@intentius/behold 0.27.0 → 0.29.0

package/dist/cli.js

@@ -5828,10 +5828,10 @@ var require_utils = __commonJS({
       REGEX_SPECIAL_CHARS_GLOBAL
     } = require_constants();
     exports.isObject = (val) => val !== null && typeof val === "object" && !Array.isArray(val);
-    exports.hasRegexChars = (str15) => REGEX_SPECIAL_CHARS.test(str15);
-    exports.isRegexChar = (str15) => str15.length === 1 && exports.hasRegexChars(str15);
-    exports.escapeRegex = (str15) => str15.replace(REGEX_SPECIAL_CHARS_GLOBAL, "\\$1");
-    exports.toPosixSlashes = (str15) => str15.replace(REGEX_BACKSLASH, "/");
+    exports.hasRegexChars = (str16) => REGEX_SPECIAL_CHARS.test(str16);
+    exports.isRegexChar = (str16) => str16.length === 1 && exports.hasRegexChars(str16);
+    exports.escapeRegex = (str16) => str16.replace(REGEX_SPECIAL_CHARS_GLOBAL, "\\$1");
+    exports.toPosixSlashes = (str16) => str16.replace(REGEX_BACKSLASH, "/");
     exports.isWindows = () => {
       if (typeof navigator !== "undefined" && navigator.platform) {
         const platform2 = navigator.platform.toLowerCase();
@@ -5842,8 +5842,8 @@ var require_utils = __commonJS({
       }
       return false;
     };
-    exports.removeBackslashes = (str15) => {
-      return str15.replace(REGEX_REMOVE_BACKSLASH, (match) => {
+    exports.removeBackslashes = (str16) => {
+      return str16.replace(REGEX_REMOVE_BACKSLASH, (match) => {
         return match === "\\" ? "" : match;
       });
     };
@@ -5933,7 +5933,7 @@ var require_scan = __commonJS({
       const slashes = [];
       const tokens = [];
       const parts = [];
-      let str15 = input;
+      let str16 = input;
       let index = -1;
       let start = 0;
       let lastIndex = 0;
@@ -5952,10 +5952,10 @@ var require_scan = __commonJS({
       let code;
       let token = { value: "", depth: 0, isGlob: false };
       const eos = () => index >= length;
-      const peek = () => str15.charCodeAt(index + 1);
+      const peek = () => str16.charCodeAt(index + 1);
       const advance = () => {
         prev = code;
-        return str15.charCodeAt(++index);
+        return str16.charCodeAt(++index);
       };
       while (index < length) {
         code = advance();
@@ -6123,24 +6123,24 @@ var require_scan = __commonJS({
         isExtglob = false;
         isGlob = false;
       }
-      let base = str15;
+      let base = str16;
       let prefix = "";
       let glob = "";
       if (start > 0) {
-        prefix = str15.slice(0, start);
-        str15 = str15.slice(start);
+        prefix = str16.slice(0, start);
+        str16 = str16.slice(start);
         lastIndex -= start;
       }
       if (base && isGlob === true && lastIndex > 0) {
-        base = str15.slice(0, lastIndex);
-        glob = str15.slice(lastIndex);
+        base = str16.slice(0, lastIndex);
+        glob = str16.slice(lastIndex);
       } else if (isGlob === true) {
         base = "";
-        glob = str15;
+        glob = str16;
       } else {
-        base = str15;
+        base = str16;
       }
-      if (base && base !== "" && base !== "/" && base !== str15) {
+      if (base && base !== "" && base !== "/" && base !== str16) {
         if (isPathSeparator(base.charCodeAt(base.length - 1))) {
           base = base.slice(0, -1);
         }
@@ -7187,8 +7187,8 @@ var require_parse = __commonJS({
         if (opts2.noglobstar === true) return star;
         return `(${capture2}(?:(?!${START_ANCHOR}${opts2.dot ? DOTS_SLASH : DOT_LITERAL}).)*?)`;
       };
-      const create = (str15) => {
-        switch (str15) {
+      const create = (str16) => {
+        switch (str16) {
           case "*":
             return `${nodot}${ONE_CHAR}${star}`;
           case ".*":
@@ -7206,7 +7206,7 @@ var require_parse = __commonJS({
           case "**/.*":
             return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${DOT_LITERAL}${ONE_CHAR}${star}`;
           default: {
-            const match = /^(.*?)\.(\w+)$/.exec(str15);
+            const match = /^(.*?)\.(\w+)$/.exec(str16);
             if (!match) return;
             const source3 = create(match[1]);
             if (!source3) return;
@@ -7237,9 +7237,9 @@ var require_picomatch = __commonJS({
     var picomatch3 = (glob, options2, returnState = false) => {
       if (Array.isArray(glob)) {
         const fns = glob.map((input) => picomatch3(input, options2, returnState));
-        const arrayMatcher = (str15) => {
+        const arrayMatcher = (str16) => {
           for (const isMatch of fns) {
-            const state2 = isMatch(str15);
+            const state2 = isMatch(str16);
             if (state2) return state2;
           }
           return false;
@@ -7315,7 +7315,7 @@ var require_picomatch = __commonJS({
       const regex = glob instanceof RegExp ? glob : picomatch3.makeRe(glob, options2);
       return regex.test(utils.basename(input, { windows: posix5 }));
     };
-    picomatch3.isMatch = (str15, patterns, options2) => picomatch3(patterns, options2)(str15);
+    picomatch3.isMatch = (str16, patterns, options2) => picomatch3(patterns, options2)(str16);
     picomatch3.parse = (pattern, options2) => {
       if (Array.isArray(pattern)) return pattern.map((p) => picomatch3.parse(p, options2));
       return parse(pattern, { ...options2, fastpaths: false });
@@ -8904,8 +8904,8 @@ __export(tree_exports, {
   workingTree: () => workingTree
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { readdirSync as readdirSync10, readFileSync as readFileSync18, statSync as statSync8 } from "node:fs";
-import { join as join25 } from "node:path";
+import { readdirSync as readdirSync10, readFileSync as readFileSync19, statSync as statSync8 } from "node:fs";
+import { join as join26 } from "node:path";
 function joinPath(...parts) {
   return parts.filter((p) => p !== "" && p !== ".").join("/");
 }
@@ -8914,7 +8914,7 @@ function workingTree(root) {
     label: "",
     stat(path) {
       try {
-        const s = statSync8(join25(root, path));
+        const s = statSync8(join26(root, path));
         return s.isDirectory() ? "dir" : s.isFile() ? "file" : void 0;
       } catch {
         return void 0;
@@ -8923,7 +8923,7 @@ function workingTree(root) {
     list(path) {
       let dirents;
       try {
-        dirents = readdirSync10(join25(root, path), { withFileTypes: true });
+        dirents = readdirSync10(join26(root, path), { withFileTypes: true });
       } catch {
         return void 0;
       }
@@ -8932,7 +8932,7 @@ function workingTree(root) {
         let type = d.isDirectory() ? "dir" : d.isFile() ? "file" : void 0;
         if (!type && d.isSymbolicLink()) {
           try {
-            const s = statSync8(join25(root, path, d.name));
+            const s = statSync8(join26(root, path, d.name));
             type = s.isDirectory() ? "dir" : s.isFile() ? "file" : void 0;
           } catch {
           }
@@ -8942,10 +8942,10 @@ function workingTree(root) {
       return out;
     },
     read(path) {
-      return readFileSync18(join25(root, path), "utf-8");
+      return readFileSync19(join26(root, path), "utf-8");
     },
     bytes(path) {
-      return readFileSync18(join25(root, path));
+      return readFileSync19(join26(root, path));
     }
   };
 }
@@ -9133,6 +9133,11 @@ var init_workspace_kinds_schema = __esm({
             },
             fields: {
               $ref: "#/$defs/fields"
+            },
+            reader: {
+              type: "string",
+              pattern: "^[a-z][a-z0-9-]{0,39}$",
+              description: "A link reader chant ships, by name, that derives a member's links from the member's own files (#3932): dbt-project reads a dbt project's sources. The reader is chant's code and runs offline, parsing files as data; the package supplies only the name. A name this chant doesn't have keeps the kind without a reader, and the load reports it. A chant older than this field fails a kinds file that uses it."
             }
           },
           patternProperties: {
@@ -9542,12 +9547,12 @@ var init_identity_gate_rule = __esm({
 });
 
 // node_modules/@intentius/chant/src/workspace/class-data.ts
-import { existsSync as existsSync17, readFileSync as readFileSync19, statSync as statSync9 } from "node:fs";
-import { dirname as dirname7, join as join26, posix, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync20, statSync as statSync9 } from "node:fs";
+import { dirname as dirname7, join as join27, posix, resolve as resolve14 } from "node:path";
 function diskFiles(dir) {
   return (path) => {
     try {
-      return readFileSync19(join26(dir, ...path.split("/")), "utf-8");
+      return readFileSync20(join27(dir, ...path.split("/")), "utf-8");
     } catch {
       return void 0;
     }
@@ -9555,9 +9560,9 @@ function diskFiles(dir) {
 }
 function findInstalledPackage(name, fromDir) {
   for (let dir = resolve14(fromDir); ; dir = dirname7(dir)) {
-    const candidate = join26(dir, "node_modules", ...name.split("/"));
+    const candidate = join27(dir, "node_modules", ...name.split("/"));
     try {
-      if (statSync9(candidate).isDirectory() && existsSync17(join26(candidate, "package.json"))) return candidate;
+      if (statSync9(candidate).isDirectory() && existsSync17(join27(candidate, "package.json"))) return candidate;
     } catch {
     }
     if (dirname7(dir) === dir) return void 0;
@@ -10007,10 +10012,10 @@ var init_jsonc = __esm({
 });
 
 // node_modules/@intentius/chant/src/package-version.ts
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function readChantPackageVersion() {
-  return JSON.parse(readFileSync20(fileURLToPath4(new URL("../package.json", import.meta.url)), "utf-8")).version;
+  return JSON.parse(readFileSync21(fileURLToPath4(new URL("../package.json", import.meta.url)), "utf-8")).version;
 }
 var init_package_version = __esm({
   "node_modules/@intentius/chant/src/package-version.ts"() {
@@ -10809,8 +10814,8 @@ var init_declaration = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve33, dirname as dirname21, join as join48 } from "node:path";
-import { realpathSync as realpathSync3, existsSync as existsSync30, readFileSync as readFileSync36, rmSync as rmSync4 } from "node:fs";
+import { resolve as resolve33, dirname as dirname21, join as join50 } from "node:path";
+import { realpathSync as realpathSync3, existsSync as existsSync30, readFileSync as readFileSync38, rmSync as rmSync4 } from "node:fs";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawn as spawn9, spawnSync as spawnSync4 } from "node:child_process";
 
