@intentius/behold 0.29.15 → 0.29.17

package/dist/cli.js

@@ -9291,8 +9291,8 @@ __export(tree_exports, {
   workingTree: () => workingTree
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { readdirSync as readdirSync11, readFileSync as readFileSync21, statSync as statSync9 } from "node:fs";
-import { join as join28 } from "node:path";
+import { readdirSync as readdirSync12, readFileSync as readFileSync22, statSync as statSync9 } from "node:fs";
+import { join as join29 } from "node:path";
 function joinPath(...parts) {
   return parts.filter((p) => p !== "" && p !== ".").join("/");
 }
@@ -9301,7 +9301,7 @@ function workingTree(root) {
     label: "",
     stat(path) {
       try {
-        const s = statSync9(join28(root, path));
+        const s = statSync9(join29(root, path));
         return s.isDirectory() ? "dir" : s.isFile() ? "file" : void 0;
       } catch {
         return void 0;
@@ -9310,7 +9310,7 @@ function workingTree(root) {
     list(path) {
       let dirents;
       try {
-        dirents = readdirSync11(join28(root, path), { withFileTypes: true });
+        dirents = readdirSync12(join29(root, path), { withFileTypes: true });
       } catch {
         return void 0;
       }
@@ -9319,7 +9319,7 @@ function workingTree(root) {
         let type = d.isDirectory() ? "dir" : d.isFile() ? "file" : void 0;
         if (!type && d.isSymbolicLink()) {
           try {
-            const s = statSync9(join28(root, path, d.name));
+            const s = statSync9(join29(root, path, d.name));
             type = s.isDirectory() ? "dir" : s.isFile() ? "file" : void 0;
           } catch {
           }
@@ -9329,10 +9329,10 @@ function workingTree(root) {
       return out;
     },
     read(path) {
-      return readFileSync21(join28(root, path), "utf-8");
+      return readFileSync22(join29(root, path), "utf-8");
     },
     bytes(path) {
-      return readFileSync21(join28(root, path));
+      return readFileSync22(join29(root, path));
     }
   };
 }
@@ -9934,12 +9934,12 @@ var init_identity_gate_rule = __esm({
 });
 
 // node_modules/@intentius/chant/src/workspace/class-data.ts
-import { existsSync as existsSync18, readFileSync as readFileSync22, statSync as statSync10 } from "node:fs";
-import { dirname as dirname7, join as join29, posix as posix2, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync23, statSync as statSync10 } from "node:fs";
+import { dirname as dirname7, join as join30, posix as posix2, resolve as resolve15 } from "node:path";
 function diskFiles(dir) {
   return (path) => {
     try {
-      return readFileSync22(join29(dir, ...path.split("/")), "utf-8");
+      return readFileSync23(join30(dir, ...path.split("/")), "utf-8");
     } catch {
       return void 0;
     }
@@ -9947,9 +9947,9 @@ function diskFiles(dir) {
 }
 function findInstalledPackage(name, fromDir) {
   for (let dir = resolve15(fromDir); ; dir = dirname7(dir)) {
-    const candidate = join29(dir, "node_modules", ...name.split("/"));
+    const candidate = join30(dir, "node_modules", ...name.split("/"));
     try {
-      if (statSync10(candidate).isDirectory() && existsSync18(join29(candidate, "package.json"))) return candidate;
+      if (statSync10(candidate).isDirectory() && existsSync19(join30(candidate, "package.json"))) return candidate;
     } catch {
     }
     if (dirname7(dir) === dir) return void 0;
@@ -10399,10 +10399,10 @@ var init_jsonc = __esm({
 });
 
 // node_modules/@intentius/chant/src/package-version.ts
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function readChantPackageVersion() {
-  return JSON.parse(readFileSync23(fileURLToPath4(new URL("../package.json", import.meta.url)), "utf-8")).version;
+  return JSON.parse(readFileSync24(fileURLToPath4(new URL("../package.json", import.meta.url)), "utf-8")).version;
 }
 var init_package_version = __esm({
   "node_modules/@intentius/chant/src/package-version.ts"() {
@@ -11201,8 +11201,8 @@ var init_declaration = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve35, dirname as dirname21, join as join53 } from "node:path";
-import { realpathSync as realpathSync3, existsSync as existsSync32, readFileSync as readFileSync41, rmSync as rmSync4 } from "node:fs";
+import { resolve as resolve35, dirname as dirname21, join as join54 } from "node:path";
+import { realpathSync as realpathSync3, existsSync as existsSync33, readFileSync as readFileSync42, rmSync as rmSync4 } from "node:fs";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawn as spawn9, spawnSync as spawnSync4 } from "node:child_process";
 
@@ -11260,8 +11260,8 @@ import { serve } from "@hono/node-server";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { existsSync as existsSync29, readFileSync as readFileSync37 } from "node:fs";
-import { basename as basename5, dirname as dirname18, join as join49, relative as relative11, resolve as resolve32, sep as sep10 } from "node:path";
+import { existsSync as existsSync30, readFileSync as readFileSync38 } from "node:fs";
+import { basename as basename5, dirname as dirname18, join as join50, relative as relative11, resolve as resolve32, sep as sep10 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -13667,10 +13667,10 @@ function joinNamespaceBindings(members, isDir = realIsDir) {
     if (!winner || tied) continue;
     const prev = best.get(winner.dir);
     if (prev === "ambiguous") continue;
-    const join54 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join54 });
+    const join55 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join55 });
     else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join54 });
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join55 });
   }
   return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
 }
@@ -15149,6 +15149,135 @@ function resourcesByRoot(ir, rootOf2) {
   return byComponent;
 }
 
+// src/pipeline-marks.ts
+init_yaml();
+init_terragrunt_units();
+import { existsSync as existsSync11, readdirSync as readdirSync9, readFileSync as readFileSync12 } from "node:fs";
+import { extname, join as join17 } from "node:path";
+var PIPELINE_FORGES = ["forgejo", "github", "gitlab"];
+var WORKFLOW_PLACES = [
+  ["forgejo", ".forgejo/workflows"],
+  ["github", ".github/workflows"],
+  ["gitlab", ".gitlab-ci.yml"]
+];
+function forgeOfName(name) {
+  const s = typeof name === "string" ? name.trim().toLowerCase() : "";
+  return PIPELINE_FORGES.find((f) => s === f || s.startsWith(`${f} `) || s.startsWith(`${f}-`));
+}
+function forgeOfPipelinePath(path) {
+  const p = path.replace(/\\/g, "/").replace(/^\.\/+/, "");
+  if (/(^|\/)\.forgejo\/workflows(\/|$)/.test(p)) return "forgejo";
+  if (/(^|\/)\.github\/workflows(\/|$)/.test(p)) return "github";
+  if (/(^|\/)\.gitlab-ci\.ya?ml$/.test(p)) return "gitlab";
+  return void 0;
+}
+function toolOfBinary(binary) {
+  const b = typeof binary === "string" ? binary.trim().toLowerCase().split("/").pop() ?? "" : "";
+  if (b === "tofu" || b === "opentofu") return "opentofu";
+  if (b === "terraform") return "terraform";
+  if (b === "choudoufu") return "choudoufu";
+  return void 0;
+}
+function configKeys(file) {
+  if (!file) return {};
+  let text2;
+  try {
+    text2 = readFileSync12(file, "utf8");
+  } catch {
+    return {};
+  }
+  if (extname(file) === ".ts") {
+    const pick = (k) => new RegExp(`(^|[\\s,{])${k}\\s*:\\s*["']([^"']+)["']`).exec(text2)?.[2];
+    const out = {};
+    const forge = pick("forge");
+    const binary = pick("binary");
+    if (forge) out.forge = forge;
+    if (binary) out.binary = binary;
+    return out;
+  }
+  let doc;
+  try {
+    doc = parseYAMLDocument(text2);
+  } catch {
+    return {};
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return {};
+  const d = doc;
+  return {
+    ...typeof d.forge === "string" ? { forge: d.forge } : {},
+    ...typeof d.binary === "string" ? { binary: d.binary } : {}
+  };
+}
+function pipelineForge(decl, dir, config) {
+  const declared = forgeOfName(decl?.pipeline.forge);
+  if (declared) return { forge: declared, from: "declared" };
+  const configured = forgeOfName(configKeys(config).forge);
+  if (configured) return { forge: configured, from: "config" };
+  const byPath = decl?.pipeline.path ? forgeOfPipelinePath(decl.pipeline.path) : void 0;
+  if (byPath) return { forge: byPath, from: "pipeline-path" };
+  const present2 = WORKFLOW_PLACES.filter(([, p]) => existsSync11(join17(dir, p))).map(([f]) => f);
+  return present2.length === 1 ? { forge: present2[0], from: "workflow-dir" } : void 0;
+}
+function chantWorkspaceWithMembers(dir) {
+  try {
+    const doc = JSON.parse(readFileSync12(join17(dir, "chant.workspace.json"), "utf8"));
+    return Array.isArray(doc.members) && doc.members.length > 0;
+  } catch {
+    return false;
+  }
+}
+function atmosRepo(dir) {
+  if (existsSync11(join17(dir, "atmos.yaml")) || existsSync11(join17(dir, "atmos.yml"))) return true;
+  return existsSync11(join17(dir, "stacks")) && existsSync11(join17(dir, "components", "terraform"));
+}
+function sqlYodelerRepo(dir) {
+  if (existsSync11(join17(dir, "yodel.config.ts"))) return true;
+  if (!existsSync11(join17(dir, "migrations"))) return false;
+  try {
+    const pkg = JSON.parse(readFileSync12(join17(dir, "package.json"), "utf8"));
+    return ["dependencies", "devDependencies"].some((k) => !!pkg[k]?.["@intentius/sql-yodeler"]);
+  } catch {
+    return false;
+  }
+}
+function repoTools(dir, config, has = {}) {
+  const out = [];
+  if ((has.terragrunt ?? hasTerragruntUnits)(dir)) out.push("terragrunt");
+  else if (existsSync11(join17(dir, "cdktf.json")) || existsSync11(join17(dir, "cdktn.json"))) out.push("cdk-terrain");
+  else if (atmosRepo(dir)) out.push("atmos");
+  else if (chantWorkspaceWithMembers(dir)) out.push("chant");
+  if (sqlYodelerRepo(dir)) out.push("sql-yodeler");
+  const engine = toolOfBinary(configKeys(config).binary);
+  if (engine) out.push(engine);
+  return out;
+}
+function sqlYodelerProjectIn(dir) {
+  if (existsSync11(join17(dir, "yodel.config.ts")) || existsSync11(join17(dir, "yodel-waves.json"))) return true;
+  return existsSync11(join17(dir, "migrations")) && (existsSync11(join17(dir, "chant.config.ts")) || sqlYodelerRepo(dir));
+}
+var SKIP_DIRS4 = /* @__PURE__ */ new Set(["node_modules", ".terraform", ".terragrunt-cache", ".git"]);
+function rootTools(repo, rootDir) {
+  const top = join17(repo, rootDir);
+  const dirs = [top];
+  const kids = (d) => {
+    try {
+      return readdirSync9(d, { withFileTypes: true }).filter((e) => e.isDirectory() && !SKIP_DIRS4.has(e.name) && e.name !== "migrations").map((e) => join17(d, e.name));
+    } catch {
+      return [];
+    }
+  };
+  for (const k of kids(top)) dirs.push(k, ...kids(k));
+  return dirs.some(sqlYodelerProjectIn) ? ["sql-yodeler"] : [];
+}
+function declaredRootTools(repo, roots) {
+  const out = {};
+  for (const [name, r] of Object.entries(roots)) {
+    const tools = rootTools(repo, r.dir.replace(/^\.\/+/, "").replace(/\/+$/, "") || ".");
+    if (tools.length) out[name] = tools;
+  }
+  return out;
+}
+
 // src/server.ts
 init_terragucci_components();
 init_terragrunt_units();
@@ -15238,10 +15367,10 @@ import {
 } from "@intentius/pinhole";
 
