;
 };
@@ -15020,7 +15027,7 @@ function schemaStamp(dist) {
 function compileSchemas(dist) {
   const version = JSON.parse(readFileSync18(join26(dist, "..", "package.json"), "utf8")).version ?? "";
   const ajv = new Ajv2020({ strict: false, allErrors: false });
-  const compiled = Object.fromEntries(
+  const compiled3 = Object.fromEntries(
     Object.keys(SCHEMA_FILES).map((n) => [n, ajv.compile(JSON.parse(readFileSync18(join26(dist, SCHEMA_FILES[n]), "utf8")))])
   );
   return {
@@ -15028,8 +15035,8 @@ function compileSchemas(dist) {
     check(name, doc) {
       const id = isRecord14(doc) ? doc.schema : void 0;
       if (id !== SCHEMA_IDS[name]) return `its schema is ${JSON.stringify(id)}, not ${SCHEMA_IDS[name]}`;
-      if (compiled[name](doc)) return void 0;
-      const e = compiled[name].errors?.[0];
+      if (compiled3[name](doc)) return void 0;
+      const e = compiled3[name].errors?.[0];
       return `${SCHEMA_FILES[name]} rejects it: ${e?.instancePath || "/"} ${e?.message ?? "is invalid"}`;
     }
   };
@@ -15272,12 +15279,12 @@ function joinTerragucci(read, nodes, roots) {
   for (const n of nodes) {
     const root = n.attrs?.root;
     if (typeof root !== "string") continue;
-    const at = n.id.indexOf(`/${root}/`);
-    if (at < 0) continue;
-    const member = n.id.slice(0, at);
+    const at2 = n.id.indexOf(`/${root}/`);
+    if (at2 < 0) continue;
+    const member = n.id.slice(0, at2);
     const key = `${member}\0${root}`;
     if (!byRoot.has(key)) byRoot.set(key, /* @__PURE__ */ new Map());
-    byRoot.get(key).set(n.id.slice(at + root.length + 2), n.id);
+    byRoot.get(key).set(n.id.slice(at2 + root.length + 2), n.id);
   }
   const cards = {};
   const unmatchedChanges = [];
@@ -15333,8 +15340,8 @@ var S3Error = class extends Error {
   status;
   /** S3's error code (`AccessDenied`, `NoSuchBucket`, ...), when the body carried one. */
   code;
-  constructor(message, answer) {
-    super(message);
+  constructor(message2, answer) {
+    super(message2);
     if (answer) {
       this.status = answer.status;
       const code = xmlText(answer.body, "Code");
@@ -15391,8 +15398,8 @@ async function assumeRole(w, fetchFn) {
 }
 var sha256 = (b) => createHash4("sha256").update(b).digest("hex");
 var hmac = (key, s) => createHmac("sha256", key).update(s).digest();
-var objectUrl = (t, key) => `${t.endpoint ? `${t.endpoint}/${t.bucket}` : `https://${t.bucket}.s3.${t.region}.amazonaws.com`}/${encodePath(key)}`;
-function sign(t, method, rawUrl, extra, payload, now) {
+var objectUrl = (t2, key) => `${t2.endpoint ? `${t2.endpoint}/${t2.bucket}` : `https://${t2.bucket}.s3.${t2.region}.amazonaws.com`}/${encodePath(key)}`;
+function sign(t2, method, rawUrl, extra, payload, now) {
   const url = new URL(rawUrl);
   const amzDate = now.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
   const day = amzDate.slice(0, 8);
@@ -15401,17 +15408,17 @@ function sign(t, method, rawUrl, extra, payload, now) {
     "x-amz-content-sha256": payload,
     "x-amz-date": amzDate,
     ...Object.fromEntries(Object.entries(extra).map(([k, v]) => [k.toLowerCase(), v])),
-    ...t.sessionToken ? { "x-amz-security-token": t.sessionToken } : {}
+    ...t2.sessionToken ? { "x-amz-security-token": t2.sessionToken } : {}
   };
   const names = Object.keys(headers).sort();
   const query = [...url.searchParams].map(([k, v]) => `${encodeStrict(k)}=${encodeStrict(v)}`).sort().join("&");
   const canonical = [method, url.pathname, query, ...names.map((n) => `${n}:${headers[n].trim()}`), "", names.join(";"), payload].join("\n");
-  const scope = `${day}/${t.region}/s3/aws4_request`;
+  const scope = `${day}/${t2.region}/s3/aws4_request`;
   const toSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256(canonical)].join("\n");
-  const key4 = hmac(hmac(hmac(hmac(`AWS4${t.secretAccessKey}`, day), t.region), "s3"), "aws4_request");
+  const key4 = hmac(hmac(hmac(hmac(`AWS4${t2.secretAccessKey}`, day), t2.region), "s3"), "aws4_request");
   const signature = createHmac("sha256", key4).update(toSign).digest("hex");
   const { host: _host, ...sent } = headers;
-  return { ...sent, authorization: `AWS4-HMAC-SHA256 Credential=${t.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${signature}` };
+  return { ...sent, authorization: `AWS4-HMAC-SHA256 Credential=${t2.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${signature}` };
 }
 var S3Object = class {
   constructor(target, fetchFn = fetch, now = () => /* @__PURE__ */ new Date()) {
@@ -15424,45 +15431,61 @@ var S3Object = class {
   now;
   creds;
   async signer() {
-    const t = this.target;
-    if (!("webIdentity" in t)) return t;
-    this.creds ??= assumeRole(t.webIdentity, this.fetchFn).catch((e) => {
+    const t2 = this.target;
+    if (!("webIdentity" in t2)) return t2;
+    this.creds ??= assumeRole(t2.webIdentity, this.fetchFn).catch((e) => {
       this.creds = void 0;
       throw e;
     });
-    return { bucket: t.bucket, ...t.endpoint ? { endpoint: t.endpoint } : {}, region: t.region, ...await this.creds };
+    return { bucket: t2.bucket, ...t2.endpoint ? { endpoint: t2.endpoint } : {}, region: t2.region, ...await this.creds };
   }
   /** The object's text, or undefined when there is none. */
   async get(key) {
-    const t = await this.signer();
-    const url = objectUrl(t, key);
-    const res = await this.fetchFn(url, { method: "GET", headers: sign(t, "GET", url, {}, sha256(""), this.now()) });
+    const t2 = await this.signer();
+    const url = objectUrl(t2, key);
+    const res = await this.fetchFn(url, { method: "GET", headers: sign(t2, "GET", url, {}, sha256(""), this.now()) });
     if (res.status === 404) return void 0;
     if (!res.ok) {
       const body = await res.text();
-      throw new S3Error(`GET s3://${t.bucket}/${key}: ${res.status} ${body.slice(0, 300)}`, { status: res.status, body });
+      throw new S3Error(`GET s3://${t2.bucket}/${key}: ${res.status} ${body.slice(0, 300)}`, { status: res.status, body });
     }
     return res.text();
   }
+  /**
+   * #505: a conditional HEAD of the object. `same` when its ETag is still
+   * `ifNoneMatch` (S3 answers 304), its ETag otherwise, undefined when there
+   * is no such object.
+   */
+  async head(key, ifNoneMatch) {
+    const t2 = await this.signer();
+    const url = objectUrl(t2, key);
+    const extra = ifNoneMatch ? { "if-none-match": ifNoneMatch } : {};
+    const res = await this.fetchFn(url, { method: "HEAD", headers: sign(t2, "HEAD", url, extra, sha256(""), this.now()) });
+    if (res.status === 304) return { same: true };
+    if (res.status === 404) return void 0;
+    if (!res.ok) throw new S3Error(`HEAD s3://${t2.bucket}/${key}: ${res.status}`, { status: res.status, body: "" });
+    const etag = res.headers?.get("etag") ?? void 0;
+    return { same: false, ...etag ? { etag } : {} };
+  }
   /** Write an object, with a Cache-Control header when one is given. */
   async put(key, body, contentType2, cacheControl) {
-    const t = await this.signer();
-    const url = objectUrl(t, key);
+    const t2 = await this.signer();
+    const url = objectUrl(t2, key);
     const extra = { "content-type": contentType2, ...cacheControl ? { "cache-control": cacheControl } : {} };
-    const res = await this.fetchFn(url, { method: "PUT", headers: sign(t, "PUT", url, extra, sha256(body), this.now()), body });
+    const res = await this.fetchFn(url, { method: "PUT", headers: sign(t2, "PUT", url, extra, sha256(body), this.now()), body });
     if (!res.ok) {
       const text = await res.text();
-      throw new S3Error(`PUT s3://${t.bucket}/${key}: ${res.status} ${text.slice(0, 300)}`, { status: res.status, body: text });
+      throw new S3Error(`PUT s3://${t2.bucket}/${key}: ${res.status} ${text.slice(0, 300)}`, { status: res.status, body: text });
     }
   }
   /** Delete an object. A missing one is not an error. */
   async delete(key) {
-    const t = await this.signer();
-    const url = objectUrl(t, key);
-    const res = await this.fetchFn(url, { method: "DELETE", headers: sign(t, "DELETE", url, {}, sha256(""), this.now()) });
+    const t2 = await this.signer();
+    const url = objectUrl(t2, key);
+    const res = await this.fetchFn(url, { method: "DELETE", headers: sign(t2, "DELETE", url, {}, sha256(""), this.now()) });
     if (res.ok || res.status === 404) return;
     const text = await res.text();
-    throw new S3Error(`DELETE s3://${t.bucket}/${key}: ${res.status} ${text.slice(0, 300)}`, { status: res.status, body: text });
+    throw new S3Error(`DELETE s3://${t2.bucket}/${key}: ${res.status} ${text.slice(0, 300)}`, { status: res.status, body: text });
   }
 };
 
@@ -15534,12 +15557,1037 @@ function terragucciSource(spec2, opts = {}) {
   };
 }
 
+// src/terragucci-timeline.ts
+import { readFileSync as readFileSync20, statSync as statSync9 } from "node:fs";
+import { createRequire as createRequire4 } from "node:module";
+import { dirname as dirname8, join as join28, resolve as resolve18 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { Ajv2020 as Ajv20202 } from "ajv/dist/2020.js";
+var AUDIT_SCHEMA = "terragucci.audit/v1";
+var AUDIT_KEY = "audit.jsonl";
+var AUDIT_SCHEMA_FILE = "audit.schema.json";
+var WHAT_IS_ROOT = /* @__PURE__ */ new Set(["override-requested", "override", "override-revoked", "unlock", "state-export"]);
+var TIMELINE_LIMIT = 200;
+var TIMELINE_MAX = 1e3;
+var TIMELINE_TTL_MS = 3e4;
+var isRecord15 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var str10 = (v) => typeof v === "string";
+function structuralAudit(doc) {
+  if (!isRecord15(doc)) return "it is not a JSON object";
+  if (doc.schema !== AUDIT_SCHEMA) return `its schema is ${JSON.stringify(doc.schema)}, not ${AUDIT_SCHEMA}`;
+  for (const f of ["id", "kind", "project", "at", "what", "result"]) if (!str10(doc[f])) return `its ${f} is not a string`;
+  if (Number.isNaN(Date.parse(doc.at))) return `its at, ${JSON.stringify(doc.at)}, is not a time`;
+  if (doc.who !== null && !str10(doc.who)) return "its who is neither a string nor null";
+  if (doc.digest !== null && !str10(doc.digest)) return "its digest is neither a string nor null";
+  if (!isRecord15(doc.evidence) || !str10(doc.evidence.source)) return "its evidence has no source";
+  if (doc.detail !== void 0 && !isRecord15(doc.detail)) return "its detail is not an object";
+  return void 0;
+}
+function compileAuditSchema(schema, version) {
+  const v = new Ajv20202({ strict: false, allErrors: false }).compile(schema);
+  return {
+    validation: { by: "schema", terragucci: version },
+    check(doc) {
+      const id = isRecord15(doc) ? doc.schema : void 0;
+      if (id !== AUDIT_SCHEMA) return `its schema is ${JSON.stringify(id)}, not ${AUDIT_SCHEMA}`;
+      if (v(doc)) return void 0;
+      const e = v.errors?.[0];
+      return `${AUDIT_SCHEMA_FILE} rejects it: ${e?.instancePath || "/"} ${e?.message ?? "is invalid"}`;
+    }
+  };
+}
+var compiled = /* @__PURE__ */ new Map();
+function auditValidator(dirs = []) {
+  for (const from of [...dirs, dirname8(fileURLToPath5(import.meta.url))]) {
+    let dist;
+    try {
+      dist = dirname8(createRequire4(join28(resolve18(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
+    } catch {
+      continue;
+    }
+    const pkg = join28(dist, "..", "package.json");
+    const file = join28(dist, AUDIT_SCHEMA_FILE);
+    let stamp;
+    try {
+      stamp = [dist, ...[pkg, file].map((f) => {
+        const st = statSync9(f);
+        return `${st.mtimeMs}:${st.size}`;
+      })].join("\0");
+    } catch {
+      continue;
+    }
+    const hit = compiled.get(stamp);
+    if (hit) return hit;
+    let v;
+    try {
+      const version = JSON.parse(readFileSync20(pkg, "utf8")).version ?? "";
+      v = compileAuditSchema(JSON.parse(readFileSync20(file, "utf8")), version);
+    } catch {
+      continue;
+    }
+    for (const k of compiled.keys()) if (k.startsWith(`${dist}\0`)) compiled.delete(k);
+    compiled.set(stamp, v);
+    return v;
+  }
+  return { validation: { by: "structural" }, check: structuralAudit };
+}
+var refuse11 = (error, remedy) => {
+  throw new TerragucciReadError({ error, code: "terragucci-report", remedy });
+};
+function parseAudit(text, location, v) {
+  const out = [];
+  const lines2 = text.split("\n");
+  for (const [i, raw] of lines2.entries()) {
+    const line = raw.trim();
+    if (!line) continue;
+    let doc;
+    try {
+      doc = JSON.parse(line);
+    } catch {
+      refuse11(`${AUDIT_KEY} in ${location}, line ${i + 1}, is not JSON.`, "Check that terragucci audit wrote it; its record is one JSON object per line.");
+    }
+    const why = v.check(doc);
+    if (why) {
+      refuse11(
+        `${AUDIT_KEY} in ${location}, line ${i + 1}, is not a terragucci ${AUDIT_SCHEMA} entry: ${why}.`,
+        v.validation.by === "schema" ? `It was checked against @intentius/terragucci ${v.validation.terragucci}'s ${AUDIT_SCHEMA_FILE}. Check that this terragucci wrote it, or upgrade behold.` : "Install @intentius/terragucci beside behold to check it against terragucci's own JSON Schema, and check that terragucci wrote it."
+      );
+    }
+    out.push(doc);
+  }
+  return out;
+}
+function ownRoots(e) {
+  const roots = /* @__PURE__ */ new Set();
+  const listed = e.detail?.roots;
+  if (Array.isArray(listed)) {
+    for (const r of listed) {
+      if (str10(r)) roots.add(r);
+      else if (isRecord15(r) && str10(r.root)) roots.add(r.root);
+      else if (isRecord15(r) && str10(r.path)) roots.add(r.path);
+    }
+  }
+  if (WHAT_IS_ROOT.has(e.kind)) roots.add(e.what);
+  return [...roots];
+}
+function reportKey(e) {
+  const k = e.evidence.key;
+  if (e.evidence.source !== "report" || !str10(k) || !k.endsWith("/report.json")) return void 0;
+  const inner = k.indexOf(`/${e.project}/`);
+  const from = k.startsWith(`${e.project}/`) ? 0 : inner < 0 ? -1 : inner + 1;
+  if (from < 0) return void 0;
+  return `${k.slice(from, -"report.json".length)}report.html`;
+}
+var at = (iso) => Date.parse(iso);
+function timelineEntries(entries, project) {
+  const mine = entries.map((e, i) => ({ e, i })).filter(({ e }) => e.project === project);
+  const gate = (e) => `${e.what}\0${e.digest ?? ""}`;
+  const gateRoots = /* @__PURE__ */ new Map();
+  const gateReport = /* @__PURE__ */ new Map();
+  for (const { e } of mine) {
+    if (WHAT_IS_ROOT.has(e.kind)) continue;
+    const roots = ownRoots(e);
+    if (roots.length) {
+      const s = gateRoots.get(gate(e)) ?? /* @__PURE__ */ new Set();
+      for (const r of roots) s.add(r);
+      gateRoots.set(gate(e), s);
+    }
+    const key = reportKey(e);
+    const prev = gateReport.get(gate(e));
+    if (key && (!prev || at(e.at) >= prev.at)) gateReport.set(gate(e), { at: at(e.at), key });
+  }
+  const out = mine.map(({ e, i }) => {
+    const d = e.detail ?? {};
+    let roots = ownRoots(e);
+    if (!roots.length && (e.kind === "approval" || e.kind === "approval-revoked")) roots = [...gateRoots.get(gate(e)) ?? []];
+    const waveNo = typeof d.wave === "number" ? d.wave : /^wave-(\d+)$/.exec(e.what)?.[1];
+    const report = reportKey(e) ?? (WHAT_IS_ROOT.has(e.kind) ? void 0 : gateReport.get(gate(e))?.key);
+    const pr = d.pull_request;
+    const entry = {
+      id: e.id,
+      kind: e.kind,
+      at: e.at,
+      who: e.who,
+      what: e.what,
+      ...waveNo !== void 0 ? { wave: Number(waveNo) } : {},
+      digest: e.digest,
+      result: e.result,
+      roots,
+      run: {
+        ...str10(d.commit) ? { commit: d.commit } : {},
+        ...str10(e.evidence.job_url) ? { job_url: e.evidence.job_url } : {},
+        ...str10(d.run_id) ? { run_id: d.run_id } : {},
+        ...str10(pr) || typeof pr === "number" ? { pull_request: String(pr) } : {},
+        ...report ? { report } : {}
+      },
+      evidence: e.evidence,
+      ...e.detail ? { detail: e.detail } : {}
+    };
+    return { entry, i };
+  });
+  out.sort((a, b) => at(b.entry.at) - at(a.entry.at) || b.i - a.i);
+  return out.map((x) => x.entry);
+}
+async function readTimeline(source2, opts = {}) {
+  const v = opts.validator ?? auditValidator();
+  let text;
+  try {
+    text = await source2.read(AUDIT_KEY);
+  } catch (e) {
+    refuse11(
+      `Could not read ${AUDIT_KEY} from ${source2.location}: ${e instanceof Error ? e.message : String(e)}`,
+      source2.kind === "s3" ? "behold reads the bucket with your aws CLI or the environment's credentials: check GetObject on <prefix>/audit.jsonl." : "Check the source serves the reports prefix."