@@ -10868,8 +10873,8 @@ import { serve } from "@hono/node-server";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { existsSync as existsSync27, readFileSync as readFileSync32 } from "node:fs";
-import { basename as basename5, dirname as dirname18, join as join44, relative as relative10, resolve as resolve30, sep as sep9 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync34 } from "node:fs";
+import { basename as basename5, dirname as dirname18, join as join46, relative as relative10, resolve as resolve30, sep as sep9 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -13275,10 +13280,10 @@ function joinNamespaceBindings(members, isDir = realIsDir) {
     if (!winner || tied) continue;
     const prev = best.get(winner.dir);
     if (prev === "ambiguous") continue;
-    const join49 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join49 });
+    const join51 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join51 });
     else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join49 });
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join51 });
   }
   return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
 }
@@ -15776,7 +15781,9 @@ function estateFace(irIn, boxesIn, opts = {}) {
   const face = cardFaces(irIn, boxesIn, opts.prefixes ? { prefixes: opts.prefixes } : {});
   const ir = face.ir;
   if (Object.keys(face.overrides).length) faceOverrides.set(ir, face.overrides);
-  const boxes = boxesIn ? Object.fromEntries(Object.entries(boxesIn).map(([key, ids]) => [key, ids.map((id) => face.display.get(id) ?? id)])) : void 0;
+  const toDisplay = (record) => record ? Object.fromEntries(Object.entries(record).map(([key, ids]) => [key, ids.map((id) => face.display.get(id) ?? id)])) : void 0;
+  const boxes = toDisplay(boxesIn);
+  const subgroups = boxes ? toDisplay(opts.subgroups) : void 0;
   const realBand = moduleBandOf(irIn);
   const toReal = new Map(ir.nodes.map((n, i) => [n.id, irIn.nodes[i].id]));
   const bandOf = realBand ? (id) => realBand(toReal.get(id) ?? id) : void 0;
@@ -15786,13 +15793,14 @@ function estateFace(irIn, boxesIn, opts = {}) {
     ...opts.nodesep !== void 0 ? { nodesep: opts.nodesep } : {},
     ...opts.ranksep !== void 0 ? { ranksep: opts.ranksep } : {}
   }) : { ir, grids: /* @__PURE__ */ new Map() };
-  return { ir, overrides: face.overrides, boxes, display: face.display, bandOf, chains, restore: face.restore };
+  return { ir, overrides: face.overrides, boxes, subgroups, display: face.display, bandOf, chains, restore: face.restore };
 }
 function packEstateBoxes(layout, face, opts = {}) {
   const boxes = face.boxes;
   if (!boxes) return;
-  const boxGrids = packBoxComponents(layout, face.ir, boxes, face.bandOf);
-  if (opts.members) packMemberBoxes(layout, face.ir, boxes);
+  const boxGrids = packBoxComponents(layout, face.ir, boxes, face.bandOf, face.subgroups);
+  if (opts.members) packMemberBoxes(layout, face.ir, { ...topLevelSubgroups(layout.groups, face.subgroups), ...boxes });
+  if (face.subgroups) fitNestedBoxes(layout, face.ir, boxes, face.subgroups);
   addBandBoxes(layout, new Map([...boxGrids, ...face.chains.grids]), footprints(face.ir, face.overrides));
   applyBadges(layout.groups, opts.badges, opts.marks);
 }
@@ -15826,17 +15834,27 @@ function renderGraph(irIn, opts = {}) {
   const groupsIn = irIn.groups;
   const pipelines = groupsIn.byPipeline && Object.keys(groupsIn.byPipeline).length ? groupsIn.byPipeline : void 0;
   const boxKey = groupsIn.byWave ? "byWave" : opts.boxes ?? (pipelines ? "byPipeline" : void 0);
-  const face = estateFace(irIn, boxKey ? groupsIn[boxKey] : void 0);
+  const nested = boxKey === "byStack" ? pipelines : void 0;
+  const face = estateFace(irIn, boxKey ? groupsIn[boxKey] : void 0, nested ? { subgroups: nested } : {});
   const ir = face.ir;
   const boxes = face.boxes;
   const chains = face.chains;
-  const layout = layoutIr(chains.ir, { fit: true, overrides: face.overrides, ...boxes ? { groups: boxes } : {} });
+  const layout = layoutIr(chains.ir, {
+    fit: true,
+    overrides: face.overrides,
+    ...boxes ? { groups: boxes } : {},
+    ...face.subgroups ? { subgroups: face.subgroups } : {}
+  });
   if (opts.radial && !boxes) radializeLayout(layout, groupKeyByNode(ir), footprints(ir, face.overrides));
   else if (!boxes) packComponents(layout, ir);
   packEstateBoxes(layout, face, { members: boxKey === "byStack", ...opts.groupBadges ? { badges: opts.groupBadges } : {} });
-  if (boxKey === "byPipeline" && pipelines) {
+  if ((boxKey === "byPipeline" || nested) && pipelines) {
     const titles = pipelineTitles(irIn, pipelines);
-    for (const box of layout.groups ?? []) if (box.id !== void 0 && titles[box.id] !== void 0) box.title = titles[box.id];
+    for (const box of layout.groups ?? []) {
+      if (box.id === void 0 || titles[box.id] === void 0) continue;
+      const title = titles[box.id];
+      box.title = title === box.id && box.parent !== void 0 && title.startsWith(`${box.parent}/`) ? title.slice(box.parent.length + 1) : title;
+    }
   }
   const svg = renderSvg(ir, layout, {
     fit: true,
@@ -15849,9 +15867,16 @@ function renderGraph(irIn, opts = {}) {
 }
 function pipelineTitles(ir, byPipeline) {
   const nodes = new Map(ir.nodes.map((n) => [n.id, n]));
+  const workflowOf = (ids) => {
+    const workflows = ids.flatMap((id) => {
+      const n = nodes.get(id);
+      return n && /::Workflow$/.test(n.kind) ? [n] : [];
+    });
+    return workflows.length === 1 ? workflows[0] : void 0;
+  };
   return Object.fromEntries(
-    Object.keys(byPipeline).map((key) => {
-      const name = nodes.get(key)?.attrs?.["name"];
+    Object.entries(byPipeline).map(([key, ids]) => {
+      const name = (nodes.get(key) ?? workflowOf(ids))?.attrs?.["name"];
       return [key, typeof name === "string" && name.trim() ? name : key];
     })
   );
@@ -15901,6 +15926,39 @@ function addBandBoxes(layout, grids, sizes) {
   boxes.push(...added);
 }
 var BAND_PAD = 14;
+var NEST_PAD_X = 50;
+var NEST_PAD_Y = 36;
+var NEST_OUTER = 36;
+function topLevelSubgroups(boxes, subgroups) {
+  if (!subgroups) return {};
+  return Object.fromEntries(
+    (boxes ?? []).flatMap((b) => b.parent === void 0 && b.id !== void 0 && subgroups[b.id] ? [[b.id, subgroups[b.id]]] : [])
+  );
+}
+function fitNestedBoxes(layout, ir, boxes, subgroups, only2) {
+  const at2 = new Map(layout.nodes.map((n) => [n.id, n]));
+  const ownerOf2 = /* @__PURE__ */ new Map();
+  for (const [key, ids] of Object.entries(boxes)) for (const id of ids) if (at2.has(id)) ownerOf2.set(id, key);
+  const sizes = footprints(ir);
+  for (const box of layout.groups ?? []) {
+    if (box.parent === void 0 || box.id === void 0 || only2 !== void 0 && box.parent !== only2) continue;
+    const cards = (subgroups[box.id] ?? []).flatMap((id) => {
+      const p = at2.get(id);
+      if (!p || ownerOf2.get(id) !== box.parent) return [];
+      const s = sizes.get(id) ?? { w: NODE_W, h: NODE_H };
+      return [{ x: p.x, y: p.y, w: s.w, h: s.h }];
+    });
+    if (!cards.length) continue;
+    const x0 = Math.min(...cards.map((c) => c.x - c.w / 2)) - NEST_PAD_X;
+    const x1 = Math.max(...cards.map((c) => c.x + c.w / 2)) + NEST_PAD_X;
+    const y0 = Math.min(...cards.map((c) => c.y - c.h / 2)) - NEST_PAD_Y;
+    const y1 = Math.max(...cards.map((c) => c.y + c.h / 2)) + NEST_PAD_Y;
+    box.x = (x0 + x1) / 2;
+    box.y = (y0 + y1) / 2;
+    box.w = x1 - x0;
+    box.h = y1 - y0;
+  }
+}
 function clampInside(r, box) {
   const inset = 6;
   const left = box.x - box.w / 2 + inset;
@@ -16216,7 +16274,8 @@ function packComponents(layout, ir) {
   layout.height = Math.max(...nodes.map((n) => n.y + halfH(n))) + pad;
 }
 function packMemberBoxes(layout, ir, members) {
-  const boxes = layout.groups ?? [];
+  const allBoxes = layout.groups ?? [];
+  const boxes = allBoxes.filter((b) => b.parent === void 0);
   if (boxes.length < 4) return;
   const nodes = layout.nodes;
   const size = footprints(ir);
@@ -16332,7 +16391,7 @@ function gridComponent(one, sizes) {
   const rows = Math.ceil(order.length / cols);
   return { local, w: Math.min(cols, order.length) * (cell.w + sep12.x) - sep12.x, h: rows * (cell.h + sep12.y) - sep12.y };
 }
-function packBoxComponents(layout, ir, boxes, bandOf) {
+function packBoxComponents(layout, ir, boxes, bandOf, subgroups) {
   const grids = /* @__PURE__ */ new Map();
   const groupBoxes = layout.groups ?? [];
   const nodes = layout.nodes;
@@ -16363,6 +16422,10 @@ function packBoxComponents(layout, ir, boxes, bandOf) {
       const b = idxOf.get(e.to);
       if (a !== void 0 && b !== void 0) parent[find(a)] = find(b);
     }
+    for (const ids2 of Object.values(subgroups ?? {})) {
+      const inside = ids2.flatMap((id) => idxOf.get(id) ?? []);
+      for (const i of inside.slice(1)) parent[find(i)] = find(inside[0]);
+    }
     const comps = /* @__PURE__ */ new Map();
     own.forEach((n, i) => (comps.get(find(i)) ?? comps.set(find(i), []).get(find(i))).push(n));
     if (comps.size < 2) continue;
@@ -16375,12 +16438,19 @@ function packBoxComponents(layout, ir, boxes, bandOf) {
         edges: ir.edges.filter((e) => inside.has(e.from) && inside.has(e.to)),
         groups: {}
       };
-      let one = layoutIr(sub, { fit: true });
+      const nest = Object.fromEntries(
+        Object.entries(subgroups ?? {}).flatMap(([k, ids2]) => {
+          const mine = ids2.filter((id) => inside.has(id));
+          return mine.length ? [[k, mine]] : [];
+        })
+      );
+      const nests = Object.keys(nest).length > 0;
+      let one = layoutIr(sub, { fit: true, ...nests ? { groups: nest } : {} });
       if (one.width > one.height * BOX_ASPECT_MAX) {
-        const sideways = layoutIr(sub, { fit: true, rankdir: "LR" });
+        const sideways = layoutIr(sub, { fit: true, rankdir: "LR", ...nests ? { groups: nest } : {} });
         if (offAspect(sideways) < offAspect(one)) one = sideways;
       }
-      const placed = offAspect(one) > GRID_COMPONENT ? gridComponent(one, size) : { local: new Map(one.nodes.map((n) => [n.id, { x: n.x, y: one.height - n.y }])), w: one.width, h: one.height };
+      const placed = !nests && offAspect(one) > GRID_COMPONENT ? gridComponent(one, size) : { local: new Map(one.nodes.map((n) => [n.id, { x: n.x, y: one.height - n.y }])), w: one.width, h: one.height };
       laid.set(root, { ...placed, ns });
     }
     const order = [void 0];
@@ -16396,8 +16466,9 @@ function packBoxComponents(layout, ir, boxes, bandOf) {
     const all = [...laid.values()];
     const area = all.reduce((s, c) => s + (c.w + COMPONENT_GAP) * (c.h + COMPONENT_GAP), 0);
     const targetW = Math.max(Math.max(...all.map((c) => c.w)), Math.sqrt(area * ROW_ASPECT));
-    const originX = box.x - box.w / 2 + BAND_PAD;
-    const originY = box.y - box.h / 2 + TITLE;
+    const holdsNested = groupBoxes.some((b) => b.parent === key);
+    const originX = box.x - box.w / 2 + (holdsNested ? NEST_OUTER : BAND_PAD);
+    const originY = box.y - box.h / 2 + (holdsNested ? NEST_OUTER : TITLE);
     let shelfX = 0;
     let shelfY = 0;
     let shelfH = 0;
@@ -16429,10 +16500,18 @@ function packBoxComponents(layout, ir, boxes, bandOf) {
       }
       bands.push({ key: band, ids: ids2 });
     }
-    const x0 = Math.min(...own.map((n) => n.x - halfW(n))) - BAND_PAD;
-    const x1 = Math.max(...own.map((n) => n.x + halfW(n))) + BAND_PAD;
-    const y0 = Math.min(...own.map((n) => n.y - halfH(n))) - TITLE;
-    const y1 = Math.max(...own.map((n) => n.y + halfH(n))) + BAND_PAD;
+    if (subgroups) fitNestedBoxes(layout, ir, boxes, subgroups, key);
+    const inner = groupBoxes.filter((b) => b.parent === key);
+    let x0 = Math.min(...own.map((n) => n.x - halfW(n))) - BAND_PAD;
+    let x1 = Math.max(...own.map((n) => n.x + halfW(n))) + BAND_PAD;
+    let y0 = Math.min(...own.map((n) => n.y - halfH(n))) - TITLE;
+    let y1 = Math.max(...own.map((n) => n.y + halfH(n))) + BAND_PAD;
+    for (const b of inner) {
+      x0 = Math.min(x0, b.x - b.w / 2 - NEST_OUTER);
+      x1 = Math.max(x1, b.x + b.w / 2 + NEST_OUTER);
+      y0 = Math.min(y0, b.y - b.h / 2 - NEST_OUTER);
+      y1 = Math.max(y1, b.y + b.h / 2 + NEST_OUTER);
+    }
     box.x = (x0 + x1) / 2;
     box.y = (y0 + y1) / 2;
     box.w = x1 - x0;
@@ -17411,11 +17490,11 @@ var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
 function tookLabel(ms) {
   return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
 }
-function paintPlayhead(ir, join49, gate) {
-  if (!join49.byNode.size && !join49.at) return ir;
+function paintPlayhead(ir, join51, gate) {
+  if (!join51.byNode.size && !join51.at) return ir;
   const nodes = ir.nodes.map((node) => {
-    const run3 = join49.byNode.get(node.id);
-    const here = join49.at === node.id;
+    const run3 = join51.byNode.get(node.id);
+    const here = join51.at === node.id;
     if (!run3 && !here) return node;
     const isGate = node.attrs?._step === "gate";
     const attrs = { ...node.attrs };
@@ -17430,7 +17509,7 @@ function paintPlayhead(ir, join49, gate) {
     if (here) {
       attrs._playhead = true;
       attrs._status = isGate && gate ? "warn" : "accent";
-      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join49.atReason ?? "here";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join51.atReason ?? "here";
       if (isGate && gate?.description) attrs.gateDescription = gate.description;
     }
     return { ...node, attrs };
@@ -17452,11 +17531,11 @@ function pendingGateCard(op, gate, ir) {
     }
   };
 }
-function playheadNote(state, join49) {
+function playheadNote(state, join51) {
   if (!state.op) {
     return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
-  const settled = join49 ? join49.byNode.size : state.records.length;
+  const settled = join51 ? join51.byNode.size : state.records.length;
   const bits = [];
   const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
   if (state.status === "running") {
@@ -17472,9 +17551,9 @@ function playheadNote(state, join49) {
   } else if (state.gateNote) {
     bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
   }
-  if (join49?.unplaced.length) {
+  if (join51?.unplaced.length) {
     bits.push(
-      `${join49.unplaced.length} record${join49.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join49.unplaced.length === 1 ? "is" : "are"} not painted`
+      `${join51.unplaced.length} record${join51.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join51.unplaced.length === 1 ? "is" : "are"} not painted`
     );
   }
   if (!bits.length) return `${head}.`;
@@ -18144,10 +18223,90 @@ var OpRunner = class {
   }
 };
 