 // src/icon-packs.ts
-import { readFileSync as readFileSync12 } from "node:fs";
-import { dirname as dirname5, join as join17 } from "node:path";
+import { readFileSync as readFileSync13 } from "node:fs";
+import { dirname as dirname5, join as join18 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-var ICON_ROOT = join17(dirname5(fileURLToPath3(import.meta.url)), "..", "web", "icons");
+var ICON_ROOT = join18(dirname5(fileURLToPath3(import.meta.url)), "..", "web", "icons");
 var cache4 = /* @__PURE__ */ new Map();
 function unprefix(body) {
   return body.replace(/\s(?:inkscape|sodipodi):[\w-]+\s*=\s*(["'])[\s\S]*?\1/g, "").replace(/\sxlink:href\s*=/g, " href=");
@@ -15263,7 +15392,7 @@ function plate(glyph) {
 function loadIcon(rel) {
   const hit = cache4.get(rel);
   if (hit) return hit;
-  const raw = readFileSync12(join17(ICON_ROOT, `${rel}.svg`), "utf8");
+  const raw = readFileSync13(join18(ICON_ROOT, `${rel}.svg`), "utf8");
   const open = raw.indexOf("<svg");
   const openEnd = raw.indexOf(">", open);
   const close = raw.lastIndexOf("</svg");
@@ -17398,12 +17527,12 @@ init_carve_manifest();
 
 // src/carve-actions.ts
 init_chant();
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync15, readdirSync as readdirSync9, statSync as statSync7 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join20, relative as relative5, resolve as resolve12, sep as sep6 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync7 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join21, relative as relative5, resolve as resolve12, sep as sep6 } from "node:path";
 
 // src/layout.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync13, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4, accessSync, constants } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync14, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4, accessSync, constants } from "node:fs";
+import { join as join19 } from "node:path";
 var LAYOUT_DIR = ".behold";
 var LAYOUT_FILE = "layout.json";
 var MAX_BODY_BYTES = 64 * 1024;
@@ -17444,10 +17573,10 @@ function lensFromQuery(params) {
   return [slug2(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug2(`stack-${stack}`) : null].filter(Boolean).join("+");
 }
 function layoutPath(projectDir) {
-  return join18(projectDir, LAYOUT_DIR, LAYOUT_FILE);
+  return join19(projectDir, LAYOUT_DIR, LAYOUT_FILE);
 }
 function unwritableReason(projectDir) {
-  if (!projectDir || !existsSync11(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
+  if (!projectDir || !existsSync12(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
   try {
     accessSync(projectDir, constants.W_OK);
   } catch {
@@ -17459,8 +17588,8 @@ function readLayoutFile(projectDir) {
   const empty = { version: 1, lenses: {} };
   const file = layoutPath(projectDir);
   try {
-    if (!existsSync11(file)) return empty;
-    const raw = readFileSync13(file, "utf8");
+    if (!existsSync12(file)) return empty;
+    const raw = readFileSync14(file, "utf8");
     if (raw.length > MAX_FILE_BYTES) return empty;
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || !parsed.lenses || typeof parsed.lenses !== "object") return empty;
@@ -17500,7 +17629,7 @@ function writeLens(projectDir, lens, deltas) {
   }
   const body = JSON.stringify({ version: 1, lenses }, null, 2) + "\n";
   if (body.length > MAX_FILE_BYTES) throw new LayoutTooLarge(`a layout sidecar is capped at ${MAX_FILE_BYTES} bytes`);
-  mkdirSync4(join18(projectDir, LAYOUT_DIR), { recursive: true });
+  mkdirSync4(join19(projectDir, LAYOUT_DIR), { recursive: true });
   const tmp = `${file}.tmp`;
   writeFileSync4(tmp, body, "utf8");
   renameSync(tmp, file);
@@ -17586,8 +17715,8 @@ function reanchorEdges(svg, moved) {
 // src/carve-live.ts
 init_scratch();
 import { spawn as spawn4 } from "node:child_process";
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync5, existsSync as existsSync12 } from "node:fs";
-import { join as join19 } from "node:path";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync5, existsSync as existsSync13 } from "node:fs";
+import { join as join20 } from "node:path";
 var LIVE_CONTAINER = "behold-carve-floci";
 var LIVE_PORT = 4602;
 var LIVE_IMAGE = "floci/floci:1.5.34";
@@ -17647,9 +17776,9 @@ async function teardownScratchFloci() {
   await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
 }
 async function applyIntoFloci(fromDir, step) {
-  const template = join19(fromDir, "floci-override.tf.disabled");
-  if (!existsSync12(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
-  writeFileSync5(join19(fromDir, "floci_override.tf"), armOverride(readFileSync14(template, "utf8"), LIVE_PORT));
+  const template = join20(fromDir, "floci-override.tf.disabled");
+  if (!existsSync13(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
+  writeFileSync5(join20(fromDir, "floci_override.tf"), armOverride(readFileSync15(template, "utf8"), LIVE_PORT));
   const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
   if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
   const apply = await step(
@@ -17699,7 +17828,7 @@ async function runCarveObserve(demo, select) {
       "run `behold demo carve --live` (needs docker + terraform)"
     );
   }
-  if (!existsSync13(join20(demo.out, "src"))) {
+  if (!existsSync14(join21(demo.out, "src"))) {
     return refuse6("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
   }
   const args = ["lifecycle", "diff", "prod", "--live", "--json"];
@@ -17780,7 +17909,7 @@ function carveWriteBlock(demo) {
   if (!demo) {
     return "this server isn't running a carve demo \u2014 the carve actions only exist inside a `behold demo carve` copy";
   }
-  if (!existsSync13(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
+  if (!existsSync14(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
   if (!insideDemo(demo.root, demo.out)) return "the carve output directory is outside the demo copy";
   return unwritableReason(demo.root);
 }
@@ -17790,14 +17919,14 @@ function readArtifacts(demo, dir, filter) {
     if (out.length >= MAX_ARTIFACTS || depth > 2) return;
     let entries;
     try {
-      entries = readdirSync9(d).sort();
+      entries = readdirSync10(d).sort();
     } catch {
       return;
     }
     for (const name of entries) {
       if (out.length >= MAX_ARTIFACTS) return;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join20(d, name);
+      const full = join21(d, name);
       let st;
       try {
         st = statSync7(full);
@@ -17812,7 +17941,7 @@ function readArtifacts(demo, dir, filter) {
       if (!filter(rel)) continue;
       let text2 = "";
       try {
-        text2 = readFileSync15(full, "utf8");
+        text2 = readFileSync16(full, "utf8");
       } catch {
         continue;
       }
@@ -17844,7 +17973,7 @@ async function runCarveEmit(demo, select) {
   const block = carveWriteBlock(demo);
   if (block) return refuse6("read-only", block, "Start the walkthrough with `behold demo carve`.");
   mkdirSync5(demo.out, { recursive: true });
-  const reportFile = join20(demo.out, `${carveSlug(select)}-boundary.json`);
+  const reportFile = join21(demo.out, `${carveSlug(select)}-boundary.json`);
   const args = [
     "carve",
     "emit",
@@ -17873,10 +18002,10 @@ async function runCarveEmit(demo, select) {
   }
   let boundary = null;
   try {
-    boundary = JSON.parse(readFileSync15(reportFile, "utf8"));
+    boundary = JSON.parse(readFileSync16(reportFile, "utf8"));
   } catch {
   }
-  const lintPath = relative5(demo.project, join20(demo.out, "src")).split(sep6).join("/");
+  const lintPath = relative5(demo.project, join21(demo.out, "src")).split(sep6).join("/");
   const lintArgs = ["lint", lintPath];
   const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
     code: 127,
@@ -17939,8 +18068,8 @@ async function runCarveBridge(demo, select) {
 }
 
 // src/ops.ts
-import { readdirSync as readdirSync10, readFileSync as readFileSync16, existsSync as existsSync14 } from "node:fs";
-import { join as join21 } from "node:path";
+import { readdirSync as readdirSync11, readFileSync as readFileSync17, existsSync as existsSync15 } from "node:fs";
+import { join as join22 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -17962,11 +18091,11 @@ function discoverOps(projectDir) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const sub of ["ops", "src", "."]) {
-    const dir = join21(projectDir, sub);
-    if (!existsSync14(dir)) continue;
-    for (const f of readdirSync10(dir)) {
+    const dir = join22(projectDir, sub);
+    if (!existsSync15(dir)) continue;
+    for (const f of readdirSync11(dir)) {
       if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync16(join21(dir, f), "utf8");
+      const content = readFileSync17(join22(dir, f), "utf8");
       const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
       if (!name || seen.has(name)) continue;
       seen.add(name);
@@ -17982,25 +18111,25 @@ function discoverOps(projectDir) {
         ...gate ? { gate } : {},
         ...env ? { env } : {},
         ...substrate ? { substrate } : {},
-        ...existsSync14(irPath) ? { irPath } : {}
+        ...existsSync15(irPath) ? { irPath } : {}
       });
     }
   }
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
 function opIrPath(projectDir, name) {
-  return join21(projectDir, "dist", "ops", name, "op.json");
+  return join22(projectDir, "dist", "ops", name, "op.json");
 }
 function discoverOpIrs(projectDirs) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const dir of projectDirs) {
-    const root = join21(dir, "dist", "ops");
-    if (!existsSync14(root)) continue;
-    for (const name of readdirSync10(root)) {
+    const root = join22(dir, "dist", "ops");
+    if (!existsSync15(root)) continue;
+    for (const name of readdirSync11(root)) {
       if (seen.has(name)) continue;
       const path = opIrPath(dir, name);
-      if (!existsSync14(path)) continue;
+      if (!existsSync15(path)) continue;
       seen.add(name);
       out.push({ name, dir, path });
     }
@@ -18235,11 +18364,11 @@ var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
 function tookLabel(ms) {
   return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
 }
-function paintPlayhead(ir, join54, gate) {
-  if (!join54.byNode.size && !join54.at) return ir;
+function paintPlayhead(ir, join55, gate) {
+  if (!join55.byNode.size && !join55.at) return ir;
   const nodes = ir.nodes.map((node) => {
-    const run3 = join54.byNode.get(node.id);
-    const here = join54.at === node.id;
+    const run3 = join55.byNode.get(node.id);
+    const here = join55.at === node.id;
     if (!run3 && !here) return node;
     const isGate = node.attrs?._step === "gate";
     const attrs = { ...node.attrs };
@@ -18254,7 +18383,7 @@ function paintPlayhead(ir, join54, gate) {
     if (here) {
       attrs._playhead = true;
       attrs._status = isGate && gate ? "warn" : "accent";
-      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join54.atReason ?? "here";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join55.atReason ?? "here";
       if (isGate && gate?.description) attrs.gateDescription = gate.description;
     }
     return { ...node, attrs };
@@ -18276,11 +18405,11 @@ function pendingGateCard(op, gate, ir) {
     }
   };
 }
-function playheadNote(state, join54) {
+function playheadNote(state, join55) {
   if (!state.op) {
     return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
-  const settled = join54 ? join54.byNode.size : state.records.length;
+  const settled = join55 ? join55.byNode.size : state.records.length;
   const bits = [];
   const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
   if (state.status === "running") {
@@ -18296,9 +18425,9 @@ function playheadNote(state, join54) {
   } else if (state.gateNote) {
     bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
   }
-  if (join54?.unplaced.length) {
+  if (join55?.unplaced.length) {
     bits.push(
-      `${join54.unplaced.length} record${join54.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join54.unplaced.length === 1 ? "is" : "are"} not painted`
+      `${join55.unplaced.length} record${join55.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join55.unplaced.length === 1 ? "is" : "are"} not painted`
     );
   }
   if (!bits.length) return `${head}.`;
@@ -18969,8 +19098,8 @@ var OpRunner = class {
 };
 
