@intentius/behold 0.9.0 → 0.10.0

package/example-k8s/package-lock.json

@@ -6,9 +6,9 @@
     "": {
       "name": "behold-example-k8s",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6",
-        "@intentius/chant-lexicon-temporal": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7",
+        "@intentius/chant-lexicon-temporal": "^0.44.7"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -443,9 +443,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
-      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.7.tgz",
+      "integrity": "sha512-etCchkfbWFHJ+XnTYVVn9GT4/gZi/O8SVphDXHeuPOfK5VvRxo0unveIUEsuRoHGHgzN9Y+aj0Jk15xhIE7Gzg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -461,9 +461,9 @@
       }
     },
     "node_modules/@intentius/chant-k8s-client": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.6.tgz",
-      "integrity": "sha512-Do3zY0Bd2nIITDDrXYePwdOBdnNf59xn5J1aJA6gsg3dzXxR3dZ25YBAh+SQxKbRPuXIbu9rKd5lodaM8ZQDng==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.7.tgz",
+      "integrity": "sha512-G9VVki/qHZ+hbKrxDDnVVhfeZWoHgozLA7tjcY/lsa/fDIwI0xMJnAN/DJNcQLBpRscXm3y3Ki/PNQ9SxshmLA==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -471,34 +471,34 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-k8s": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.6.tgz",
-      "integrity": "sha512-JP2Lo4fFV7FPbSTHapKuDgpvrsm3dbNBT9pMW9NQB2MoE/ZkMGf3z3/wsPnygLdjbYq29abVYmw7DzPqBmA1tw==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.7.tgz",
+      "integrity": "sha512-h8QXOYoxjsAeA1w8koLQlZqOuSQcvWpEHKmwlf0AKPgwuVRiapwJI+UtuoBwL/AOrBKDh6Z5pW3zbo6vDltGvA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@types/js-yaml": "^4.0.9",
         "js-yaml": "^4.1.1"
       },
       "optionalDependencies": {
-        "@intentius/chant-k8s-client": "^0.44.6"
+        "@intentius/chant-k8s-client": "^0.44.7"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }
     },
     "node_modules/@intentius/chant-lexicon-temporal": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.6.tgz",
-      "integrity": "sha512-Uta1NNOHjZpI04NLaB9lTjXxAlKM7TSRx4D6Yj76RyeSoIZzcvnFJ9lJjSaIGaN20rdjK1w43b8BxsLOZTrwyA==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.7.tgz",
+      "integrity": "sha512-tA7DaXGG9dsHwbMO7SNQhdVnpgsdTtZNyRexS9MdVgS4xuWHIV9N76oISEd2hK76vwPXBD/d/e+2OT6amlse1A==",
       "license": "Apache-2.0",
       "dependencies": {
         "@temporalio/common": "^1.17.2",
         "js-yaml": "^4.1.1"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }
@@ -1145,9 +1145,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
+      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
       "license": "MIT",
       "optional": true,
       "engines": {

package/example-k8s/package.json

@@ -7,8 +7,8 @@
     "build": "./node_modules/.bin/chant build src --lexicon k8s -o app.yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6",
-    "@intentius/chant-lexicon-temporal": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7",
+    "@intentius/chant-lexicon-temporal": "^0.44.7"
   }
 }

package/example-writes/package-lock.json

@@ -6,9 +6,9 @@
     "": {
       "name": "behold-example-writes",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-aws": "^0.44.6",
-        "@intentius/chant-lexicon-temporal": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-aws": "^0.44.7",
+        "@intentius/chant-lexicon-temporal": "^0.44.7"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -443,9 +443,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
-      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.7.tgz",
+      "integrity": "sha512-etCchkfbWFHJ+XnTYVVn9GT4/gZi/O8SVphDXHeuPOfK5VvRxo0unveIUEsuRoHGHgzN9Y+aj0Jk15xhIE7Gzg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -461,30 +461,30 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-aws": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.6.tgz",
-      "integrity": "sha512-2qGwWFCRLkT9MD5YFnhnZOGDCqPZg9la4MM8szlX8QxFFoQjAulJ8e+vjeCGbWoB8nbSIQ9kJOX8Yn46Pm37iQ==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.7.tgz",
+      "integrity": "sha512-tlwcUv0zN5rTupRdJHdcYSsKbodiVjYaBAwG/omK4hYPtys3dZMjLVOt8bszBeTKp+h8boIEjhwpgQKpDAGmcQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "fflate": "^0.8.2",
         "js-yaml": "^4.1.0"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3"
       }
     },
     "node_modules/@intentius/chant-lexicon-temporal": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.6.tgz",
-      "integrity": "sha512-Uta1NNOHjZpI04NLaB9lTjXxAlKM7TSRx4D6Yj76RyeSoIZzcvnFJ9lJjSaIGaN20rdjK1w43b8BxsLOZTrwyA==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.44.7.tgz",
+      "integrity": "sha512-tA7DaXGG9dsHwbMO7SNQhdVnpgsdTtZNyRexS9MdVgS4xuWHIV9N76oISEd2hK76vwPXBD/d/e+2OT6amlse1A==",
       "license": "Apache-2.0",
       "dependencies": {
         "@temporalio/common": "^1.17.2",
         "js-yaml": "^4.1.1"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }

package/example-writes/package.json

@@ -7,8 +7,8 @@
     "build": "./node_modules/.bin/chant build src --lexicon aws -o template.json"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-aws": "^0.44.6",
-    "@intentius/chant-lexicon-temporal": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-aws": "^0.44.7",
+    "@intentius/chant-lexicon-temporal": "^0.44.7"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",
   "bin": {
@@ -37,7 +37,7 @@
     "@hono/node-server": "^2.0.5",
     "@intentius/chant": "^0.38.0",
     "@intentius/chant-k8s-client": "^0.44.5",
-    "@intentius/pinhole": "^0.3.3",
+    "@intentius/pinhole": "^0.3.4",
     "hono": "^4.12.34"
   },
   "devDependencies": {

package/web/app.js

@@ -1233,6 +1233,32 @@ const carveActions = {
   },
   runEmit: () => runCarveStep("emit"),
   runBridge: () => runCarveStep("bridge"),
+  async runPlan() {
+    if (carveState.busy) return;
+    carveState.busy = "plan";
+    carveState.error = null;
+    renderPanelCarve();
+    try {
+      const res = await fetch("/api/carve/plan", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      });
+      const body = await res.json().catch(() => ({ error: "plan returned an unreadable body", remedy: "" }));
+      if (!res.ok || body.error) {
+        carveState.error = { step: "handoff", ...body };
+        showToast(`✗ terraform plan: ${body.error || res.status}`, false);
+      } else {
+        carveState.plan = body;
+        showToast(body.noDestroy ? "✓ plan: nothing to destroy" : "✗ plan wants to destroy something", body.noDestroy);
+      }
+    } catch (err) {
+      carveState.error = { step: "handoff", error: String((err && err.message) || err), remedy: "Is the behold server still running?" };
+    } finally {
+      carveState.busy = null;
+      renderPanelCarve();
+    }
+  },
   copy(text, el) {
     const done = () => {
       el.dataset.copied = "1";

package/web/carve-steps.js

@@ -63,7 +63,10 @@ export function initialCarveState() {
     bridge: null,
     /** Set when the user says they ran the handoff commands. */
     handoff: false,
-    /** Which step is mid-run ("emit" | "bridge" | null) — the dial's progress. */
+    /** POST /api/carve/plan's answer (live tier only). Estate-wide, so a new
+     * pick keeps it — the plan is about the armed Terraform, not the pick. */
+    plan: null,
+    /** Which step is mid-run ("emit" | "bridge" | "plan" | null). */
     busy: null,
     /** The last structured refusal, keyed by step id. */
     error: null,
@@ -140,7 +143,18 @@ export function edgeLine(e) {
       ? `${e.survivor} reads ${attrs || "this resource"}`
       : `this resource reads ${attrs || "something"} from ${e.survivor}`;
   const where = via ? ` (in its ${via})` : "";
-  const fix = e.bridge === "deferred-input" ? "becomes a deploy-time input" : "becomes a Terraform data source";
+  // Three bridge shapes chant hands back, not two: a survivor's own reference
+  // becomes a data source (`tf-data-source`) or a deploy-time input
+  // (`deferred-input`); an `output` block reading the carved resource becomes
+  // a one-line rewrite instead (`tf-output-rewrite`, chant#1638) — it is
+  // neither of the other two, and defaulting it to "data source" would name
+  // the wrong fix for a line that was never a data block to begin with.
+  const fix =
+    e.bridge === "deferred-input"
+      ? "becomes a deploy-time input"
+      : e.bridge === "tf-output-rewrite"
+        ? "becomes a one-line output rewrite"
+        : "becomes a Terraform data source";
   const when = e.required === "at-apply" ? ", deferred until apply" : e.required === "immediately" ? ", needed immediately" : "";
   return `${dir} — ${head}${where} → ${fix}${when}`;
 }
@@ -367,7 +381,7 @@ export function renderCarvePanel(host, state, ctx, actions) {
     pick: () => renderPick(body, state, ctx, actions),
     emit: () => renderEmit(body, state, ctx, actions),
     bridge: () => renderBridge(body, state, ctx, actions),
-    handoff: () => renderHandoff(body, state, actions),
+    handoff: () => renderHandoff(body, state, ctx, actions),
     done: () => renderDone(body, state, ctx, actions),
   };
   renderers[step.id]();
@@ -415,6 +429,17 @@ function renderAdvise(body, ctx) {
         `Terraform read from ${ctx.demo.fromLabel}/ in your demo copy. Emit and bridge write only into ${ctx.demo.outLabel}/.`,
       ),
     );
+    if (ctx.demo.live) {
+      body.appendChild(
+        el(
+          "p",
+          "panel-muted carve-live-note",
+          `Live tier: the starred resources are REALLY applied into a scratch Floci (${ctx.demo.live.endpoint}, ` +
+            "deleted when this server exits) and the tfstate the advisor read was written by terraform, not shipped. " +
+            "The observe beat — chant reading the bucket live while Terraform still owns it — waits on chant#1647.",
+        ),
+      );
+    }
   }
 }
 