+// src/public-mode.ts
+import { readFileSync as readFileSync15 } from "node:fs";
+import { join as join20 } from "node:path";
+var ReadOnlyRunner = class {
+  running = null;
+  applyProgress = initialApplyProgress;
+  runState = initialRunState;
+  operatorState = initialOperatorState;
+  retarget() {
+  }
+  noteGate() {
+    return initialRunState;
+  }
+  noteDeclaredConvergeOps() {
+    return initialOperatorState;
+  }
+  noteOperator() {
+    return initialOperatorState;
+  }
+  trigger() {
+    return false;
+  }
+  run() {
+    return false;
+  }
+  apply() {
+    return false;
+  }
+  pipeline() {
+    return false;
+  }
+  bringUp() {
+    return false;
+  }
+  track() {
+    return false;
+  }
+};
+var REFUSED_READS = [
+  [/^\/api\/ops\/[^/]+\/status$/, "the op tools are off"],
+  [/^\/api\/operator(\/|$)/, "the op tools are off"],
+  [/^\/api\/overlay$/, "it reads the live estate with behold's own credentials"],
+  [/^\/api\/reconcile$/, "it plans against the live estate with behold's own credentials"],
+  [/^\/api\/diff(\/|$)/, "it reads the live estate with behold's own credentials"],
+  [/^\/api\/components\/compare$/, "it reads the live estate with behold's own credentials"],
+  [/^\/api\/resources$/, "it runs chant against the project"],
+  [/^\/api\/ci(\/|$)/, "it reads the pipeline and the forge run"],
+  [/^\/api\/doctor$/, "it probes this machine's tools"],
+  [/^\/api\/substrates$/, "it probes this machine's tools"],
+  [/^\/api\/history$/, "it runs git against the checkout"],
+  [/^\/api\/workspace\/(gates|why)$/, "it runs chant against the workspace"],
+  [/^\/api\/choudoufu\/moves$/, "it runs choudoufu"],
+  [/^\/choudoufu\/morph$/, "it runs choudoufu"],
+  [/^\/api\/sql-yodeler\/lifecycle$/, "a public view shows a terragucci repo"]
+];
+var LIVE_PARAMS = ["env", "target", "consistent", "plan", "live"];
+function publicReadRefusal(path, query) {
+  for (const [re, why] of REFUSED_READS) if (re.test(path)) return why;
+  if (path === "/api/graph" && LIVE_PARAMS.some((p) => query.has(p))) {
+    return "a public view draws the source graph only; a live read uses behold's own credentials";
+  }
+  return void 0;
+}
+var PUBLIC_FLAG = "<script>window.__BEHOLD_PUBLIC__ = true;</script>";
+function publicPage(webRoot2) {
+  const html = readFileSync15(join20(webRoot2, "index.html"), "utf8");
+  return html.replace("</head>", `  ${PUBLIC_FLAG}
+  </head>`);
+}
+function publicRoutes(app, webRoot2) {
+  app.use("*", async (c, next) => {
+    const why = publicReadRefusal(c.req.path, new URL(c.req.url).searchParams);
+    if (why) return c.json({ error: `behold is serving a public, read-only view: ${c.req.path} is refused, because ${why}`, code: "public" }, 403);
+    await next();
+  });
+  const page = () => new Response(publicPage(webRoot2), { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
+  app.get("/", () => page());
+  app.get("/index.html", () => page());
+}
+
 // src/substrates.ts
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
+import { join as join21 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
@@ -18176,11 +18335,11 @@ async function dockerRunning(run3, nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync14(join20(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync14(join21(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync15(join20(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync16(join21(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -18232,7 +18391,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync14(join20(projectDir, marker))) continue;
+    if (!existsSync14(join21(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -18266,7 +18425,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync14(join20(projectDir, ".github", "workflows"))) {
+  if (existsSync14(join21(projectDir, ".github", "workflows"))) {
     const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -18279,7 +18438,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync15(join20(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync16(join21(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -18422,8 +18581,8 @@ function statusVocabulary(kinds) {
 }
 