 // src/public-mode.ts
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join22 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join23 } from "node:path";
 var ReadOnlyRunner = class {
   running = null;
   applyProgress = initialApplyProgress;
@@ -19033,7 +19162,7 @@ function publicReadRefusal(path, query) {
 }
 var PUBLIC_FLAG = "<script>window.__BEHOLD_PUBLIC__ = true;</script>";
 function publicPage(webRoot2) {
-  const html = readFileSync17(join22(webRoot2, "index.html"), "utf8");
+  const html = readFileSync18(join23(webRoot2, "index.html"), "utf8");
   return html.replace("</head>", `  ${PUBLIC_FLAG}
   </head>`);
 }
@@ -19050,8 +19179,8 @@ function publicRoutes(app, webRoot2) {
 
 // src/substrates.ts
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync18 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync19 } from "node:fs";
+import { join as join24 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
@@ -19080,11 +19209,11 @@ async function dockerRunning(run3, nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync15(join23(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync16(join24(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync18(join23(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync19(join24(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -19136,7 +19265,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync15(join23(projectDir, marker))) continue;
+    if (!existsSync16(join24(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -19170,7 +19299,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync15(join23(projectDir, ".github", "workflows"))) {
+  if (existsSync16(join24(projectDir, ".github", "workflows"))) {
     const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -19183,7 +19312,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync18(join23(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync19(join24(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -19326,8 +19455,8 @@ function statusVocabulary(kinds) {
 }
 
 // src/behaviour.ts
-import { readFileSync as readFileSync19 } from "node:fs";
-import { join as join24 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { join as join25 } from "node:path";
 var rec5 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 var str6 = (v) => typeof v === "string" && v.trim().length > 0 ? v : void 0;
 var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
@@ -19434,7 +19563,7 @@ var FIRST_TOTAL_SHOWN = "two members stated an estate total; the first is shown"
 var behaviourFileName = (env) => `behaviour.${env}.json`;
 var realRead = (path) => {
   try {
-    return readFileSync19(path, "utf8");
+    return readFileSync20(path, "utf8");
   } catch {
     return void 0;
   }
@@ -19492,7 +19621,7 @@ function attachBehaviour(ir, members, env, readFile2 = realRead) {
     }
     const file = behaviourFileName(env);
     looked.push(`${label}/${file}`);
-    const raw = readFile2(join24(m.dir, file));
+    const raw = readFile2(join25(m.dir, file));
     if (raw === void 0) {
       sources.set(label, "none");
       continue;
@@ -19928,7 +20057,7 @@ init_choudoufu_live();
 init_choudoufu_member();
 import { mkdtempSync, rmSync as rmSync3 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 var isRecord10 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var refuse7 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var CREDS2 = "Give behold the ambient read-only AWS credentials the estate's `plan` needs (AWS_PROFILE, or AWS_ENDPOINT_URL for an emulator), then re-check live with plan.";
@@ -20002,8 +20131,8 @@ var planArgv = (out) => ({
   show: ["show", "-json", out]
 });
 async function readChoudoufuPlan(dir, run3 = captureChoudoufu) {
-  const scratch = mkdtempSync(join25(tmpdir2(), "behold-choudoufu-plan-"));
-  const file = join25(scratch, "plan.tfplan");
+  const scratch = mkdtempSync(join26(tmpdir2(), "behold-choudoufu-plan-"));
+  const file = join26(scratch, "plan.tfplan");
   const argv = planArgv(file);
   try {
     const planRun = await run3(argv.plan, dir);
@@ -20035,8 +20164,8 @@ init_choudoufu_refs();
 // src/choudoufu-moves.ts
 init_choudoufu_member();
 init_choudoufu_live();
-import { existsSync as existsSync16, readFileSync as readFileSync20 } from "node:fs";
-import { join as join26, relative as relative6 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync21 } from "node:fs";
+import { join as join27, relative as relative6 } from "node:path";
 var isRecord11 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var refuse8 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var HOW_TO_GET_ONE2 = "A plan is the live-mv workbench's carve.json: `{from, estates[], moves[{address, from, to}]}` \u2014 the workbench's plan phase writes one, or write it by hand.";
@@ -20056,7 +20185,7 @@ function parseCarvePlan(value) {
     }
   };
 }
-function readCarvePlan(path, readFile2 = (p) => readFileSync20(p, "utf8")) {
+function readCarvePlan(path, readFile2 = (p) => readFileSync21(p, "utf8")) {
   let text2;
   try {
     text2 = readFile2(path);
@@ -20072,8 +20201,8 @@ function readCarvePlan(path, readFile2 = (p) => readFileSync20(p, "utf8")) {
 function discoverCarvePlans(memberDirs, base) {
   const out = [];
   for (const dir of memberDirs) {
-    const p = join26(dir, "carve.json");
-    if (existsSync16(p)) out.push(relative6(base, p));
+    const p = join27(dir, "carve.json");
+    if (existsSync17(p)) out.push(relative6(base, p));
   }
   return out;
 }
@@ -20302,27 +20431,27 @@ function getRuntime() {
 }
 
 // node_modules/@intentius/chant/src/lifecycle/member-ledger.ts
-import { existsSync as existsSync19 } from "node:fs";
-import { dirname as dirname8, join as join30, relative as relative7, resolve as resolve16, sep as sep7 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { dirname as dirname8, join as join31, relative as relative7, resolve as resolve16, sep as sep7 } from "node:path";
 
 // node_modules/@intentius/chant/src/project-root.ts
-import { existsSync as existsSync17 } from "fs";
-import { dirname as dirname6, join as join27, resolve as resolve14 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { dirname as dirname6, join as join28, resolve as resolve14 } from "path";
 var WORKSPACE_DECLARATION_FILES = ["chant.workspace.json", "chant.workspace.jsonc"];
 function findWorkspaceRoot(startDir) {
   const start = resolve14(startDir);
   let top;
   for (let dir = start; ; dir = dirname6(dir)) {
-    if (existsSync17(join27(dir, ".git"))) {
+    if (existsSync18(join28(dir, ".git"))) {
       top = dir;
       break;
     }
     if (dirname6(dir) === dir) break;
   }
   for (let dir = start; ; dir = dirname6(dir)) {
-    const [json2, jsonc] = WORKSPACE_DECLARATION_FILES.map((name) => join27(dir, name));
-    const hasJson = existsSync17(json2);
-    const hasJsonc = existsSync17(jsonc);
+    const [json2, jsonc] = WORKSPACE_DECLARATION_FILES.map((name) => join28(dir, name));
+    const hasJson = existsSync18(json2);
+    const hasJsonc = existsSync18(jsonc);
     if (hasJson && hasJsonc) return { dir, file: json2, conflicting: jsonc };
     if (hasJson) return { dir, file: json2 };
     if (hasJsonc) return { dir, file: jsonc };
@@ -20382,7 +20511,7 @@ async function ledgerIn(root, dir) {
   }
   let outer = FLAT;
   const parent = dirname8(root);
-  if (parent !== root && !existsSync19(join30(root, ".git"))) {
+  if (parent !== root && !existsSync20(join31(root, ".git"))) {
     const outerFound = findWorkspaceRoot(parent);
     if (outerFound) outer = await ledgerIn(outerFound.dir, root);
   }
@@ -20936,8 +21065,8 @@ function decideOverride(input) {
 }
 
 // src/terragucci-repo.ts
-import { existsSync as existsSync20 } from "node:fs";
-import { dirname as dirname9, join as join31, resolve as resolve17 } from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import { dirname as dirname9, join as join32, resolve as resolve17 } from "node:path";
 var TERRAGUCCI_CONFIG_NAMES = ["terragucci.yml", "terragucci.yaml", "terragucci.json", "terragucci.ts"];
 function terragucciConfig(dir) {
   return walkUp(dir, TERRAGUCCI_CONFIG_NAMES);
@@ -20946,10 +21075,10 @@ function walkUp(dir, names) {
   let at2 = resolve17(dir);
   for (; ; ) {
     for (const name of names) {
-      const file = join31(at2, name);
-      if (existsSync20(file)) return file;
+      const file = join32(at2, name);
+      if (existsSync21(file)) return file;
     }
-    if (existsSync20(join31(at2, ".git"))) return void 0;
+    if (existsSync21(join32(at2, ".git"))) return void 0;
     const up = dirname9(at2);
     if (up === at2) return void 0;
     at2 = up;
@@ -21752,8 +21881,8 @@ init_read_stats();
 init_foreign();
 
 // src/events.ts
-import { watch, existsSync as existsSync21 } from "node:fs";
-import { join as join32 } from "node:path";
+import { watch, existsSync as existsSync22 } from "node:fs";
+import { join as join33 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -21771,7 +21900,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync21(join32(projectDir, "src")) ? join32(projectDir, "src") : projectDir;
+  const dir = existsSync22(join33(projectDir, "src")) ? join33(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -22075,27 +22204,27 @@ async function emulatorDown(projectDir) {
 
 // src/terragucci-view.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { dirname as dirname13, join as join41, relative as relative9, sep as sep8 } from "node:path";
+import { dirname as dirname13, join as join42, relative as relative9, sep as sep8 } from "node:path";
 init_terraform_member();
 
 // src/terragucci-reports.ts
-import { readFileSync as readFileSync25, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync26, statSync as statSync11 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname10, join as join35, resolve as resolve21 } from "node:path";
+import { dirname as dirname10, join as join36, resolve as resolve21 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { Ajv2020 } from "ajv/dist/2020.js";
 