+    );
+  }
+  const base = { source: source2.location, kind: source2.kind, validation: v.validation, read: (opts.now ?? /* @__PURE__ */ new Date()).toISOString() };
+  if (text === void 0) return { ...base, present: false, project: opts.project ?? opts.checkoutProject ?? null, projects: [], lines: 0, entries: [] };
+  const all = parseAudit(text, source2.location, v);
+  const projects = [...new Set(all.map((e) => e.project))].sort();
+  let project;
+  if (opts.project) project = opts.project;
+  else if (projects.length <= 1) project = projects[0] ?? opts.checkoutProject ?? null;
+  else if (opts.checkoutProject && projects.includes(opts.checkoutProject)) project = opts.checkoutProject;
+  else {
+    project = refuse11(
+      `${source2.location}/${AUDIT_KEY} holds ${projects.length} projects, and none is this checkout's${opts.checkoutProject ? ` (${opts.checkoutProject})` : ""}.`,
+      `Name one with --terragucci-project: ${projects.join(", ")}.`
+    );
+  }
+  return { ...base, present: true, project, projects, lines: all.length, entries: project ? timelineEntries(all, project) : [] };
+}
+var absentWords = (location) => `${location} has no ${AUDIT_KEY}: terragucci writes its audit record at the top of the reports prefix when the estate job runs \`terragucci audit\`. This says nothing about whether anything happened.`;
+function timelineAnswer(r, q = {}) {
+  const limit = q.limit ?? TIMELINE_LIMIT;
+  const matched = q.root ? r.entries.filter((e) => e.roots.includes(q.root)) : r.entries;
+  return {
+    source: r.source,
+    kind: r.kind,
+    project: r.project,
+    validation: r.validation,
+    read: r.read,
+    record: { key: AUDIT_KEY, present: r.present },
+    ...r.present ? {} : { absent: absentWords(r.source) },
+    files: "/api/terragucci/file?key=",
+    ...q.root ? { root: q.root } : {},
+    total: matched.length,
+    limit,
+    entries: matched.slice(0, limit)
+  };
+}
+function terragucciTimelineRoute(app, source2, opts = {}) {
+  let cached;
+  app.get("/api/terragucci/timeline", async (c) => {
+    const q = new URL(c.req.url).searchParams;
+    const rawLimit = q.get("limit");
+    let limit;
+    if (rawLimit !== null) {
+      limit = Number(rawLimit);
+      if (!Number.isInteger(limit) || limit < 1 || limit > TIMELINE_MAX) {
+        return c.json({ error: `limit must be a whole number from 1 to ${TIMELINE_MAX}, not ${JSON.stringify(rawLimit)}`, code: "terragucci-timeline" }, 400);
+      }
+    }
+    const root = q.get("root") || void 0;
+    const checkout = opts.checkoutProject?.();
+    const key = checkout ?? "";
+    const now = Date.now();
+    if (q.get("fresh") === "1" || !cached || cached.key !== key || now - cached.at >= TIMELINE_TTL_MS) {
+      const p = readTimeline(source2, {
+        ...opts.project ? { project: opts.project } : {},
+        ...checkout ? { checkoutProject: checkout } : {},
+        ...opts.validator ? { validator: opts.validator() } : {},
+        ...opts.now ? { now: opts.now() } : {}
+      });
+      cached = { at: now, key, read: p };
+      p.catch(() => cached = void 0);
+    }
+    let r;
+    try {
+      r = await cached.read;
+    } catch (e) {
+      if (e instanceof TerragucciReadError) return c.json(e.refusal, 422);
+      throw e;
+    }
+    return c.json(timelineAnswer(r, { ...root ? { root } : {}, ...limit ? { limit } : {} }));
+  });
+}
+
+// src/terragucci-poll.ts
+import { createHash as createHash6 } from "node:crypto";
+import { stat } from "node:fs/promises";
+import { join as join30, resolve as resolve20 } from "node:path";
+import { streamSSE } from "hono/streaming";
+
+// src/terragucci-lifecycle.ts
+init_scratch();
+import { execFile as execFile3 } from "node:child_process";
+import { createHash as createHash5 } from "node:crypto";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readdirSync as readdirSync10 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { basename as basename3, isAbsolute as isAbsolute4, join as join29, resolve as resolve19 } from "node:path";
+var LIFECYCLE_BRANCH = "chant/lifecycle";
+var LEDGER_PATH = "_gates/tf-apply.jsonl";
+var APPLIED_PATH = "_gates/tf-apply/applied.jsonl";
+var WAVE_RECORDS_DIR = "_gates/tf-apply";
+var LOCKS_PATH = "_locks/tf-apply.json";
+var CHECKOUT_REF = `refs/remotes/origin/${LIFECYCLE_BRANCH}`;
+var CACHE_REF = `refs/heads/${LIFECYCLE_BRANCH}`;
+var CACHE_PREFIX = "behold-lifecycle-";
+var lines = (text) => text.split("\n").map((l) => l.trim()).filter(Boolean);
+var json = (line) => {
+  try {
+    const r = JSON.parse(line);
+    return r && typeof r === "object" && !Array.isArray(r) ? r : void 0;
+  } catch {
+    return void 0;
+  }
+};
+function parseLedger(text) {
+  const out = { pending: [], resolutions: [] };
+  for (const line of lines(text)) {
+    const r = json(line);
+    if (!r) continue;
+    if (r.version !== 1 || typeof r.op !== "string" || typeof r.gate !== "string" || typeof r.timestamp !== "string") continue;
+    if (r.planDigest !== void 0 && typeof r.planDigest !== "string") continue;
+    if (r.kind === "pending") {
+      if (typeof r.expiresAt === "string") out.pending.push(r);
+    } else if (typeof r.resolvedBy === "string") {
+      out.resolutions.push(r);
+    }
+  }
+  return out;
+}
+function parseApplied(text) {
+  const out = { applied: [], finished: [] };
+  for (const line of lines(text)) {
+    const r = json(line);
+    if (!r || r.version !== 1 || typeof r.gate !== "string" || typeof r.planDigest !== "string") continue;
+    if (r.kind === "applied" && typeof r.approvedAt === "string") out.applied.push(r);
+    else if (r.kind === "finished" && typeof r.applied === "string" && (r.result === "applied" || r.result === "failed")) out.finished.push(r);
+  }
+  return out;
+}
+function parseLocks(text) {
+  const doc = json(text.trim());
+  const locks = {};
+  if (doc?.version !== 1 || !doc.locks || typeof doc.locks !== "object" || Array.isArray(doc.locks)) return locks;
+  for (const [root, l] of Object.entries(doc.locks)) {
+    if (Number.isInteger(l?.pr) && typeof l.by === "string" && typeof l.at === "string" && typeof l.head === "string")
+      locks[root] = { pr: l.pr, by: l.by, at: l.at, head: l.head, ...l.via === "lock" ? { via: "lock" } : {}, ...l.stage === "plan" ? { stage: "plan" } : {} };
+  }
+  return locks;
+}
+var DIGEST = /^(?:jcs1-)?sha256:([0-9a-f]{64})$/;
+function samePlanDigest(a, b) {
+  if (a === b) return true;
+  if (a === void 0 || b === void 0) return false;
+  const x = DIGEST.exec(a);
+  const y = DIGEST.exec(b);
+  return x !== null && y !== null && x[1] === y[1];
+}
+var t = (iso) => new Date(iso).getTime();
+var newest = (xs, at2) => xs.reduce((b, x) => !b || t(at2(x)) >= t(at2(b)) ? x : b, void 0);
+function gateEntries(ledger, records, source2, now) {
+  const gates = /* @__PURE__ */ new Set();
+  for (const r of [...ledger.pending, ...ledger.resolutions, ...ledger.applied]) if (/^wave-\d+$/.test(r.gate)) gates.add(r.gate);
+  const out = [];
+  for (const gate of gates) {
+    const wave = Number(gate.slice("wave-".length));
+    const pending = newest(ledger.pending.filter((p) => p.gate === gate), (p) => p.timestamp);
+    const since = pending ? t(pending.timestamp) : 0;
+    const resolutions = ledger.resolutions.filter((r) => r.gate === gate && t(r.timestamp) >= since);
+    const approval = pending ? newest(resolutions.filter((r) => samePlanDigest(r.planDigest, pending.planDigest)), (r) => r.timestamp) : newest(resolutions, (r) => r.timestamp);
+    const digest = pending?.planDigest ?? approval?.planDigest;
+    const applied = approval ? newest(ledger.applied.filter((a) => a.gate === gate && samePlanDigest(a.planDigest, approval.planDigest) && t(a.approvedAt) >= t(approval.timestamp)), (a) => a.timestamp) : !pending ? newest(ledger.applied.filter((a) => a.gate === gate), (a) => a.timestamp) : void 0;
+    const finished = applied ? newest(ledger.finished.filter((f) => f.gate === gate && samePlanDigest(f.planDigest, applied.planDigest) && f.applied === applied.timestamp), (f) => f.timestamp) : void 0;
+    const state = applied ? finished?.result === "failed" ? "failed" : "applied" : approval ? "approved" : pending && t(pending.expiresAt) <= now.getTime() ? "expired" : "waiting";
+    out.push({
+      gate,
+      wave,
+      state,
+      ...digest ? { digest } : {},
+      ...pending ? {
+        pending: {
+          timestamp: pending.timestamp,
+          expiresAt: pending.expiresAt,
+          ...pending.planDigest ? { planDigest: pending.planDigest } : {},
+          ...pending.commit ? { commit: pending.commit } : {},
+          ...pending.runId ? { runId: pending.runId } : {},
+          ...pending.url ? { url: pending.url } : {},
+          ...pending.description ? { description: pending.description } : {}
+        }
+      } : {},
+      ...approval ? {
+        approval: {
+          by: approval.resolvedBy,
+          at: approval.timestamp,
+          ...approval.planDigest ? { planDigest: approval.planDigest } : {},
+          signed: !!approval.seal,
+          ...approval.via ? { via: approval.via } : {},
+          ...approval.pr !== void 0 ? { pr: approval.pr } : {},
+          ...approval.note ? { note: approval.note } : {}
+        }
+      } : {},
+      ...applied ? {
+        applied: {
+          at: applied.timestamp,
+          approvedAt: applied.approvedAt,
+          approvedBy: applied.approvedBy,
+          ...applied.runId ? { runId: applied.runId } : {},
+          ...applied.commit ? { commit: applied.commit } : {},
+          ...finished ? { result: finished.result, finished: finished.timestamp } : {}
+        }
+      } : {},
+      records: records.filter((r) => r.wave === wave).map(({ digest: d, path }) => ({ digest: d, path })),
+      ...state === "waiting" ? { command: `npx terragucci approve ${gate}${digest ? ` --plan ${digest}` : ""}` } : {},
+      source: source2
+    });
+  }
+  return out.sort((a, b) => a.wave - b.wave);
+}
+function waveRecords(paths) {
+  const out = [];
+  for (const path of paths) {
+    const m = /^_gates\/tf-apply\/wave-(\d+)\/([^/]+)\.json$/.exec(path);
+    if (m) out.push({ wave: Number(m[1]), digest: m[2].replace("_", ":"), path });
+  }
+  return out;
+}
+var realGit = (args, o = {}) => new Promise((res) => {
+  execFile3(
+    process.env.GIT_BIN || "git",
+    args,
+    { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, timeout: o.timeoutMs ?? 6e4, env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0" } },
+    (err, stdout, stderr) => {
+      const code = err ? typeof err.code === "number" ? err.code : -1 : 0;
+      res({ code, stdout: String(stdout ?? ""), stderr: String(stderr ?? "") || (err ? err.message : "") });
+    }
+  );
+});
+var redact = (s) => s.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/gi, "$1");
+function cacheDir(origin, root = tmpdir3()) {
+  return join29(root, `${CACHE_PREFIX}${createHash5("sha256").update(origin).digest("hex").slice(0, 16)}`);
+}
+var inflight = /* @__PURE__ */ new Map();
+function serially(key, fn) {
+  const prev = inflight.get(key) ?? Promise.resolve();
+  const next = prev.catch(() => void 0).then(fn);
+  inflight.set(key, next);
+  void next.finally(() => {
+    if (inflight.get(key) === next) inflight.delete(key);
+  }).catch(() => void 0);
+  return next;
+}
+function fetchable(url, checkout) {
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(url) || /^[^/]+@[^:/]+:/.test(url) || isAbsolute4(url)) return url;
+  return resolve19(checkout, url);
+}
+async function fetchIntoCache(git, origin, cache5) {
+  assertScratch(basename3(cache5));
+  return serially(cache5, async () => {
+    if (!existsSync18(join29(cache5, "HEAD"))) {
+      if (existsSync18(cache5) && readdirSync10(cache5).length > 0) return { ok: false, error: `${cache5} exists and is not behold's lifecycle cache; behold leaves it alone` };
+      mkdirSync6(cache5, { recursive: true });
+      const init = await git(["init", "--bare", "-q", cache5]);
+      if (init.code !== 0) return { ok: false, error: `could not make the cache ${cache5}: ${init.stderr.trim()}` };
+    }
+    const f = await git(["--git-dir", cache5, "fetch", "-q", "--no-tags", origin, `+refs/heads/${LIFECYCLE_BRANCH}:${CACHE_REF}`]);
+    if (f.code === 0) return { ok: true, found: true };
+    if (/couldn't find remote ref|could not find remote ref/i.test(f.stderr)) return { ok: true, found: false };
+    return { ok: false, error: redact(f.stderr.trim() || `git fetch exited ${f.code}`) };
+  });
+}
+async function readAt(git, repo, ref2, now) {
+  const tip = await git([...repo, "log", "-1", "--format=%H%x00%cI", ref2, "--"]);
+  if (tip.code !== 0 || !tip.stdout.trim()) return void 0;
+  const [sha, committed] = tip.stdout.trim().split("\0");
+  const show = async (path) => {
+    const r = await git([...repo, "show", `${sha}:${path}`]);
+    return r.code === 0 ? r.stdout : "";
+  };
+  const changed = async (...paths) => {
+    const r = await git([...repo, "log", "-1", "--format=%H%x00%cI", sha, "--", ...paths]);
+    const [c, at2] = r.code === 0 && r.stdout.trim() ? r.stdout.trim().split("\0") : [sha, committed];
+    return { branch: LIFECYCLE_BRANCH, commit: c, committed: at2, path: paths.join(" ") };
+  };
+  const [ledgerText, appliedText, locksText, tree] = await Promise.all([
+    show(LEDGER_PATH),
+    show(APPLIED_PATH),
+    show(LOCKS_PATH),
+    git([...repo, "ls-tree", "-r", "--name-only", sha, "--", `${WAVE_RECORDS_DIR}/`])
+  ]);
+  const ledger = { ...parseLedger(ledgerText), ...parseApplied(appliedText) };
+  const records = waveRecords(tree.code === 0 ? lines(tree.stdout) : []);
+  const gates = ledger.pending.length || ledger.resolutions.length || ledger.applied.length ? gateEntries(ledger, records, await changed(LEDGER_PATH, APPLIED_PATH), now) : [];
+  const lockMap = parseLocks(locksText);
+  const lockSource = Object.keys(lockMap).length ? await changed(LOCKS_PATH) : void 0;
+  const locks = Object.entries(lockMap).sort(([a], [b]) => a < b ? -1 : 1).map(([root, l]) => ({ root, ...l, source: lockSource }));
+  return { commit: { sha, committed }, gates, locks };
+}
+async function readLifecycle(checkout, opts = {}) {
+  const git = opts.git ?? realGit;
+  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  const base = { branch: LIFECYCLE_BRANCH, read: { at: now.toISOString() } };
+  const empty = { gates: [], locks: [] };
+  const remote = await git(["-C", checkout, "remote", "get-url", "origin"]);
+  const url = remote.code === 0 ? remote.stdout.trim() : "";
+  let fetchError;
+  let origin;
+  if (!url) {
+    fetchError = "the checkout has no origin remote";
+  } else {
+    const from = fetchable(url, checkout);
+    origin = redact(from);
+    const cache5 = cacheDir(from, opts.cacheRoot);
+    let f;
+    try {
+      f = await fetchIntoCache(git, from, cache5);
+    } catch (e) {
+      f = { ok: false, error: e instanceof Error ? e.message : String(e) };
+    }
+    if (f.ok && !f.found) {
+      return { ...base, found: false, via: "fetch", origin, fetch: { ok: true }, ...empty, note: `${origin} has no ${LIFECYCLE_BRANCH} branch: no wave has asked for an approval and no root is locked yet.` };
+    }
+    if (f.ok) {
+      const lane2 = await readAt(git, ["--git-dir", cache5], CACHE_REF, now);
+      if (lane2) return { ...base, found: true, via: "fetch", origin, fetch: { ok: true }, ...lane2, note: `${LIFECYCLE_BRANCH} as fetched from ${origin} at ${base.read.at}.` };
+      fetchError = `fetched ${LIFECYCLE_BRANCH}, but behold's cache could not read it`;
+    } else {
+      fetchError = f.error;
+    }
+  }
+  const lane = await readAt(git, ["-C", checkout], CHECKOUT_REF, now);
+  if (lane) {
+    return {
+      ...base,
+      found: true,
+      via: "checkout-ref",
+      ...origin ? { origin } : {},
+      fetch: { ok: false, error: fetchError },
+      ...lane,
+      note: `behold could not fetch ${LIFECYCLE_BRANCH} (${fetchError}), so this is the checkout's ${CHECKOUT_REF}, as of its last git fetch; its tip was committed ${lane.commit.committed}.`
+    };
+  }
+  return {
+    ...base,
+    found: false,
+    via: "none",
+    ...origin ? { origin } : {},
+    fetch: { ok: false, error: fetchError },
+    ...empty,
+    note: `behold could not fetch ${LIFECYCLE_BRANCH} (${fetchError}) and the checkout has no ${CHECKOUT_REF}, so the gates and locks are unknown.`
+  };
+}
+
+// src/terragucci-poll.ts
+var TERRAGUCCI_POLL_SECS = 30;
+var INDEX_KEY = "index.json";
+var trim2 = (s) => s.replace(/^\/+|\/+$/g, "");
+var joinKey2 = (...p) => p.map(trim2).filter(Boolean).join("/");
+var verdict2 = (prev, tag) => ({ ...tag ? { tag } : {}, changed: prev !== void 0 && tag !== prev });
+function indexProbe(spec2, opts = {}) {
+  const name = opts.key ?? INDEX_KEY;
+  const s3 = /^s3:\/\/([^/]+)\/?(.*)$/.exec(spec2);
+  if (s3) {
+    const bucket = s3[1];
+    const key = joinKey2(s3[2] ?? "", name);
+    const env = opts.env ?? process.env;
