@intentius/behold 0.7.0 → 0.9.0

package/example-flux-estate/README.md

@@ -3,15 +3,19 @@
 Three chant projects served as one composed estate:
 
 - **control-plane/** — the Flux machinery: a `GitRepository` pointing at
-  behold's own public repo and one `Kustomization` per app. The reconcilers
-  deploy the apps; this project never applies a workload itself.
+  behold's own public repo and one `Kustomization` per app, app-b's gated on
+  app-a's with `dependsOn` (behold#223). The reconcilers deploy the apps; this
+  project never applies a workload itself.
 - **app-a/** — a small web workload with explicit `metadata.namespace` on
   every object: the fully-resolved half.
 - **app-b/** — the same workload with **no** namespace anywhere: the control
   plane's `targetNamespace` stamps it at apply time. Idiomatic Flux, and the
-  deliberate exhibit of behold's namespace-mismatch note (behold#192) — a
-  plain live read scopes to `default`, finds nothing, and behold explains the
-  all-pending paint instead of letting it read as "not deployed".
+  deliberate exhibit of the estate namespace join (behold#221). Served alone,
+  app-b's live read scopes to `default`, finds nothing, and behold explains
+  the all-pending paint with the namespace-mismatch note (behold#192) instead
+  of letting it read as "not deployed". Served composed, the estate reads the
+  binding off the control plane's own `Kustomization` and scopes app-b's read
+  to `app-b` — the answer neither project holds by itself.
 
 ```sh
 npx @intentius/behold demo flux-estate
@@ -22,14 +26,20 @@ controllers straight from the pinned release manifest (no `flux` CLI needed),
 applies the control plane, waits for the reconcilers to deploy both apps from
 this repo, and serves the three projects composed. What to look at:
 
-- The **estate**: per-project boundary boxes, and the `sourceRef` edges wiring
-  Kustomization → GitRepository across stacks.
+- The **estate**: per-project boundary boxes, the `sourceRef` edges wiring
+  Kustomization → GitRepository across stacks, and the `dependsOn` edge from
+  app-b's Kustomization to app-a's — the estate's reconcile ordering.
 - The **overlay** (env `local`): app-a green, the control plane's CRs green,
-  app-b pending **with the note explaining why**.
-- The **runtime tier** on the control plane alone
-  (`behold serve control-plane --env local`, zoom: runtime): the workloads
-  Flux deployed, attributed back to the declaring Kustomization via its
-  labels (chant#1549).
+  and app-b green too — read in the namespace the control plane binds it to,
+  with a note naming where it looked. Serve `app-b` on its own to see the
+  same objects go pending, which is what the join is worth.
+- The **runtime tier** (zoom: runtime), on the estate itself since behold#224:
+  the workloads Flux deployed, attributed back to the declaring Kustomization
+  via its labels (chant#1549) and boxed under it.
+- The **logical lens** (zoom: logical): cluster ⊃ namespace boxes, with each
+  app's objects inside the namespace the control plane declared for them —
+  the view that only exists once the three projects are composed, since the
+  namespaces are declared in one project and filled from the others.
 
 The app `manifests/` are committed `chant build` output — Flux syncs them
 from GitHub `main`, so changes to an app's source need a rebuild

package/example-flux-estate/app-a/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.2",
-    "@intentius/chant-lexicon-k8s": "^0.44.2"
+    "@intentius/chant": "^0.44.6",
+    "@intentius/chant-lexicon-k8s": "^0.44.6"
   }
 }

package/example-flux-estate/app-a/src/app.ts

@@ -1,7 +1,8 @@
 // App A: one small web workload, namespace declared EXPLICITLY on every
 // object. Contrast app-b, which leaves namespace to the control plane's
 // targetNamespace — the two apps together show both halves of the Flux
-// namespace story (behold#192).
+// namespace story: behold#192's note when app-b is served alone, behold#221's
+// estate join when the three projects are served composed.
 import { Deployment, Service } from "@intentius/chant-lexicon-k8s";
 
 const labels = { app: "app-a" };

package/example-flux-estate/app-b/chant.config.ts

@@ -4,9 +4,10 @@ import type { K8sChantConfig } from "@intentius/chant-lexicon-k8s";
 // App project B — the targetNamespace half of the estate: its objects declare
 // no metadata.namespace (see src/app.ts), so the control plane's
 // Kustomization stamps `app-b` at apply time. That is idiomatic Flux, AND it
-// means a plain live read scopes to `default` and finds nothing — behold's
-// namespace-mismatch note (behold#192) names exactly this, on purpose, in
-// this demo.