 // src/terragucci-lifecycle.ts
 import { execFile as execFile4 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync6, readdirSync as readdirSync12 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync6, readdirSync as readdirSync13 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename3, isAbsolute as isAbsolute4, join as join34, resolve as resolve20 } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute4, join as join35, resolve as resolve20 } from "node:path";
 
 // node_modules/@intentius/chant/src/gate-decision.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { readFileSync as readFileSync24 } from "node:fs";
-import { join as join33, posix as posix4 } from "node:path";
+import { readFileSync as readFileSync25 } from "node:fs";
+import { join as join34, posix as posix4 } from "node:path";
 
 // node_modules/@intentius/chant/src/lifecycle/gate-applied.ts
 function appliedGatePath(op) {
@@ -22204,7 +22333,7 @@ function pinnedClassesAt(repo, base, pins, packages) {
     }
     let installed2;
     try {
-      installed2 = JSON.parse(readFileSync24(join33(dir, "package.json"), "utf-8")).version;
+      installed2 = JSON.parse(readFileSync25(join34(dir, "package.json"), "utf-8")).version;
     } catch {
       installed2 = void 0;
     }
@@ -22811,7 +22940,7 @@ var realGit = (args, o = {}) => new Promise((res) => {
 });
 var redact = (s) => s.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/gi, "$1");
 function cacheDir(origin, root = tmpdir3()) {
-  return join34(root, `${CACHE_PREFIX}${createHash8("sha256").update(origin).digest("hex").slice(0, 16)}`);
+  return join35(root, `${CACHE_PREFIX}${createHash8("sha256").update(origin).digest("hex").slice(0, 16)}`);
 }
 var inflight = /* @__PURE__ */ new Map();
 function serially(key, fn) {
@@ -22830,8 +22959,8 @@ function fetchable(url, checkout) {
 async function fetchIntoCache(git3, origin, cache6) {
   assertScratch(basename3(cache6));
   return serially(cache6, async () => {
-    if (!existsSync22(join34(cache6, "HEAD"))) {
-      if (existsSync22(cache6) && readdirSync12(cache6).length > 0) return { ok: false, error: `${cache6} exists and is not behold's lifecycle cache; behold leaves it alone` };
+    if (!existsSync23(join35(cache6, "HEAD"))) {
+      if (existsSync23(cache6) && readdirSync13(cache6).length > 0) return { ok: false, error: `${cache6} exists and is not behold's lifecycle cache; behold leaves it alone` };
       mkdirSync6(cache6, { recursive: true });
       const init = await git3(["init", "--bare", "-q", cache6]);
       if (init.code !== 0) return { ok: false, error: `could not make the cache ${cache6}: ${init.stderr.trim()}` };
@@ -23032,7 +23161,7 @@ function structural(name, doc) {
 var compiledSchemas = /* @__PURE__ */ new Map();
 function schemaStamp(dist) {
   try {
-    const files = [join35(dist, "..", "package.json"), ...Object.values(SCHEMA_FILES).map((f) => join35(dist, f))];
+    const files = [join36(dist, "..", "package.json"), ...Object.values(SCHEMA_FILES).map((f) => join36(dist, f))];
     return [dist, ...files.map((f) => {
       const st = statSync11(f);
       return `${st.mtimeMs}:${st.size}`;
@@ -23042,10 +23171,10 @@ function schemaStamp(dist) {
   }
 }
 function compileSchemas(dist) {
-  const version = JSON.parse(readFileSync25(join35(dist, "..", "package.json"), "utf8")).version ?? "";
+  const version = JSON.parse(readFileSync26(join36(dist, "..", "package.json"), "utf8")).version ?? "";
   const ajv = new Ajv2020({ strict: false, allErrors: false });
   const compiled4 = Object.fromEntries(
-    Object.keys(SCHEMA_FILES).map((n) => [n, ajv.compile(JSON.parse(readFileSync25(join35(dist, SCHEMA_FILES[n]), "utf8")))])
+    Object.keys(SCHEMA_FILES).map((n) => [n, ajv.compile(JSON.parse(readFileSync26(join36(dist, SCHEMA_FILES[n]), "utf8")))])
   );
   return {
     validation: { by: "schema", terragucci: version },
@@ -23062,7 +23191,7 @@ function terragucciValidator(dirs = []) {
   for (const from of [...dirs, dirname10(fileURLToPath5(import.meta.url))]) {
     let entry;
     try {
-      entry = createRequire4(join35(resolve21(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
+      entry = createRequire4(join36(resolve21(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
     } catch {
       continue;
     }
@@ -23418,11 +23547,11 @@ function joinTerragucci(read, nodes, roots) {
 // src/terragucci-source.ts
 import { spawn as spawn7 } from "node:child_process";
 import { readFile } from "node:fs/promises";
-import { join as join36, resolve as resolve22 } from "node:path";
+import { join as join37, resolve as resolve22 } from "node:path";
 
 // src/s3-object.ts
 import { createHash as createHash9, createHmac } from "node:crypto";
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync27 } from "node:fs";
 var S3Error = class extends Error {
   /** The HTTP status S3 answered, when it answered. */
   status;
@@ -23469,7 +23598,7 @@ function s3FromEnv(bucket, env = process.env) {
 async function assumeRole(w, fetchFn) {
   let token;
   try {
-    token = readFileSync26(w.tokenFile, "utf8").trim();
+    token = readFileSync27(w.tokenFile, "utf8").trim();
   } catch (e) {
     throw new S3Error(`cannot read the OIDC token in ${w.tokenFile}: ${e.message}`);
   }
@@ -23666,7 +23795,7 @@ function terragucciSource(spec2, opts = {}) {
     location: dir,
     async read(key) {
       try {
-        return await readFile(join36(dir, ...trim(key).split("/")), "utf8");
+        return await readFile(join37(dir, ...trim(key).split("/")), "utf8");
       } catch (e) {
         if (e.code === "ENOENT") return void 0;
         throw e;
@@ -23676,9 +23805,9 @@ function terragucciSource(spec2, opts = {}) {
 }
 
 // src/terragucci-timeline.ts
-import { readFileSync as readFileSync27, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync28, statSync as statSync12 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
-import { dirname as dirname11, join as join37, resolve as resolve23 } from "node:path";
+import { dirname as dirname11, join as join38, resolve as resolve23 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { Ajv2020 as Ajv20202 } from "ajv/dist/2020.js";
 var AUDIT_SCHEMA = "terragucci.audit/v1";
@@ -23719,12 +23848,12 @@ function auditValidator(dirs = []) {
   for (const from of [...dirs, dirname11(fileURLToPath6(import.meta.url))]) {
     let dist;
     try {
-      dist = dirname11(createRequire5(join37(resolve23(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
+      dist = dirname11(createRequire5(join38(resolve23(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
     } catch {
       continue;
     }
-    const pkg = join37(dist, "..", "package.json");
-    const file = join37(dist, AUDIT_SCHEMA_FILE);
+    const pkg = join38(dist, "..", "package.json");
+    const file = join38(dist, AUDIT_SCHEMA_FILE);
     let stamp;
     try {
       stamp = [dist, ...[pkg, file].map((f) => {
@@ -23738,8 +23867,8 @@ function auditValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync27(pkg, "utf8")).version ?? "";
-      v = compileAuditSchema(JSON.parse(readFileSync27(file, "utf8")), version);
+      const version = JSON.parse(readFileSync28(pkg, "utf8")).version ?? "";
+      v = compileAuditSchema(JSON.parse(readFileSync28(file, "utf8")), version);
     } catch {
       continue;
     }
@@ -23935,7 +24064,7 @@ function terragucciTimelineRoute(app, source2, opts = {}) {
 // src/terragucci-poll.ts
 import { createHash as createHash10 } from "node:crypto";
 import { stat } from "node:fs/promises";
-import { join as join38, resolve as resolve24 } from "node:path";
+import { join as join39, resolve as resolve24 } from "node:path";
 import { streamSSE } from "hono/streaming";
 var TERRAGUCCI_POLL_SECS = 30;
 var INDEX_KEY = "index.json";
@@ -23986,7 +24115,7 @@ function indexProbe(spec2, opts = {}) {
       return verdict2(prev, etag);
     };
   }
-  const file = join38(resolve24(opts.cwd ?? process.cwd(), spec2), name);
+  const file = join39(resolve24(opts.cwd ?? process.cwd(), spec2), name);
   return async (prev) => {
     try {
       const s = await stat(file);
@@ -24141,9 +24270,9 @@ function terragucciLaneRoutes(app, o, base, forget) {
 }
 
 // src/terragucci-progress.ts
-import { readFileSync as readFileSync28, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync29, statSync as statSync13 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import { dirname as dirname12, join as join39, resolve as resolve25 } from "node:path";
+import { dirname as dirname12, join as join40, resolve as resolve25 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { Ajv2020 as Ajv20203 } from "ajv/dist/2020.js";
 var RUN_SCHEMA = "terragucci.run/v1";
@@ -24188,12 +24317,12 @@ function runValidator(dirs = []) {
   for (const from of [...dirs, dirname12(fileURLToPath7(import.meta.url))]) {
     let dist;
     try {
-      dist = dirname12(createRequire6(join39(resolve25(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
+      dist = dirname12(createRequire6(join40(resolve25(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
     } catch {
       continue;
     }
-    const pkg = join39(dist, "..", "package.json");
-    const file = join39(dist, RUN_SCHEMA_FILE);
+    const pkg = join40(dist, "..", "package.json");
+    const file = join40(dist, RUN_SCHEMA_FILE);
     let stamp;
     try {
       stamp = [dist, ...[pkg, file].map((f) => {
@@ -24207,8 +24336,8 @@ function runValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync28(pkg, "utf8")).version ?? "";
-      v = compileRunSchema(JSON.parse(readFileSync28(file, "utf8")), version);
+      const version = JSON.parse(readFileSync29(pkg, "utf8")).version ?? "";
+      v = compileRunSchema(JSON.parse(readFileSync29(file, "utf8")), version);
     } catch {
       continue;
     }
@@ -24501,8 +24630,8 @@ function terragucciProgressRoute(app, progress) {
 }
 