+    if (!opts.aws && hasEnvCredentials(env)) {
+      const client = new S3Object(s3FromEnv(bucket, env), opts.fetch);
+      return async (prev) => {
+        const h = await client.head(key, prev);
+        if (!h) return verdict2(prev, void 0);
+        return h.same ? { tag: prev, changed: false } : verdict2(prev, h.etag);
+      };
+    }
+    const aws = opts.aws ?? realAws;
+    return async (prev) => {
+      const r = await aws(["s3api", "head-object", "--bucket", bucket, "--key", key, ...prev ? ["--if-none-match", prev] : [], "--output", "json"]);
+      if (r.code === 0) {
+        let etag;
+        try {
+          etag = JSON.parse(r.stdout).ETag;
+        } catch {
+          etag = void 0;
+        }
+        return verdict2(prev, etag);
+      }
+      if (/\(304\)|Not Modified/i.test(r.stderr)) return { tag: prev, changed: false };
+      if (/\(404\)|Not Found|NoSuchKey/i.test(r.stderr)) return verdict2(prev, void 0);
+      throw new Error(`aws s3api head-object s3://${bucket}/${key} failed: ${r.stderr.trim() || `exit ${r.code}`}`);
+    };
+  }
+  if (/^https?:\/\//.test(spec2)) {
+    const url = `${spec2.replace(/\/+$/, "")}/${name}`;
+    const get = opts.fetch ?? fetch;
+    return async (prev) => {
+      const res = await get(url, { headers: prev ? { "if-none-match": prev } : {} });
+      if (res.status === 304) return { tag: prev, changed: false };
+      if (res.status === 404 || res.status === 403) return verdict2(prev, void 0);
+      if (!res.ok) throw new Error(`GET ${url} answered ${res.status}`);
+      const etag = res.headers.get("etag") ?? `sha256:${createHash6("sha256").update(await res.text()).digest("hex")}`;
+      return verdict2(prev, etag);
+    };
+  }
+  const file = join30(resolve20(opts.cwd ?? process.cwd(), spec2), name);
+  return async (prev) => {
+    try {
+      const s = await stat(file);
+      return verdict2(prev, `mtime:${s.mtimeMs}`);
+    } catch (e) {
+      if (e.code === "ENOENT") return verdict2(prev, void 0);
+      throw e;
+    }
+  };
+}
+function lifecycleKey(a) {
+  const { read: _read, note: _note, ...rest } = a;
+  return JSON.stringify(rest);
+}
+var TerragucciPoller = class {
+  constructor(o) {
+    this.o = o;
+  }
+  o;
+  listeners = /* @__PURE__ */ new Set();
+  timer;
+  running;
+  indexTag;
+  lastKey;
+  /** Bumped on every start and stop, so a tick that outlives a stop schedules nothing. */
+  generation = 0;
+  get active() {
+    return this.listeners.size > 0;
+  }
+  subscribe(fn) {
+    this.listeners.add(fn);
+    if (this.listeners.size === 1) this.start();
+    return () => {
+      if (!this.listeners.delete(fn)) return;
+      if (this.listeners.size === 0) this.stop();
+    };
+  }
+  start() {
+    this.generation++;
+    this.indexTag = void 0;
+    const last = this.o.lastLifecycle?.();
+    this.lastKey = last ? lifecycleKey(last) : void 0;
+    this.schedule(0);
+  }
+  stop() {
+    this.generation++;
+    clearTimeout(this.timer);
+    this.timer = void 0;
+  }
+  schedule(ms) {
+    const gen = this.generation;
+    clearTimeout(this.timer);
+    this.timer = setTimeout(() => {
+      if (gen !== this.generation) return;
+      this.running = this.tick().finally(() => {
+        this.running = void 0;
+        if (gen === this.generation && this.active) this.schedule(this.o.intervalMs);
+      });
+    }, ms);
+  }
+  send(e) {
+    for (const fn of [...this.listeners]) fn(e);
+  }
+  /** One round: the index, then the lane. Exposed for a test; the timer calls it. */
+  async tick() {
+    const now = () => (this.o.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+    const reports = {};
+    try {
+      const p = await this.o.probe(this.indexTag);
+      if (p.tag) reports.tag = p.tag;
+      if (p.changed) {
+        this.o.onReportsChanged?.();
+        this.send({ type: "reports", data: { at: now(), ...p.tag ? { tag: p.tag } : {} } });
+      }
+      this.indexTag = p.tag;
+    } catch (e) {
+      reports.error = e instanceof Error ? e.message : String(e);
+    }
+    let progress;
+    if (this.o.progress) {
+      try {
+        const { answer, ...asked } = await this.o.progress();
+        progress = asked;
+        if (answer !== void 0) this.send({ type: "progress", data: answer });
+      } catch (e) {
+        progress = { asked: true, error: e instanceof Error ? e.message : String(e) };
+      }
+    }
+    const lifecycle = {};
+    try {
+      const a = await this.o.lifecycle();
+      this.o.onLifecycle?.(a);
+      if (a.commit) lifecycle.commit = a.commit.sha;
+      lifecycle.via = a.via;
+      const key = lifecycleKey(a);
+      if (key !== this.lastKey) {
+        this.lastKey = key;
+        this.send({ type: "lifecycle", data: a });
+      }
+    } catch (e) {
+      lifecycle.error = e instanceof Error ? e.message : String(e);
+    }
+    this.send({ type: "polled", data: { at: now(), reports, lifecycle, ...progress ? { progress } : {} } });
+  }
+  /** For a test: wait for a tick in flight. */
+  async settled() {
+    await this.running;
+  }
+};
+var LIFECYCLE_READ_TTL_MS = 3e4;
+function terragucciLaneRoutes(app, o, base, forget) {
+  let cached;
+  let last;
+  const fresh = () => {
+    const b = base();
+    const p = o.readLane ? o.readLane(b) : readLifecycle(b, { ...o.now ? { now: o.now } : {}, ...o.lifecycle });
+    cached = { at: Date.now(), base: b, read: p };
+    p.then((a) => last = a).catch(() => cached = void 0);
+    return p;
+  };
+  const read = (force) => {
+    const b = base();
+    if (!force && cached && cached.base === b && Date.now() - cached.at < LIFECYCLE_READ_TTL_MS) return cached.read;
+    return fresh();
+  };
+  const pollSecs = o.pollSecs ?? TERRAGUCCI_POLL_SECS;
+  const poller = new TerragucciPoller({
+    intervalMs: pollSecs * 1e3,
+    probe: o.probe ?? indexProbe(o.source, { ...o.aws ? { aws: o.aws } : {}, ...o.fetch ? { fetch: o.fetch } : {} }),
+    lifecycle: fresh,
+    lastLifecycle: () => last,
+    onReportsChanged: forget,
+    ...o.progress ? { progress: o.progress } : {},
+    ...o.now ? { now: o.now } : {}
+  });
+  app.get("/api/terragucci/lifecycle", async (c) => c.json(await read(new URL(c.req.url).searchParams.get("fresh") === "1")));
+  app.get(
+    "/api/terragucci/events",
+    (c) => streamSSE(c, async (stream) => {
+      await stream.writeSSE({ event: "hello", data: JSON.stringify({ pollSecs }) });
+      const unsubscribe = pollSecs > 0 ? poller.subscribe((e) => void stream.writeSSE({ event: e.type, data: JSON.stringify(e.data) }).catch(() => void 0)) : () => {
+      };
+      stream.onAbort(unsubscribe);
+      while (!stream.aborted) {
+        await stream.writeSSE({ event: "ping", data: "" });
+        await stream.sleep(3e4);
+      }
+      unsubscribe();
+    })
+  );
+  return poller;
+}
+
+// src/terragucci-progress.ts
+import { readFileSync as readFileSync21, statSync as statSync10 } from "node:fs";
+import { createRequire as createRequire5 } from "node:module";
+import { dirname as dirname9, join as join31, resolve as resolve21 } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { Ajv2020 as Ajv20203 } from "ajv/dist/2020.js";
+var RUN_SCHEMA = "terragucci.run/v1";
+var RUN_SCHEMA_FILE = "run.schema.json";
+var PROGRESS_TTL_MS = 3e4;
+var PROGRESS_STATUSES = ["done", "in-flight", "waiting", "not-applied"];
+var isRecord16 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var str11 = (v) => typeof v === "string";
+function structuralRun(doc) {
+  if (!isRecord16(doc)) return "it is not a JSON object";
+  if (doc.schema !== RUN_SCHEMA) return `its schema is ${JSON.stringify(doc.schema)}, not ${RUN_SCHEMA}`;
+  for (const f of ["project", "commit", "updated"]) if (!str11(doc[f])) return `its ${f} is not a string`;
+  if (!Array.isArray(doc.waves)) return "it has no waves array";
+  for (const [i, w] of doc.waves.entries()) {
+    if (!isRecord16(w) || typeof w.number !== "number" || !str11(w.state) || !str11(w.gate) || !Array.isArray(w.roots)) return `wave ${i} lacks number, state, gate or roots`;
+    if (w.progress === void 0) continue;
+    const p = w.progress;
+    if (!isRecord16(p) || !str11(p.read) || !Array.isArray(p.resources)) return `wave ${String(w.number)}'s progress lacks read or resources`;
+    for (const r of p.resources) {
+      if (!isRecord16(r) || !str11(r.root) || !str11(r.address) || !str11(r.action)) return `a resource of wave ${String(w.number)}'s progress lacks root, address or action`;
+      if (!PROGRESS_STATUSES.includes(r.status)) return `a resource of wave ${String(w.number)}'s progress has status ${JSON.stringify(r.status)}`;
+      if (r.done_at !== void 0 && !str11(r.done_at)) return `a resource of wave ${String(w.number)}'s progress has a done_at that is not a string`;
+    }
+  }
+  return void 0;
+}
+function compileRunSchema(schema, version) {
+  const v = new Ajv20203({ strict: false, allErrors: false }).compile(schema);
+  return {
+    validation: { by: "schema", terragucci: version },
+    check(doc) {
+      const id = isRecord16(doc) ? doc.schema : void 0;
+      if (id !== RUN_SCHEMA) return `its schema is ${JSON.stringify(id)}, not ${RUN_SCHEMA}`;
+      if (v(doc)) return void 0;
+      const e = v.errors?.[0];
+      return `${RUN_SCHEMA_FILE} rejects it: ${e?.instancePath || "/"} ${e?.message ?? "is invalid"}`;
+    }
+  };
+}
+var compiled2 = /* @__PURE__ */ new Map();
+function runValidator(dirs = []) {
+  for (const from of [...dirs, dirname9(fileURLToPath6(import.meta.url))]) {
+    let dist;
+    try {
+      dist = dirname9(createRequire5(join31(resolve21(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
+    } catch {
+      continue;
+    }
+    const pkg = join31(dist, "..", "package.json");
+    const file = join31(dist, RUN_SCHEMA_FILE);
+    let stamp;
+    try {
+      stamp = [dist, ...[pkg, file].map((f) => {
+        const st = statSync10(f);
+        return `${st.mtimeMs}:${st.size}`;
+      })].join("\0");
+    } catch {
+      continue;
+    }
+    const hit = compiled2.get(stamp);
+    if (hit) return hit;
+    let v;
+    try {
+      const version = JSON.parse(readFileSync21(pkg, "utf8")).version ?? "";
+      v = compileRunSchema(JSON.parse(readFileSync21(file, "utf8")), version);
+    } catch {
+      continue;
+    }
+    for (const k of compiled2.keys()) if (k.startsWith(`${dist}\0`)) compiled2.delete(k);
+    compiled2.set(stamp, v);
+    return v;
+  }
+  return { validation: { by: "structural" }, check: structuralRun };
+}
+var refuse12 = (error, remedy) => {
+  throw new TerragucciReadError({ error, code: "terragucci-report", remedy });
+};
+var newestFirst2 = (a, b) => a.finished < b.finished ? 1 : a.finished > b.finished ? -1 : 0;
+function newestApply(rows, project) {
+  return rows.filter((r) => r.project === project && r.stage === "tf-apply").sort(newestFirst2)[0];
+}
+function runKey(row) {
+  const segs = row.path.split("/").filter(Boolean);
+  const at2 = segs.lastIndexOf(row.commit);
+  const base = at2 >= 2 && /^\d{4}$/.test(segs[at2 - 2]) && /^\d{2}$/.test(segs[at2 - 1]) ? segs.slice(0, at2 - 2) : row.project.split("/").filter(Boolean);
+  return [...base, "runs", row.commit, "run.json"].join("/");
+}
+var zero = () => ({ done: 0, "in-flight": 0, waiting: 0, "not-applied": 0 });
+var MARK_ORDER = ["not-applied", "in-flight", "waiting", "done"];
+function unsettled(run3) {
+  return run3.waves.some((w) => w.state === "applying" || (w.progress?.resources ?? []).some((r) => r.status === "in-flight" || r.status === "waiting"));
+}
+function joinProgress(run3, nodes, roots) {
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    const root = n.attrs?.root;
+    if (typeof root !== "string") continue;
+    const at2 = n.id.indexOf(`/${root}/`);
+    if (at2 < 0) continue;
+    const key = `${n.id.slice(0, at2)}\0${root}`;
+    if (!byRoot.has(key)) byRoot.set(key, /* @__PURE__ */ new Map());
+    byRoot.get(key).set(n.id.slice(at2 + root.length + 2), n.id);
+  }
+  const rootByPath = new Map(roots.map((r) => [r.path, r]));
+  const waves = [];
+  const cards = {};
+  const unmatched = [];
+  for (const w of run3.waves) {
+    if (!w.progress) continue;
+    const counts = zero();
+    const resources = [];
+    const onCard = /* @__PURE__ */ new Map();
+    for (const r of w.progress.resources) {
+      counts[r.status]++;
+      const root = rootByPath.get(r.root);
+      const card = root ? byRoot.get(`${root.member}\0${root.name}`)?.get(blockPath(r.address)) : void 0;
+      const own = { root: r.root, address: r.address, action: r.action, status: r.status, ...r.done_at ? { done_at: r.done_at } : {} };
+      resources.push({ ...own, ...card ? { card } : {} });
+      if (!card) {
+        unmatched.push({ root: r.root, address: r.address });
+        continue;
+      }
+      const m = onCard.get(card) ?? { wave: w.number, state: w.state, read: w.progress.read, status: "done", counts: zero(), resources: [] };
+      m.counts[r.status]++;
+      m.resources.push(own);
+      onCard.set(card, m);
+    }
+    for (const [card, m] of onCard) {
+      m.status = MARK_ORDER.find((s) => m.counts[s] > 0) ?? "done";
+      (cards[card] ??= []).push(m);
+    }
+    waves.push({ number: w.number, state: w.state, gate: w.gate, read: w.progress.read, counts, resources });
+  }
+  return { waves, cards, unmatched, watching: unsettled(run3) };
+}
+var ProgressGraphError = class extends Error {
+};
+var FILES = "/api/terragucci/file?key=";
+var progressKey = (a) => JSON.stringify([a.run, a.waves, a.unmatched]);
+var TerragucciProgress = class {
+  constructor(o) {
+    this.o = o;
+  }
+  o;
+  cached;
+  /** The run view the poll watches: its key, the tag last seen, and the answer last given. */
+  watch;
+  probes = /* @__PURE__ */ new Map();
+  now() {
+    return this.o.now?.() ?? /* @__PURE__ */ new Date();
+  }
+  /** The answer, from the 30 s cache unless `fresh`. */
+  answer(fresh = false) {
+    const key = this.o.checkoutProject?.() ?? "";
+    const at2 = Date.now();
+    if (!fresh && this.cached && this.cached.key === key && at2 - this.cached.at < PROGRESS_TTL_MS) return this.cached.answer;
+    const p = this.read();
+    this.cached = { at: at2, key, answer: p };
+    p.catch(() => this.cached = void 0);
+    return p;
+  }
+  /** Drop the cached answer: the index changed, so the newest commit may have. */
+  forget() {
+    this.cached = void 0;
+  }
+  async read() {
+    const v = this.o.validators?.();
+    const src = this.o.source;
+    let text;
+    try {
+      text = await src.read("index.json");
+    } catch (e) {
+      refuse12(`Could not read index.json from ${src.location}: ${e instanceof Error ? e.message : String(e)}`, "Check the source serves terragucci's reports prefix.");
+    }
+    if (text === void 0) refuse12(`${src.location} has no index.json.`, "Point --terragucci at terragucci's report directory or bucket prefix, the one holding index.json.");
+    let doc;
+    try {
+      doc = JSON.parse(text);
+    } catch {
+      refuse12(`index.json in ${src.location} is not JSON.`, "Point --terragucci at a terragucci reports directory or bucket prefix, the one holding index.json.");
+    }
+    const why = v?.index.check("index", doc);
+    if (why) refuse12(`index.json in ${src.location} is not a terragucci terragucci.report-index/v1 document: ${why}.`, "Check that terragucci wrote it.");
+    const rows = doc.reports;
+    const checkout = this.o.checkoutProject?.();
+    const project = pickProject(rows, { ...this.o.project ? { project: this.o.project } : {}, ...checkout ? { checkoutProject: checkout } : {} }, src);
+    const row = newestApply(rows, project);
+    if (!row) {
+      this.watch = void 0;
+      return {
+        ...this.base(project, v?.run.validation),
+        run: null,
+        absent: `index.json lists no tf-apply run of ${project} yet, so there is no run view to read.`,
+        waves: [],
+        cards: {},
+        unmatched: [],
+        watching: false
+      };
+    }
+    const key = runKey(row);
+    const a = await this.readRun(project, row.commit, key, v?.run);
+    this.watch = { key, commit: row.commit, project, last: a };
+    return a;
+  }
+  base(project, validation) {
+    return { source: this.o.source.location, kind: this.o.source.kind, project, validation: validation ?? { by: "structural" }, read: this.now().toISOString(), files: FILES };
+  }
+  /** One GET of run.json, checked and joined. */
+  async readRun(project, commit, key, v) {
+    const src = this.o.source;
+    const validator = v ?? runValidator();
+    let text;
+    try {
+      text = await src.read(key);
+    } catch (e) {
+      refuse12(
+        `Could not read ${key} from ${src.location}: ${e instanceof Error ? e.message : String(e)}`,
+        src.kind === "s3" ? "behold reads the bucket with your aws CLI or the environment's credentials: check GetObject on <prefix>/*/runs/*/run.json." : "Check the source serves the reports prefix."