+// means a live read of THIS PROJECT ALONE scopes to `default` and finds
+// nothing — behold's namespace-mismatch note (behold#192) names exactly this,
+// on purpose, in this demo. Composed with the control plane, behold joins the
+// binding and reads `app-b` instead (behold#221).
 export default {
   lexicons: ["k8s"],
   sourceDir: "src",

package/example-flux-estate/app-b/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.2",
-    "@intentius/chant-lexicon-k8s": "^0.44.2"
+    "@intentius/chant": "^0.44.6",
+    "@intentius/chant-lexicon-k8s": "^0.44.6"
   }
 }

package/example-flux-estate/app-b/src/app.ts

@@ -1,9 +1,11 @@
 // App B: same small workload as app-a, with NO metadata.namespace anywhere —
 // the control plane's Kustomization stamps targetNamespace: app-b at apply
 // time. Idiomatic Flux (that's what the field is for), and the deliberate
-// exhibit of behold's namespace-mismatch note (behold#192): a plain live read
-// scopes to `default`, finds nothing, and behold explains the all-pending
-// paint instead of letting it read as "not deployed".
+// exhibit of behold's estate namespace join (behold#221): served ALONE this
+// project's live read scopes to `default`, finds nothing, and behold explains
+// the all-pending paint with its namespace-mismatch note (behold#192) rather
+// than letting it read as "not deployed". Served COMPOSED, the estate reads
+// the binding off ../../control-plane and scopes the read to `app-b`.
 import { Deployment, Service } from "@intentius/chant-lexicon-k8s";
 
 const labels = { app: "app-b" };

package/example-flux-estate/control-plane/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o dist/control-plane.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.2",
-    "@intentius/chant-lexicon-k8s": "^0.44.2"
+    "@intentius/chant": "^0.44.6",
+    "@intentius/chant-lexicon-k8s": "^0.44.6"
   }
 }

package/example-flux-estate/control-plane/src/flux.ts

@@ -3,8 +3,10 @@
 // Kustomization applies one app project's committed manifests into that app's
 // namespace via targetNamespace — which is why app-b's objects declare no
 // metadata.namespace (see ../../app-b/src/app.ts): Flux stamps it at apply
-// time. That is the normal Flux estate shape, and exactly the shape behold's
-// namespace-mismatch note (behold#192) exists to explain.
+// time. That is the normal Flux estate shape — the one behold#192's note
+// explains for a project served alone, and the one behold#221's estate join
+// resolves outright by reading `targetNamespace` off the Kustomizations
+// below and scoping app-b's live read to it.
 //
 // scripts/estate-up.sh applies the BUILT form of this project (chant build →
 // dist/control-plane.yaml) once, after installing Flux; from then on the
@@ -39,6 +41,11 @@ export const appA = new Kustomization({
   },
 });
 
+// app-b is the estate's second layer: Flux holds it back until app-a has
+// applied cleanly. Nothing in app-b talks to app-a at runtime — the gate is
+// here because a layered estate's ordering is its most load-bearing structure
+// and the demo should show one (behold#223). Same field a real estate uses to
+// put its platform layer ahead of its apps.
 export const appB = new Kustomization({
   metadata: { name: "app-b", namespace: "flux-system" },
   spec: {
@@ -47,5 +54,6 @@ export const appB = new Kustomization({
     targetNamespace: "app-b",
     sourceRef: { kind: "GitRepository", name: "behold" },
     path: "./example-flux-estate/app-b/manifests",
+    dependsOn: [{ name: "app-a" }],
   },
 });

package/example-flux-estate/package-lock.json

@@ -14,22 +14,22 @@
     "app-a": {
       "name": "behold-example-flux-app-a",
       "dependencies": {
-        "@intentius/chant": "^0.44.2",
-        "@intentius/chant-lexicon-k8s": "^0.44.2"
+        "@intentius/chant": "^0.44.6",
+        "@intentius/chant-lexicon-k8s": "^0.44.6"
       }
     },
     "app-b": {
       "name": "behold-example-flux-app-b",
       "dependencies": {
-        "@intentius/chant": "^0.44.2",
-        "@intentius/chant-lexicon-k8s": "^0.44.2"
+        "@intentius/chant": "^0.44.6",
+        "@intentius/chant-lexicon-k8s": "^0.44.6"
       }
     },
     "control-plane": {
       "name": "behold-example-flux-control-plane",
       "dependencies": {
-        "@intentius/chant": "^0.44.2",
-        "@intentius/chant-lexicon-k8s": "^0.44.2"
+        "@intentius/chant": "^0.44.6",