@@ -533,12 +558,38 @@ function renderBridge(body, state, ctx, actions) {
   for (const a of b.proposals || []) body.appendChild(artifactBlock(a, actions));
 }
 
-function renderHandoff(body, state, actions) {
+function renderHandoff(body, state, ctx, actions) {
   const runbook = state.bridge && state.bridge.runbook;
   if (!runbook) {
     body.appendChild(el("p", "panel-muted", blockedReason(state, "handoff") || "no runbook yet"));
     return;
   }
+
+  // The live tier's read-only beat (#254): a REAL `terraform plan`. Before the
+  // operator pastes `state rm` it shows a no-op; after, the carved resource is
+  // simply absent from Terraform's world — not destroyed. That verdict line is
+  // the reason the tier exists.
+  if (ctx.demo && ctx.demo.live) {
+    const planBtn = el("button", "act carve-plan", state.busy === "plan" ? "planning…" : "▶ terraform plan (read-only)");
+    planBtn.disabled = !!state.busy;
+    planBtn.title = "Runs terraform plan in the demo copy against the scratch Floci. Reads everything, changes nothing.";
+    planBtn.addEventListener("click", actions.runPlan);
+    body.appendChild(planBtn);
+    if (state.plan) {
+      const verdict = el("div", "carve-plan-verdict");
+      verdict.appendChild(el("code", null, state.plan.planLine));
+      verdict.appendChild(
+        el(
+          "p",
+          "panel-muted",
+          state.plan.noDestroy
+            ? "0 to destroy — the resource never blinked."
+            : "The plan wants to destroy something. Stop and read it before touching the estate.",
+        ),
+      );
+      body.appendChild(verdict);
+    }
+  }
   // The one place the walkthrough refuses to be a button, stated out loud.
   const why = el("div", "carve-refusal carve-human");
   why.appendChild(el("div", "carve-refusal-title", "These two are not buttons, on purpose."));
@@ -594,13 +645,20 @@ function renderDone(body, state, ctx, actions) {
   if (!state.handoff) {
     body.appendChild(el("p", "panel-muted", "The handoff commands haven't been marked as run — this is the shape of the ending, not a claim about your estate."));
   }
+  if (state.pick) {
+    const watch = el("a", "act carve-morph-link", "▶ watch it move");
+    watch.href = "/carve/morph?select=" + encodeURIComponent(state.pick.node.id);
+    watch.target = "_blank";
+    watch.rel = "noopener";
+    watch.title = "The estate frame, morphing: the card slides out of the Terraform box and into the chant project box beside last month's carves.";
+    body.appendChild(watch);
+  }
   body.appendChild(
     el(
       "p",
       "panel-muted carve-honesty",
-      "Deferred to the follow-up: the card doesn't yet SLIDE out of the Terraform box and into the chant project " +
-        "beside last month's carves — it is marked in place. The Floci `--live` tier (a real terraform apply, a real " +
-        "plan showing no destroy) is the other half of that follow-up.",
+      "Deferred to the follow-up: the Floci `--live` tier — a real terraform apply into a scratch emulator, " +
+        "a real plan showing no destroy.",
     ),
   );
   const again = el("button", "act", "↺ start over");

package/web/carve-steps.test.js

@@ -149,6 +149,21 @@ describe("edgeLine", () => {
     expect(edgeLine({ direction: "outbound", survivor: "vpc", carved: "sg", attrs: ["id"] })).toContain("from vpc");
     expect(edgeLine({ direction: "outbound", survivor: "vpc", carved: "sg", bridge: "deferred-input" })).toContain("deploy-time input");
   });
+
+  it("names an output block's fix as a rewrite, not a data source (chant#1638)", () => {
+    const line = edgeLine({
+      direction: "inbound",
+      survivor: "output.assets_bucket",
+      carved: "aws_s3_bucket.assets",
+      attrs: ["bucket"],
+      via: ["value"],
+      bridge: "tf-output-rewrite",
+      required: "immediately",
+    });
+    expect(line).toContain("output.assets_bucket reads bucket");
+    expect(line).toContain("output rewrite");
+    expect(line).not.toContain("data source");
+  });
 });
 
 describe("pickFacts / carveable", () => {