+      );
+    }
+    const html = key.replace(/run\.json$/, "run.html");
+    if (text === void 0) {
+      return {
+        ...this.base(project, validator.validation),
+        run: { commit, key, present: false },
+        absent: `${src.location} has no ${key}: terragucci writes the run view when reports.bucket is set, and a wave's progress per resource only for a choudoufu wave (terragucci 0.4.7 and newer). This says nothing about whether the apply moved.`,
+        waves: [],
+        cards: {},
+        unmatched: [],
+        watching: false
+      };
+    }
+    let doc;
+    try {
+      doc = JSON.parse(text);
+    } catch {
+      refuse12(`${key} in ${src.location} is not JSON.`, "Check that terragucci wrote it.");
+    }
+    const why = validator.check(doc);
+    if (why) {
+      refuse12(
+        `${key} in ${src.location} is not a terragucci ${RUN_SCHEMA} document: ${why}.`,
+        validator.validation.by === "schema" ? `It was checked against @intentius/terragucci ${validator.validation.terragucci}'s ${RUN_SCHEMA_FILE}. Check that this terragucci wrote it, or upgrade behold.` : "Install @intentius/terragucci beside behold to check it against terragucci's own JSON Schema, and check that terragucci wrote it."
+      );
+    }
+    const run3 = doc;
+    let ctx;
+    try {
+      ctx = await this.o.context();
+    } catch (e) {
+      throw new ProgressGraphError(`behold could not read the checkout's roots to place the progress on: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return {
+      ...this.base(project, validator.validation),
+      run: { commit, key, present: true, updated: run3.updated, html },
+      ...joinProgress(run3, ctx.nodes, ctx.roots)
+    };
+  }
+  /**
+   * One tick of the #505 poll: ask whether the watched run.json changed, only
+   * while it is unsettled. A first ask after a read has no tag to compare, so
+   * it reads the view again rather than miss a write made in between.
+   */
+  async poll() {
+    const w = this.watch;
+    if (!w || !w.last.watching) return { asked: false };
+    let probe2 = this.probes.get(w.key);
+    if (!probe2) {
+      probe2 = this.o.probe(w.key);
+      this.probes.set(w.key, probe2);
+    }
+    const p = await probe2(w.tag);
+    const changed = p.changed || w.tag === void 0;
+    w.tag = p.tag;
+    if (!changed) return { asked: true, key: w.key, changed: false };
+    const v = this.o.validators?.();
+    const a = await this.readRun(w.project, w.commit, w.key, v?.run);
+    if (this.watch !== w) return { asked: true, key: w.key, changed: true };
+    const moved = progressKey(a) !== progressKey(w.last);
+    w.last = a;
+    this.cached = { at: Date.now(), key: this.o.checkoutProject?.() ?? "", answer: Promise.resolve(a) };
+    return { asked: true, key: w.key, changed: true, ...moved ? { answer: a } : {} };
+  }
+};
+function terragucciProgressRoute(app, progress) {
+  app.get("/api/terragucci/progress", async (c) => {
+    try {
+      return c.json(await progress.answer(new URL(c.req.url).searchParams.get("fresh") === "1"));
+    } catch (e) {
+      if (e instanceof TerragucciReadError) return c.json(e.refusal, 422);
+      if (e instanceof ProgressGraphError) return c.json({ error: e.message, code: "terragucci-graph", remedy: "`behold doctor` names what the Terraform read needs." }, 422);
+      throw e;
+    }
+  });
+}
+
 // src/terragucci-view.ts
 var TERRAGUCCI_READ_TTL_MS = 3e4;
 function repoBase(dirs) {
   for (const d of dirs) {
     const cfg = terragucciConfig(d);
-    if (cfg) return dirname8(cfg);
+    if (cfg) return dirname10(cfg);
   }
   try {
     return execFileSync2("git", ["-C", dirs[0], "rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
@@ -15572,7 +16620,7 @@ function checkoutRoots(dirs, base = repoBase(dirs)) {
   for (const m of estateMembers(dirs)) {
     if (m.kind !== "terraform") continue;
     for (const r of discoverTerraformRoots(m.dir).roots) {
-      const path = relative7(base, join28(m.dir, r.dir)).split(sep6).join("/") || ".";
+      const path = relative7(base, join32(m.dir, r.dir)).split(sep6).join("/") || ".";
       out.push({ member: m.name, name: r.name, path });
     }
   }
@@ -15599,6 +16647,28 @@ function terragucciRoutes(app, opts, dirs) {
     p.catch(() => cached = void 0);
     return p;
   };
+  const progress = new TerragucciProgress({
+    source: source2,
+    ...opts.project ? { project: opts.project } : {},
+    checkoutProject: () => checkoutProject(repoBase(dirs())),
+    validators: () => ({ index: terragucciValidator(dirs()), run: runValidator(dirs()) }),
+    context: async () => {
+      const served2 = dirs();
+      return { nodes: (await composeEstate(served2, { detail: 3 })).nodes, roots: checkoutRoots(served2) };
+    },
+    probe: (key) => indexProbe(opts.source, { key, ...opts.aws ? { aws: opts.aws } : {}, ...opts.fetch ? { fetch: opts.fetch } : {} }),
+    ...opts.now ? { now: opts.now } : {}
+  });
+  terragucciProgressRoute(app, progress);
+  terragucciLaneRoutes(
+    app,
+    { source: opts.source, ...opts.pollSecs !== void 0 ? { pollSecs: opts.pollSecs } : {}, ...opts.aws ? { aws: opts.aws } : {}, ...opts.fetch ? { fetch: opts.fetch } : {}, ...opts.now ? { now: opts.now } : {}, progress: () => progress.poll(), ...opts.lane },
+    () => repoBase(dirs()),
+    () => {
+      cached = void 0;
+      progress.forget();
+    }
+  );
   app.get("/api/terragucci", async (c) => {
     const served2 = dirs();
     const roots = checkoutRoots(served2);
@@ -15629,6 +16699,12 @@ function terragucciRoutes(app, opts, dirs) {
       ...marks
     });
   });
+  terragucciTimelineRoute(app, source2, {
+    ...opts.project ? { project: opts.project } : {},
+    checkoutProject: () => checkoutProject(repoBase(dirs())),
+    validator: () => auditValidator(dirs()),
+    ...opts.now ? { now: opts.now } : {}
+  });
   app.get("/api/terragucci/file", async (c) => {
     const key = new URL(c.req.url).searchParams.get("key") ?? "";
     if (!FILE_KEY.test(key)) return c.json({ error: `not a report file: ${JSON.stringify(key)}`, code: "terragucci-file" }, 400);
@@ -15647,30 +16723,372 @@ function terragucciRoutes(app, opts, dirs) {
   });
 }
 
+// src/terragucci-estate.ts
+init_yaml();
+import { existsSync as existsSync19, readFileSync as readFileSync22, statSync as statSync11 } from "node:fs";
+import { createRequire as createRequire6 } from "node:module";
+import { dirname as dirname11, extname, join as join33, resolve as resolve22 } from "node:path";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { Ajv2020 as Ajv20204 } from "ajv/dist/2020.js";
+var RUN_SCHEMA2 = "terragucci.run/v1";
+function configProjects(file) {
+  let text;
+  try {
+    text = readFileSync22(file, "utf8");
+  } catch {
+    return void 0;
+  }
+  if (extname(file) === ".ts") return /(^|[\s,{])projects\s*:\s*\{/.test(text) ? [] : void 0;
+  let doc;
+  try {
+    doc = parseYAMLDocument(text);
+  } catch {
+    return void 0;
+  }
+  const projects = doc && typeof doc === "object" && !Array.isArray(doc) ? doc.projects : void 0;
+  if (!projects || typeof projects !== "object" || Array.isArray(projects)) return void 0;
+  return Object.keys(projects);
+}
+function controlRepo(dirs, roots = () => checkoutRoots(dirs).length) {
+  const config = servedTerragucciConfig(dirs);
+  if (!config) return void 0;
+  const projects = configProjects(config);
+  if (!projects) return void 0;
+  let n;
+  try {
+    n = roots();
+  } catch {
+    n = 0;
+  }
+  return n === 0 ? { config, projects } : void 0;
+}
+var isRecord17 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var str12 = (v) => typeof v === "string";
+var int = (v) => typeof v === "number" && Number.isInteger(v);
+function structuralRun2(doc) {
+  if (!isRecord17(doc)) return "it is not a JSON object";
+  if (doc.schema !== RUN_SCHEMA2) return `its schema is ${JSON.stringify(doc.schema)}, not ${RUN_SCHEMA2}`;
+  if (!str12(doc.project) || !str12(doc.commit) || !str12(doc.updated)) return "it lacks project, commit or updated";
+  if (!Array.isArray(doc.roots) || !Array.isArray(doc.waves)) return "it has no roots or waves array";
+  for (const [i, r] of doc.roots.entries()) {
+    if (!isRecord17(r) || !str12(r.root) || !int(r.wave) || !Array.isArray(r.reads) || !r.reads.every(str12)) return `root ${i} lacks root, wave or reads`;
+    if (r.state !== void 0 && !(isRecord17(r.state) && str12(r.state.key))) return `root ${String(r.root)}'s state has no key`;
+    if (r.external !== void 0 && !(Array.isArray(r.external) && r.external.every((x) => isRecord17(x) && str12(x.data) && str12(x.key)))) return `root ${String(r.root)}'s external reads lack data or key`;
+  }
+  for (const [i, w] of doc.waves.entries()) {
+    if (!isRecord17(w) || !int(w.number) || !Array.isArray(w.roots) || !Array.isArray(w.reads) || !str12(w.state) || !str12(w.gate)) return `wave ${i} lacks number, roots, reads, state or gate`;
+  }
+  return void 0;
+}
+var compiledRun = /* @__PURE__ */ new Map();
+function runViewValidator(dirs = []) {
+  for (const from of [...dirs, dirname11(fileURLToPath7(import.meta.url))]) {
+    let entry;
+    try {
+      entry = createRequire6(join33(resolve22(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
+    } catch {
+      continue;
+    }
+    const dist = dirname11(entry);
+    const schema = join33(dist, "run.schema.json");
+    let stamp;
+    try {
+      const st = statSync11(schema);
+      const pkg = statSync11(join33(dist, "..", "package.json"));
+      stamp = `${schema}\0${st.mtimeMs}:${st.size}\0${pkg.mtimeMs}`;
+    } catch {
+      continue;
+    }
+    const hit = compiledRun.get(stamp);
+    if (hit) return hit;
+    let v;
+    try {
+      const version = JSON.parse(readFileSync22(join33(dist, "..", "package.json"), "utf8")).version ?? "";
+      const validate = new Ajv20204({ strict: false, allErrors: false }).compile(JSON.parse(readFileSync22(schema, "utf8")));
+      v = {
+        validation: { by: "schema", terragucci: version },
+        check(doc) {
+          const id = isRecord17(doc) ? doc.schema : void 0;
+          if (id !== RUN_SCHEMA2) return `its schema is ${JSON.stringify(id)}, not ${RUN_SCHEMA2}`;
+          if (validate(doc)) return void 0;
+          const e = validate.errors?.[0];
+          return `run.schema.json rejects it: ${e?.instancePath || "/"} ${e?.message ?? "is invalid"}`;
+        }
+      };
+    } catch {
+      continue;
+    }
+    for (const k of compiledRun.keys()) if (k.startsWith(`${schema}\0`)) compiledRun.delete(k);
+    compiledRun.set(stamp, v);
+    return v;
+  }
+  return { validation: { by: "structural" }, check: structuralRun2 };
+}
+var refusal = (error, remedy) => ({ error, code: "terragucci-report", remedy });
+var refuse13 = (error, remedy) => {
+  throw new TerragucciReadError(refusal(error, remedy));
+};
+var trimSlashes = (s) => s.replace(/^\/+|\/+$/g, "");
+function runKey2(p, commit) {
+  const page = p.run_view?.commit === commit ? p.run_view.page : void 0;
+  if (page && !/^[a-z]+:\/\//i.test(page) && !page.startsWith("/") && !page.split("/").includes("..") && page.endsWith("/run.html")) {
+    return `${trimSlashes(page.slice(0, -"run.html".length))}/run.json`;
+  }
+  return [trimSlashes(p.project), "runs", commit, "run.json"].join("/");
+}
+var sameState = (a, b) => a.key === b.key && (!a.bucket || !b.bucket || a.bucket === b.bucket);
+function controlEdges(views) {
+  const edges = [];
+  const has = (f, t2) => edges.some((e) => e.from.project === f.project && e.from.root === f.root && e.to.project === t2.project && e.to.root === t2.root);
+  for (const v of views) for (const r of v.roots) for (const u of r.reads) edges.push({ from: { project: v.project, root: u }, to: { project: v.project, root: r.root }, cross: false });
+  const held = views.flatMap((v) => v.roots.filter((r) => r.state).map((r) => ({ project: v.project, root: r.root, state: r.state })));
+  for (const v of views) {
+    for (const r of v.roots) {
+      for (const x of r.external ?? []) {
+        for (const h of held) {
+          if (h.project === v.project || !sameState(h.state, x)) continue;
+          const from = { project: h.project, root: h.root };
+          const to = { project: v.project, root: r.root };
+          if (!has(from, to)) edges.push({ from, to, cross: true });
+        }
+      }
+    }
+  }
+  return edges;
+}
+function siblingCheckout(project, base, projectOf = checkoutProject) {
+  const name = project.split("/").filter(Boolean).pop();
+  if (!name) return void 0;
+  const dir = join33(dirname11(resolve22(base)), name);
+  if (dir === resolve22(base) || !existsSync19(join33(dir, ".git"))) return void 0;
+  return projectOf(dir) === project ? dir : void 0;
+}
+var shellWord = (s) => /^[A-Za-z0-9_./:@%+=,-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
+async function readControlEstate(source2, config, opts = {}) {
+  const v = opts.validator ?? terragucciValidator();
+  const rv = opts.runValidator ?? runViewValidator();
+  let gets = 0;
+  const get = async (key) => {
+    gets++;
+    return source2.read(key);
+  };
+  let text;
+  try {
+    text = await get("estate.json");
+  } catch (e) {
+    refuse13(`Could not read estate.json from ${source2.location}: ${e instanceof Error ? e.message : String(e)}`, "Check the source is the top of terragucci's reports prefix and that GetObject on estate.json is allowed.");
+  }
+  if (text === void 0) {
+    refuse13(
+      `${source2.location} has no estate.json, so a control repo's projects have nothing to be drawn from.`,
+      "Point --terragucci at the top of the reports prefix, where `terragucci estate` writes estate.json, or run `terragucci estate` once."
+    );
+  }
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch {
+    refuse13(`estate.json in ${source2.location} is not JSON.`, "Point --terragucci at the top of terragucci's reports prefix.");
+  }
+  const why = v.check("estate", doc);
+  if (why) {
+    refuse13(
+      `estate.json in ${source2.location} is not a terragucci terragucci.estate/v1 document: ${why}.`,
+      v.validation.by === "schema" ? `It was checked against @intentius/terragucci ${v.validation.terragucci}'s estate.schema.json. Check that this terragucci wrote it, or upgrade behold.` : "Install @intentius/terragucci beside behold to check it against terragucci's own JSON Schemas, and check that terragucci wrote it."
+    );
+  }
+  const estate = doc;
+  const estateDated = { key: "estate.json", at: estate.generated };
+  const views = [];
+  const projects = [];
+  const configured = new Set(opts.configured ?? []);
+  for (const p of estate.projects) {
+    const commit = p.run_view?.commit ?? p.apply?.commit;
+    let run3;
+    let missing;
+    let refused2;
+    if (!commit) {
+      missing = p.status === "ok" ? "no apply has run, so there is no run view" : p.status === "no-index" ? "no runs in the bucket yet" : `its index could not be read${p.error ? `: ${p.error}` : ""}`;
+    } else {
+      const key = runKey2(p, commit);
+      let body;
+      try {
+        body = await get(key);
+      } catch (e) {
+        refused2 = refusal(`Could not read ${key} from ${source2.location}: ${e instanceof Error ? e.message : String(e)}`, "Check GetObject on <prefix>/*/runs/*/run.json is allowed.");
+      }
+      if (!refused2 && body === void 0) missing = `no run view at ${key}`;
+      if (!refused2 && body !== void 0) {
+        let parsed;
+        let problem;
+        try {
+          parsed = JSON.parse(body);
+          problem = rv.check(parsed);
+        } catch {
+          problem = "it is not JSON";
+        }
+        if (!problem && parsed.project !== p.project) problem = `it is ${JSON.stringify(parsed.project)}'s run view, not ${p.project}'s`;
+        if (!problem && parsed.commit !== commit) problem = `it is the run view of ${parsed.commit}, not ${commit}`;
+        if (problem) {
+          refused2 = refusal(
+            `${key} in ${source2.location} is not a terragucci ${RUN_SCHEMA2} document: ${problem}.`,
+            rv.validation.by === "schema" ? `It was checked against @intentius/terragucci ${rv.validation.terragucci}'s run.schema.json. Check that this terragucci wrote it, or upgrade behold.` : "Install @intentius/terragucci beside behold to check it against terragucci's own run.schema.json, and check that terragucci wrote it."