+        "@intentius/chant-lexicon-k8s": "^0.44.6"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -464,9 +464,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.2.tgz",
-      "integrity": "sha512-qGt/eAteVO6R6UGDEo7QdlRL48lOiTnjYc58OLrxMfDJ1nxzQaDa68H7UnGytApQ1mOdLcEsK60lX8vnYYg0Nw==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
+      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -482,9 +482,9 @@
       }
     },
     "node_modules/@intentius/chant-k8s-client": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.2.tgz",
-      "integrity": "sha512-97r6hXTwnSw2f2CDFCaBoKOs6J1VHj2l59vTvQ5Q+HFq1XPADilmRAcAq5vbcFFkIZbfbAe4JiRbMls0ATDW2w==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.6.tgz",
+      "integrity": "sha512-Do3zY0Bd2nIITDDrXYePwdOBdnNf59xn5J1aJA6gsg3dzXxR3dZ25YBAh+SQxKbRPuXIbu9rKd5lodaM8ZQDng==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -492,19 +492,19 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-k8s": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.2.tgz",
-      "integrity": "sha512-w3OycY5D/dez3J+7L0NjxcEA4AjAVhfZHC9jeawei+vWo2cbN74H8RKRqS3WHdyqiaBWlyiJRuI+8lJxEVSzUA==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.6.tgz",
+      "integrity": "sha512-JP2Lo4fFV7FPbSTHapKuDgpvrsm3dbNBT9pMW9NQB2MoE/ZkMGf3z3/wsPnygLdjbYq29abVYmw7DzPqBmA1tw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@types/js-yaml": "^4.0.9",
         "js-yaml": "^4.1.1"
       },
       "optionalDependencies": {
-        "@intentius/chant-k8s-client": "^0.44.2"
+        "@intentius/chant-k8s-client": "^0.44.6"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.2",
+        "@intentius/chant": "^0.44.6",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }

package/example-k8s/README.md

@@ -6,13 +6,27 @@ PodDisruptionBudget), deployed from the browser with the **▶ Deploy
 [k3d](https://k3d.io) cluster — no cloud account, no credentials.
 
 ```
-src/config.ts        static config — app name, pinned image tag
+src/config.ts         static config — app name, pinned image tag
 src/web.ts            WebApp composite → Deployment + Service + PodDisruptionBudget
 ops/k3d-apply.op.ts   ApplyOp "k3d-apply" — code → local k3d, server-side apply
-chant.config.ts       lexicons [k8s, temporal], k8s.profiles.local bound to k3d-behold-k3d-demo
+base/                 a plain Deployment + Service, core kinds only
+overlays/dev/         kustomize overlay over base/ — namePrefix "dev-" + a replica patch
+chant.config.ts       lexicons [k8s, temporal], k8s.profiles.local bound to k3d-behold-k3d-demo,
+                       k8s.kustomize.roots: ["overlays/dev"]
 scripts/local/        local-up.sh / local-down.sh — the k3d cluster's own lifecycle
 ```
 
+`overlays/dev` is a real kustomize build root (chant#1626, chant 0.44.3): chant
+renders it (`kustomize build`, `kubectl kustomize` fallback) at build time and
+joins the two rendered objects (`dev-echo` Deployment + Service) to the graph,
+each stamped with a `chant.intentius.io/kustomize-root: overlays/dev`
+annotation. behold's kustomize lens (behold#171/#217) reads that stamp and
+boxes them as `overlay dev` in the graph — the same lens a hand-rolled
+`kustomization.yaml` next to typed source triggers via its directory walk, but
+here from chant's own provenance rather than file location. Kept to core/apps
+kinds on purpose: chant#1628 still mistypes a Flux/Argo/cert-manager CR
+rendered through a kustomize root.
+
 ## Run it
 
 From the **behold** repo root:

package/example-k8s/base/deployment.yaml

@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: echo
+  labels:
+    app: echo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: echo
+  template:
+    metadata:
+      labels:
+        app: echo
+    spec:
+      containers:
+        - name: echo
+          image: nginxinc/nginx-unprivileged:1.27-alpine
+          ports:
+            - containerPort: 8080

package/example-k8s/base/kustomization.yaml

@@ -0,0 +1,3 @@
+resources:
+  - deployment.yaml
+  - service.yaml

package/example-k8s/base/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: echo
+  labels:
+    app: echo
+spec:
+  selector:
+    app: echo
+  ports:
+    - port: 80
+      targetPort: 8080

package/example-k8s/chant.config.ts

@@ -17,5 +17,15 @@ export default {
     profiles: {
       local: { context: "k3d-behold-k3d-demo" },
     },
+    // chant#1626 (chant 0.44.3, behold#225): a real kustomize build root —
+    // `overlays/dev` layers a namePrefix and a replica patch onto `base/`.