 // src/terragucci-demo.ts
-import { readFileSync as readFileSync29 } from "node:fs";
-import { join as join40 } from "node:path";
+import { readFileSync as readFileSync30 } from "node:fs";
+import { join as join41 } from "node:path";
 var DEMO_KEY = "demo.json";
 var DEMO_READ_TTL_MS = 2e3;
 var DEMO_STEPS = ["pull-request", "planned", "merged", "applying", "waiting", "approved", "failed", "resumed", "applied", "reset", "stalled"];
@@ -24591,10 +24720,10 @@ function kioskRoute(app, webRoot2, enabled) {
     if (!enabled) {
       return c.html(disabledPage, 404);
     }
-    return new Response(readFileSync29(join40(webRoot2, "kiosk.html"), "utf8"), { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
+    return new Response(readFileSync30(join41(webRoot2, "kiosk.html"), "utf8"), { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
   });
 }
-var VENDOR_TOOLS = ["terraform", "terragrunt", "cdk-terrain", "choudoufu"];
+var VENDOR_TOOLS = ["terraform", "terragrunt", "cdk-terrain", "choudoufu", "chant"];
 var isVendorTool = (v) => VENDOR_TOOLS.includes(v);
 var cycleKey = (tool) => `cycles/${tool}/latest.json`;
 var CYCLE_READ_TTL_MS = 1e4;
@@ -24671,7 +24800,7 @@ function vendorRoutes(app, webRoot2, enabled) {
   for (const tool of VENDOR_TOOLS) {
     app.get(`/${tool}`, (c) => {
       if (!enabled) return c.html(disabledPage, 404);
-      const html = vendorPage(readFileSync29(join40(webRoot2, "kiosk.html"), "utf8"), tool);
+      const html = vendorPage(readFileSync30(join41(webRoot2, "kiosk.html"), "utf8"), tool);
       return new Response(html, { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
     });
   }
@@ -24837,7 +24966,7 @@ function checkoutRoots(dirs, base = repoBase(dirs)) {
   for (const m of estateMembers(dirs)) {
     if (m.kind !== "terraform") continue;
     for (const r of checkoutRootDirs(m.dir)) {
-      const path = relative9(base, join41(m.dir, r.dir)).split(sep8).join("/") || ".";
+      const path = relative9(base, join42(m.dir, r.dir)).split(sep8).join("/") || ".";
       out.push({ member: m.name, name: r.name, path });
     }
   }
@@ -24948,8 +25077,8 @@ function terragucciRoutes(app, opts, dirs) {
 
 // src/view-repos.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-import { existsSync as existsSync23, readdirSync as readdirSync13, readFileSync as readFileSync30 } from "node:fs";
-import { join as join42, resolve as resolve26 } from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync14, readFileSync as readFileSync31 } from "node:fs";
+import { join as join43, resolve as resolve26 } from "node:path";
 var NAME2 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 function repoName(value) {
   const v = value.trim().replace(/\.git$/, "");
@@ -24959,11 +25088,11 @@ function repoName(value) {
 function listCheckouts(parent) {
   let names;
   try {
-    names = readdirSync13(parent, { withFileTypes: true }).filter((e) => e.isDirectory() && NAME2.test(e.name)).map((e) => e.name).sort();
+    names = readdirSync14(parent, { withFileTypes: true }).filter((e) => e.isDirectory() && NAME2.test(e.name)).map((e) => e.name).sort();
   } catch {
     return [];
   }
-  return names.map((name) => ({ name, dir: resolve26(parent, name) })).filter((c) => existsSync23(join42(c.dir, ".git")));
+  return names.map((name) => ({ name, dir: resolve26(parent, name) })).filter((c) => existsSync24(join43(c.dir, ".git")));
 }
 var scope = new AsyncLocalStorage2();
 function scopeServedDirs(cfg) {
@@ -25005,7 +25134,7 @@ var SHA = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
 function checkoutCommit(dir) {
   const read = (f) => {
     try {
-      return readFileSync30(join42(dir, ".git", f), "utf8");
+      return readFileSync31(join43(dir, ".git", f), "utf8");
     } catch {
       return void 0;
     }
@@ -25486,8 +25615,8 @@ function lifecycleHistoryRoute(app, base, opts = {}) {
 }
 
 // src/lifecycle-releases.ts
-import { existsSync as existsSync24, readFileSync as readFileSync31 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync32 } from "node:fs";
+import { join as join44 } from "node:path";
 
 // node_modules/@intentius/chant/src/lifecycle/legacy-digest.ts
 import { resolve as resolve27 } from "node:path";
@@ -25600,10 +25729,10 @@ function memberNote(l) {
 // src/lifecycle-releases.ts
 var WAVES_SPEC_FILE = "yodel-waves.json";
 function waveOrder(checkout) {
-  const p = join43(checkout, WAVES_SPEC_FILE);
-  if (!existsSync24(p)) return void 0;
+  const p = join44(checkout, WAVES_SPEC_FILE);
+  if (!existsSync25(p)) return void 0;
   try {
-    const doc = JSON.parse(readFileSync31(p, "utf8"));
+    const doc = JSON.parse(readFileSync32(p, "utf8"));
     const names = (doc.waves ?? []).map((w) => w?.name).filter((n) => typeof n === "string" && n.length > 0);
     return names.length ? [...new Set(names)] : void 0;
   } catch {
@@ -25611,7 +25740,7 @@ function waveOrder(checkout) {
   }
 }
 function hasReleaseLedgerHint(checkout) {
-  return existsSync24(join43(checkout, "yodel.config.ts")) || existsSync24(join43(checkout, WAVES_SPEC_FILE));
+  return existsSync25(join44(checkout, "yodel.config.ts")) || existsSync25(join44(checkout, WAVES_SPEC_FILE));
 }
 function orderEnvironments(envs, waves) {
   const seen = new Set(envs);
@@ -25653,7 +25782,7 @@ function releaseCells(ledgers, order, sources) {
 }
 async function copyCheckoutRef(git3, checkout, cache6) {
   assertScratch(cache6.split(/[\\/]/).pop());
-  if (!existsSync24(join43(cache6, "HEAD"))) {
+  if (!existsSync25(join44(cache6, "HEAD"))) {
     const init = await git3(["init", "--bare", "-q", cache6]);
     if (init.code !== 0) return false;
   }
@@ -25756,8 +25885,8 @@ function releasesRoutes(app, base, opts = {}) {
 }
 
 // src/sql-yodeler-lane.ts
-import { existsSync as existsSync25, readdirSync as readdirSync14, readFileSync as readFileSync32 } from "node:fs";
-import { join as join44 } from "node:path";
+import { existsSync as existsSync26, readdirSync as readdirSync15, readFileSync as readFileSync33 } from "node:fs";
+import { join as join45 } from "node:path";
 var YODEL_APPLY_OP = "yodel-apply";
 var YODEL_HEAD_PLANS_DIR = headPlansPath(YODEL_APPLY_OP, "").dir;
 function parseYodelWaves(text2, path = WAVES_SPEC_FILE) {
@@ -25789,19 +25918,19 @@ function parseYodelWaves(text2, path = WAVES_SPEC_FILE) {
   return { path, waves };
 }
 function readYodelWaves(checkout) {
-  const p = join44(checkout, WAVES_SPEC_FILE);
-  if (!existsSync25(p)) return void 0;
+  const p = join45(checkout, WAVES_SPEC_FILE);
+  if (!existsSync26(p)) return void 0;
   try {
-    return parseYodelWaves(readFileSync32(p, "utf8"));
+    return parseYodelWaves(readFileSync33(p, "utf8"));
   } catch (e) {
     return { path: WAVES_SPEC_FILE, waves: [], error: e instanceof Error ? e.message : String(e) };
   }
 }
 function migrateOpEnvironments(checkout) {
-  const dir = join44(checkout, "ops");
-  if (!existsSync25(dir)) return [];
+  const dir = join45(checkout, "ops");
+  if (!existsSync26(dir)) return [];
   try {
-    return readdirSync14(dir).map((f) => /^migrate-(.+)\.op\.ts$/.exec(f)?.[1]).filter((e) => !!e).sort();
+    return readdirSync15(dir).map((f) => /^migrate-(.+)\.op\.ts$/.exec(f)?.[1]).filter((e) => !!e).sort();
   } catch {
     return [];
   }
@@ -25921,20 +26050,20 @@ function sqlYodelerLaneRoute(app, checkout, opts = {}) {
 
 // src/terragucci-estate.ts
 init_yaml();
-import { existsSync as existsSync26, readFileSync as readFileSync33, statSync as statSync14 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync34, statSync as statSync14 } from "node:fs";
 import { createRequire as createRequire7 } from "node:module";
-import { dirname as dirname14, extname, join as join45, resolve as resolve28 } from "node:path";
+import { dirname as dirname14, extname as extname2, join as join46, resolve as resolve28 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { Ajv2020 as Ajv20204 } from "ajv/dist/2020.js";
 var RUN_SCHEMA2 = "terragucci.run/v1";
 function configProjects(file) {
   let text2;
   try {
-    text2 = readFileSync33(file, "utf8");
+    text2 = readFileSync34(file, "utf8");
   } catch {
     return void 0;
   }
-  if (extname(file) === ".ts") return /(^|[\s,{])projects\s*:\s*\{/.test(text2) ? [] : void 0;
+  if (extname2(file) === ".ts") return /(^|[\s,{])projects\s*:\s*\{/.test(text2) ? [] : void 0;
   let doc;
   try {
     doc = parseYAMLDocument(text2);
@@ -25981,16 +26110,16 @@ function runViewValidator(dirs = []) {
   for (const from of [...dirs, dirname14(fileURLToPath8(import.meta.url))]) {
     let entry;
     try {
-      entry = createRequire7(join45(resolve28(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
+      entry = createRequire7(join46(resolve28(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
     } catch {
       continue;
     }
     const dist = dirname14(entry);
-    const schema = join45(dist, "run.schema.json");
+    const schema = join46(dist, "run.schema.json");
     let stamp;
     try {
       const st = statSync14(schema);
-      const pkg = statSync14(join45(dist, "..", "package.json"));
+      const pkg = statSync14(join46(dist, "..", "package.json"));
       stamp = `${schema}\0${st.mtimeMs}:${st.size}\0${pkg.mtimeMs}`;
     } catch {
       continue;
@@ -25999,8 +26128,8 @@ function runViewValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync33(join45(dist, "..", "package.json"), "utf8")).version ?? "";
-      const validate = new Ajv20204({ strict: false, allErrors: false }).compile(JSON.parse(readFileSync33(schema, "utf8")));
+      const version = JSON.parse(readFileSync34(join46(dist, "..", "package.json"), "utf8")).version ?? "";
+      const validate = new Ajv20204({ strict: false, allErrors: false }).compile(JSON.parse(readFileSync34(schema, "utf8")));
       v = {
         validation: { by: "schema", terragucci: version },
         check(doc) {
@@ -26055,8 +26184,8 @@ function controlEdges(views) {
 function siblingCheckout(project, base, projectOf = checkoutProject) {
   const name = project.split("/").filter(Boolean).pop();
   if (!name) return void 0;
-  const dir = join45(dirname14(resolve28(base)), name);
-  if (dir === resolve28(base) || !existsSync26(join45(dir, ".git"))) return void 0;
+  const dir = join46(dirname14(resolve28(base)), name);
+  if (dir === resolve28(base) || !existsSync27(join46(dir, ".git"))) return void 0;
   return projectOf(dir) === project ? dir : void 0;
 }
 var shellWord = (s) => /^[A-Za-z0-9_./:@%+=,-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
@@ -26263,9 +26392,9 @@ function controlRepoInfo(dirs) {
 }
 
 // src/yodel-report.ts
-import { readdirSync as readdirSync15, readFileSync as readFileSync34, statSync as statSync15 } from "node:fs";
+import { readdirSync as readdirSync16, readFileSync as readFileSync35, statSync as statSync15 } from "node:fs";
 import { createRequire as createRequire8 } from "node:module";
-import { basename as basename4, dirname as dirname15, join as join46, resolve as resolve29 } from "node:path";
+import { basename as basename4, dirname as dirname15, join as join47, resolve as resolve29 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { Ajv2020 as Ajv20205 } from "ajv/dist/2020.js";
 