+          );
+        } else {
+          const view = parsed;
+          views.push(view);
+          run3 = {
+            commit,
+            updated: view.updated,
+            from: p.run_view?.commit === commit ? "run_view" : "apply",
+            key,
+            page: key.replace(/run\.json$/, "run.html"),
+            roots: view.roots.map((r) => ({
+              root: r.root,
+              wave: r.wave,
+              reads: r.reads,
+              ...r.state ? { state: r.state } : {},
+              ...r.external?.length ? { external: r.external } : {}
+            })),
+            waves: view.waves.map((w) => ({
+              number: w.number,
+              roots: w.roots,
+              reads: w.reads,
+              state: w.state,
+              gate: w.gate,
+              ...w.policy ? { policy: w.policy } : {},
+              ...w.approval ? { approval: w.approval } : {},
+              ...w.digest !== void 0 ? { digest: w.digest } : {},
+              ...w.command ? { command: w.command } : {},
+              ...w.updated ? { updated: w.updated } : {}
+            })),
+            dated: { key, at: view.updated }
+          };
+        }
+      }
+    }
+    const waiting = p.waiting.map((w) => {
+      const fromRun = run3 && run3.commit === w.commit ? run3.waves.find((x) => x.number === w.wave) : void 0;
+      const digest = fromRun?.digest;
+      return {
+        wave: w.wave,
+        commit: w.commit,
+        since: w.since,
+        age_seconds: w.age_seconds,
+        ...w.report ? { report: w.report } : {},
+        ...digest !== void 0 ? { digest } : {},
+        command: fromRun?.command ?? `npx terragucci approve wave-${w.wave}${digest ? ` --plan ${digest}` : " --plan <digest>"}`,
+        dated: estateDated
+      };
+    });
+    const at2 = opts.base ? siblingCheckout(p.project, opts.base, opts.projectOf) : void 0;
+    projects.push({
+      project: p.project,
+      status: p.status,
+      ...p.error ? { error: p.error } : {},
+      ...p.index ? { index: p.index } : {},
+      counts: { drifted: p.drifted, failed: p.failed, waiting: p.waiting.length, dated: estateDated },
+      waiting,
+      ...run3 ? { run: run3 } : {},
+      ...missing ? { missing } : {},
+      ...refused2 ? { refused: refused2 } : {},
+      ...at2 ? { checkout: { path: at2, command: `behold serve ${shellWord(at2)} --terragucci ${shellWord(source2.location)}` } } : {},
+      configured: configured.has(p.project)
+    });
+  }
+  for (const name of opts.configured ?? []) {
+    if (projects.some((p) => p.project === name)) continue;
+    const at2 = opts.base ? siblingCheckout(name, opts.base, opts.projectOf) : void 0;
+    projects.push({
+      project: name,
+      status: "not-in-estate",
+      waiting: [],
+      missing: `estate.json (generated ${estate.generated}) does not list it`,
+      ...at2 ? { checkout: { path: at2, command: `behold serve ${shellWord(at2)} --terragucci ${shellWord(source2.location)}` } } : {},
+      configured: true
+    });
+  }
+  return {
+    source: source2.location,
+    kind: source2.kind,
+    config,
+    validation: { estate: v.validation, run: rv.validation },
+    read: (opts.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    estate: { key: "estate.json", html: "estate.html", generated: estate.generated },
+    gets,
+    projects,
+    edges: controlEdges(views),
+    files: "/api/terragucci/file?key="
+  };
+}
+function terragucciEstateRoutes(app, opts, dirs) {
+  const source2 = terragucciSource(opts.source, { ...opts.aws ? { aws: opts.aws } : {}, ...opts.fetch ? { fetch: opts.fetch } : {} });
+  let cached;
+  app.get("/api/terragucci/estate", async (c) => {
+    const served2 = dirs();
+    const control = controlRepo(served2);
+    if (!control) {
+      return c.json(
+        {
+          error: "This is not a terragucci control repo: its terragucci config lists no `projects:`, or the checkout has Terraform roots of its own.",
+          code: "terragucci-not-control",
+          remedy: "GET /api/terragucci answers a repo's own roots; this route answers a control repo, the one whose terragucci.yml lists `projects:`."
+        },
+        404
+      );
+    }
+    const key = served2.join("\0");
+    const now = Date.now();
+    const fresh = new URL(c.req.url).searchParams.get("fresh") === "1";
+    if (fresh || !cached || cached.key !== key || now - cached.at >= TERRAGUCCI_READ_TTL_MS) {
+      const base = repoBase(served2);
+      const p = readControlEstate(source2, control.config, {
+        validator: terragucciValidator(served2),
+        runValidator: runViewValidator(served2),
+        configured: control.projects,
+        base,
+        ...opts.now ? { now: opts.now() } : {}
+      });
+      cached = { at: now, key, read: p };
+      p.catch(() => cached = void 0);
+    }
+    try {
+      return c.json(await cached.read);
+    } catch (e) {
+      if (e instanceof TerragucciReadError) return c.json(e.refusal, 422);
+      throw e;
+    }
+  });
+}
+function controlRepoInfo(dirs) {
+  const c = controlRepo(dirs);
+  return c ? { config: c.config, projects: c.projects } : void 0;
+}
+
 // src/demo-pins.ts
 init_terraform_member();
-import { existsSync as existsSync18, lstatSync as lstatSync2, mkdirSync as mkdirSync6, readFileSync as readFileSync20, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname9, join as join29, resolve as resolve18 } from "node:path";
-var isRecord15 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+import { existsSync as existsSync20, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync23, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname12, join as join34, resolve as resolve23 } from "node:path";
+var isRecord18 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function linkDemoPins(work, probes = {}) {
-  const file = join29(work, "chant.workspace.json");
-  if (!existsSync18(file)) return { ok: true, linked: [] };
+  const file = join34(work, "chant.workspace.json");
+  if (!existsSync20(file)) return { ok: true, linked: [] };
   let decl;
   try {
-    decl = JSON.parse(readFileSync20(file, "utf8"));
+    decl = JSON.parse(readFileSync23(file, "utf8"));
   } catch {
     return { ok: true, linked: [] };
   }
-  if (!isRecord15(decl) || !Array.isArray(decl.pins)) return { ok: true, linked: [] };
+  if (!isRecord18(decl) || !Array.isArray(decl.pins)) return { ok: true, linked: [] };
   const find = probes.resolve ?? ((pkg) => resolvedPackage(pkg));
   const linked = [];
   let rewrite = false;
   for (const pin of decl.pins) {
-    if (!isRecord15(pin) || typeof pin.package !== "string") continue;
+    if (!isRecord18(pin) || typeof pin.package !== "string") continue;
     const pkg = pin.package;
     if (pkg === TERRAFORM_LEXICON_PKG) {
-      const refusal = (probes.reader ?? terraformReaderState)().refusal;
-      if (refusal) return { ok: false, error: refusal.error, remedy: refusal.remedy };
+      const refusal2 = (probes.reader ?? terraformReaderState)().refusal;
+      if (refusal2) return { ok: false, error: refusal2.error, remedy: refusal2.remedy };
     }
     const found = find(pkg);
     if (!found) {
@@ -15680,9 +17098,9 @@ function linkDemoPins(work, probes = {}) {
         remedy: `Install ${pkg} beside behold, then load the demo again.`
       };
     }
-    const link = join29(work, "node_modules", ...pkg.split("/"));
+    const link = join34(work, "node_modules", ...pkg.split("/"));
     if (!present(link)) {
-      mkdirSync6(dirname9(link), { recursive: true });
+      mkdirSync7(dirname12(link), { recursive: true });
       symlinkSync2(found.dir, link, "junction");
     } else if (!linksTo(link, found.dir)) {
       continue;
@@ -15708,26 +17126,26 @@ function present(path) {
 }
 function linksTo(link, target) {
   try {
-    return lstatSync2(link).isSymbolicLink() && resolve18(dirname9(link), readlinkSync2(link)) === resolve18(target);
+    return lstatSync2(link).isSymbolicLink() && resolve23(dirname12(link), readlinkSync2(link)) === resolve23(target);
   } catch {
     return false;
   }
 }
 
 // src/demos.ts
-import { readFileSync as readFileSync21, existsSync as existsSync19, cpSync, mkdirSync as mkdirSync7 } from "node:fs";
-import { dirname as dirname10, isAbsolute as isAbsolute4, join as join30, relative as relative8, resolve as resolve19, sep as sep7 } from "node:path";
+import { readFileSync as readFileSync24, existsSync as existsSync21, cpSync, mkdirSync as mkdirSync8 } from "node:fs";
+import { dirname as dirname13, isAbsolute as isAbsolute5, join as join35, relative as relative8, resolve as resolve24, sep as sep7 } from "node:path";
 import { spawn as spawn7, spawnSync as spawnSync2 } from "node:child_process";
 function readCatalog(file, catalog) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync21(file, "utf8"));
+    raw = JSON.parse(readFileSync24(file, "utf8"));
   } catch {
     return [];
   }
   const list3 = raw?.demos;
   if (!Array.isArray(list3)) return [];
-  const catalogDir = dirname10(resolve19(file));
+  const catalogDir = dirname13(resolve24(file));
   return list3.filter((e) => validEntry(e)).map((e) => ({ ...e, catalog, catalogDir }));
 }
 function validEntry(e) {
@@ -15761,10 +17179,10 @@ function validEntry(e) {
   return true;
 }
 function loadDemoRegistry(pkgRoot3) {
-  const merged = readCatalog(join30(pkgRoot3, "demos.json"), "demos");
+  const merged = readCatalog(join35(pkgRoot3, "demos.json"), "demos");
   const seen = new Set(merged.map((e) => e.name));
   const named = process.env.BEHOLD_WORKBENCH;
-  for (const e of [...readCatalog(join30(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve19(named), "workbench") : []]) {
+  for (const e of [...readCatalog(join35(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve24(named), "workbench") : []]) {
     if (seen.has(e.name)) {
       process.stderr.write(`behold: workbench entry "${e.name}" collides with a demo already in the catalog \u2014 dropped
 `);
@@ -15777,17 +17195,17 @@ function loadDemoRegistry(pkgRoot3) {
 }
 function demoLocalPath(entry) {
   if (entry.source !== "local" || !entry.path) return void 0;
-  return isAbsolute4(entry.path) ? entry.path : resolve19(entry.catalogDir ?? process.cwd(), entry.path);
+  return isAbsolute5(entry.path) ? entry.path : resolve24(entry.catalogDir ?? process.cwd(), entry.path);
 }
 function missingRequirements(entry) {
   const bins = entry.source === "git" && !entry.requires.includes("git") ? [...entry.requires, "git"] : entry.requires;
   const finder = process.platform === "win32" ? "where" : "which";
   const missing = bins.filter((bin) => {
-    if (bin === "choudoufu" && process.env.CHOUDOUFU_BIN && existsSync19(process.env.CHOUDOUFU_BIN)) return false;
+    if (bin === "choudoufu" && process.env.CHOUDOUFU_BIN && existsSync21(process.env.CHOUDOUFU_BIN)) return false;
     return spawnSync2(finder, [bin], { stdio: "ignore" }).status !== 0;
   });
   const local = demoLocalPath(entry);
-  if (local && !existsSync19(local)) missing.push(`${entry.path} (not checked out)`);
+  if (local && !existsSync21(local)) missing.push(`${entry.path} (not checked out)`);
   return missing;
 }
 function fetchesFromNetwork(entry) {
@@ -15796,9 +17214,9 @@ function fetchesFromNetwork(entry) {
 function demoTargetDir(entry, cwd = process.cwd()) {
   const inPlace = entry.inPlace ? demoLocalPath(entry) : void 0;
   if (inPlace) return inPlace;
-  const legacy = resolve19(cwd, "behold-demo");
-  if (entry.name === "writes" && existsSync19(legacy)) return legacy;
-  return resolve19(cwd, "behold-demos", entry.name);
+  const legacy = resolve24(cwd, "behold-demo");
+  if (entry.name === "writes" && existsSync21(legacy)) return legacy;
+  return resolve24(cwd, "behold-demos", entry.name);
 }
 async function loadDemo(entry, opts) {
   const { pkgRoot: pkgRoot3, target } = opts;
@@ -15807,12 +17225,12 @@ async function loadDemo(entry, opts) {
   const inPlace = entry.source === "local" && entry.inPlace;
   const work = inPlace ? local : target;
   if (inPlace) {
-    if (!existsSync19(work)) return { ok: false, error: `${entry.path} is not checked out (looked in ${work})` };
+    if (!existsSync21(work)) return { ok: false, error: `${entry.path} is not checked out (looked in ${work})` };
     say(`serving ${work} where it is \u2014 nothing copied`);
-  } else if (!existsSync19(target)) {
+  } else if (!existsSync21(target)) {
     if (entry.source === "bundled" || entry.source === "local" && local) {
-      const from = entry.source === "bundled" ? join30(pkgRoot3, entry.dir) : local;
-      if (!existsSync19(from)) return { ok: false, error: entry.source === "bundled" ? `this install has no bundled ${entry.dir}` : `${entry.path} is not checked out (looked in ${from})` };
+      const from = entry.source === "bundled" ? join35(pkgRoot3, entry.dir) : local;
+      if (!existsSync21(from)) return { ok: false, error: entry.source === "bundled" ? `this install has no bundled ${entry.dir}` : `${entry.path} is not checked out (looked in ${from})` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
         cpSync(from, target, {
@@ -15825,7 +17243,7 @@ async function loadDemo(entry, opts) {
     } else if (entry.source === "local") {
       say(`rendering into ${target} (empty \u2014 the setup writes the estate)`);
       try {
-        mkdirSync7(target, { recursive: true });
+        mkdirSync8(target, { recursive: true });
       } catch (err) {
         return { ok: false, error: `could not make ${target}: ${err instanceof Error ? err.message : String(err)}` };
       }
@@ -15843,7 +17261,7 @@ async function loadDemo(entry, opts) {
     if (!pins.ok) return { ok: false, error: `${pins.error} ${pins.remedy}` };
     for (const p of pins.linked) say(`linked ${p.pkg} ${p.version} into the copy${p.was ? ` (the declaration pinned ${p.was}; now ${p.version})` : ""}`);
   }
-  if (!inPlace && existsSync19(join30(work, "package.json")) && !existsSync19(join30(work, "node_modules"))) {
+  if (!inPlace && existsSync21(join35(work, "package.json")) && !existsSync21(join35(work, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: work, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${work}` };
@@ -15860,7 +17278,7 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join30(work, d)) : [work] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join35(work, d)) : [work] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
@@ -15871,9 +17289,9 @@ function runStep(cmd, args, opts = {}) {
 }
 
 // src/server.ts
-var pkgRoot = join31(dirname11(fileURLToPath5(import.meta.url)), "..");
-var webRoot = join31(pkgRoot, "web");
-var execFileP = async (cmd, args) => (await promisify3(execFile3)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
+var pkgRoot = join36(dirname14(fileURLToPath8(import.meta.url)), "..");
+var webRoot = join36(pkgRoot, "web");
+var execFileP = async (cmd, args) => (await promisify3(execFile4)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
   const opts = {};
@@ -15913,17 +17331,17 @@ async function knownComponents(projectDir, opts) {
     return void 0;
   }
 }
-function tierFailure(tier, message) {
+function tierFailure(tier, message2) {
   return {
     code: "tier",
-    error: `chant couldn't evaluate the "${tier}" tier here: ${message}`,
+    error: `chant couldn't evaluate the "${tier}" tier here: ${message2}`,
     remedy: `A non-default tier (e.g. a production-only one) can need parameters \u2014 real credentials, a different target \u2014 this environment doesn't have. Pick a different tier to see its graph.`
   };
 }
 function beholdVersion() {
   try {
-    const here = dirname11(fileURLToPath5(import.meta.url));
-    return JSON.parse(readFileSync22(join31(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    const here = dirname14(fileURLToPath8(import.meta.url));
+    return JSON.parse(readFileSync25(join36(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -15937,8 +17355,8 @@ function noProjectError(projectDir) {
 }
 function errorResponse(c, opts, err) {
   if (err instanceof TerraformReadError) return c.json(err.refusal, 500);
-  const message = err instanceof Error ? err.message : String(err);
-  const failure = err instanceof ChantCliError ? err.failure : classifyChantFailure(message);
+  const message2 = err instanceof Error ? err.message : String(err);
+  const failure = err instanceof ChantCliError ? err.failure : classifyChantFailure(message2);
   const routeError = opts.tier && failure.code !== "not-installed" ? tierFailure(opts.tier, failure.message) : { error: failure.message, code: failure.code, remedy: failure.remedy };
   return c.json(routeError, 500);
 }
@@ -15947,13 +17365,13 @@ function deployAxes(tierEnvVar, lexicons = [], k8sTarget) {
   if (tierEnvVar && process.env[tierEnvVar]) axes.tier = process.env[tierEnvVar];
   const targets = [...resolveSubstrateTargets(lexicons), ...k8sTarget ? [k8sTarget] : []];
   if (targets.length === 1) axes.target = targets[0].endpoint;
-  else if (targets.length > 1) axes.target = targets.map((t) => `${t.label}=${t.endpoint}`).join(" ");
+  else if (targets.length > 1) axes.target = targets.map((t2) => `${t2.label}=${t2.endpoint}`).join(" ");
   return axes;
 }
 function deployTargets(lexicons = [], k8sTarget) {
-  return [...resolveSubstrateTargets(lexicons), ...k8sTarget ? [k8sTarget] : []].map((t) => ({
-    name: t.label,
-    endpoint: t.endpoint
+  return [...resolveSubstrateTargets(lexicons), ...k8sTarget ? [k8sTarget] : []].map((t2) => ({
+    name: t2.label,
+    endpoint: t2.endpoint
   }));
 }
 async function captureFrame(projectDir, env, frames, broadcaster) {
@@ -15970,8 +17388,8 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
   }
 }
 function carveRoutes(app, reportPath, demo) {
-  const load2 = () => readCarveReport(reportPath, (p) => readFileSync22(p, "utf8"));
-  const carveDirs = [dirname11(reportPath), ...demo ? [demo.out] : []];
+  const load2 = () => readCarveReport(reportPath, (p) => readFileSync25(p, "utf8"));
+  const carveDirs = [dirname14(reportPath), ...demo ? [demo.out] : []];
   const carveStates = () => readCarveStates(carveDirs, nodeCarveIo, 0);
   const emittedNodes = async (states) => {
     if (!demo || states.size === 0) return /* @__PURE__ */ new Map();
@@ -16195,7 +17613,7 @@ async function readoptDispatchedRun(cfg, runner) {
       onLine: io.line,
       onProgress: io.progress,
       onAdopted: ({ runId, url }) => saveDispatchedRun({ ...run3, runId, ...url ? { url } : {} }),
-      onConcluded: ({ verdict: verdict2 }) => concludeDispatchedRun(cfg.projectDir, run3.runId, verdict2)
+      onConcluded: ({ verdict: verdict3 }) => concludeDispatchedRun(cfg.projectDir, run3.runId, verdict3)
     });
   });
   if (!started) return { outcome: "refused", reason: `busy \u2014 ${runner.running} is running`, run: run3 };
@@ -16214,7 +17632,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   const app = new Hono();
   const guard = { allowedHosts: allowedHostsFrom(cfg.allowedHosts ?? []), ...cfg.host ? { boundHost: cfg.host } : {} };
   app.use("*", async (c, next) => {
-    const verdict2 = guardRequest(
+    const verdict3 = guardRequest(
       {
         method: c.req.method,
         host: c.req.header("host") ?? new URL(c.req.url).host,
@@ -16223,7 +17641,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       },
       guard
     );
-    if (!verdict2.ok) return c.json({ error: verdict2.error, code: "request-refused" }, verdict2.status);
+    if (!verdict3.ok) return c.json({ error: verdict3.error, code: "request-refused" }, verdict3.status);
     await next();
   });
   setChoudoufuRunner(cfg.choudoufu?.run);
@@ -16242,6 +17660,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     await next();
   });
   if (cfg.terragucci) terragucciRoutes(app, cfg.terragucci, () => cfg.projectDirs ?? [cfg.projectDir]);
+  if (cfg.terragucci) terragucciEstateRoutes(app, cfg.terragucci, () => cfg.projectDirs ?? [cfg.projectDir]);
   if (cfg.carveReport) carveRoutes(app, cfg.carveReport, cfg.carveDemo);
   const predictDeps = cfg.behaviour ?? { read: graphIr };
   let beholdConfig = loadBeholdConfig(cfg.projectDir);
@@ -16354,9 +17773,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join31(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join31(cfg.projectDir, "scripts/local/local-up.sh");
-    if (!existsSync20(down) || !existsSync20(up)) {
+    const down = join36(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join36(cfg.projectDir, "scripts/local/local-up.sh");
+    if (!existsSync22(down) || !existsSync22(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
     if (!runner.bringUp("reset local emulator", "bash", ["-c", "bash scripts/local/local-down.sh && bash scripts/local/local-up.sh"], cfg.projectDir)) {
@@ -16377,7 +17796,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const dirs = [];
     const declared = [];
     for (const f of discoverOpIrs(estateDirs)) {
-      const parsed = readOpIr(f.path, (p) => readFileSync22(p, "utf8"));
+      const parsed = readOpIr(f.path, (p) => readFileSync25(p, "utf8"));
       if (!parsed.ok) continue;
       const mine = declaredConvergeOps([parsed.ir]);
       if (!mine.length) continue;
@@ -16526,7 +17945,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   });
   app.get(
     "/api/events",
-    (c) => streamSSE(c, async (stream) => {
+    (c) => streamSSE2(c, async (stream) => {
       const unsubscribe = broadcaster.subscribe((type, data) => {
         void stream.writeSSE({ event: type, data: data || String(Date.now()) });
       });
@@ -16595,6 +18014,11 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       ...tgConfig() ? { terragucci: { config: tgConfig(), ...terragucciRefusal(tgConfig(), "deploying from behold") } } : {},
       // #490: the page asks /api/terragucci for the marks when this is set.
