@intentius/behold 0.5.0 → 0.7.0

package/example-flux-estate/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "behold-example-flux-estate",
+  "private": true,
+  "description": "A GitOps estate for behold's flux-estate demo: a Flux control plane + two app projects, served composed.",
+  "workspaces": [
+    "control-plane",
+    "app-a",
+    "app-b"
+  ]
+}

package/example-flux-estate/scripts/estate-down.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Tear the flux-estate demo down: delete the uniquely-named cluster and
+# restore whatever kubectl context was current before estate-up.sh switched it.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+CLUSTER=behold-flux-demo
+STATE="scripts/.prev-context"
+
+k3d cluster delete "$CLUSTER" 2>/dev/null || echo "flux-estate demo: no ${CLUSTER} cluster to remove."
+if [ -f "$STATE" ]; then
+  prev="$(cat "$STATE")"
+  if [ -n "$prev" ] && kubectl config get-contexts -o name 2>/dev/null | grep -qx "$prev"; then
+    kubectl config use-context "$prev" >/dev/null
+    echo "flux-estate demo: restored kubectl context \"$prev\"."
+  fi
+  rm -f "$STATE"
+fi
+echo "flux-estate demo: cluster removed."

package/example-flux-estate/scripts/estate-up.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Stand up the flux-estate demo (#211): a throwaway single-node k3d cluster,
+# Flux's controllers (applied straight from the pinned release manifest — no
+# flux CLI needed), and the control plane's CRs. From there the reconcilers
+# deploy the app projects out of behold's public repo.
+#
+# Safety, same contract as example-k8s: never touches any OTHER kubeconfig
+# context. Whatever context is current is saved to .prev-context and restored
+# by estate-down.sh; the cluster and its context are uniquely named
+# (behold-flux-demo / k3d-behold-flux-demo).
+#
+# BEHOLD_FLUX_REF (optional): patch the LIVE GitRepository to sync a branch
+# other than main — how a not-yet-merged manifests change is verified. The
+# declared source always says main.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+CLUSTER=behold-flux-demo
+CONTEXT="k3d-${CLUSTER}"
+STATE="scripts/.prev-context"
+FLUX_MANIFEST="https://github.com/fluxcd/flux2/releases/download/v2.4.0/install.yaml"
+
+if ! docker info >/dev/null 2>&1; then
+  echo "flux-estate demo: Docker is not running — start Docker and re-run." >&2
+  exit 1
+fi
+for bin in k3d kubectl; do
+  if ! command -v "$bin" >/dev/null 2>&1; then
+    echo "flux-estate demo: $bin is not installed." >&2
+    exit 1
+  fi
+done
+
+if ! k3d cluster list 2>/dev/null | grep -q "^${CLUSTER} "; then
+  kubectl config current-context > "$STATE" 2>/dev/null || true
+  k3d cluster create "$CLUSTER" --wait
+else
+  echo "flux-estate demo: cluster ${CLUSTER} already up — reusing."
+fi
+
+echo "flux-estate demo: installing Flux controllers (${FLUX_MANIFEST##*/download/})…"
+kubectl --context "$CONTEXT" apply -f "$FLUX_MANIFEST" > /dev/null
+kubectl --context "$CONTEXT" -n flux-system rollout status deploy/source-controller --timeout=180s
+kubectl --context "$CONTEXT" -n flux-system rollout status deploy/kustomize-controller --timeout=180s
+
+echo "flux-estate demo: building + applying the control plane's CRs…"
+(cd control-plane && npx chant build src -o dist/control-plane.yaml --format yaml)
+kubectl --context "$CONTEXT" apply -f control-plane/dist/control-plane.yaml
+
+if [ -n "${BEHOLD_FLUX_REF:-}" ]; then
+  echo "flux-estate demo: syncing branch ${BEHOLD_FLUX_REF} instead of main (BEHOLD_FLUX_REF)"
+  kubectl --context "$CONTEXT" -n flux-system patch gitrepository behold --type merge \
+    -p "{\"spec\":{\"ref\":{\"branch\":\"${BEHOLD_FLUX_REF}\"}}}"
+fi
+
+echo "flux-estate demo: waiting for the reconcilers to deploy the apps…"
+kubectl --context "$CONTEXT" -n flux-system wait --for=condition=Ready --timeout=180s gitrepository/behold
+kubectl --context "$CONTEXT" -n flux-system wait --for=condition=Ready --timeout=180s kustomization/app-a kustomization/app-b
+kubectl --context "$CONTEXT" -n app-a rollout status deploy/app-a --timeout=180s
+kubectl --context "$CONTEXT" -n app-b rollout status deploy/app-b --timeout=180s
+echo "flux-estate demo: up — Flux deployed both apps from the repo."