@@ -26694,13 +26823,13 @@ var installed = /* @__PURE__ */ new Map();
 function packageRoot(from) {
   let entry;
   try {
-    entry = createRequire8(join46(resolve29(from), "noop.js")).resolve("@intentius/sql-yodeler");
+    entry = createRequire8(join47(resolve29(from), "noop.js")).resolve("@intentius/sql-yodeler");
   } catch {
     return void 0;
   }
   for (let d = dirname15(entry); d !== dirname15(d); d = dirname15(d)) {
     try {
-      const pkg = JSON.parse(readFileSync34(join46(d, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync35(join47(d, "package.json"), "utf8"));
       if (pkg.name === "@intentius/sql-yodeler") return d;
     } catch {
     }
@@ -26712,11 +26841,11 @@ function yodelValidator(dirs = []) {
     const root = packageRoot(from);
     if (!root) continue;
     try {
-      const version = JSON.parse(readFileSync34(join46(root, "package.json"), "utf8")).version ?? "";
+      const version = JSON.parse(readFileSync35(join47(root, "package.json"), "utf8")).version ?? "";
       const key = `${root}\0${version}`;
       let v = installed.get(key);
       if (!v) {
-        const load2 = (n) => JSON.parse(readFileSync34(join46(root, "schemas", `${n}.schema.json`), "utf8"));
+        const load2 = (n) => JSON.parse(readFileSync35(join47(root, "schemas", `${n}.schema.json`), "utf8"));
         v = compile({ common: load2("common"), report: load2("report"), drift: load2("drift") }, { by: "schema", from: "package", sqlYodeler: version });
         installed.set(key, v);
       }
@@ -26738,7 +26867,7 @@ function filesOf(source2) {
     return refuse14(`--yodel-report ${source2}: no such file or directory`, "Point --yodel-report at the file `yodel report --json` wrote, or the directory holding it.");
   }
   const dir = st.isDirectory() ? source2 : dirname15(source2);
-  const files = readdirSync15(dir).filter((f) => f.endsWith(".json")).sort().map((f) => join46(dir, f));
+  const files = readdirSync16(dir).filter((f) => f.endsWith(".json")).sort().map((f) => join47(dir, f));
   return st.isDirectory() ? { dir, files } : { dir, files, named: resolve29(source2) };
 }
 function readYodelReport(source2, validator2) {
@@ -26750,7 +26879,7 @@ function readYodelReport(source2, validator2) {
   for (const file of files) {
     let doc;
     try {
-      doc = JSON.parse(readFileSync34(file, "utf8"));
+      doc = JSON.parse(readFileSync35(file, "utf8"));
     } catch (e) {
       if (file === named) refuse14(`${basename4(file)} is not JSON: ${e instanceof Error ? e.message : String(e)}`, remedy);
       ignored.push(basename4(file));
@@ -26837,15 +26966,15 @@ function yodelReportRoute(app, source2, dirs) {
 
 // src/demo-pins.ts
 init_terraform_member();
-import { existsSync as existsSync27, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync35, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname16, join as join47, resolve as resolve30 } from "node:path";
+import { existsSync as existsSync28, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync36, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname16, join as join48, resolve as resolve30 } from "node:path";
 var isRecord21 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function linkDemoPins(work, probes = {}) {
-  const file = join47(work, "chant.workspace.json");
-  if (!existsSync27(file)) return { ok: true, linked: [] };
+  const file = join48(work, "chant.workspace.json");
+  if (!existsSync28(file)) return { ok: true, linked: [] };
   let decl;
   try {
-    decl = JSON.parse(readFileSync35(file, "utf8"));
+    decl = JSON.parse(readFileSync36(file, "utf8"));
   } catch {
     return { ok: true, linked: [] };
   }
@@ -26868,7 +26997,7 @@ function linkDemoPins(work, probes = {}) {
         remedy: `Install ${pkg} beside behold, then load the demo again.`
       };
     }
-    const link = join47(work, "node_modules", ...pkg.split("/"));
+    const link = join48(work, "node_modules", ...pkg.split("/"));
     if (!present(link)) {
       mkdirSync7(dirname16(link), { recursive: true });
       symlinkSync2(found.dir, link, "junction");
@@ -26903,13 +27032,13 @@ function linksTo(link, target) {
 }
 
 // src/demos.ts
-import { readFileSync as readFileSync36, existsSync as existsSync28, cpSync, mkdirSync as mkdirSync8 } from "node:fs";
-import { dirname as dirname17, isAbsolute as isAbsolute5, join as join48, relative as relative10, resolve as resolve31, sep as sep9 } from "node:path";
+import { readFileSync as readFileSync37, existsSync as existsSync29, cpSync, mkdirSync as mkdirSync8 } from "node:fs";
+import { dirname as dirname17, isAbsolute as isAbsolute5, join as join49, relative as relative10, resolve as resolve31, sep as sep9 } from "node:path";
 import { spawn as spawn8, spawnSync as spawnSync3 } from "node:child_process";
 function readCatalog(file, catalog) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync36(file, "utf8"));
+    raw = JSON.parse(readFileSync37(file, "utf8"));
   } catch {
     return [];
   }
@@ -26949,10 +27078,10 @@ function validEntry(e) {
   return true;
 }
 function loadDemoRegistry(pkgRoot3) {
-  const merged = readCatalog(join48(pkgRoot3, "demos.json"), "demos");
+  const merged = readCatalog(join49(pkgRoot3, "demos.json"), "demos");
   const seen = new Set(merged.map((e) => e.name));
   const named = process.env.BEHOLD_WORKBENCH;
-  for (const e of [...readCatalog(join48(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve31(named), "workbench") : []]) {
+  for (const e of [...readCatalog(join49(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve31(named), "workbench") : []]) {
     if (seen.has(e.name)) {
       process.stderr.write(`behold: workbench entry "${e.name}" collides with a demo already in the catalog \u2014 dropped
 `);
@@ -26971,11 +27100,11 @@ function missingRequirements(entry) {
   const bins = entry.source === "git" && !entry.requires.includes("git") ? [...entry.requires, "git"] : entry.requires;
   const finder = process.platform === "win32" ? "where" : "which";
   const missing = bins.filter((bin) => {
-    if (bin === "choudoufu" && process.env.CHOUDOUFU_BIN && existsSync28(process.env.CHOUDOUFU_BIN)) return false;
+    if (bin === "choudoufu" && process.env.CHOUDOUFU_BIN && existsSync29(process.env.CHOUDOUFU_BIN)) return false;
     return spawnSync3(finder, [bin], { stdio: "ignore" }).status !== 0;
   });
   const local = demoLocalPath(entry);
-  if (local && !existsSync28(local)) missing.push(`${entry.path} (not checked out)`);
+  if (local && !existsSync29(local)) missing.push(`${entry.path} (not checked out)`);
   return missing;
 }
 function fetchesFromNetwork(entry) {
@@ -26985,7 +27114,7 @@ function demoTargetDir(entry, cwd = process.cwd()) {
   const inPlace = entry.inPlace ? demoLocalPath(entry) : void 0;
   if (inPlace) return inPlace;
   const legacy = resolve31(cwd, "behold-demo");
-  if (entry.name === "writes" && existsSync28(legacy)) return legacy;
+  if (entry.name === "writes" && existsSync29(legacy)) return legacy;
   return resolve31(cwd, "behold-demos", entry.name);
 }
 async function loadDemo(entry, opts) {
@@ -26995,12 +27124,12 @@ async function loadDemo(entry, opts) {
   const inPlace = entry.source === "local" && entry.inPlace;
   const work = inPlace ? local : target;
   if (inPlace) {
-    if (!existsSync28(work)) return { ok: false, error: `${entry.path} is not checked out (looked in ${work})` };
+    if (!existsSync29(work)) return { ok: false, error: `${entry.path} is not checked out (looked in ${work})` };
     say(`serving ${work} where it is \u2014 nothing copied`);
-  } else if (!existsSync28(target)) {
+  } else if (!existsSync29(target)) {
     if (entry.source === "bundled" || entry.source === "local" && local) {
-      const from = entry.source === "bundled" ? join48(pkgRoot3, entry.dir) : local;
-      if (!existsSync28(from)) return { ok: false, error: entry.source === "bundled" ? `this install has no bundled ${entry.dir}` : `${entry.path} is not checked out (looked in ${from})` };
+      const from = entry.source === "bundled" ? join49(pkgRoot3, entry.dir) : local;
+      if (!existsSync29(from)) return { ok: false, error: entry.source === "bundled" ? `this install has no bundled ${entry.dir}` : `${entry.path} is not checked out (looked in ${from})` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
         cpSync(from, target, {
@@ -27031,7 +27160,7 @@ async function loadDemo(entry, opts) {
     if (!pins.ok) return { ok: false, error: `${pins.error} ${pins.remedy}` };
     for (const p of pins.linked) say(`linked ${p.pkg} ${p.version} into the copy${p.was ? ` (the declaration pinned ${p.was}; now ${p.version})` : ""}`);
   }
-  if (!inPlace && existsSync28(join48(work, "package.json")) && !existsSync28(join48(work, "node_modules"))) {
+  if (!inPlace && existsSync29(join49(work, "package.json")) && !existsSync29(join49(work, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: work, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${work}` };
@@ -27048,7 +27177,7 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join48(work, d)) : [work] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join49(work, d)) : [work] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
@@ -27059,8 +27188,8 @@ function runStep(cmd, args, opts = {}) {
 }
 