+    // Rendered at build time and stamped with the
+    // `chant.intentius.io/kustomize-root` provenance annotation, which
+    // behold's kustomize lens (src/logical-kustomize.ts, #217) prefers over
+    // its directory-walk heuristic — the `overlay dev` box in the demo graph
+    // comes from this, not source-file location. Core/apps kinds only inside
+    // the root: chant#1628 still mistypes Flux/Argo/cert-manager CRs
+    // rendered through a kustomize build.
+    kustomize: { roots: ["overlays/dev"] },
   } satisfies K8sChantConfig,
 } satisfies ChantConfig;

package/example-k8s/overlays/dev/kustomization.yaml

@@ -0,0 +1,6 @@
+resources:
+  - ../../base
+namePrefix: dev-
+replicas:
+  - name: echo
+    count: 2

package/example-k8s/package-lock.json

@@ -6,9 +6,9 @@
     "": {
       "name": "behold-example-k8s",
       "dependencies": {
-        "@intentius/chant": "^0.44.2",
-        "@intentius/chant-lexicon-k8s": "^0.44.2",
-        "@intentius/chant-lexicon-temporal": "^0.44.2"
+        "@intentius/chant": "^0.44.6",
+        "@intentius/chant-lexicon-k8s": "^0.44.6",
+        "@intentius/chant-lexicon-temporal": "^0.44.6"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -443,9 +443,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.2.tgz",
-      "integrity": "sha512-qGt/eAteVO6R6UGDEo7QdlRL48lOiTnjYc58OLrxMfDJ1nxzQaDa68H7UnGytApQ1mOdLcEsK60lX8vnYYg0Nw==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
+      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -461,9 +461,9 @@
       }
     },
     "node_modules/@intentius/chant-k8s-client": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.2.tgz",
-      "integrity": "sha512-97r6hXTwnSw2f2CDFCaBoKOs6J1VHj2l59vTvQ5Q+HFq1XPADilmRAcAq5vbcFFkIZbfbAe4JiRbMls0ATDW2w==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.6.tgz",
+      "integrity": "sha512-Do3zY0Bd2nIITDDrXYePwdOBdnNf59xn5J1aJA6gsg3dzXxR3dZ25YBAh+SQxKbRPuXIbu9rKd5lodaM8ZQDng==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -471,34 +471,34 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-k8s": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.2.tgz",
-      "integrity": "sha512-w3OycY5D/dez3J+7L0NjxcEA4AjAVhfZHC9jeawei+vWo2cbN74H8RKRqS3WHdyqiaBWlyiJRuI+8lJxEVSzUA==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.6.tgz",
+      "integrity": "sha512-JP2Lo4fFV7FPbSTHapKuDgpvrsm3dbNBT9pMW9NQB2MoE/ZkMGf3z3/wsPnygLdjbYq29abVYmw7DzPqBmA1tw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@types/js-yaml": "^4.0.9",
         "js-yaml": "^4.1.1"
       },
       "optionalDependencies": {
-        "@intentius/chant-k8s-client": "^0.44.2"
+        "@intentius/chant-k8s-client": "^0.44.6"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.2",
+        "@intentius/chant": "^0.44.6",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }
     },
     "node_modules/@intentius/chant-lexicon-temporal": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.2.tgz",
-      "integrity": "sha512-0sHR116Z7mDRgJZudNGgITJs4GDwU5fLgOM6ruJ2u1uIehCd1CYGJ1P7nWtetr4FHfM9vn022iLuO194rvkwcA==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.6.tgz",
+      "integrity": "sha512-Uta1NNOHjZpI04NLaB9lTjXxAlKM7TSRx4D6Yj76RyeSoIZzcvnFJ9lJjSaIGaN20rdjK1w43b8BxsLOZTrwyA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@temporalio/common": "^1.17.2",
         "js-yaml": "^4.1.1"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.2",
+        "@intentius/chant": "^0.44.6",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }

package/example-k8s/package.json

@@ -7,8 +7,8 @@
     "build": "./node_modules/.bin/chant build src --lexicon k8s -o app.yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.2",
-    "@intentius/chant-lexicon-k8s": "^0.44.2",
-    "@intentius/chant-lexicon-temporal": "^0.44.2"
+    "@intentius/chant": "^0.44.6",
+    "@intentius/chant-lexicon-k8s": "^0.44.6",
+    "@intentius/chant-lexicon-temporal": "^0.44.6"
   }
 }

package/example-writes/package-lock.json

@@ -6,9 +6,9 @@
     "": {
       "name": "behold-example-writes",
       "dependencies": {