package/example-k8s/package-lock.json

@@ -6,9 +6,9 @@
     "": {
       "name": "behold-example-k8s",
       "dependencies": {
-        "@intentius/chant": "^0.32.0",
-        "@intentius/chant-lexicon-k8s": "^0.32.0",
-        "@intentius/chant-lexicon-temporal": "^0.32.0"
+        "@intentius/chant": "^0.44.2",
+        "@intentius/chant-lexicon-k8s": "^0.44.2",
+        "@intentius/chant-lexicon-temporal": "^0.44.2"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -443,9 +443,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.32.0.tgz",
-      "integrity": "sha512-U+wnypMgidM/SS6nA0vff+8KP6KBeZL5+0laeU3slhnCUU+zFKIg6NxFZcxsZE81P/VFOPstZnSMU9KUqcwjvg==",
+      "version": "0.44.2",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.2.tgz",
+      "integrity": "sha512-qGt/eAteVO6R6UGDEo7QdlRL48lOiTnjYc58OLrxMfDJ1nxzQaDa68H7UnGytApQ1mOdLcEsK60lX8vnYYg0Nw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -461,9 +461,9 @@
       }
     },
     "node_modules/@intentius/chant-k8s-client": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.32.0.tgz",
-      "integrity": "sha512-I4bwNqvzfrEgjY9ZM7Ya73xLaDbgS1zzKza4gtwod4au7jpD+5kO22Pb+NAFgMb6c+kxgApaWFC3OVD1ewJpbg==",
+      "version": "0.44.2",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.2.tgz",
+      "integrity": "sha512-97r6hXTwnSw2f2CDFCaBoKOs6J1VHj2l59vTvQ5Q+HFq1XPADilmRAcAq5vbcFFkIZbfbAe4JiRbMls0ATDW2w==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -471,33 +471,36 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-k8s": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.32.0.tgz",
-      "integrity": "sha512-47MJBS1g9BvP+J5rZ0HdCNtdKyU31O9cpLG3VqyiP/Q5YhJeLgrLbPFwAzphCUmEFMswuK+LXAiS3Vu/HXuXYQ==",
+      "version": "0.44.2",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.2.tgz",
+      "integrity": "sha512-w3OycY5D/dez3J+7L0NjxcEA4AjAVhfZHC9jeawei+vWo2cbN74H8RKRqS3WHdyqiaBWlyiJRuI+8lJxEVSzUA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@types/js-yaml": "^4.0.9",
         "js-yaml": "^4.1.1"
       },
       "optionalDependencies": {
-        "@intentius/chant-k8s-client": "^0.32.0"
+        "@intentius/chant-k8s-client": "^0.44.2"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.32.0",
-        "typescript": "^5.9.3"
+        "@intentius/chant": "^0.44.2",
+        "typescript": "^5.9.3",
+        "zod": "^4.3.6"
       }
     },
     "node_modules/@intentius/chant-lexicon-temporal": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.32.0.tgz",
-      "integrity": "sha512-A/JEV3dwgNp1RcguWWGxYUfwx/7nQ3btHtFoqHJVJ3zZo9qodpDCTOTHNDJrM1yuq6sCp22I0gJeS4ZkdDS2Tg==",
+      "version": "0.44.2",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.2.tgz",
+      "integrity": "sha512-0sHR116Z7mDRgJZudNGgITJs4GDwU5fLgOM6ruJ2u1uIehCd1CYGJ1P7nWtetr4FHfM9vn022iLuO194rvkwcA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@temporalio/common": "^1.17.2"