       ...cfg.terragucci ? { terragucciReports: { source: cfg.terragucci.source, ...cfg.terragucci.project ? { project: cfg.terragucci.project } : {} } } : {},
+      // #509: a control repo (`projects:`, no roots): the page asks /api/terragucci/estate.
+      ...(() => {
+        const control = cfg.terragucci ? controlRepoInfo(cfg.projectDirs ?? [cfg.projectDir]) : void 0;
+        return control ? { terragucciControl: control } : {};
+      })(),
       // #477: who `chant approve` records when behold runs it. The approve
       // buttons say it before the click.
       approver: localApprover(),
@@ -16651,9 +18075,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   app.post("/api/project/open", async (c) => {
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve20(body.dir.trim()) : "";
-    if (!dir || !existsSync20(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync20(join31(dir, "chant.config.ts"))) {
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve25(body.dir.trim()) : "";
+    if (!dir || !existsSync22(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
+    if (!existsSync22(join36(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -16676,7 +18100,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   };
   app.post("/api/project/reveal", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve20(body.dir.trim()) : cfg.projectDir;
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve25(body.dir.trim()) : cfg.projectDir;
     const known = /* @__PURE__ */ new Set([cfg.projectDir, ...cfg.projectDirs ?? [], ...listRecents().map((r) => r.dir)]);
     if (!known.has(dir)) return c.json({ error: "not a served or recent project directory" }, 400);
     const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
@@ -16704,7 +18128,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       fetches: fetchesFromNetwork(e),
       ...e.repo ? { repo: e.repo } : {},
       target,
-      loaded: existsSync20(target),
+      loaded: existsSync22(target),
       satisfiable: missing.length === 0,
       // #254: the carve walkthrough runs fine here — it just isn't a project
       // to switch INTO. Carve mode claims `/api/graph` and `/api/project` at
@@ -16956,7 +18380,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const parsedOps = [];
         for (const f of files) {
-          const parsed = readOpIr(f.path, (p) => readFileSync22(p, "utf8"));
+          const parsed = readOpIr(f.path, (p) => readFileSync25(p, "utf8"));
           if (!parsed.ok) return c.json(parsed.refusal, 422);
           parsedOps.push(parsed.ir);
         }
@@ -16969,8 +18393,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const runState = runner.runState;
         const ranOp = runState.op ? parsedOps.find((o) => o.name === runState.op) : void 0;
-        const join35 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
-        const opsIr = join35 ? paintPlayhead(declaredIr, join35, runState.gate) : declaredIr;
+        const join41 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
+        const opsIr = join41 ? paintPlayhead(declaredIr, join41, runState.gate) : declaredIr;
         const { svg: svg2 } = renderGraph(opsIr, { boxes: "byStack" });
         const operator = runner.noteDeclaredConvergeOps(declaredConvergeOps(parsedOps));
         return c.json({
@@ -16983,7 +18407,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
             target: null,
             mode: "ops",
             ops: parsedOps.length,
-            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join35)} ${operatorNote(operator)}`,
+            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join41)} ${operatorNote(operator)}`,
             // The operator strip's own model: the ConvergeOps this project
             // declares, plus whatever the last status read said. `declared`
             // without a `strip` is the honest starting state — a loop exists and
@@ -17094,7 +18518,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync20(join31(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync22(join36(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -17199,8 +18623,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           adoptedId = runId;
           saveDispatchedRun({ ...base, runId, ...url ? { url } : {} });
         },
-        onConcluded: ({ verdict: verdict2 }) => {
-          if (adoptedId !== void 0) concludeDispatchedRun(cfg.projectDir, adoptedId, verdict2);
+        onConcluded: ({ verdict: verdict3 }) => {
+          if (adoptedId !== void 0) concludeDispatchedRun(cfg.projectDir, adoptedId, verdict3);
         }
       })
     );
@@ -17575,12 +18999,12 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
     for (const id of ids) {
       const observed = nodeObserved(parsed, id);
-      const verdict2 = classifyObservedHealth(observed);
+      const verdict3 = classifyObservedHealth(observed);
       nodes[id] = {
         observed,
         diff: nodeDiff(parsed, id),
-        health: verdict2.health,
-        ...verdict2.detail ? { healthDetail: verdict2.detail } : {},
+        health: verdict3.health,
+        ...verdict3.detail ? { healthDetail: verdict3.detail } : {},
         // Field-level (per-manager) drift (#87, chant#1181) — null when no
         // lexicon in this diff carries a `deep` section at all.
         fieldDrift: nodeFieldDrift(parsed, id)
@@ -17590,9 +19014,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   });
   const choudoufuPlanPath = (plan) => {
     if (!plan) return { error: "no plan named", code: "choudoufu_no_plan", remedy: "pass ?plan=<path to a carve.json inside a served choudoufu member> \u2014 GET /api/project lists the ones found" };
-    const abs = resolve20(cfg.projectDir, plan);
+    const abs = resolve25(cfg.projectDir, plan);
     const members = (cfg.projectDirs ?? [cfg.projectDir]).filter((d) => memberKindOf(d) === "choudoufu");
-    const inside = members.some((d) => abs.startsWith(resolve20(d) + sep8));
+    const inside = members.some((d) => abs.startsWith(resolve25(d) + sep8));
     if (!inside) return { error: `${plan} is not inside a served choudoufu member`, code: "choudoufu_plan_outside", remedy: "a plan lives in the estate it moves; point ?plan= at a carve.json under one of the served members" };
     return { path: abs };
   };
@@ -17664,14 +19088,14 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       return c.json({ error: "diff output was not JSON \u2014 chant may predate --live --json (needs 0.18.7+)" }, 500);
     }
     const observed = nodeObserved(parsed, node);
-    const verdict2 = classifyObservedHealth(observed);
+    const verdict3 = classifyObservedHealth(observed);
     return c.json({
       node,
       env,
       diff: nodeDiff(parsed, node),
       observed,
-      health: verdict2.health,
-      ...verdict2.detail ? { healthDetail: verdict2.detail } : {},
+      health: verdict3.health,
+      ...verdict3.detail ? { healthDetail: verdict3.detail } : {},
       // Field-level (per-manager) drift (#87, chant#1181) — null when no
       // lexicon in this diff carries a `deep` section at all.
       fieldDrift: nodeFieldDrift(parsed, node)
@@ -17728,7 +19152,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (!c.req.path.startsWith("/api/") && c.res.ok && !c.res.headers.has("cache-control")) c.res.headers.set("cache-control", "no-cache");
   });
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join31(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join36(rel, "index.html") }));
   return app;
 }
 async function bootLocalEmulators(dir, who) {
@@ -17757,7 +19181,7 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync20(join31(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync22(join36(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -17790,7 +19214,7 @@ async function startServer(cfg) {
     invalidateOverlay(memberDir);
     onEstateChange(memberDir);
   };
-  const memberTag = (dir) => (cfg.projectDirs?.length ?? 0) > 1 ? ` [${basename3(dir)}]` : "";
+  const memberTag = (dir) => (cfg.projectDirs?.length ?? 0) > 1 ? ` [${basename4(dir)}]` : "";
   const onPollDrift = (dir, movedLexicons) => {
     broadcaster.emit("changed", dir);
     if (autoSync === "off") return;
@@ -17805,7 +19229,7 @@ async function startServer(cfg) {
     const suspended = autoSync === "pull-request" ? suspendedByRollback(await openRollbackBranches(dir, cfg.env), movedLexicons) : /* @__PURE__ */ new Set();
     const { routed, local } = splitForgeRouted(discoverEstateOps(cfg.projectDirs ?? [cfg.projectDir]), executorDesignation);
     for (const { op: o, designation: d } of routed) {
-      broadcaster.emit("op", `\u27F3 auto-sync (${autoSync})${memberTag(dir)} declined ${o.name}: env ${o.env} deploys through ${"invalid" in d ? "a forge" : d.forge} per ${basename3(o.dir)}/.behold.json \u2014 never applied from here`);
+      broadcaster.emit("op", `\u27F3 auto-sync (${autoSync})${memberTag(dir)} declined ${o.name}: env ${o.env} deploys through ${"invalid" in d ? "a forge" : d.forge} per ${basename4(o.dir)}/.behold.json \u2014 never applied from here`);
     }
     const { picks, declined } = pickAutoSyncOps(
       autoSync,
@@ -17930,8 +19354,8 @@ init_chant();
 
 // src/workspace-convert.ts
 init_chant();
-import { existsSync as existsSync21, mkdirSync as mkdirSync8, readFileSync as readFileSync23, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { basename as basename4, dirname as dirname12, join as join32, relative as relative10, resolve as resolve21, sep as sep9 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync9, readFileSync as readFileSync26, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { basename as basename5, dirname as dirname15, join as join37, relative as relative10, resolve as resolve26, sep as sep9 } from "node:path";
 import { shortStackNames as shortStackNames2 } from "@intentius/pinhole";
 init_project();
 init_terraform_member();
@@ -17948,28 +19372,28 @@ function unique(name, taken) {
 }
 var posix = (p) => p.split(sep9).join("/");
 function installedVersion(pkg, dir) {
-  for (let at = resolve21(dir); ; at = dirname12(at)) {
-    const manifest = join32(at, "node_modules", ...pkg.split("/"), "package.json");
-    if (existsSync21(manifest)) {
+  for (let at2 = resolve26(dir); ; at2 = dirname15(at2)) {
+    const manifest = join37(at2, "node_modules", ...pkg.split("/"), "package.json");
+    if (existsSync23(manifest)) {
       try {
-        const v = JSON.parse(readFileSync23(manifest, "utf8")).version;
+        const v = JSON.parse(readFileSync26(manifest, "utf8")).version;
         return typeof v === "string" ? v : void 0;
       } catch {
         return void 0;
       }
     }
-    if (dirname12(at) === at) return void 0;
+    if (dirname15(at2) === at2) return void 0;
   }
 }
 function planConversion(rootArg) {
-  const root = resolve21(rootArg);
-  const existing = DECLARATION_FILES.find((f) => existsSync21(join32(root, f)));
+  const root = resolve26(rootArg);
+  const existing = DECLARATION_FILES.find((f) => existsSync23(join37(root, f)));
   if (existing) return { ok: false, error: `${root} already has ${existing}; there is nothing to convert.` };
   const shape = detectProjectShape(root);
   if (shape.kind !== "estate" || !shape.members?.length || shape.membersFrom === "itself") {
     return { ok: false, error: `${root} is not an estate root with a member list, so there is no member list to convert.` };
   }
-  const abs = shape.members.map((m) => resolve21(root, m.dir));
+  const abs = shape.members.map((m) => resolve26(root, m.dir));
   const shorts = shortStackNames2(abs);
   const taken = /* @__PURE__ */ new Set();
   const members = [];
@@ -17984,10 +19408,10 @@ function planConversion(rootArg) {
       const scan = discoverTerraformRoots(abs[i]);
       for (const r of scan.roots) {
         const name2 = unique(declarationName(r.name), taken);
-        members.push({ name: name2, dir: r.dir === "." ? dir : posix(join32(dir, r.dir)), kind: "terraform" });
+        members.push({ name: name2, dir: r.dir === "." ? dir : posix(join37(dir, r.dir)), kind: "terraform" });
         moves.push({ from: `${short}/${r.name}/`, to: `${name2}/${name2}/` });
       }
-      for (const s of scan.skipped) notes.push(`${posix(join32(dir, s.dir))} is not declared: ${s.why}.`);
+      for (const s of scan.skipped) notes.push(`${posix(join37(dir, s.dir))} is not declared: ${s.why}.`);
       if (scan.roots.length > 1) notes.push(`${dir} held ${scan.roots.length} Terraform roots; each is its own member now, since a chant terraform member is one root.`);
       return;
     }
@@ -18008,14 +19432,14 @@ function planConversion(rootArg) {
     else notes.push(`${TERRAFORM_LEXICON2} is not installed where chant looks from ${root}; install it there and add it to "pins", or chant cannot read the terraform and choudoufu members.`);
   }
   const declaration = {
-    name: declarationName(basename4(root)),
+    name: declarationName(basename5(root)),
     schema: 1,
     ...pins.length ? { pins } : {},
     members
   };
   const firstLayout = layoutPath(abs[0]);
   moves.sort((a, b) => b.from.length - a.from.length);
-  return { ok: true, plan: { root, from: shape.membersFrom === "behold-config" ? "behold-config" : "workspaces", declaration, moves, ...existsSync21(firstLayout) ? { layoutFrom: firstLayout } : {}, notes } };
+  return { ok: true, plan: { root, from: shape.membersFrom === "behold-config" ? "behold-config" : "workspaces", declaration, moves, ...existsSync23(firstLayout) ? { layoutFrom: firstLayout } : {}, notes } };
 }
 function moveLayoutIds(file, moves) {
   const lenses = {};
@@ -18030,18 +19454,18 @@ function moveLayoutIds(file, moves) {
   return { version: 1, lenses };
 }
 function applyConversion(plan) {
-  const declarationFile = join32(plan.root, DECLARATION_FILES[0]);
-  if (existsSync21(declarationFile)) throw new Error(`${declarationFile} appeared while converting; nothing was written`);
+  const declarationFile = join37(plan.root, DECLARATION_FILES[0]);
+  if (existsSync23(declarationFile)) throw new Error(`${declarationFile} appeared while converting; nothing was written`);
   writeFileSync7(declarationFile, `${JSON.stringify(plan.declaration, null, 2)}
 `);
   let layout;
   const target = layoutPath(plan.root);
   if (!plan.layoutFrom) layout = { skipped: "no saved layout to move" };
-  else if (resolve21(plan.layoutFrom) === resolve21(target)) layout = { skipped: "the saved layout is already in the root" };
-  else if (existsSync21(target)) layout = { skipped: `${target} already exists; the layout in ${plan.layoutFrom} was left alone` };
+  else if (resolve26(plan.layoutFrom) === resolve26(target)) layout = { skipped: "the saved layout is already in the root" };
+  else if (existsSync23(target)) layout = { skipped: `${target} already exists; the layout in ${plan.layoutFrom} was left alone` };
   else {
-    const moved = moveLayoutIds(readLayoutFile(dirname12(dirname12(plan.layoutFrom))), plan.moves);
-    mkdirSync8(join32(plan.root, LAYOUT_DIR), { recursive: true });
+    const moved = moveLayoutIds(readLayoutFile(dirname15(dirname15(plan.layoutFrom))), plan.moves);
+    mkdirSync9(join37(plan.root, LAYOUT_DIR), { recursive: true });
     const tmp = `${target}.tmp`;
     writeFileSync7(tmp, `${JSON.stringify(moved, null, 2)}
 `);
@@ -18052,11 +19476,11 @@ function applyConversion(plan) {
 }
 
 // src/export.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, copyFileSync, cpSync as cpSync2, readFileSync as readFileSync24, readdirSync as readdirSync10, existsSync as existsSync22, realpathSync as realpathSync2 } from "node:fs";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, copyFileSync, cpSync as cpSync2, readFileSync as readFileSync27, readdirSync as readdirSync11, existsSync as existsSync24, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join33, dirname as dirname13, basename as basename5, relative as relative11, resolve as resolve22, sep as sep10 } from "node:path";
-import { createHash as createHash5 } from "node:crypto";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { join as join38, dirname as dirname16, basename as basename6, relative as relative11, resolve as resolve27, sep as sep10 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
 var LENS_PARAMS = ["collapse", "components", "detail", "env", "logical", "ops", "radial", "stacks", "tier"];
 function canonicalKey(path, params) {
   const flat = params.get("components") === "1" || params.get("logical") === "1" || params.get("ops") === "1" || params.get("stacks") === "1";
@@ -18065,7 +19489,7 @@ function canonicalKey(path, params) {
 }
 function slug3(key, body) {
   const base = key.replace(/^\//, "").replace(/[^a-zA-Z0-9=_.-]+/g, "_").slice(0, 120);
-  return `${base}.${createHash5("sha256").update(body).digest("hex").slice(0, 16)}.json`;
+  return `${base}.${createHash7("sha256").update(body).digest("hex").slice(0, 16)}.json`;
 }
 var CONTENT_ADDRESSED = /^snapshots\/[A-Za-z0-9=_.-]+\.[0-9a-f]{16}\.json$/;
 function captureKeys(axes) {
@@ -18076,6 +19500,7 @@ function captureKeys(axes) {
   add("/api/ops", {});
   if (axes.ops) add("/api/graph", { ops: "1", entities: "1" });
   if (axes.terragucci) add("/api/terragucci", {});
+  if (axes.terragucci) add("/api/terragucci/timeline", {});
   const tiers = axes.tiers && axes.tiers.length ? axes.tiers : [""];
   const envs = ["", ...axes.environments];
   for (const env of envs) {
@@ -18106,31 +19531,31 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join33(dirname13(fileURLToPath6(import.meta.url)), "..", "web");
+  return join38(dirname16(fileURLToPath9(import.meta.url)), "..", "web");
 }