 // src/behaviour.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { join as join21 } from "node:path";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join22 } from "node:path";
 var rec5 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 var str6 = (v) => typeof v === "string" && v.trim().length > 0 ? v : void 0;
 var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
@@ -18530,7 +18689,7 @@ var FIRST_TOTAL_SHOWN = "two members stated an estate total; the first is shown"
 var behaviourFileName = (env) => `behaviour.${env}.json`;
 var realRead = (path) => {
   try {
-    return readFileSync16(path, "utf8");
+    return readFileSync17(path, "utf8");
   } catch {
     return void 0;
   }
@@ -18588,7 +18747,7 @@ function attachBehaviour(ir, members, env, readFile2 = realRead) {
     }
     const file = behaviourFileName(env);
     looked.push(`${label}/${file}`);
-    const raw = readFile2(join21(m.dir, file));
+    const raw = readFile2(join22(m.dir, file));
     if (raw === void 0) {
       sources.set(label, "none");
       continue;
@@ -19024,7 +19183,7 @@ init_choudoufu_live();
 init_choudoufu_member();
 import { mkdtempSync, rmSync as rmSync3 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var isRecord10 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var refuse7 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var CREDS2 = "Give behold the ambient read-only AWS credentials the estate's `plan` needs (AWS_PROFILE, or AWS_ENDPOINT_URL for an emulator), then re-check live with plan.";
@@ -19098,8 +19257,8 @@ var planArgv = (out) => ({
   show: ["show", "-json", out]
 });
 async function readChoudoufuPlan(dir, run3 = captureChoudoufu) {
-  const scratch = mkdtempSync(join22(tmpdir2(), "behold-choudoufu-plan-"));
-  const file = join22(scratch, "plan.tfplan");
+  const scratch = mkdtempSync(join23(tmpdir2(), "behold-choudoufu-plan-"));
+  const file = join23(scratch, "plan.tfplan");
   const argv = planArgv(file);
   try {
     const planRun = await run3(argv.plan, dir);
@@ -19131,8 +19290,8 @@ init_choudoufu_refs();
 // src/choudoufu-moves.ts
 init_choudoufu_member();
 init_choudoufu_live();
-import { existsSync as existsSync15, readFileSync as readFileSync17 } from "node:fs";
-import { join as join23, relative as relative5 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync18 } from "node:fs";
+import { join as join24, relative as relative5 } from "node:path";
 var isRecord11 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var refuse8 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var HOW_TO_GET_ONE2 = "A plan is the live-mv workbench's carve.json: `{from, estates[], moves[{address, from, to}]}` \u2014 the workbench's plan phase writes one, or write it by hand.";
@@ -19152,7 +19311,7 @@ function parseCarvePlan(value) {
     }
   };
 }
-function readCarvePlan(path, readFile2 = (p) => readFileSync17(p, "utf8")) {
+function readCarvePlan(path, readFile2 = (p) => readFileSync18(p, "utf8")) {
   let text;
   try {
     text = readFile2(path);
@@ -19168,7 +19327,7 @@ function readCarvePlan(path, readFile2 = (p) => readFileSync17(p, "utf8")) {
 function discoverCarvePlans(memberDirs, base) {
   const out = [];
   for (const dir of memberDirs) {
-    const p = join23(dir, "carve.json");
+    const p = join24(dir, "carve.json");
     if (existsSync15(p)) out.push(relative5(base, p));
   }
   return out;
@@ -19399,24 +19558,24 @@ function getRuntime() {
 
 // node_modules/@intentius/chant/src/lifecycle/member-ledger.ts
 import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname8, join as join27, relative as relative6, resolve as resolve15, sep as sep6 } from "node:path";
+import { dirname as dirname8, join as join28, relative as relative6, resolve as resolve15, sep as sep6 } from "node:path";
 
 // node_modules/@intentius/chant/src/project-root.ts
 import { existsSync as existsSync16 } from "fs";
-import { dirname as dirname6, join as join24, resolve as resolve13 } from "path";
+import { dirname as dirname6, join as join25, resolve as resolve13 } from "path";
 var WORKSPACE_DECLARATION_FILES = ["chant.workspace.json", "chant.workspace.jsonc"];
 function findWorkspaceRoot(startDir) {
   const start = resolve13(startDir);
   let top;
   for (let dir = start; ; dir = dirname6(dir)) {
-    if (existsSync16(join24(dir, ".git"))) {
+    if (existsSync16(join25(dir, ".git"))) {
       top = dir;
       break;
     }
     if (dirname6(dir) === dir) break;
   }
   for (let dir = start; ; dir = dirname6(dir)) {
-    const [json2, jsonc] = WORKSPACE_DECLARATION_FILES.map((name) => join24(dir, name));
+    const [json2, jsonc] = WORKSPACE_DECLARATION_FILES.map((name) => join25(dir, name));
     const hasJson = existsSync16(json2);
     const hasJsonc = existsSync16(jsonc);
     if (hasJson && hasJsonc) return { dir, file: json2, conflicting: jsonc };
@@ -19478,7 +19637,7 @@ async function ledgerIn(root, dir) {
   }
   let outer = FLAT;
   const parent = dirname8(root);
-  if (parent !== root && !existsSync18(join27(root, ".git"))) {
+  if (parent !== root && !existsSync18(join28(root, ".git"))) {
     const outerFound = findWorkspaceRoot(parent);
     if (outerFound) outer = await ledgerIn(outerFound.dir, root);
   }
@@ -19486,6 +19645,17 @@ async function ledgerIn(root, dir) {
   return { members, prefix: memberLedgerPrefix(members) };
 }
 
+// node_modules/@intentius/chant/src/lifecycle/no-record.ts
+var NO_RECORD_ENV = "CHANT_NO_RECORD";
+function ledgerRecordingOff(env = process.env) {
+  const value = env[NO_RECORD_ENV]?.trim().toLowerCase();
+  return value !== void 0 && value !== "" && value !== "0" && value !== "false";
+}
+var overlays = /* @__PURE__ */ new Map();
+function overlayTip(key) {
+  return overlays.get(key)?.tip;
+}
+
 // node_modules/@intentius/chant/src/lifecycle/git.ts
 var STATE_BRANCH = "chant/lifecycle";
 async function ledgerDir(dir, opts) {
@@ -19502,7 +19672,7 @@ async function readBlobFromPath(environment, filename, opts) {
   const rt = getRuntime();
   const dir = await ledgerDir(environment, opts);
   const result = await rt.spawn(
-    ["git", "show", `${STATE_BRANCH}:${dir}/${filename}`],
+    ["git", "show", `${await ledgerRevision(opts?.cwd)}:${dir}/${filename}`],
     { cwd: opts?.cwd }
   );
   if (result.exitCode !== 0) return null;
@@ -19527,7 +19697,7 @@ async function listLedgerTrees(opts) {
   const rt = getRuntime();
   const base = await ledgerDir("", opts);
   const rootResult = await rt.spawn(
-    ["git", "ls-tree", "--full-tree", base === "" ? STATE_BRANCH : `${STATE_BRANCH}:${base}`],
+    ["git", "ls-tree", "--full-tree", base === "" ? tip : `${tip}:${base}`],
     { cwd: opts?.cwd }
   );
   if (rootResult.exitCode !== 0) return [];
@@ -19538,7 +19708,12 @@ async function listLedgerTrees(opts) {
   }
   return trees;
 }
+var C_LOCALE_ENV = { LC_ALL: "C", LANGUAGE: "" };
 async function getStateBranchTip(cwd) {
+  if (ledgerRecordingOff()) {
+    const tip = overlayTip(await overlayKey(cwd));
+    if (tip !== void 0) return tip;
+  }
   const rt = getRuntime();
   const result = await rt.spawn(
     ["git", "rev-parse", "--verify", `refs/heads/${STATE_BRANCH}`],
@@ -19547,6 +19722,20 @@ async function getStateBranchTip(cwd) {
   if (result.exitCode !== 0) return null;
   return result.stdout.trim();
 }
+async function ledgerRevision(cwd) {
+  if (!ledgerRecordingOff()) return STATE_BRANCH;
+  return overlayTip(await overlayKey(cwd)) ?? STATE_BRANCH;
+}
+var overlayKeys = /* @__PURE__ */ new Map();
+async function overlayKey(cwd) {
+  const from = cwd ?? process.cwd();
+  const cached = overlayKeys.get(from);
+  if (cached !== void 0) return cached;
+  const result = await getRuntime().spawn(["git", "rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: from, env: C_LOCALE_ENV });
+  const key = result.exitCode === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : from;
+  overlayKeys.set(from, key);
+  return key;
+}
 
 // node_modules/@intentius/chant/src/content-digest.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -20003,7 +20192,7 @@ function decideOverride(input) {
 
 // src/terragucci-repo.ts
 import { existsSync as existsSync19 } from "node:fs";
-import { dirname as dirname9, join as join28, resolve as resolve16 } from "node:path";
+import { dirname as dirname9, join as join29, resolve as resolve16 } from "node:path";
 var TERRAGUCCI_CONFIG_NAMES = ["terragucci.yml", "terragucci.yaml", "terragucci.json", "terragucci.ts"];
 function terragucciConfig(dir) {
   return walkUp(dir, TERRAGUCCI_CONFIG_NAMES);
@@ -20012,10 +20201,10 @@ function walkUp(dir, names) {
   let at2 = resolve16(dir);
   for (; ; ) {
     for (const name of names) {
-      const file = join28(at2, name);
+      const file = join29(at2, name);
       if (existsSync19(file)) return file;
     }
-    if (existsSync19(join28(at2, ".git"))) return void 0;
+    if (existsSync19(join29(at2, ".git"))) return void 0;
     const up = dirname9(at2);
     if (up === at2) return void 0;
     at2 = up;
@@ -20420,6 +20609,9 @@ function guardRequest(req, cfg) {
     return { ok: false, status: 421, error: `behold doesn't answer to host ${name}. Start it with --allow-host ${name} if a proxy of yours sends that name.` };
   }
   if (SAFE.has(req.method.toUpperCase())) return { ok: true };
+  if (cfg.public) {
+    return { ok: false, status: 405, error: `behold is serving a public, read-only view: a ${req.method.toUpperCase()} is refused (GET, HEAD and OPTIONS only)` };
+  }
   if ((req.secFetchSite || "").toLowerCase() === "cross-site") {
     return { ok: false, status: 403, error: "a cross-site page can't write to behold" };
   }
@@ -20815,7 +21007,7 @@ init_foreign();
 
 // src/events.ts
 import { watch, existsSync as existsSync20 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -20833,7 +21025,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync20(join29(projectDir, "src")) ? join29(projectDir, "src") : projectDir;
+  const dir = existsSync20(join30(projectDir, "src")) ? join30(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -21136,13 +21328,13 @@ async function emulatorDown(projectDir) {
 
 // src/terragucci-view.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { dirname as dirname13, join as join37, relative as relative8, sep as sep7 } from "node:path";
+import { dirname as dirname13, join as join39, relative as relative8, sep as sep7 } from "node:path";
 init_terraform_member();
 
 // src/terragucci-reports.ts
-import { readFileSync as readFileSync22, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync23, statSync as statSync10 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname10, join as join32, resolve as resolve20 } from "node:path";
+import { dirname as dirname10, join as join33, resolve as resolve20 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { Ajv2020 } from "ajv/dist/2020.js";
 
@@ -21151,12 +21343,12 @@ import { execFile as execFile4 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync21, mkdirSync as mkdirSync6, readdirSync as readdirSync11 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename3, isAbsolute as isAbsolute4, join as join31, resolve as resolve19 } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute4, join as join32, resolve as resolve19 } from "node:path";
 
 // node_modules/@intentius/chant/src/gate-decision.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join30, posix as posix3 } from "node:path";
+import { readFileSync as readFileSync22 } from "node:fs";
+import { join as join31, posix as posix3 } from "node:path";
 