+        "@temporalio/common": "^1.17.2",
+        "js-yaml": "^4.1.1"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.32.0",
-        "typescript": "^5.9.3"
+        "@intentius/chant": "^0.44.2",
+        "typescript": "^5.9.3",
+        "zod": "^4.3.6"
       }
     },
     "node_modules/@jsep-plugin/assignment": {
@@ -727,9 +730,9 @@
       }
     },
     "node_modules/bare-fs": {
-      "version": "4.7.4",
-      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.7.4.tgz",
-      "integrity": "sha512-y1kC+ffIx/tPLdTE693uNjHfzTfr+ravR5tvWlMXe25nELbkqV400S71qHDwbkAQ1FVEZobB1NFRzFbCCcyBCQ==",
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.8.0.tgz",
+      "integrity": "sha512-fM+MhCvdQhZ7NV6S95a07gPSqjIYKn6mFaXfx266wN3ajZGl/+1AzH+ubkXQ0fFZvOe2nk9VHkzdYkQE5zMV3Q==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -740,7 +743,7 @@
         "fast-fifo": "^1.3.2"
       },
       "engines": {
-        "bare": ">=1.16.0"
+        "bare": ">=1.28.0"
       },
       "peerDependencies": {
         "bare-buffer": "*"
@@ -787,9 +790,9 @@
       }
     },
     "node_modules/bare-url": {
-      "version": "2.4.6",
-      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.4.6.tgz",
-      "integrity": "sha512-iQxPClE07hETVpbRoX7JXX3v/ZQViCxe/SYCxylRLzdEx1xJAufPptfiOqR8tqiCtmbtMDANKWszzjLu1PMAZQ==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.5.1.tgz",
+      "integrity": "sha512-cD5ciQuKlx+eumTCfqbfiL+fhQm+dHbVNB/cX4+d+I/nx4JsVop9VoFEPAs5RJ6I84QR6bZIBjpd2kjDOYeWcg==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -1142,9 +1145,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.3.1",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.3.1.tgz",
-      "integrity": "sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -1162,9 +1165,9 @@
       }
     },
     "node_modules/jose": {
-      "version": "6.2.4",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.4.tgz",
-      "integrity": "sha512-N8acGzVsQy6M/fjFcxtysNc4Q379TcM5dM/qKkNtsHFji88yANnXTr7BLeP75iPnFwBfQzM/jg2BZ9+HZrHCZA==",
+      "version": "6.2.8",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.8.tgz",
+      "integrity": "sha512-Bsdjwm3Qsd/P0jR+BHDe3LytDfY7WBq2HmCCLIwuVRHMuEC9ae7/R474GIUdF1NgCyZjzVo/A9DOiOBtXq8ZoQ==",
       "license": "MIT",
       "optional": true,
       "funding": {
@@ -1172,9 +1175,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "funding": [
         {
           "type": "github",
@@ -2037,9 +2040,9 @@
       "optional": true
     },
     "node_modules/ws": {
-      "version": "8.21.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
-      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "license": "MIT",
       "optional": true,
       "engines": {