-        "@intentius/chant": "^0.44.2",
-        "@intentius/chant-lexicon-aws": "^0.44.2",
-        "@intentius/chant-lexicon-temporal": "^0.44.2"
+        "@intentius/chant": "^0.44.6",
+        "@intentius/chant-lexicon-aws": "^0.44.6",
+        "@intentius/chant-lexicon-temporal": "^0.44.6"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -443,9 +443,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.2.tgz",
-      "integrity": "sha512-qGt/eAteVO6R6UGDEo7QdlRL48lOiTnjYc58OLrxMfDJ1nxzQaDa68H7UnGytApQ1mOdLcEsK60lX8vnYYg0Nw==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
+      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -461,30 +461,30 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-aws": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.2.tgz",
-      "integrity": "sha512-TPlq70LqLB8KRYLup8njKJeLbQyjofVTvQy892HI2RkacyAohhWj65hxIDH7zbEbnONbfJpolxyaicAzDXmnuw==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.6.tgz",
+      "integrity": "sha512-2qGwWFCRLkT9MD5YFnhnZOGDCqPZg9la4MM8szlX8QxFFoQjAulJ8e+vjeCGbWoB8nbSIQ9kJOX8Yn46Pm37iQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "fflate": "^0.8.2",
         "js-yaml": "^4.1.0"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.2",
+        "@intentius/chant": "^0.44.6",
         "typescript": "^5.9.3"
       }
     },
     "node_modules/@intentius/chant-lexicon-temporal": {
-      "version": "0.44.2",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.2.tgz",
-      "integrity": "sha512-0sHR116Z7mDRgJZudNGgITJs4GDwU5fLgOM6ruJ2u1uIehCd1CYGJ1P7nWtetr4FHfM9vn022iLuO194rvkwcA==",
+      "version": "0.44.6",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.6.tgz",
+      "integrity": "sha512-Uta1NNOHjZpI04NLaB9lTjXxAlKM7TSRx4D6Yj76RyeSoIZzcvnFJ9lJjSaIGaN20rdjK1w43b8BxsLOZTrwyA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@temporalio/common": "^1.17.2",
         "js-yaml": "^4.1.1"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.2",
+        "@intentius/chant": "^0.44.6",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }

package/example-writes/package.json

@@ -7,8 +7,8 @@
     "build": "./node_modules/.bin/chant build src --lexicon aws -o template.json"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.2",
-    "@intentius/chant-lexicon-aws": "^0.44.2",
-    "@intentius/chant-lexicon-temporal": "^0.44.2"
+    "@intentius/chant": "^0.44.6",
+    "@intentius/chant-lexicon-aws": "^0.44.6",
+    "@intentius/chant-lexicon-temporal": "^0.44.6"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",
   "bin": {
@@ -13,6 +13,8 @@
     "example-writes",
     "example-k8s",
     "example-flux-estate",
+    "example-argo-estate",
+    "example-carve",
     "demos.json",
     "AGENTS.md"
   ],
@@ -24,18 +26,19 @@
     "dev": "tsx src/cli.ts",
     "demo": "npm --prefix example-writes install && tsx src/cli.ts serve example-writes --local --env prod",
     "demo:k8s": "bash example-k8s/scripts/local/local-up.sh; npm --prefix example-k8s install && tsx src/cli.ts serve example-k8s --local --env local; bash example-k8s/scripts/local/local-down.sh",
-    "smoke:ui": "node smoke/ui-smoke.mjs",
+    "smoke:ui": "tsx smoke/ui-smoke.mjs",
     "tsc": "tsc --noEmit",
     "test": "vitest run",
-    "build": "esbuild src/cli.ts --bundle --platform=node --format=esm --external:hono --external:@hono/node-server --external:@intentius/pinhole --outfile=dist/cli.js && chmod +x dist/cli.js",
+    "build": "esbuild src/cli.ts --bundle --platform=node --format=esm --external:hono --external:@hono/node-server --external:@intentius/pinhole --external:@kubernetes/client-node --outfile=dist/cli.js && chmod +x dist/cli.js",
     "prepare": "npm run build",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@hono/node-server": "^1.13.0",
+    "@hono/node-server": "^2.0.5",
     "@intentius/chant": "^0.38.0",
-    "@intentius/pinhole": "^0.2.5",
-    "hono": "^4.6.0"
+    "@intentius/chant-k8s-client": "^0.44.5",
+    "@intentius/pinhole": "^0.3.3",
+    "hono": "^4.12.34"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",