 // node_modules/@intentius/chant/src/lifecycle/gate-applied.ts
 function appliedGatePath(op) {
@@ -21265,7 +21457,7 @@ function pinnedClassesAt(repo, base, pins, packages) {
     }
     let installed2;
     try {
-      installed2 = JSON.parse(readFileSync21(join30(dir, "package.json"), "utf-8")).version;
+      installed2 = JSON.parse(readFileSync22(join31(dir, "package.json"), "utf-8")).version;
     } catch {
       installed2 = void 0;
     }
@@ -21860,7 +22052,7 @@ var realGit = (args, o = {}) => new Promise((res) => {
 });
 var redact = (s) => s.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/gi, "$1");
 function cacheDir(origin, root = tmpdir3()) {
-  return join31(root, `${CACHE_PREFIX}${createHash8("sha256").update(origin).digest("hex").slice(0, 16)}`);
+  return join32(root, `${CACHE_PREFIX}${createHash8("sha256").update(origin).digest("hex").slice(0, 16)}`);
 }
 var inflight = /* @__PURE__ */ new Map();
 function serially(key, fn) {
@@ -21879,7 +22071,7 @@ function fetchable(url, checkout) {
 async function fetchIntoCache(git3, origin, cache6) {
   assertScratch(basename3(cache6));
   return serially(cache6, async () => {
-    if (!existsSync21(join31(cache6, "HEAD"))) {
+    if (!existsSync21(join32(cache6, "HEAD"))) {
       if (existsSync21(cache6) && readdirSync11(cache6).length > 0) return { ok: false, error: `${cache6} exists and is not behold's lifecycle cache; behold leaves it alone` };
       mkdirSync6(cache6, { recursive: true });
       const init = await git3(["init", "--bare", "-q", cache6]);
@@ -22067,7 +22259,7 @@ function structural(name, doc) {
 var compiledSchemas = /* @__PURE__ */ new Map();
 function schemaStamp(dist) {
   try {
-    const files = [join32(dist, "..", "package.json"), ...Object.values(SCHEMA_FILES).map((f) => join32(dist, f))];
+    const files = [join33(dist, "..", "package.json"), ...Object.values(SCHEMA_FILES).map((f) => join33(dist, f))];
     return [dist, ...files.map((f) => {
       const st = statSync10(f);
       return `${st.mtimeMs}:${st.size}`;
@@ -22077,10 +22269,10 @@ function schemaStamp(dist) {
   }
 }
 function compileSchemas(dist) {
-  const version = JSON.parse(readFileSync22(join32(dist, "..", "package.json"), "utf8")).version ?? "";
+  const version = JSON.parse(readFileSync23(join33(dist, "..", "package.json"), "utf8")).version ?? "";
   const ajv = new Ajv2020({ strict: false, allErrors: false });
   const compiled4 = Object.fromEntries(
-    Object.keys(SCHEMA_FILES).map((n) => [n, ajv.compile(JSON.parse(readFileSync22(join32(dist, SCHEMA_FILES[n]), "utf8")))])
+    Object.keys(SCHEMA_FILES).map((n) => [n, ajv.compile(JSON.parse(readFileSync23(join33(dist, SCHEMA_FILES[n]), "utf8")))])
   );
   return {
     validation: { by: "schema", terragucci: version },
@@ -22097,7 +22289,7 @@ function terragucciValidator(dirs = []) {
   for (const from of [...dirs, dirname10(fileURLToPath5(import.meta.url))]) {
     let entry;
     try {
-      entry = createRequire4(join32(resolve20(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
+      entry = createRequire4(join33(resolve20(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
     } catch {
       continue;
     }
@@ -22221,6 +22413,10 @@ async function readTerragucci(source2, opts = {}) {
       }
     }
   }
+  let pullRequest;
+  const prRow = rows.find((r) => r.stage === "tf-plan" && r.pull_request);
+  const prDoc = prRow ? await report(prRow) : void 0;
+  if (prRow && prDoc) pullRequest = pullRequestPlan(prDoc, under(prRow.path, "report.html"));
   const estateDoc = await readDoc(source2, "estate.json", "estate", v);
   const estateProject = estateDoc?.projects.find((p) => p.project === project);
   const waiting = [];
@@ -22266,6 +22462,7 @@ async function readTerragucci(source2, opts = {}) {
     reports: cache6.size,
     roots,
     waiting,
+    ...pullRequest ? { pull_request: pullRequest } : {},
     ...estateDoc && estateProject ? {
       estate: {
         generated: estateDoc.generated,
@@ -22278,6 +22475,57 @@ async function readTerragucci(source2, opts = {}) {
     } : {}
   };
 }
+function pullRequestPlan(doc, report) {
+  return {
+    run: {
+      commit: doc.run.commit,
+      finished: doc.run.finished,
+      pull_request: doc.run.pull_request ?? "",
+      ...doc.run.pull_request_url ? { pull_request_url: doc.run.pull_request_url } : {},
+      ...doc.run.job_url ? { job_url: doc.run.job_url } : {},
+      report
+    },
+    reads: doc.roots.flatMap(
+      (r) => (r.reads ?? []).map((x) => ({
+        root: r.path,
+        upstream: x.upstream,
+        data: x.data,
+        outputs: x.outputs,
+        ...x.unknown?.length ? { unknown: [...x.unknown] } : {},
+        ...x.why ? { why: x.why } : {},
+        ...x.composed ? { composed: true } : {}
+      }))
+    ),
+    roots: doc.roots.map((r) => r.path),
+    waves: doc.waves.map((w) => ({
+      number: w.number,
+      roots: w.roots,
+      ...w.state ? { state: w.state } : {},
+      // A wave that plans again has no digest a review binds until it does.
+      set_digest: w.replans_after?.length ? null : w.set_digest,
+      ...w.review_digest !== void 0 ? { review_digest: w.replans_after?.length ? null : w.review_digest } : {},
+      ...w.waits !== void 0 ? { waits: w.waits } : {},
+      ...w.reads?.length ? { reads: w.reads } : {},
+      ...w.replans_after?.length ? { replans_after: w.replans_after } : {},
+      ...w.cost ? { cost: w.cost } : {},
+      // #568 step 3: each member's changes come from its own slice, under its own name.
+      ...w.composed ? {
+        composed: {
+          ...w.composed,
+          members: w.composed.members.map((m) => {
+            const counts = doc.roots.find((r) => r.path === m.root)?.counts;
+            return { ...m, ...counts ? { counts } : {} };
+          })
+        }
+      } : {}
+    })),
+    ...doc.compose ? { compose: doc.compose } : {},
+    ...doc.totals ? { totals: doc.totals } : {},
+    ...doc.totals_roots !== void 0 ? { totals_roots: doc.totals_roots } : {},
+    ...doc.cost ? { cost: doc.cost } : {},
+    ...doc.blast ? { blast: doc.blast } : {}
+  };
+}
 
 // src/terragucci-overlay.ts
 function blockPath(address) {
@@ -22382,11 +22630,11 @@ function joinTerragucci(read, nodes, roots) {
 // src/terragucci-source.ts
 import { spawn as spawn7 } from "node:child_process";
 import { readFile } from "node:fs/promises";
-import { join as join33, resolve as resolve21 } from "node:path";
+import { join as join34, resolve as resolve21 } from "node:path";
 
 // src/s3-object.ts
 import { createHash as createHash9, createHmac } from "node:crypto";
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 var S3Error = class extends Error {
   /** The HTTP status S3 answered, when it answered. */
   status;
@@ -22433,7 +22681,7 @@ function s3FromEnv(bucket, env = process.env) {
 async function assumeRole(w, fetchFn) {
   let token;
   try {
-    token = readFileSync23(w.tokenFile, "utf8").trim();
+    token = readFileSync24(w.tokenFile, "utf8").trim();
   } catch (e) {
     throw new S3Error(`cannot read the OIDC token in ${w.tokenFile}: ${e.message}`);
   }
@@ -22630,7 +22878,7 @@ function terragucciSource(spec2, opts = {}) {
     location: dir,
     async read(key) {
       try {
-        return await readFile(join33(dir, ...trim(key).split("/")), "utf8");
+        return await readFile(join34(dir, ...trim(key).split("/")), "utf8");
       } catch (e) {
         if (e.code === "ENOENT") return void 0;
         throw e;
@@ -22640,9 +22888,9 @@ function terragucciSource(spec2, opts = {}) {
 }
 
 // src/terragucci-timeline.ts
-import { readFileSync as readFileSync24, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync25, statSync as statSync11 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
-import { dirname as dirname11, join as join34, resolve as resolve22 } from "node:path";
+import { dirname as dirname11, join as join35, resolve as resolve22 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { Ajv2020 as Ajv20202 } from "ajv/dist/2020.js";
 var AUDIT_SCHEMA = "terragucci.audit/v1";
@@ -22683,12 +22931,12 @@ function auditValidator(dirs = []) {
   for (const from of [...dirs, dirname11(fileURLToPath6(import.meta.url))]) {
     let dist;
     try {
-      dist = dirname11(createRequire5(join34(resolve22(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
+      dist = dirname11(createRequire5(join35(resolve22(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
     } catch {
       continue;
     }
-    const pkg = join34(dist, "..", "package.json");
-    const file = join34(dist, AUDIT_SCHEMA_FILE);
+    const pkg = join35(dist, "..", "package.json");
+    const file = join35(dist, AUDIT_SCHEMA_FILE);
     let stamp;
     try {
       stamp = [dist, ...[pkg, file].map((f) => {
@@ -22702,8 +22950,8 @@ function auditValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync24(pkg, "utf8")).version ?? "";
-      v = compileAuditSchema(JSON.parse(readFileSync24(file, "utf8")), version);
+      const version = JSON.parse(readFileSync25(pkg, "utf8")).version ?? "";
+      v = compileAuditSchema(JSON.parse(readFileSync25(file, "utf8")), version);
     } catch {
       continue;
     }
@@ -22899,7 +23147,7 @@ function terragucciTimelineRoute(app, source2, opts = {}) {
 // src/terragucci-poll.ts
 import { createHash as createHash10 } from "node:crypto";
 import { stat } from "node:fs/promises";
-import { join as join35, resolve as resolve23 } from "node:path";
+import { join as join36, resolve as resolve23 } from "node:path";
 import { streamSSE } from "hono/streaming";
 var TERRAGUCCI_POLL_SECS = 30;
 var INDEX_KEY = "index.json";
@@ -22950,7 +23198,7 @@ function indexProbe(spec2, opts = {}) {
       return verdict2(prev, etag);
     };
   }
-  const file = join35(resolve23(opts.cwd ?? process.cwd(), spec2), name);
+  const file = join36(resolve23(opts.cwd ?? process.cwd(), spec2), name);
   return async (prev) => {
     try {
       const s = await stat(file);
@@ -23105,9 +23353,9 @@ function terragucciLaneRoutes(app, o, base, forget) {
 }
 