package/example-k8s/package.json

@@ -2,13 +2,13 @@
   "name": "behold-example-k8s",
   "private": true,
   "type": "module",
-  "description": "A small nginx Deployment+Service on k3d — behold's k3d turnkey demo (#88), the Kubernetes counterpart to Loom-on-Floci.",
+  "description": "A small nginx Deployment+Service on k3d \u2014 behold's k3d turnkey demo (#88), the Kubernetes counterpart to Loom-on-Floci.",
   "scripts": {
     "build": "./node_modules/.bin/chant build src --lexicon k8s -o app.yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.32.0",
-    "@intentius/chant-lexicon-k8s": "^0.32.0",
-    "@intentius/chant-lexicon-temporal": "^0.32.0"
+    "@intentius/chant": "^0.44.2",
+    "@intentius/chant-lexicon-k8s": "^0.44.2",
+    "@intentius/chant-lexicon-temporal": "^0.44.2"
   }
 }

package/example-writes/package-lock.json

@@ -6,9 +6,9 @@
     "": {
       "name": "behold-example-writes",
       "dependencies": {
-        "@intentius/chant": "^0.32.0",
-        "@intentius/chant-lexicon-aws": "^0.32.0",
-        "@intentius/chant-lexicon-temporal": "^0.32.0"
+        "@intentius/chant": "^0.44.2",
+        "@intentius/chant-lexicon-aws": "^0.44.2",
+        "@intentius/chant-lexicon-temporal": "^0.44.2"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -443,9 +443,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.32.0.tgz",
-      "integrity": "sha512-U+wnypMgidM/SS6nA0vff+8KP6KBeZL5+0laeU3slhnCUU+zFKIg6NxFZcxsZE81P/VFOPstZnSMU9KUqcwjvg==",
+      "version": "0.44.2",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.2.tgz",
+      "integrity": "sha512-qGt/eAteVO6R6UGDEo7QdlRL48lOiTnjYc58OLrxMfDJ1nxzQaDa68H7UnGytApQ1mOdLcEsK60lX8vnYYg0Nw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -461,30 +461,32 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-aws": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.32.0.tgz",
-      "integrity": "sha512-+hebdJ9RxexbMDl4bxG8To4C67qiYD1XEZ6V2i8o+txDUEmBph81Hdpjqf7Z/3x2yg9lDUX4qoFkQpjzmvxUog==",
+      "version": "0.44.2",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.2.tgz",
+      "integrity": "sha512-TPlq70LqLB8KRYLup8njKJeLbQyjofVTvQy892HI2RkacyAohhWj65hxIDH7zbEbnONbfJpolxyaicAzDXmnuw==",
       "license": "Apache-2.0",
       "dependencies": {
         "fflate": "^0.8.2",
         "js-yaml": "^4.1.0"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.32.0",
+        "@intentius/chant": "^0.44.2",
         "typescript": "^5.9.3"
       }
     },
     "node_modules/@intentius/chant-lexicon-temporal": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.32.0.tgz",
-      "integrity": "sha512-A/JEV3dwgNp1RcguWWGxYUfwx/7nQ3btHtFoqHJVJ3zZo9qodpDCTOTHNDJrM1yuq6sCp22I0gJeS4ZkdDS2Tg==",
+      "version": "0.44.2",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.2.tgz",
+      "integrity": "sha512-0sHR116Z7mDRgJZudNGgITJs4GDwU5fLgOM6ruJ2u1uIehCd1CYGJ1P7nWtetr4FHfM9vn022iLuO194rvkwcA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@temporalio/common": "^1.17.2"
+        "@temporalio/common": "^1.17.2",
+        "js-yaml": "^4.1.1"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.32.0",
-        "typescript": "^5.9.3"
+        "@intentius/chant": "^0.44.2",
+        "typescript": "^5.9.3",
+        "zod": "^4.3.6"
       }
     },
     "node_modules/@protobufjs/aspromise": {

package/example-writes/package.json

@@ -7,8 +7,8 @@
     "build": "./node_modules/.bin/chant build src --lexicon aws -o template.json"
   },
   "dependencies": {
-    "@intentius/chant": "^0.32.0",
-    "@intentius/chant-lexicon-aws": "^0.32.0",
-    "@intentius/chant-lexicon-temporal": "^0.32.0"
+    "@intentius/chant": "^0.44.2",
+    "@intentius/chant-lexicon-aws": "^0.44.2",
+    "@intentius/chant-lexicon-temporal": "^0.44.2"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",
   "bin": {
@@ -12,6 +12,7 @@
     "web",
     "example-writes",
     "example-k8s",
+    "example-flux-estate",
     "demos.json",
     "AGENTS.md"
   ],

package/web/app.js

@@ -460,6 +460,16 @@ function renderDiff(panel, diff) {
   const cat = document.createElement("p");
   cat.textContent = DIFF_LABEL[diff.category] || diff.category;
   panel.appendChild(cat);
+  // chant#1620 (#192): where the live read actually looked — the line that
+  // separates "not there" from "looked in the wrong place" (a declared k8s
+  // object with no namespace reads from the DEFAULTED namespace, and only
+  // this address makes that visible). Monospace so a request path scans.
+  if (diff.queried) {
+    const q = document.createElement("p");
+    q.style.cssText = "color:var(--muted);font:11px/1.4 ui-monospace,monospace;overflow-wrap:anywhere;margin-top:2px";
+    q.textContent = `queried: ${diff.queried} → ${diff.category === "missing" ? "not found" : "read failed"}`;
+    panel.appendChild(q);
+  }
   // chant#1168 (#1089): show WHY chant couldn't look, instead of the
   // "no field changes" text below — that phrasing implies a comparison ran
   // and found nothing, which is exactly the wrong read for a hole in the