 // src/server.ts
-var pkgRoot = join49(dirname18(fileURLToPath10(import.meta.url)), "..");
-var webRoot = join49(pkgRoot, "web");
+var pkgRoot = join50(dirname18(fileURLToPath10(import.meta.url)), "..");
+var webRoot = join50(pkgRoot, "web");
 var execFileP = async (cmd, args) => (await promisify3(execFile5)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
@@ -27111,7 +27240,7 @@ function tierFailure(tier, message2) {
 function beholdVersion() {
   try {
     const here = dirname18(fileURLToPath10(import.meta.url));
-    return JSON.parse(readFileSync37(join49(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync38(join50(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -27158,7 +27287,7 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
   }
 }
 function carveRoutes(app, reportPath, demo) {
-  const load2 = () => readCarveReport(reportPath, (p) => readFileSync37(p, "utf8"));
+  const load2 = () => readCarveReport(reportPath, (p) => readFileSync38(p, "utf8"));
   const carveDirs = [dirname18(reportPath), ...demo ? [demo.out] : []];
   const carveStates = () => readCarveStates(carveDirs, nodeCarveIo, 0);
   const emittedNodes = async (states) => {
@@ -27550,8 +27679,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (!sub) return c.json({ error: `unknown substrate "${name}"` }, 404);
     if (!sub.bringUp) return c.json({ error: `no bring-up available for "${name}"` }, 400);
     const { label, cmd, args } = sub.bringUp;
-    const PIPELINE_FORGES = { "gitlab-ci": "gitlab", forgejo: "forgejo" };
-    const forge = PIPELINE_FORGES[name];
+    const PIPELINE_FORGES2 = { "gitlab-ci": "gitlab", forgejo: "forgejo" };
+    const forge = PIPELINE_FORGES2[name];
     if (forge) {
       const parsed = await ciPipeline(cfg.projectDir, { env: cfg.env }, forge).catch(() => void 0);
       if (parsed && parsed.jobs.length > 0) {
@@ -27567,9 +27696,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join49(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join49(cfg.projectDir, "scripts/local/local-up.sh");
-    if (!existsSync29(down) || !existsSync29(up)) {
+    const down = join50(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join50(cfg.projectDir, "scripts/local/local-up.sh");
+    if (!existsSync30(down) || !existsSync30(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
     if (!runner.bringUp("reset local emulator", "bash", ["-c", "bash scripts/local/local-down.sh && bash scripts/local/local-up.sh"], cfg.projectDir)) {
@@ -27590,7 +27719,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const dirs = [];
     const declared = [];
     for (const f of discoverOpIrs(estateDirs)) {
-      const parsed = readOpIr(f.path, (p) => readFileSync37(p, "utf8"));
+      const parsed = readOpIr(f.path, (p) => readFileSync38(p, "utf8"));
       if (!parsed.ok) continue;
       const mine = declaredConvergeOps([parsed.ir]);
       if (!mine.length) continue;
@@ -27820,7 +27949,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         const decl = servedTerragucciComponents();
         if (!decl) return {};
         const waves = decl.pipeline.jobs.filter((j) => typeof j.wave === "number").map((j) => ({ job: j.name, wave: j.wave, roots: [...j.applies] }));
-        return { terragucciRoots: { roots: Object.keys(decl.roots).sort(), waves } };
+        const tools = repoTools(cfg.projectDir, tgConfig());
+        const rootTools2 = declaredRootTools(cfg.projectDir, decl.roots);
+        return { terragucciRoots: { roots: Object.keys(decl.roots).sort(), waves, ...tools.length ? { tools } : {}, ...Object.keys(rootTools2).length ? { rootTools: rootTools2 } : {} } };
       })(),
       // #517: a SQL Yodeler repo is migrated by its pipeline; same contract.
       ...(() => {
@@ -27896,8 +28027,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
     const dir = typeof body.dir === "string" && body.dir.trim() ? resolve32(body.dir.trim()) : "";
-    if (!dir || !existsSync29(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync29(join49(dir, "chant.config.ts"))) {
+    if (!dir || !existsSync30(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
+    if (!existsSync30(join50(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -27948,7 +28079,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       fetches: fetchesFromNetwork(e),
       ...e.repo ? { repo: e.repo } : {},
       target,
-      loaded: existsSync29(target),
+      loaded: existsSync30(target),
       satisfiable: missing.length === 0,
       // #254: the carve walkthrough runs fine here — it just isn't a project
       // to switch INTO. Carve mode claims `/api/graph` and `/api/project` at
@@ -28164,6 +28295,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const { project } = terraformMemberProject(cfg.projectDir);
     const ir = await componentGraphIr(project, tierTargetOpts(opts));
     const titles = waveTitles(ir, decl);
+    const forge = pipelineForge(decl, cfg.projectDir, tgConfig());
+    const tools = repoTools(cfg.projectDir, tgConfig());
+    const rootToolsByName = declaredRootTools(cfg.projectDir, decl.roots);
     const { svg } = renderGraph(ir, { waveTitles: titles });
     const waves = Object.keys(ir.groups.byWave ?? {}).length;
     const noun = hasTerragruntUnits(cfg.projectDir) ? "unit" : "root";
@@ -28181,7 +28315,11 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         // The CI facet's source on a terragucci repo: the declared jobs, not a
         // chant-generated pipeline (`/api/ci`, which a public view refuses).
         terragucciComponents: {
-          ...decl.pipeline.forge ? { forge: decl.pipeline.forge } : {},
+          // behold#571: the forge, and what said so, for each wave box's mark (web/forge-mark.js).
+          ...forge ? { forge: forge.forge, forgeFrom: forge.from } : decl.pipeline.forge ? { forge: decl.pipeline.forge } : {},
+          ...tools.length ? { tools } : {},
+          // behold#571: the tools a root carries inside it (a SQL Yodeler project), by root name.
+          ...Object.keys(rootToolsByName).length ? { rootTools: rootToolsByName } : {},
           ...decl.pipeline.path ? { pipeline: decl.pipeline.path } : {},
           jobs: Object.values(componentJobs(decl)),
           // component -> the root it applies: the live marks' join onto the
@@ -28245,7 +28383,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const parsedOps = [];
         for (const f of files) {
-          const parsed = readOpIr(f.path, (p) => readFileSync37(p, "utf8"));
+          const parsed = readOpIr(f.path, (p) => readFileSync38(p, "utf8"));
           if (!parsed.ok) return c.json(parsed.refusal, 422);
           parsedOps.push(parsed.ir);
         }
@@ -28258,8 +28396,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const runState = runner.runState;
         const ranOp = runState.op ? parsedOps.find((o) => o.name === runState.op) : void 0;
-        const join54 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
-        const opsIr = join54 ? paintPlayhead(declaredIr, join54, runState.gate) : declaredIr;
+        const join55 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
+        const opsIr = join55 ? paintPlayhead(declaredIr, join55, runState.gate) : declaredIr;
         const { svg: svg2 } = renderGraph(opsIr, { boxes: "byStack" });
         const operator = runner.noteDeclaredConvergeOps(declaredConvergeOps(parsedOps));
         return c.json({
@@ -28272,7 +28410,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
             target: null,
             mode: "ops",
             ops: parsedOps.length,
-            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join54)} ${operatorNote(operator)}`,
+            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join55)} ${operatorNote(operator)}`,
             // The operator strip's own model: the ConvergeOps this project
             // declares, plus whatever the last status read said. `declared`
             // without a `strip` is the honest starting state — a loop exists and
@@ -28385,7 +28523,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync29(join49(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync30(join50(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -29024,7 +29162,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (!c.req.path.startsWith("/api/") && c.res.ok && !c.res.headers.has("cache-control")) c.res.headers.set("cache-control", "no-cache");
   });
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join49(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join50(rel, "index.html") }));
   if (cfg.terragucci) vendorFallback(app);
   return app;
 }
@@ -29054,7 +29192,7 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync29(join49(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync30(join50(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -29229,8 +29367,8 @@ init_chant();
 
 // src/workspace-convert.ts
 init_chant();
-import { existsSync as existsSync30, mkdirSync as mkdirSync9, readFileSync as readFileSync38, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { basename as basename6, dirname as dirname19, join as join50, relative as relative12, resolve as resolve33, sep as sep11 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync9, readFileSync as readFileSync39, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { basename as basename6, dirname as dirname19, join as join51, relative as relative12, resolve as resolve33, sep as sep11 } from "node:path";
 import { shortStackNames as shortStackNames2 } from "@intentius/pinhole";
 init_project();
 init_terraform_member();
@@ -29248,10 +29386,10 @@ function unique(name, taken) {
 var posix5 = (p) => p.split(sep11).join("/");
 function installedVersion(pkg, dir) {
   for (let at2 = resolve33(dir); ; at2 = dirname19(at2)) {
-    const manifest = join50(at2, "node_modules", ...pkg.split("/"), "package.json");
-    if (existsSync30(manifest)) {
+    const manifest = join51(at2, "node_modules", ...pkg.split("/"), "package.json");
+    if (existsSync31(manifest)) {
       try {
-        const v = JSON.parse(readFileSync38(manifest, "utf8")).version;
+        const v = JSON.parse(readFileSync39(manifest, "utf8")).version;
         return typeof v === "string" ? v : void 0;
       } catch {
         return void 0;
@@ -29262,7 +29400,7 @@ function installedVersion(pkg, dir) {
 }
 function planConversion(rootArg) {
   const root = resolve33(rootArg);
-  const existing = DECLARATION_FILES.find((f) => existsSync30(join50(root, f)));
+  const existing = DECLARATION_FILES.find((f) => existsSync31(join51(root, f)));
   if (existing) return { ok: false, error: `${root} already has ${existing}; there is nothing to convert.` };
   const shape = detectProjectShape(root);
   if (shape.kind !== "estate" || !shape.members?.length || shape.membersFrom === "itself") {
@@ -29283,10 +29421,10 @@ function planConversion(rootArg) {
       const scan = discoverTerraformRoots(abs[i]);
       for (const r of scan.roots) {
         const name2 = unique(declarationName(r.name), taken);
-        members.push({ name: name2, dir: r.dir === "." ? dir : posix5(join50(dir, r.dir)), kind: "terraform" });
+        members.push({ name: name2, dir: r.dir === "." ? dir : posix5(join51(dir, r.dir)), kind: "terraform" });
         moves.push({ from: `${short}/${r.name}/`, to: `${name2}/${name2}/` });
       }
-      for (const s of scan.skipped) notes.push(`${posix5(join50(dir, s.dir))} is not declared: ${s.why}.`);
+      for (const s of scan.skipped) notes.push(`${posix5(join51(dir, s.dir))} is not declared: ${s.why}.`);
       if (scan.roots.length > 1) notes.push(`${dir} held ${scan.roots.length} Terraform roots; each is its own member now, since a chant terraform member is one root.`);
       return;
     }
@@ -29314,7 +29452,7 @@ function planConversion(rootArg) {
   };
   const firstLayout = layoutPath(abs[0]);
   moves.sort((a, b) => b.from.length - a.from.length);
-  return { ok: true, plan: { root, from: shape.membersFrom === "behold-config" ? "behold-config" : "workspaces", declaration, moves, ...existsSync30(firstLayout) ? { layoutFrom: firstLayout } : {}, notes } };
+  return { ok: true, plan: { root, from: shape.membersFrom === "behold-config" ? "behold-config" : "workspaces", declaration, moves, ...existsSync31(firstLayout) ? { layoutFrom: firstLayout } : {}, notes } };
 }
 function moveLayoutIds(file, moves) {
   const lenses = {};
@@ -29329,18 +29467,18 @@ function moveLayoutIds(file, moves) {
   return { version: 1, lenses };
 }
 function applyConversion(plan) {
-  const declarationFile = join50(plan.root, DECLARATION_FILES[0]);
-  if (existsSync30(declarationFile)) throw new Error(`${declarationFile} appeared while converting; nothing was written`);
+  const declarationFile = join51(plan.root, DECLARATION_FILES[0]);
+  if (existsSync31(declarationFile)) throw new Error(`${declarationFile} appeared while converting; nothing was written`);
   writeFileSync7(declarationFile, `${JSON.stringify(plan.declaration, null, 2)}
 `);
   let layout;
   const target = layoutPath(plan.root);
   if (!plan.layoutFrom) layout = { skipped: "no saved layout to move" };
   else if (resolve33(plan.layoutFrom) === resolve33(target)) layout = { skipped: "the saved layout is already in the root" };
-  else if (existsSync30(target)) layout = { skipped: `${target} already exists; the layout in ${plan.layoutFrom} was left alone` };
+  else if (existsSync31(target)) layout = { skipped: `${target} already exists; the layout in ${plan.layoutFrom} was left alone` };
   else {
     const moved = moveLayoutIds(readLayoutFile(dirname19(dirname19(plan.layoutFrom))), plan.moves);
-    mkdirSync9(join50(plan.root, LAYOUT_DIR), { recursive: true });
+    mkdirSync9(join51(plan.root, LAYOUT_DIR), { recursive: true });
     const tmp = `${target}.tmp`;
     writeFileSync7(tmp, `${JSON.stringify(moved, null, 2)}
 `);
@@ -29351,9 +29489,9 @@ function applyConversion(plan) {
 }
 