 // src/terragucci-progress.ts
-import { readFileSync as readFileSync25, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync26, statSync as statSync12 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import { dirname as dirname12, join as join36, resolve as resolve24 } from "node:path";
+import { dirname as dirname12, join as join37, resolve as resolve24 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { Ajv2020 as Ajv20203 } from "ajv/dist/2020.js";
 var RUN_SCHEMA = "terragucci.run/v1";
@@ -23152,12 +23400,12 @@ function runValidator(dirs = []) {
   for (const from of [...dirs, dirname12(fileURLToPath7(import.meta.url))]) {
     let dist;
     try {
-      dist = dirname12(createRequire6(join36(resolve24(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
+      dist = dirname12(createRequire6(join37(resolve24(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
     } catch {
       continue;
     }
-    const pkg = join36(dist, "..", "package.json");
-    const file = join36(dist, RUN_SCHEMA_FILE);
+    const pkg = join37(dist, "..", "package.json");
+    const file = join37(dist, RUN_SCHEMA_FILE);
     let stamp;
     try {
       stamp = [dist, ...[pkg, file].map((f) => {
@@ -23171,8 +23419,8 @@ function runValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync25(pkg, "utf8")).version ?? "";
-      v = compileRunSchema(JSON.parse(readFileSync25(file, "utf8")), version);
+      const version = JSON.parse(readFileSync26(pkg, "utf8")).version ?? "";
+      v = compileRunSchema(JSON.parse(readFileSync26(file, "utf8")), version);
     } catch {
       continue;
     }
@@ -23198,7 +23446,10 @@ function runKey(row) {
 var zero = () => ({ done: 0, "in-flight": 0, waiting: 0, "not-applied": 0 });
 var MARK_ORDER = ["not-applied", "in-flight", "waiting", "done"];
 function unsettled(run3) {
-  return run3.waves.some((w) => w.state === "applying" || (w.progress?.resources ?? []).some((r) => r.status === "in-flight" || r.status === "waiting"));
+  if (run3.waves.some((w) => w.state === "applying" || (w.progress?.resources ?? []).some((r) => r.status === "in-flight" || r.status === "waiting"))) return true;
+  if (run3.waves.some((w) => w.state === "waiting")) return true;
+  if (run3.waves.some((w) => w.state === "failed" || w.state === "refused")) return false;
+  return run3.waves.some((w) => w.state === "applied") && run3.waves.some((w) => w.state === "not-started");
 }
 function joinProgress(run3, nodes, roots) {
   const byRoot = /* @__PURE__ */ new Map();
@@ -23241,12 +23492,36 @@ function joinProgress(run3, nodes, roots) {
     }
     waves.push({ number: w.number, state: w.state, gate: w.gate, read: w.progress.read, counts, resources });
   }
-  return { waves, cards, unmatched, watching: unsettled(run3) };
+  const states = run3.waves.map((w) => ({
+    number: w.number,
+    state: w.state,
+    gate: w.gate,
+    roots: [...w.roots],
+    reads: [...w.reads ?? []],
+    ...w.approval ? { approval: w.approval } : {},
+    ...w.digest !== void 0 ? { digest: w.digest } : {},
+    // The run view writes the approve line while the wave waits; behold's own form when it does not.
+    ...w.state === "waiting" ? { command: w.command ?? terragucciApproveCommand(w.number, w.digest ?? null) } : {},
+    ...w.report ? { report: `${w.report}/report.html` } : {},
+    ...w.changed ? { changed: [...w.changed] } : {},
+    ...w.totals ? { totals: { ...w.totals } } : {},
+    ...w.totals_roots !== void 0 ? { totals_roots: w.totals_roots } : {},
+    ...w.composed ? {
+      composed: {
+        roots: [...w.composed.roots],
+        ...w.composed.digest !== void 0 ? { digest: w.composed.digest } : {},
+        ...w.composed.unknown ? { unknown: [...w.composed.unknown] } : {},
+        ...w.composed.members ? { members: w.composed.members.map((m) => ({ ...m })) } : {}
+      }
+    } : {}
+  }));
+  const reads2 = (run3.roots ?? []).map((r) => ({ root: r.root, wave: r.wave, reads: [...r.reads ?? []], ...r.composed ? { composed: { ...r.composed } } : {} }));
+  return { states, reads: reads2, waves, cards, unmatched, watching: unsettled(run3) };
 }
 var ProgressGraphError = class extends Error {
 };
 var FILES = "/api/terragucci/file?key=";
-var progressKey = (a) => JSON.stringify([a.run, a.waves, a.unmatched]);
+var progressKey = (a) => JSON.stringify([a.run, a.waves, a.unmatched, a.states, a.reads]);
 var TerragucciProgress = class {
   constructor(o) {
     this.o = o;
@@ -23301,6 +23576,8 @@ var TerragucciProgress = class {
         ...this.base(project, v?.run.validation),
         run: null,
         absent: `index.json lists no tf-apply run of ${project} yet, so there is no run view to read.`,
+        states: [],
+        reads: [],
         waves: [],
         cards: {},
         unmatched: [],
@@ -23337,6 +23614,8 @@ var TerragucciProgress = class {
         run: { commit, key, present: false },
         ...unreadable ? { unreadable: true } : {},
         absent: unreadable ?? `${src.location} has no ${key}: terragucci writes the run view when reports.bucket is set, and a wave's progress per resource only for a choudoufu wave (terragucci 0.4.7 and newer). This says nothing about whether the apply moved.`,
+        states: [],
+        reads: [],
         waves: [],
         cards: {},
         unmatched: [],
@@ -23407,6 +23686,90 @@ function terragucciProgressRoute(app, progress) {
   });
 }
 