 function pkgRoot2() {
-  return join33(dirname13(fileURLToPath6(import.meta.url)), "..");
+  return join38(dirname16(fileURLToPath9(import.meta.url)), "..");
 }
 var NOTICE_FILES = ["LICENSE", "THIRD_PARTY.md"];
 function copyNotices(outDir, root = pkgRoot2()) {
   const copied = [];
   for (const f of NOTICE_FILES) {
-    if (!existsSync22(join33(root, f))) continue;
-    copyFileSync(join33(root, f), join33(outDir, f));
+    if (!existsSync24(join38(root, f))) continue;
+    copyFileSync(join38(root, f), join38(outDir, f));
     copied.push(f);
   }
-  const lic = join33(root, "licenses");
-  if (existsSync22(lic)) {
-    mkdirSync9(join33(outDir, "licenses"), { recursive: true });
-    for (const f of readdirSync10(lic)) {
-      copyFileSync(join33(lic, f), join33(outDir, "licenses", f));
+  const lic = join38(root, "licenses");
+  if (existsSync24(lic)) {
+    mkdirSync10(join38(outDir, "licenses"), { recursive: true });
+    for (const f of readdirSync11(lic)) {
+      copyFileSync(join38(lic, f), join38(outDir, "licenses", f));
       copied.push(`licenses/${f}`);
     }
   }
   return copied;
 }
 function workerName(project, override) {
-  const raw = override ?? `behold-${basename5(project)}`;
+  const raw = override ?? `behold-${basename6(project)}`;
   const name = raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
   return name || "behold-export";
 }
@@ -18145,8 +19570,8 @@ async function runExport(cfg, outDir, opts = {}) {
     ...proj.terragucciReports ? { terragucci: true } : {}
   };
   const scrub = exportScrubber(cfg);
-  const snapDir = join33(outDir, "snapshots");
-  mkdirSync9(snapDir, { recursive: true });
+  const snapDir = join38(outDir, "snapshots");
+  mkdirSync10(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
   let failed = 0;
@@ -18154,45 +19579,46 @@ async function runExport(cfg, outDir, opts = {}) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = scrub(shapeSnapshot(key, await res.text(), opts));
     const file = slug3(key, body);
-    writeFileSync8(join33(snapDir, file), body);
+    writeFileSync8(join38(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
     if (key === "/api/terragucci" && !res.ok) {
-      const refusal = JSON.parse(body);
-      throw new Error(`terragucci reports not read: ${refusal.error ?? res.status}${refusal.remedy ? `
-  ${refusal.remedy}` : ""}`);
+      const refusal2 = JSON.parse(body);
+      throw new Error(`terragucci reports not read: ${refusal2.error ?? res.status}${refusal2.remedy ? `
+  ${refusal2.remedy}` : ""}`);
     }
   }
   const manifest = {
     static: true,
     capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    projectDir: basename5(cfg.projectDir),
+    projectDir: basename6(cfg.projectDir),
     axes,
     keyToFile
   };
-  writeFileSync8(join33(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync24(join33(webDir(), "index.html"), "utf8").replace(
+  writeFileSync8(join38(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync27(join38(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync8(join33(outDir, "index.html"), html);
-  for (const f of readdirSync10(webDir())) {
+  writeFileSync8(join38(outDir, "index.html"), html);
+  for (const f of readdirSync11(webDir())) {
     if (f === "index.html" || f.endsWith(".test.js")) continue;
-    cpSync2(join33(webDir(), f), join33(outDir, f), { recursive: true });
+    cpSync2(join38(webDir(), f), join38(outDir, f), { recursive: true });
   }
-  writeFileSync8(join33(outDir, "README.md"), BUNDLE_README);
+  writeFileSync8(join38(outDir, "README.md"), BUNDLE_README);
   copyNotices(outDir);
   const name = workerName(cfg.projectDir, opts.name);
   writeFileSync8(
-    join33(outDir, "wrangler.jsonc"),
+    join38(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
       2
     ) + "\n"
   );
+  writeFileSync8(join38(outDir, "manifest.json"), JSON.stringify({ ...manifest, files: bundleFiles(outDir).filter((f) => f !== "manifest.json") }, null, 2));
   process.stdout.write(
     `behold export \u2192 ${outDir}
   ${ok} snapshots${failed ? ` (${failed} endpoint error(s) captured as-is)` : ""}
@@ -18201,11 +19627,11 @@ async function runExport(cfg, outDir, opts = {}) {
 `
   );
 }
-var isRecord16 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var isRecord19 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function dropSource(v) {
   if (Array.isArray(v)) return v.forEach(dropSource);
-  if (!isRecord16(v)) return;
-  if (isRecord16(v.attrs)) delete v.attrs.source;
+  if (!isRecord19(v)) return;
+  if (isRecord19(v.attrs)) delete v.attrs.source;
   for (const x of Object.values(v)) dropSource(x);
 }
 function shapeSnapshot(key, body, opts = {}) {
@@ -18215,22 +19641,22 @@ function shapeSnapshot(key, body, opts = {}) {
   } catch {
     return body;
   }
-  if (!isRecord16(doc)) return body;
+  if (!isRecord19(doc)) return body;
   if (key === "/api/project") {
     delete doc.recents;
     delete doc.approver;
   }
-  if (key === "/api/terragucci") doc.files = opts.reportsBase ?? VIEWS_REPORTS_BASE;
+  if (key === "/api/terragucci" || key === "/api/terragucci/timeline") doc.files = opts.reportsBase ?? VIEWS_REPORTS_BASE;
   if (opts.noSource) dropSource(doc);
   return JSON.stringify(doc);
 }
 function exportScrubber(cfg, home = homedir3()) {
   const dirs = [cfg.projectDir, ...cfg.projectDirs ?? [], ...cfg.workspace ? [cfg.workspace.root] : []];
   const tg = cfg.terragucci?.source;
-  if (tg && !/^[a-z0-9]+:\/\//i.test(tg)) dirs.push(resolve22(tg));
+  if (tg && !/^[a-z0-9]+:\/\//i.test(tg)) dirs.push(resolve27(tg));
   const pairs = /* @__PURE__ */ new Map();
   for (const d of dirs) {
-    for (const p of [resolve22(d), safeRealpath(d)]) if (p && p !== "/") pairs.set(p, basename5(p));
+    for (const p of [resolve27(d), safeRealpath(d)]) if (p && p !== "/") pairs.set(p, basename6(p));
   }
   const ordered = [...pairs].sort((a, b) => b[0].length - a[0].length);
   return (text) => {
@@ -18269,8 +19695,8 @@ function publishTarget(spec2) {
   const prefix = m[2];
   const parts = prefix.split("/");
   if (parts.some((p) => p === "" || p === "." || p === "..")) return { error: `--publish ${spec2}: the prefix has an empty, . or .. segment` };
-  const at = parts.lastIndexOf("views");
-  if (at < 0 || at !== parts.length - 2) {
+  const at2 = parts.lastIndexOf("views");
+  if (at2 < 0 || at2 !== parts.length - 2) {
     return { error: `--publish writes only to a views/<name> directory, such as s3://${m[1]}/${parts.filter((p) => p !== "views").join("/")}/views/behold: a bundle's index.html would overwrite the prefix's own pages anywhere else` };
   }
   return { bucket: m[1], prefix };
@@ -18284,16 +19710,19 @@ function manifestFiles(text) {
   } catch {
     return [];
   }
-  const map = isRecord16(doc) && isRecord16(doc.keyToFile) ? doc.keyToFile : {};
+  const map = isRecord19(doc) && isRecord19(doc.keyToFile) ? doc.keyToFile : {};
   return Object.values(map).filter((f) => typeof f === "string" && /^snapshots\/[A-Za-z0-9=_.-]+$/.test(f) && !f.includes(".."));
 }
+function bundleFiles(outDir) {
+  return readdirSync11(outDir, { recursive: true, withFileTypes: true }).filter((d) => d.isFile()).map((d) => relative11(outDir, join38(d.parentPath, d.name)).split(sep10).join("/")).sort();
+}
 async function publishBundle(outDir, target, client) {
-  const files = readdirSync10(outDir, { recursive: true, withFileTypes: true }).filter((d) => d.isFile()).map((d) => relative11(outDir, join33(d.parentPath, d.name)).split(sep10).join("/")).sort();
+  const files = bundleFiles(outDir);
   const warnings = [];
-  const at = (f) => `${target.prefix}/${f}`;
+  const at2 = (f) => `${target.prefix}/${f}`;
   let previous = [];
   try {
-    const text = await client.get(at("manifest.json"));
+    const text = await client.get(at2("manifest.json"));
     if (text !== void 0) previous = manifestFiles(text);
   } catch (e) {
     const note = e instanceof S3Error && e.status === 403 ? " (S3 answers 403 for a missing object too when the credentials lack s3:ListBucket)" : "";
@@ -18301,18 +19730,18 @@ async function publishBundle(outDir, target, client) {
   }
   const last = ["manifest.json", "index.html"];
   const order = [...files.filter((f) => !last.includes(f)), ...last.filter((f) => files.includes(f))];
-  for (const f of order) await client.put(at(f), readFileSync24(join33(outDir, f)), contentType(f), CONTENT_ADDRESSED.test(f) ? IMMUTABLE : NO_CACHE);
+  for (const f of order) await client.put(at2(f), readFileSync27(join38(outDir, f)), contentType(f), CONTENT_ADDRESSED.test(f) ? IMMUTABLE : NO_CACHE);
   const wrote = new Set(files);
   const removed = [];
   for (const f of previous) {
     if (wrote.has(f)) continue;
     try {
-      await client.delete(at(f));
-      removed.push(at(f));
+      await client.delete(at2(f));
+      removed.push(at2(f));
     } catch (e) {
-      const denied = e instanceof S3Error && (e.status === 403 || e.code === "AccessDenied");
+      const denied2 = e instanceof S3Error && (e.status === 403 || e.code === "AccessDenied");
       warnings.push(
-        denied ? `the previous export's files were left in s3://${target.bucket}/${target.prefix}/: deleting them needs s3:DeleteObject on that prefix, which these credentials lack` : `the previous export's files were left in s3://${target.bucket}/${target.prefix}/: ${e instanceof Error ? e.message : String(e)}`
+        denied2 ? `the previous export's files were left in s3://${target.bucket}/${target.prefix}/: deleting them needs s3:DeleteObject on that prefix, which these credentials lack` : `the previous export's files were left in s3://${target.bucket}/${target.prefix}/: ${e instanceof Error ? e.message : String(e)}`
       );
       break;
     }
@@ -18351,6 +19780,143 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 (\`wrangler pages deploy .\`) all work.
 `;
 
+// src/publish-snapshots.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { readFileSync as readFileSync28 } from "node:fs";
+import { join as join39 } from "node:path";
+var DEFAULT_KEEP = 30;
+var SNAPSHOT_REPORTS_BASE = "../../../";
+var COMMIT = /^[0-9a-f]{7,64}$/;
+function resolveCommit(dir, given) {
+  const git = (...args) => execFileSync3("git", ["-C", dir, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  let sha;
+  if (given !== void 0) {
+    sha = given.toLowerCase();
+    if (!COMMIT.test(sha)) return { error: `--commit takes a commit's hex digits (7 to 64 of them), not ${given}` };
+  } else {
+    try {
+      sha = git("rev-parse", "HEAD").toLowerCase();
+    } catch {
+      return { error: `--publish files the view under the served checkout's commit, and ${dir} is not a git checkout with a commit: pass --commit <sha>` };
+    }
+    if (!COMMIT.test(sha)) return { error: `git rev-parse HEAD in ${dir} answered ${sha}: pass --commit <sha>` };
+  }
+  try {
+    const at2 = git("show", "-s", "--format=%cI", `${sha}^{commit}`);
+    return at2 ? { sha, at: new Date(at2).toISOString() } : { sha };
+  } catch {
+    return { sha };
+  }
+}
+var isRecord20 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function parseHistory(text) {
+  const doc = JSON.parse(text);
+  if (!Array.isArray(doc)) throw new Error("history.json is not an array");
+  const str13 = (v) => typeof v === "string" ? v : "";
+  return doc.filter((e) => isRecord20(e) && typeof e.commit === "string" && COMMIT.test(e.commit)).map((e) => ({ commit: e.commit, at: str13(e.at), project: str13(e.project), generated: str13(e.generated) }));
+}
+function nextHistory(old, entry, keep) {
+  const all = [entry, ...old.filter((e) => e.commit !== entry.commit)];
+  const seen = /* @__PURE__ */ new Set();
+  const unique2 = all.filter((e) => seen.has(e.commit) ? false : (seen.add(e.commit), true));
+  return { history: unique2.slice(0, keep), dropped: unique2.slice(keep).map((e) => e.commit) };
+}
+var BUNDLE_PATH = /^[A-Za-z0-9=_.@+-]+(\/[A-Za-z0-9=_.@+-]+)*$/;
+var insideBundle = (f) => typeof f === "string" && BUNDLE_PATH.test(f) && !f.split("/").some((p) => p === "." || p === "..");
+function commitFiles(manifestText) {
+  const doc = JSON.parse(manifestText);
+  if (!isRecord20(doc)) return ["manifest.json"];
+  const listed = Array.isArray(doc.files) ? doc.files.filter(insideBundle) : [];
+  const snaps = isRecord20(doc.keyToFile) ? Object.values(doc.keyToFile).filter(insideBundle) : [];
+  const rest = [.../* @__PURE__ */ new Set([...listed, ...snaps])].filter((f) => f !== "index.html" && f !== "manifest.json").sort();
+  return ["index.html", ...rest, "manifest.json"];
+}
+function redirectPage() {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>behold</title>
+<script>
+(function () {
+  var path = location.pathname;
+  var base = /\\/$|\\.html?$/.test(path) ? "" : path.split("/").pop() + "/";
+  fetch(base + "latest.json", { cache: "no-cache" })
+    .then(function (r) { if (!r.ok) throw new Error("latest.json: " + r.status); return r.json(); })
+    .then(function (l) {
+      if (!l || typeof l.commit !== "string" || !${COMMIT}.test(l.commit)) throw new Error("latest.json names no commit");
+      location.replace(base + l.commit + "/index.html" + location.search + location.hash);
+    })
+    .catch(function (e) { document.getElementById("m").textContent = "No published view to open: " + e.message; });
+})();
+</script>
+</head>
+<body style="font: 13px ui-monospace, monospace; padding: 16px">
+<p id="m">Opening the newest view...</p>
+<noscript><p>This page opens the newest view named in latest.json and needs JavaScript.</p></noscript>
+</body>
+</html>
+`;
+}
+var message = (e) => e instanceof Error ? e.message : String(e);
+var denied = (e) => e instanceof S3Error && (e.status === 403 || e.code === "AccessDenied");
+async function publishSnapshot(outDir, target, commit, client, opts = {}) {
+  const sha = commit.sha.toLowerCase();
+  if (!COMMIT.test(sha)) throw new Error(`a commit is 7 to 64 hex digits, not ${commit.sha}`);
+  const keep = opts.keep ?? DEFAULT_KEEP;
+  if (!Number.isInteger(keep) || keep < 1) throw new Error(`--keep takes a whole number of at least 1, not ${keep}`);
+  const at2 = (f) => `${target.prefix}/${f}`;
+  const local = JSON.parse(readFileSync28(join39(outDir, "manifest.json"), "utf8"));
+  const generated = local.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const entry = { commit: sha, at: commit.at ?? generated, project: opts.project ?? local.projectDir ?? "", generated };
+  const bundle = await publishBundle(outDir, { bucket: target.bucket, prefix: at2(sha) }, client);
+  const warnings = [...bundle.warnings];
+  const removed = [...bundle.removed];
+  let old = [];
+  try {
+    const text = await client.get(at2("history.json"));
+    if (text !== void 0) old = parseHistory(text);
+  } catch (e) {
+    const note = e instanceof S3Error && e.status === 403 ? " (S3 answers 403 for a missing object too when the credentials lack s3:ListBucket)" : "";
+    warnings.push(`the previous history.json could not be read, so it starts again from ${sha} and older commits are left in place: ${message(e)}${note}`);
+  }
+  const { history, dropped } = nextHistory(old, entry, keep);
+  await client.put(at2("history.json"), JSON.stringify(history, null, 2) + "\n", "application/json", NO_CACHE);
+  await client.put(at2("latest.json"), JSON.stringify({ commit: sha }) + "\n", "application/json", NO_CACHE);
+  await client.put(at2("index.html"), redirectPage(), "text/html; charset=utf-8", NO_CACHE);
+  const pruned = [];
+  prune: for (const c of dropped) {
+    if (c === sha) continue;
+    let files;
+    try {
+      const text = await client.get(at2(`${c}/manifest.json`));
+      if (text === void 0) {
+        pruned.push(c);
+        continue;
+      }
+      files = commitFiles(text);
+    } catch (e) {
+      warnings.push(`${c} left history.json but its files were left in s3://${target.bucket}/${at2(c)}/: its manifest.json could not be read: ${message(e)}`);
+      continue;
+    }
+    for (const f of files) {
+      try {
+        await client.delete(at2(`${c}/${f}`));
+        removed.push(at2(`${c}/${f}`));
+      } catch (e) {
+        const left = dropped.slice(dropped.indexOf(c)).join(", ");
+        warnings.push(
+          denied(e) ? `commits past --keep ${keep} left history.json but their files were left in s3://${target.bucket}/${target.prefix}/ (${left}): deleting them needs s3:DeleteObject on that prefix, which these credentials lack` : `commits past --keep ${keep} left history.json but their files were left in s3://${target.bucket}/${target.prefix}/ (${left}): ${message(e)}`
+        );
+        break prune;
+      }
+    }
+    pruned.push(c);
+  }
+  return { commit: sha, files: bundle.files, removed, dropped, pruned, history: history.length, warnings };
+}
+
 // src/cli.ts
 init_project();
 init_member_kind();
@@ -18366,7 +19932,7 @@ Usage:
   behold preview [project-dir] [--port <n>] [--emulator]
   behold export [project-dir] [--out <dir>] [--env <name>] [--name <worker>] [--emulator]
                 [--terragucci <src> [--terragucci-project <p>] [--reports-base <rel>]] [--no-source]
-                [--publish s3://<bucket>/<prefix>/views/<name>]
+                [--publish s3://<bucket>/<prefix>/views/<name> [--commit <sha>] [--keep <n>]]
   behold serve <project-dir\u2026> [--port <n>] [--host <addr>] [--allow-host <name,\u2026>] [--hud <url>] [--env <name>] [--poll <secs>] [--local]
   behold carve <report.json> [--port <n>]
 
@@ -18446,6 +20012,13 @@ Options:
   --terragucci-project <host/path>
                       serve/export: which project, when the reports hold several
                       and none is this checkout's git remote.