 // src/export.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, copyFileSync, cpSync as cpSync2, readFileSync as readFileSync39, readdirSync as readdirSync16, existsSync as existsSync31, realpathSync as realpathSync2 } from "node:fs";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, copyFileSync, cpSync as cpSync2, readFileSync as readFileSync40, readdirSync as readdirSync17, existsSync as existsSync32, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join51, dirname as dirname20, basename as basename7, relative as relative13, resolve as resolve34, sep as sep12 } from "node:path";
+import { join as join52, dirname as dirname20, basename as basename7, relative as relative13, resolve as resolve34, sep as sep12 } from "node:path";
 import { createHash as createHash11 } from "node:crypto";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 var LENS_PARAMS = ["collapse", "components", "detail", "env", "logical", "ops", "radial", "stacks", "tier"];
@@ -29410,24 +29548,24 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join51(dirname20(fileURLToPath11(import.meta.url)), "..", "web");
+  return join52(dirname20(fileURLToPath11(import.meta.url)), "..", "web");
 }
 function pkgRoot2() {
-  return join51(dirname20(fileURLToPath11(import.meta.url)), "..");
+  return join52(dirname20(fileURLToPath11(import.meta.url)), "..");
 }
 var NOTICE_FILES = ["LICENSE", "THIRD_PARTY.md"];
 function copyNotices(outDir, root = pkgRoot2()) {
   const copied = [];
   for (const f of NOTICE_FILES) {
-    if (!existsSync31(join51(root, f))) continue;
-    copyFileSync(join51(root, f), join51(outDir, f));
+    if (!existsSync32(join52(root, f))) continue;
+    copyFileSync(join52(root, f), join52(outDir, f));
     copied.push(f);
   }
-  const lic = join51(root, "licenses");
-  if (existsSync31(lic)) {
-    mkdirSync10(join51(outDir, "licenses"), { recursive: true });
-    for (const f of readdirSync16(lic)) {
-      copyFileSync(join51(lic, f), join51(outDir, "licenses", f));
+  const lic = join52(root, "licenses");
+  if (existsSync32(lic)) {
+    mkdirSync10(join52(outDir, "licenses"), { recursive: true });
+    for (const f of readdirSync17(lic)) {
+      copyFileSync(join52(lic, f), join52(outDir, "licenses", f));
       copied.push(`licenses/${f}`);
     }
   }
@@ -29452,7 +29590,7 @@ async function runExport(cfg, outDir, opts = {}) {
     ...proj.sqlYodeler ? { sqlYodeler: true } : {}
   };
   const scrub = exportScrubber(cfg);
-  const snapDir = join51(outDir, "snapshots");
+  const snapDir = join52(outDir, "snapshots");
   mkdirSync10(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
@@ -29461,7 +29599,7 @@ async function runExport(cfg, outDir, opts = {}) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = scrub(shapeSnapshot(key, await res.text(), opts));
     const file = slug3(key, body);
-    writeFileSync8(join51(snapDir, file), body);
+    writeFileSync8(join52(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -29483,29 +29621,29 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync8(join51(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync39(join51(webDir(), "index.html"), "utf8").replace(
+  writeFileSync8(join52(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync40(join52(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync8(join51(outDir, "index.html"), html);
-  for (const f of readdirSync16(webDir())) {
+  writeFileSync8(join52(outDir, "index.html"), html);
+  for (const f of readdirSync17(webDir())) {
     if (f === "index.html" || f.endsWith(".test.js")) continue;
-    cpSync2(join51(webDir(), f), join51(outDir, f), { recursive: true });
+    cpSync2(join52(webDir(), f), join52(outDir, f), { recursive: true });
   }
-  writeFileSync8(join51(outDir, "README.md"), BUNDLE_README);
+  writeFileSync8(join52(outDir, "README.md"), BUNDLE_README);
   copyNotices(outDir);
   const name = workerName(cfg.projectDir, opts.name);
   writeFileSync8(
-    join51(outDir, "wrangler.jsonc"),
+    join52(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
       2
     ) + "\n"
   );
-  writeFileSync8(join51(outDir, "manifest.json"), JSON.stringify({ ...manifest, files: bundleFiles(outDir).filter((f) => f !== "manifest.json") }, null, 2));
+  writeFileSync8(join52(outDir, "manifest.json"), JSON.stringify({ ...manifest, files: bundleFiles(outDir).filter((f) => f !== "manifest.json") }, null, 2));
   process.stdout.write(
     `behold export \u2192 ${outDir}
   ${ok} snapshots${failed ? ` (${failed} endpoint error(s) captured as-is)` : ""}
@@ -29602,7 +29740,7 @@ function manifestFiles(text2) {
   return Object.values(map).filter((f) => typeof f === "string" && /^snapshots\/[A-Za-z0-9=_.-]+$/.test(f) && !f.includes(".."));
 }
 function bundleFiles(outDir) {
-  return readdirSync16(outDir, { recursive: true, withFileTypes: true }).filter((d) => d.isFile()).map((d) => relative13(outDir, join51(d.parentPath, d.name)).split(sep12).join("/")).sort();
+  return readdirSync17(outDir, { recursive: true, withFileTypes: true }).filter((d) => d.isFile()).map((d) => relative13(outDir, join52(d.parentPath, d.name)).split(sep12).join("/")).sort();
 }
 async function publishBundle(outDir, target, client) {
   const files = bundleFiles(outDir);
@@ -29618,7 +29756,7 @@ async function publishBundle(outDir, target, client) {
   }
   const last = ["manifest.json", "index.html"];
   const order = [...files.filter((f) => !last.includes(f)), ...last.filter((f) => files.includes(f))];
-  for (const f of order) await client.put(at2(f), readFileSync39(join51(outDir, f)), contentType(f), CONTENT_ADDRESSED.test(f) ? IMMUTABLE : NO_CACHE);
+  for (const f of order) await client.put(at2(f), readFileSync40(join52(outDir, f)), contentType(f), CONTENT_ADDRESSED.test(f) ? IMMUTABLE : NO_CACHE);
   const wrote = new Set(files);
   const removed = [];
   for (const f of previous) {
@@ -29670,8 +29808,8 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 
 // src/publish-snapshots.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { readFileSync as readFileSync40 } from "node:fs";
-import { join as join52 } from "node:path";
+import { readFileSync as readFileSync41 } from "node:fs";
+import { join as join53 } from "node:path";
 var DEFAULT_KEEP = 30;
 var SNAPSHOT_REPORTS_BASE = "../../../";
 var COMMIT = /^[0-9a-f]{7,64}$/;
@@ -29759,7 +29897,7 @@ async function publishSnapshot(outDir, target, commit, client, opts = {}) {
   const keep = opts.keep ?? DEFAULT_KEEP;
   if (!Number.isInteger(keep) || keep < 1) throw new Error(`--keep takes a whole number of at least 1, not ${keep}`);
   const at2 = (f) => `${target.prefix}/${f}`;
-  const local = JSON.parse(readFileSync40(join52(outDir, "manifest.json"), "utf8"));
+  const local = JSON.parse(readFileSync41(join53(outDir, "manifest.json"), "utf8"));
   const generated = local.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const entry = { commit: sha, at: commit.at ?? generated, project: opts.project ?? local.projectDir ?? "", generated };
   const bundle = await publishBundle(outDir, { bucket: target.bucket, prefix: at2(sha) }, client);
@@ -30260,7 +30398,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join53(dir, m.dir)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join54(dir, m.dir)).join(" ")}
 `
     );
     return;
@@ -30296,7 +30434,7 @@ async function runCarve(rest) {
     process.exit(2);
   }
   const reportPath = resolve35(fileArg);
-  const parsed = readCarveReport(reportPath, (p) => readFileSync41(p, "utf8"));
+  const parsed = readCarveReport(reportPath, (p) => readFileSync42(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
   ${parsed.refusal.remedy}
@@ -30325,7 +30463,7 @@ async function runDoctor(rest) {
     }
   }
   const dir = dirArg ?? ".";
-  if (!existsSync32(resolve35(dir))) {
+  if (!existsSync33(resolve35(dir))) {
     process.stderr.write(`behold doctor: no such directory: ${resolve35(dir)}
 `);
     process.exit(2);
@@ -30362,7 +30500,7 @@ ${check.stdout || check.stderr}
   if (check.code !== 0) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot3 = join53(dirname21(fileURLToPath12(import.meta.url)), "..");
+  const pkgRoot3 = join54(dirname21(fileURLToPath12(import.meta.url)), "..");
   const registry2 = loadDemoRegistry(pkgRoot3);
   let port = 4600;
   let live2 = false;
@@ -30497,7 +30635,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     };
     process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
   }
-  if (existsSync32(join53(project, "package.json")) && !existsSync32(join53(project, "node_modules"))) {
+  if (existsSync33(join54(project, "package.json")) && !existsSync33(join54(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -30508,7 +30646,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     }
   }
   let degraded;
-  if (!existsSync32(join53(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
+  if (!existsSync33(join54(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
     process.stdout.write(`behold demo carve \u2192 npm install ${HCL_PARSER_PKG} (chant's HCL parser, ~2MB, once)\u2026
 `);
     const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", HCL_PARSER_PKG], target);
@@ -30525,7 +30663,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     );
     if (code !== 0) degraded = `chant carve advise exited ${code}`;
   }
-  const serving = !degraded && existsSync32(report) ? report : committed;
+  const serving = !degraded && existsSync33(report) ? report : committed;
   if (degraded) {
     process.stderr.write(
       `behold demo carve: ${degraded}
@@ -30533,7 +30671,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
 `
     );
   }
-  if (!existsSync32(serving)) {
+  if (!existsSync33(serving)) {
     process.stderr.write(`behold demo carve: no carve report at ${serving}
 `);
     process.exit(2);
@@ -30579,7 +30717,7 @@ async function runPreview(rest) {
     process.exit(2);
   }
   const projectDir = resolve35(dirArg ?? process.cwd());
-  if (!existsSync32(projectDir)) {
+  if (!existsSync33(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -30670,7 +30808,7 @@ async function runExportCmd(rest) {
     injectEmulatorEnv(env);
     env ??= "local";
   }
-  if (!existsSync32(projectDir)) {
+  if (!existsSync33(projectDir)) {
     process.stderr.write(`behold export: project not found at ${projectDir}
 `);
     process.exit(2);