+// src/terragucci-demo.ts
+import { readFileSync as readFileSync27 } from "node:fs";
+import { join as join38 } from "node:path";
+var DEMO_KEY = "demo.json";
+var DEMO_READ_TTL_MS = 2e3;
+var DEMO_STEPS = ["pull-request", "planned", "merged", "applying", "waiting", "approved", "failed", "resumed", "applied", "reset", "stalled"];
+var UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/;
+var isRecord17 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var str13 = (v) => typeof v === "string";
+var int = (v) => typeof v === "number" && Number.isInteger(v);
+function demoProblem(doc) {
+  if (!isRecord17(doc)) return "it is not an object";
+  if (!int(doc.cycle)) return "cycle is not an integer";
+  if (!str13(doc.scenario) || !doc.scenario) return "scenario is not a string";
+  if (!str13(doc.title)) return "title is not a string";
+  if (!str13(doc.step) || !DEMO_STEPS.includes(doc.step)) return `step is not one of ${DEMO_STEPS.join(", ")}`;
+  if (!str13(doc.label)) return "label is not a string";
+  if (!str13(doc.started_at) || !UTC.test(doc.started_at)) return "started_at is not a UTC time (YYYY-MM-DDTHH:MM:SSZ)";
+  if (doc.next !== null) {
+    if (!isRecord17(doc.next)) return "next is neither an object nor null";
+    if (!str13(doc.next.action)) return "next.action is not a string";
+    if (doc.next.at !== null && !(str13(doc.next.at) && UTC.test(doc.next.at))) return "next.at is neither a UTC time nor null";
+  }
+  if (doc.pull !== null && !int(doc.pull)) return "pull is neither an integer nor null";
+  if (doc.commit !== null && !str13(doc.commit)) return "commit is neither a string nor null";
+  return void 0;
+}
+async function readDemo(source2, now = /* @__PURE__ */ new Date()) {
+  const base = { source: source2.location, read: now.toISOString() };
+  let body;
+  try {
+    body = await source2.read(DEMO_KEY);
+  } catch (e) {
+    if (e instanceof TerragucciDenied) return { ...base, demo: null, error: deniedWords(e, "the demo's narration"), code: "terragucci-demo" };
+    return { ...base, demo: null, error: `behold could not read ${DEMO_KEY} from ${source2.location}: ${e instanceof Error ? e.message : String(e)}`, code: "terragucci-demo" };
+  }
+  if (body === void 0) {
+    return { ...base, demo: null, absent: `${source2.location} has no ${DEMO_KEY}: the demo's loop driver writes it at every step (terragucci's stack/demo.sh), beside index.json.` };
+  }
+  let doc;
+  try {
+    doc = JSON.parse(body);
+  } catch {
+    return { ...base, demo: null, error: `${DEMO_KEY} in ${source2.location} is not JSON.`, code: "terragucci-demo" };
+  }
+  const problem = demoProblem(doc);
+  if (problem) return { ...base, demo: null, error: `${DEMO_KEY} in ${source2.location} is not the demo's format: ${problem}.`, code: "terragucci-demo" };
+  const d = doc;
+  return {
+    ...base,
+    demo: {
+      cycle: d.cycle,
+      scenario: d.scenario,
+      title: d.title,
+      step: d.step,
+      label: d.label,
+      started_at: d.started_at,
+      next: d.next ? { action: d.next.action, at: d.next.at } : null,
+      pull: d.pull,
+      commit: d.commit
+    }
+  };
+}
+function terragucciDemoRoute(app, source2, opts = {}) {
+  let cached;
+  app.get("/api/terragucci/demo", async (c) => {
+    const at2 = Date.now();
+    if (!cached || at2 - cached.at >= DEMO_READ_TTL_MS) cached = { at: at2, read: readDemo(source2, opts.now ? opts.now() : /* @__PURE__ */ new Date()) };
+    const a = await cached.read;
+    return c.json(a, "error" in a ? 502 : 200, { "cache-control": "no-store" });
+  });
+}
+function kioskRoute(app, webRoot2, enabled) {
+  app.get("/kiosk", (c) => {
+    if (!enabled) {
+      return c.html(
+        `<!doctype html><meta charset=utf-8><title>behold kiosk</title><script type="module">import { initTheme } from "/theme.js"; initTheme();</script><body style="font:16px system-ui;background:var(--bg,#1e1e2e);color:var(--fg,#cdd6f4);padding:2rem"><h3>The kiosk follows a terragucci demo</h3><p style="color:var(--muted,#777a8c)">Start behold with <code>--terragucci &lt;reports source&gt;</code>; the kiosk reads <code>demo.json</code> there.</p></body>`,
+        404
+      );
+    }
+    return new Response(readFileSync27(join38(webRoot2, "kiosk.html"), "utf8"), { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
+  });
+}
+
 // src/terragucci-view.ts
 var TERRAGUCCI_READ_TTL_MS = 3e4;
 function repoBase(dirs) {
@@ -23445,7 +23808,7 @@ function checkoutRoots(dirs, base = repoBase(dirs)) {
   for (const m of estateMembers(dirs)) {
     if (m.kind !== "terraform") continue;
     for (const r of discoverTerraformRoots(m.dir).roots) {
-      const path = relative8(base, join37(m.dir, r.dir)).split(sep7).join("/") || ".";
+      const path = relative8(base, join39(m.dir, r.dir)).split(sep7).join("/") || ".";
       out.push({ member: m.name, name: r.name, path });
     }
   }
@@ -23521,9 +23884,12 @@ function terragucciRoutes(app, opts, dirs) {
       // Where a key opens: this server, which reads it from the same source.
       files: "/api/terragucci/file?key=",
       ...r.estate ? { estate: r.estate } : {},
+      // #568: the pull request stage, read from the newest tf-plan of a pull request.
+      ...r.pull_request ? { pull_request: r.pull_request } : {},
       ...marks
     });
   });
+  terragucciDemoRoute(app, source2, opts.now ? { now: opts.now } : {});
   terragucciTimelineRoute(app, source2, {
     ...opts.project ? { project: opts.project } : {},
     checkoutProject: () => checkoutProject(repoBase(dirs())),
@@ -23588,7 +23954,7 @@ var heldByOf = (v) => {
   return h && typeof h === "object" && typeof h.hook === "string" && typeof h.moment === "string" ? { hook: h.hook, moment: h.moment, ...typeof h.target === "string" ? { target: h.target } : {} } : void 0;
 };
 var modeOf = (v) => v === "ledger" || v === "pr-review" || v === "sealed" ? v : void 0;
-var str13 = (v) => typeof v === "string" && v !== "" ? v : void 0;
+var str14 = (v) => typeof v === "string" && v !== "" ? v : void 0;
 var strings3 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : void 0;
 var time3 = (iso) => Date.parse(iso) || 0;
 function rowOf(line) {
@@ -23604,14 +23970,14 @@ function rowOf(line) {
 }
 function sealOf(r) {
   const s = r.seal;
-  const signed = s && s.signature ? { sealed: true, ...str13(s.signer) ? { signer: str13(s.signer) } : {} } : void 0;
+  const signed = s && s.signature ? { sealed: true, ...str14(s.signer) ? { signer: str14(s.signer) } : {} } : void 0;
   if (r.review || r.via === "pr-review") return { seal: "review", ...signed };
   return signed ? { seal: "sealed", ...signed } : { seal: "unsigned" };
 }
 function reviewOf(r) {
   const rv = r.review ?? void 0;
   const pr = typeof rv?.pr === "number" ? rv.pr : typeof r.pr === "number" ? r.pr : void 0;
-  const head = str13(rv?.head) ?? str13(r.head);
+  const head = str14(rv?.head) ?? str14(r.head);
   const approvers = strings3(rv?.approvers) ?? strings3(r.reviewers);
   if (pr === void 0 && head === void 0 && approvers === void 0) return void 0;
   return { ...pr !== void 0 ? { pr } : {}, ...head ? { head } : {}, ...approvers ? { approvers } : {} };
@@ -23637,7 +24003,7 @@ function decisionOf(d) {
   const r = v;
   if (!r || typeof r !== "object" || typeof r.wave !== "number" || typeof r.name !== "string" || typeof r.op !== "string" || typeof r.gate !== "string") return void 0;
   const outcomes2 = Array.isArray(r.outcomes) ? r.outcomes.filter((o) => !!o && typeof o === "object" && typeof o.moment === "string" && typeof o.name === "string" && typeof o.exit === "number" && typeof o.outcome === "string") : void 0;
-  return { wave: r.wave, name: r.name, op: r.op, gate: r.gate, ...str13(r.digest) ? { digest: str13(r.digest) } : {}, ...strings3(r.heldBy) ? { heldBy: strings3(r.heldBy) } : {}, ...r.heldOn !== void 0 ? { heldOn: r.heldOn } : {}, ...outcomes2 ? { outcomes: outcomes2 } : {} };
+  return { wave: r.wave, name: r.name, op: r.op, gate: r.gate, ...str14(r.digest) ? { digest: str14(r.digest) } : {}, ...strings3(r.heldBy) ? { heldBy: strings3(r.heldBy) } : {}, ...r.heldOn !== void 0 ? { heldOn: r.heldOn } : {}, ...outcomes2 ? { outcomes: outcomes2 } : {} };
 }
 function deriveGateAudit(input) {
   const isOverride = input.isOverride ?? isOverrideGate2;
@@ -23662,17 +24028,17 @@ function deriveGateAudit(input) {
     const requests = [];
     for (const p of parsed) {
       if (!p.pending || p.line.removed) continue;
-      const digest = str13(p.r.planDigest);
+      const digest = str14(p.r.planDigest);
       denials.set(`${String(p.r.gate)}
 ${digest ?? ""}`, p.r);
-      requests.push({ op: ledger.op, gate: String(p.r.gate), at: time3(String(p.r.timestamp)), ...digest ? { digest } : {}, ...str13(p.r.environment) ? { environment: str13(p.r.environment) } : {} });
+      requests.push({ op: ledger.op, gate: String(p.r.gate), at: time3(String(p.r.timestamp)), ...digest ? { digest } : {}, ...str14(p.r.environment) ? { environment: str14(p.r.environment) } : {} });
     }
     for (const { line, n, r, pending } of parsed) {
       const gate = String(r.gate);
       const override = isOverride(ledger.op, gate);
       const removed = line.removed;
       if (pending && removed) continue;
-      const digest = str13(r.planDigest);
+      const digest = str14(r.planDigest);
       const author = removed ?? line.added;
       const source2 = {
         path,
@@ -23691,7 +24057,7 @@ ${digest ?? ""}`, p.r);
           ...base,
           kind: override ? "override-requested" : "approval-requested",
           at: String(r.timestamp),
-          ...drop({ runId: str13(r.runId), expiresAt: str13(r.expiresAt), description: str13(r.description), url: str13(r.url), rules: strings3(r.rules), wave: waveOf(r.wave), heldBy: heldByOf(r.heldBy), approvalMode: modeOf(r.approvalMode) }),
+          ...drop({ runId: str14(r.runId), expiresAt: str14(r.expiresAt), description: str14(r.description), url: str14(r.url), rules: strings3(r.rules), wave: waveOf(r.wave), heldBy: heldByOf(r.heldBy), approvalMode: modeOf(r.approvalMode) }),
           detail: extra2
         }));
         continue;
@@ -23719,13 +24085,13 @@ ${digest ?? ""}`) : void 0;
         at: String(r.timestamp),
         by: String(r.resolvedBy),
         seal,
-        ...drop({ sealed, signer, committedBy: line.added?.by, relayedBy: str13(r.relayedBy), approver: approverOf(r), note: str13(r.note), url: str13(r.url), review: reviewOf(r), rules }),
+        ...drop({ sealed, signer, committedBy: line.added?.by, relayedBy: str14(r.relayedBy), approver: approverOf(r), note: str14(r.note), url: str14(r.url), review: reviewOf(r), rules }),
         detail: extra2
       });
       entries.push(entry);
       if (!override) {
         const at2 = time3(entry.at);
-        const env = str13(r.environment);
+        const env = str14(r.environment);
         const asked = requests.some((q) => q.gate === gate && q.at <= at2 && compatible(q.digest, digest) && (q.environment === void 0 || env === void 0 || q.environment === env));
         if (!asked) {
           gaps.push({ kind: "approval-without-request", op: ledger.op, gate, ...digest ? { digest } : {}, detail: `${path} holds an approval of ${gate} by ${entry.by} at ${entry.at} with no pending fact of that gate${digest ? " and digest" : ""} before it` });
@@ -24000,8 +24366,8 @@ function lifecycleHistoryRoute(app, base, opts = {}) {
 }
 
 // src/lifecycle-releases.ts
-import { existsSync as existsSync22, readFileSync as readFileSync26 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync28 } from "node:fs";
+import { join as join40 } from "node:path";
 
 // node_modules/@intentius/chant/src/lifecycle/legacy-digest.ts
 import { resolve as resolve25 } from "node:path";
@@ -24114,10 +24480,10 @@ function memberNote(l) {
 // src/lifecycle-releases.ts
 var WAVES_SPEC_FILE = "yodel-waves.json";
 function waveOrder(checkout) {
-  const p = join38(checkout, WAVES_SPEC_FILE);
+  const p = join40(checkout, WAVES_SPEC_FILE);
   if (!existsSync22(p)) return void 0;
   try {
-    const doc = JSON.parse(readFileSync26(p, "utf8"));
+    const doc = JSON.parse(readFileSync28(p, "utf8"));
     const names = (doc.waves ?? []).map((w) => w?.name).filter((n) => typeof n === "string" && n.length > 0);
     return names.length ? [...new Set(names)] : void 0;
   } catch {
@@ -24125,7 +24491,7 @@ function waveOrder(checkout) {
   }
 }
 function hasReleaseLedgerHint(checkout) {
-  return existsSync22(join38(checkout, "yodel.config.ts")) || existsSync22(join38(checkout, WAVES_SPEC_FILE));
+  return existsSync22(join40(checkout, "yodel.config.ts")) || existsSync22(join40(checkout, WAVES_SPEC_FILE));
 }
 function orderEnvironments(envs, waves) {
   const seen = new Set(envs);
@@ -24167,7 +24533,7 @@ function releaseCells(ledgers, order, sources) {
 }
 async function copyCheckoutRef(git3, checkout, cache6) {
   assertScratch(cache6.split(/[\\/]/).pop());
-  if (!existsSync22(join38(cache6, "HEAD"))) {
+  if (!existsSync22(join40(cache6, "HEAD"))) {
     const init = await git3(["init", "--bare", "-q", cache6]);
     if (init.code !== 0) return false;
   }
@@ -24270,8 +24636,8 @@ function releasesRoutes(app, base, opts = {}) {
 }
 
 // src/sql-yodeler-lane.ts
-import { existsSync as existsSync23, readdirSync as readdirSync12, readFileSync as readFileSync27 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync23, readdirSync as readdirSync12, readFileSync as readFileSync29 } from "node:fs";
+import { join as join41 } from "node:path";
 var YODEL_APPLY_OP = "yodel-apply";
 var YODEL_HEAD_PLANS_DIR = headPlansPath(YODEL_APPLY_OP, "").dir;
 function parseYodelWaves(text, path = WAVES_SPEC_FILE) {
@@ -24303,16 +24669,16 @@ function parseYodelWaves(text, path = WAVES_SPEC_FILE) {
   return { path, waves };
 }
 function readYodelWaves(checkout) {
-  const p = join39(checkout, WAVES_SPEC_FILE);
+  const p = join41(checkout, WAVES_SPEC_FILE);
   if (!existsSync23(p)) return void 0;
   try {
-    return parseYodelWaves(readFileSync27(p, "utf8"));
+    return parseYodelWaves(readFileSync29(p, "utf8"));
   } catch (e) {
     return { path: WAVES_SPEC_FILE, waves: [], error: e instanceof Error ? e.message : String(e) };
   }
 }
 function migrateOpEnvironments(checkout) {
-  const dir = join39(checkout, "ops");
+  const dir = join41(checkout, "ops");
   if (!existsSync23(dir)) return [];
   try {
     return readdirSync12(dir).map((f) => /^migrate-(.+)\.op\.ts$/.exec(f)?.[1]).filter((e) => !!e).sort();
@@ -24435,16 +24801,16 @@ function sqlYodelerLaneRoute(app, checkout, opts = {}) {
 