+  --terragucci-poll <secs>
+                      serve with --terragucci only: while a page is open, ask
+                      whether index.json changed (If-None-Match, or its mtime)
+                      and fetch chant/lifecycle (the gates and locks) every
+                      <secs> (default 30), and push what moved to the page.
+                      0 turns it off. The fetch goes into behold's own cache
+                      (<tmpdir>/behold-lifecycle-*), never into the checkout.
   --env <name>        Environment name \u2014 turns on the live drift overlay.
                       export/serve.
   --poll <secs>       Re-query live drift every <secs> and push updates (needs --env).
@@ -18493,9 +20066,17 @@ Options:
                       (terragucci never writes there), so a bundle never
                       overwrites a page it did not make. The one cloud write
                       behold makes, and only when an export asks for it.
+                      Each commit's view goes to <name>/<commit>/; history.json,
+                      latest.json and a redirecting index.html sit beside them.
+  --commit <sha>      export with --publish only: the commit to file the view
+                      under (default: the served checkout's HEAD).
+  --keep <n>          export with --publish only: how many commits history.json
+                      keeps (default 30); older commits' files are deleted as
+                      their manifest.json names them, best effort.
   --reports-base <r>  export with --terragucci only: where a report link points
                       from the bundle, relative to it (default ../../, for a
-                      bundle uploaded to <prefix>/views/behold/).
+                      bundle at <prefix>/views/behold/; ../../../ with
+                      --publish, whose bundle sits one commit deeper).
   --name <worker>     export only: Cloudflare Worker name in the generated
                       wrangler.jsonc.
   -h, --help          This text.
@@ -18547,6 +20128,7 @@ ${USAGE}`);
   let hudArg = process.env.BEHOLD_HUD_URL || void 0;
   let terragucci;
   let terragucciProject;
+  let terragucciPoll;
   const allowHosts = [];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
@@ -18556,6 +20138,7 @@ ${USAGE}`);
     else if (a === "--hud") hudArg = rest[++i];
     else if (a === "--terragucci") terragucci = rest[++i];
     else if (a === "--terragucci-project") terragucciProject = rest[++i];
+    else if (a === "--terragucci-poll") terragucciPoll = Number(rest[++i]);
     else if (a === "--env") env = rest[++i];
     else if (a === "--poll") pollSecs = Number(rest[++i]);
     else if (a === "--local") local = true;
@@ -18610,7 +20193,15 @@ ${USAGE}`);
     process.stderr.write("behold serve: --terragucci-project needs --terragucci\n");
     process.exit(2);
   }
-  const dirs = projectDirs.map((d) => resolve23(d));
+  if (terragucciPoll !== void 0 && (!Number.isFinite(terragucciPoll) || terragucciPoll < 0)) {
+    process.stderr.write("behold serve: --terragucci-poll must be a number of seconds, 0 for off\n");
+    process.exit(2);
+  }
+  if (terragucciPoll !== void 0 && terragucci === void 0) {
+    process.stderr.write("behold serve: --terragucci-poll needs --terragucci\n");
+    process.exit(2);
+  }
+  const dirs = projectDirs.map((d) => resolve28(d));
   const target = await serveTarget(dirs, "serve");
   await startServer({
     ...target,
@@ -18622,7 +20213,7 @@ ${USAGE}`);
     ...host ? { host } : {},
     ...allowHosts.length ? { allowedHosts: allowHosts } : {},
     ...target.workspace && hud ? { hud } : {},
-    ...terragucci ? { terragucci: { source: terragucci, ...terragucciProject ? { project: terragucciProject } : {} } } : {}
+    ...terragucci ? { terragucci: { source: terragucci, ...terragucciProject ? { project: terragucciProject } : {}, ...terragucciPoll !== void 0 ? { pollSecs: terragucciPoll } : {} } } : {}
   });
 }
 async function serveTarget(dirs, verb) {
@@ -18676,7 +20267,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join34(dir, m.dir)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join40(dir, m.dir)).join(" ")}
 `
     );
     return;
@@ -18711,8 +20302,8 @@ async function runCarve(rest) {
     );
     process.exit(2);
   }
-  const reportPath = resolve23(fileArg);
-  const parsed = readCarveReport(reportPath, (p) => readFileSync25(p, "utf8"));
+  const reportPath = resolve28(fileArg);
+  const parsed = readCarveReport(reportPath, (p) => readFileSync29(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
   ${parsed.refusal.remedy}
@@ -18723,14 +20314,14 @@ async function runCarve(rest) {
     `behold carve \u2014 ${parsed.report.resources.length} resource(s)/module(s) ranked${parsed.report.from ? ` from ${parsed.report.from}` : ""}
 `
   );
-  await startServer({ projectDir: dirname14(reportPath), carveReport: reportPath, port });
+  await startServer({ projectDir: dirname17(reportPath), carveReport: reportPath, port });
 }
 async function runDoctor(rest) {
-  let json = false;
+  let json2 = false;
   let fix = false;
   let dirArg;
   for (const a of rest) {
-    if (a === "--json") json = true;
+    if (a === "--json") json2 = true;
     else if (a === "--fix") fix = true;
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
@@ -18741,14 +20332,14 @@ async function runDoctor(rest) {
     }
   }
   const dir = dirArg ?? ".";
-  if (!existsSync23(resolve23(dir))) {
-    process.stderr.write(`behold doctor: no such directory: ${resolve23(dir)}
+  if (!existsSync25(resolve28(dir))) {
+    process.stderr.write(`behold doctor: no such directory: ${resolve28(dir)}
 `);
     process.exit(2);
   }
   if (fix) return runDoctorFix(dir);
   const report = await diagnose(dir);
-  process.stdout.write(json ? JSON.stringify(report, null, 2) + "\n" : formatReport(report));
+  process.stdout.write(json2 ? JSON.stringify(report, null, 2) + "\n" : formatReport(report));
   if (!report.ok) process.exitCode = 1;
 }
 async function runDoctorFix(dir) {
@@ -18778,7 +20369,7 @@ ${check.stdout || check.stderr}
   if (check.code !== 0) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot3 = join34(dirname14(fileURLToPath7(import.meta.url)), "..");
+  const pkgRoot3 = join40(dirname17(fileURLToPath10(import.meta.url)), "..");
   const registry2 = loadDemoRegistry(pkgRoot3);
   let port = 4600;
   let live2 = false;
@@ -18841,7 +20432,7 @@ async function runDemo(rest) {
 `);
     process.exit(2);
   }
-  const target = dirArg ? resolve23(dirArg) : demoTargetDir(entry);
+  const target = dirArg ? resolve28(dirArg) : demoTargetDir(entry);
   const loaded = await loadDemo(entry, { pkgRoot: pkgRoot3, target, log: (line) => process.stdout.write(line + "\n") });
   if (!loaded.ok) {
     process.stderr.write(`behold demo ${entry.name}: ${loaded.error}
@@ -18873,11 +20464,11 @@ function spawnStep(cmd, args, cwd) {
   });
 }
 async function serveCarveDemo(target, carve, port, live2 = false) {
-  const at = (rel) => resolve23(target, rel);
-  const project = at(carve.project);
-  const from = at(carve.from);
-  const state = carve.state ? at(carve.state) : void 0;
-  const committed = at(carve.report);
+  const at2 = (rel) => resolve28(target, rel);
+  const project = at2(carve.project);
+  const from = at2(carve.from);
+  const state = carve.state ? at2(carve.state) : void 0;
+  const committed = at2(carve.report);
   let liveInfo;
   if (live2) {
     for (const bin of ["docker", "terraform"]) {
@@ -18913,7 +20504,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     };
     process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
   }
-  if (existsSync23(join34(project, "package.json")) && !existsSync23(join34(project, "node_modules"))) {
+  if (existsSync25(join40(project, "package.json")) && !existsSync25(join40(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -18924,13 +20515,13 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     }
   }
   let degraded;
-  if (!existsSync23(join34(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
+  if (!existsSync25(join40(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
     process.stdout.write(`behold demo carve \u2192 npm install ${HCL_PARSER_PKG} (chant's HCL parser, ~2MB, once)\u2026
 `);
     const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", HCL_PARSER_PKG], target);
     if (code !== 0) degraded = `couldn't install ${HCL_PARSER_PKG} (chant's HCL parser) \u2014 no network?`;
   }
-  const report = at("carve-report.json");
+  const report = at2("carve-report.json");
   if (!degraded) {
     const bin = resolveChant(project).bin;
     process.stdout.write("behold demo carve \u2192 chant carve advise (read-only; emits nothing)\u2026\n");
@@ -18941,7 +20532,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     );
     if (code !== 0) degraded = `chant carve advise exited ${code}`;
   }
-  const serving = !degraded && existsSync23(report) ? report : committed;
+  const serving = !degraded && existsSync25(report) ? report : committed;
   if (degraded) {
     process.stderr.write(
       `behold demo carve: ${degraded}
@@ -18949,7 +20540,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
 `
     );
   }
-  if (!existsSync23(serving)) {
+  if (!existsSync25(serving)) {
     process.stderr.write(`behold demo carve: no carve report at ${serving}
 `);
     process.exit(2);
@@ -18965,7 +20556,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
       from,
       ...state ? { state } : {},
       project,
-      out: at(carve.out),
+      out: at2(carve.out),
       ...liveInfo ? { live: liveInfo } : {},
       ...degraded ? { degraded: `${degraded} \u2014 showing the committed report shipped with the demo.` } : {}
     },
@@ -18994,8 +20585,8 @@ async function runPreview(rest) {
     process.stderr.write("behold preview: --port must be a number\n");
     process.exit(2);
   }
-  const projectDir = resolve23(dirArg ?? process.cwd());
-  if (!existsSync23(projectDir)) {
+  const projectDir = resolve28(dirArg ?? process.cwd());
+  if (!existsSync25(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -19015,7 +20606,7 @@ async function runPreview(rest) {
   await startServer({ projectDir, port, env: "local", previewMode: true });
 }
 async function runExportCmd(rest) {
-  let outDir = resolve23("behold-export");
+  let outDir = resolve28("behold-export");
   let env;
   let name;
   let dirArg;
@@ -19024,10 +20615,12 @@ async function runExportCmd(rest) {
   let terragucciProject;
   let reportsBase;
   let publish;
+  let commitArg;
+  let keepArg;
   let noSource = false;
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--out") outDir = resolve23(rest[++i]);
+    if (a === "--out") outDir = resolve28(rest[++i]);
     else if (a === "--env") env = rest[++i];
     else if (a === "--name") name = rest[++i];
     else if (a === "--emulator") emulator = true;
@@ -19036,6 +20629,8 @@ async function runExportCmd(rest) {
     else if (a === "--reports-base") reportsBase = rest[++i];
     else if (a === "--no-source") noSource = true;
     else if (a === "--publish") publish = rest[++i];
+    else if (a === "--commit") commitArg = rest[++i];
+    else if (a === "--keep") keepArg = rest[++i];
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
   }
@@ -19046,6 +20641,16 @@ async function runExportCmd(rest) {
   const destination = publish === void 0 ? void 0 : publishTarget(publish);
   if (destination && "error" in destination) {
     process.stderr.write(`behold export: ${destination.error}
+`);
+    process.exit(2);
+  }
+  if ((commitArg !== void 0 || keepArg !== void 0) && !destination) {
+    process.stderr.write("behold export: --commit and --keep need --publish\n");
+    process.exit(2);
+  }
+  const keep = keepArg === void 0 ? DEFAULT_KEEP : Number(keepArg);
+  if (!Number.isInteger(keep) || keep < 1) {
+    process.stderr.write(`behold export: --keep takes a whole number of at least 1, not ${keepArg}
 `);
     process.exit(2);
   }
@@ -19055,12 +20660,18 @@ async function runExportCmd(rest) {
     );
     process.exit(2);
   }
-  const projectDir = resolve23(dirArg ?? process.cwd());
+  const projectDir = resolve28(dirArg ?? process.cwd());
+  const commit = destination ? resolveCommit(projectDir, commitArg) : void 0;
+  if (commit && "error" in commit) {
+    process.stderr.write(`behold export: ${commit.error}
+`);
+    process.exit(2);
+  }
   if (emulator) {
     injectEmulatorEnv(env);
     env ??= "local";
   }
-  if (!existsSync23(projectDir)) {
+  if (!existsSync25(projectDir)) {
     process.stderr.write(`behold export: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -19074,12 +20685,16 @@ async function runExportCmd(rest) {
       ...terragucci ? { terragucci: { source: terragucci, ...terragucciProject ? { project: terragucciProject } : {} } } : {}
     },
     outDir,
-    { ...name ? { name } : {}, ...noSource ? { noSource } : {}, ...reportsBase !== void 0 ? { reportsBase } : {} }
+    {
+      ...name ? { name } : {},
+      ...noSource ? { noSource } : {},
+      ...reportsBase !== void 0 ? { reportsBase } : destination ? { reportsBase: SNAPSHOT_REPORTS_BASE } : {}
+    }
   );
-  if (destination && !("error" in destination)) {
-    const done = await publishBundle(outDir, destination, new S3Object(s3FromEnv(destination.bucket)));
+  if (destination && !("error" in destination) && commit && !("error" in commit)) {
+    const done = await publishSnapshot(outDir, destination, commit, new S3Object(s3FromEnv(destination.bucket)), { keep });
     process.stdout.write(
-      `  Published: ${done.files} files to s3://${destination.bucket}/${destination.prefix}/` + (done.removed.length ? `, ${done.removed.length} stale snapshot${done.removed.length === 1 ? "" : "s"} removed` : "") + "\n"
+      `  Published: ${done.files} files to s3://${destination.bucket}/${destination.prefix}/${done.commit}/, latest and history (${done.history} of ${keep} kept) updated` + (done.removed.length ? `, ${done.removed.length} stale file${done.removed.length === 1 ? "" : "s"} removed` : "") + (done.dropped.length ? `, ${done.dropped.length} commit${done.dropped.length === 1 ? "" : "s"} past --keep dropped` : "") + "\n"
     );
     for (const w of done.warnings) process.stderr.write(`  warning: ${w}
 `);
@@ -19089,7 +20704,7 @@ function isMainModule() {
   const entry = process.argv[1];
   if (!entry) return false;
   try {
-    return realpathSync3(entry) === realpathSync3(fileURLToPath7(import.meta.url));
+    return realpathSync3(entry) === realpathSync3(fileURLToPath10(import.meta.url));
   } catch {
     return false;
   }