 // src/terragucci-estate.ts
 init_yaml();
-import { existsSync as existsSync24, readFileSync as readFileSync28, statSync as statSync13 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync30, statSync as statSync13 } from "node:fs";
 import { createRequire as createRequire7 } from "node:module";
-import { dirname as dirname14, extname, join as join40, resolve as resolve26 } from "node:path";
+import { dirname as dirname14, extname, join as join42, resolve as resolve26 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { Ajv2020 as Ajv20204 } from "ajv/dist/2020.js";
 var RUN_SCHEMA2 = "terragucci.run/v1";
 function configProjects(file) {
   let text;
   try {
-    text = readFileSync28(file, "utf8");
+    text = readFileSync30(file, "utf8");
   } catch {
     return void 0;
   }
@@ -24472,21 +24838,21 @@ function controlRepo(dirs, roots = () => checkoutRoots(dirs).length) {
   }
   return n === 0 ? { config, projects } : void 0;
 }
-var isRecord17 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-var str14 = (v) => typeof v === "string";
-var int = (v) => typeof v === "number" && Number.isInteger(v);
+var isRecord18 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var str15 = (v) => typeof v === "string";
+var int2 = (v) => typeof v === "number" && Number.isInteger(v);
 function structuralRun2(doc) {
-  if (!isRecord17(doc)) return "it is not a JSON object";
+  if (!isRecord18(doc)) return "it is not a JSON object";
   if (doc.schema !== RUN_SCHEMA2) return `its schema is ${JSON.stringify(doc.schema)}, not ${RUN_SCHEMA2}`;
-  if (!str14(doc.project) || !str14(doc.commit) || !str14(doc.updated)) return "it lacks project, commit or updated";
+  if (!str15(doc.project) || !str15(doc.commit) || !str15(doc.updated)) return "it lacks project, commit or updated";
   if (!Array.isArray(doc.roots) || !Array.isArray(doc.waves)) return "it has no roots or waves array";
   for (const [i, r] of doc.roots.entries()) {
-    if (!isRecord17(r) || !str14(r.root) || !int(r.wave) || !Array.isArray(r.reads) || !r.reads.every(str14)) return `root ${i} lacks root, wave or reads`;
-    if (r.state !== void 0 && !(isRecord17(r.state) && str14(r.state.key))) return `root ${String(r.root)}'s state has no key`;
-    if (r.external !== void 0 && !(Array.isArray(r.external) && r.external.every((x) => isRecord17(x) && str14(x.data) && str14(x.key)))) return `root ${String(r.root)}'s external reads lack data or key`;
+    if (!isRecord18(r) || !str15(r.root) || !int2(r.wave) || !Array.isArray(r.reads) || !r.reads.every(str15)) return `root ${i} lacks root, wave or reads`;
+    if (r.state !== void 0 && !(isRecord18(r.state) && str15(r.state.key))) return `root ${String(r.root)}'s state has no key`;
+    if (r.external !== void 0 && !(Array.isArray(r.external) && r.external.every((x) => isRecord18(x) && str15(x.data) && str15(x.key)))) return `root ${String(r.root)}'s external reads lack data or key`;
   }
   for (const [i, w] of doc.waves.entries()) {
-    if (!isRecord17(w) || !int(w.number) || !Array.isArray(w.roots) || !Array.isArray(w.reads) || !str14(w.state) || !str14(w.gate)) return `wave ${i} lacks number, roots, reads, state or gate`;
+    if (!isRecord18(w) || !int2(w.number) || !Array.isArray(w.roots) || !Array.isArray(w.reads) || !str15(w.state) || !str15(w.gate)) return `wave ${i} lacks number, roots, reads, state or gate`;
   }
   return void 0;
 }
@@ -24495,16 +24861,16 @@ function runViewValidator(dirs = []) {
   for (const from of [...dirs, dirname14(fileURLToPath8(import.meta.url))]) {
     let entry;
     try {
-      entry = createRequire7(join40(resolve26(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
+      entry = createRequire7(join42(resolve26(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
     } catch {
       continue;
     }
     const dist = dirname14(entry);
-    const schema = join40(dist, "run.schema.json");
+    const schema = join42(dist, "run.schema.json");
     let stamp;
     try {
       const st = statSync13(schema);
-      const pkg = statSync13(join40(dist, "..", "package.json"));
+      const pkg = statSync13(join42(dist, "..", "package.json"));
       stamp = `${schema}\0${st.mtimeMs}:${st.size}\0${pkg.mtimeMs}`;
     } catch {
       continue;
@@ -24513,12 +24879,12 @@ function runViewValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync28(join40(dist, "..", "package.json"), "utf8")).version ?? "";
-      const validate = new Ajv20204({ strict: false, allErrors: false }).compile(JSON.parse(readFileSync28(schema, "utf8")));
+      const version = JSON.parse(readFileSync30(join42(dist, "..", "package.json"), "utf8")).version ?? "";
+      const validate = new Ajv20204({ strict: false, allErrors: false }).compile(JSON.parse(readFileSync30(schema, "utf8")));
       v = {
         validation: { by: "schema", terragucci: version },
         check(doc) {
-          const id = isRecord17(doc) ? doc.schema : void 0;
+          const id = isRecord18(doc) ? doc.schema : void 0;
           if (id !== RUN_SCHEMA2) return `its schema is ${JSON.stringify(id)}, not ${RUN_SCHEMA2}`;
           if (validate(doc)) return void 0;
           const e = validate.errors?.[0];
@@ -24569,8 +24935,8 @@ function controlEdges(views) {
 function siblingCheckout(project, base, projectOf = checkoutProject) {
   const name = project.split("/").filter(Boolean).pop();
   if (!name) return void 0;
-  const dir = join40(dirname14(resolve26(base)), name);
-  if (dir === resolve26(base) || !existsSync24(join40(dir, ".git"))) return void 0;
+  const dir = join42(dirname14(resolve26(base)), name);
+  if (dir === resolve26(base) || !existsSync24(join42(dir, ".git"))) return void 0;
   return projectOf(dir) === project ? dir : void 0;
 }
 var shellWord = (s) => /^[A-Za-z0-9_./:@%+=,-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
@@ -24777,9 +25143,9 @@ function controlRepoInfo(dirs) {
 }
 
 // src/yodel-report.ts
-import { readdirSync as readdirSync13, readFileSync as readFileSync29, statSync as statSync14 } from "node:fs";
+import { readdirSync as readdirSync13, readFileSync as readFileSync31, statSync as statSync14 } from "node:fs";
 import { createRequire as createRequire8 } from "node:module";
-import { basename as basename4, dirname as dirname15, join as join41, resolve as resolve27 } from "node:path";
+import { basename as basename4, dirname as dirname15, join as join43, resolve as resolve27 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { Ajv2020 as Ajv20205 } from "ajv/dist/2020.js";
 
@@ -25208,13 +25574,13 @@ var installed = /* @__PURE__ */ new Map();
 function packageRoot(from) {
   let entry;
   try {
-    entry = createRequire8(join41(resolve27(from), "noop.js")).resolve("@intentius/sql-yodeler");
+    entry = createRequire8(join43(resolve27(from), "noop.js")).resolve("@intentius/sql-yodeler");
   } catch {
     return void 0;
   }
   for (let d = dirname15(entry); d !== dirname15(d); d = dirname15(d)) {
     try {
-      const pkg = JSON.parse(readFileSync29(join41(d, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync31(join43(d, "package.json"), "utf8"));
       if (pkg.name === "@intentius/sql-yodeler") return d;
     } catch {
     }
@@ -25226,11 +25592,11 @@ function yodelValidator(dirs = []) {
     const root = packageRoot(from);
     if (!root) continue;
     try {
-      const version = JSON.parse(readFileSync29(join41(root, "package.json"), "utf8")).version ?? "";
+      const version = JSON.parse(readFileSync31(join43(root, "package.json"), "utf8")).version ?? "";
       const key = `${root}\0${version}`;
       let v = installed.get(key);
       if (!v) {
-        const load2 = (n) => JSON.parse(readFileSync29(join41(root, "schemas", `${n}.schema.json`), "utf8"));
+        const load2 = (n) => JSON.parse(readFileSync31(join43(root, "schemas", `${n}.schema.json`), "utf8"));
         v = compile({ common: load2("common"), report: load2("report"), drift: load2("drift") }, { by: "schema", from: "package", sqlYodeler: version });
         installed.set(key, v);
       }
@@ -25241,9 +25607,9 @@ function yodelValidator(dirs = []) {
   pinned ??= compile({ common: common_schema_default, report: report_schema_default, drift: drift_schema_default }, { by: "schema", from: "pinned", commit: PINNED_COMMIT.slice(0, 7) });
   return pinned;
 }
-var isRecord18 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var looksLikeReport = (d) => isRecord18(d) && "generatedAt" in d && "environments" in d;
-var looksLikeDrift = (d) => isRecord18(d) && "environment" in d && ("drifted" in d || "changed" in d);
+var isRecord19 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var looksLikeReport = (d) => isRecord19(d) && "generatedAt" in d && "environments" in d;
+var looksLikeDrift = (d) => isRecord19(d) && "environment" in d && ("drifted" in d || "changed" in d);
 function filesOf(source2) {
   let st;
   try {
@@ -25252,7 +25618,7 @@ function filesOf(source2) {
     return refuse14(`--yodel-report ${source2}: no such file or directory`, "Point --yodel-report at the file `yodel report --json` wrote, or the directory holding it.");
   }
   const dir = st.isDirectory() ? source2 : dirname15(source2);
-  const files = readdirSync13(dir).filter((f) => f.endsWith(".json")).sort().map((f) => join41(dir, f));
+  const files = readdirSync13(dir).filter((f) => f.endsWith(".json")).sort().map((f) => join43(dir, f));
   return st.isDirectory() ? { dir, files } : { dir, files, named: resolve27(source2) };
 }
 function readYodelReport(source2, validator2) {
@@ -25264,7 +25630,7 @@ function readYodelReport(source2, validator2) {
   for (const file of files) {
     let doc;
     try {
-      doc = JSON.parse(readFileSync29(file, "utf8"));
+      doc = JSON.parse(readFileSync31(file, "utf8"));
     } catch (e) {
       if (file === named) refuse14(`${basename4(file)} is not JSON: ${e instanceof Error ? e.message : String(e)}`, remedy);
       ignored.push(basename4(file));
@@ -25351,24 +25717,24 @@ function yodelReportRoute(app, source2, dirs) {
 
 // src/demo-pins.ts
 init_terraform_member();
-import { existsSync as existsSync25, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync30, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname16, join as join42, resolve as resolve28 } from "node:path";
-var isRecord19 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+import { existsSync as existsSync25, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync32, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname16, join as join44, resolve as resolve28 } from "node:path";
+var isRecord20 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function linkDemoPins(work, probes = {}) {
-  const file = join42(work, "chant.workspace.json");
+  const file = join44(work, "chant.workspace.json");
   if (!existsSync25(file)) return { ok: true, linked: [] };
   let decl;
   try {
-    decl = JSON.parse(readFileSync30(file, "utf8"));
+    decl = JSON.parse(readFileSync32(file, "utf8"));
   } catch {
     return { ok: true, linked: [] };
   }
-  if (!isRecord19(decl) || !Array.isArray(decl.pins)) return { ok: true, linked: [] };
+  if (!isRecord20(decl) || !Array.isArray(decl.pins)) return { ok: true, linked: [] };
   const find = probes.resolve ?? ((pkg) => resolvedPackage(pkg));
   const linked = [];
   let rewrite = false;
   for (const pin of decl.pins) {
-    if (!isRecord19(pin) || typeof pin.package !== "string") continue;
+    if (!isRecord20(pin) || typeof pin.package !== "string") continue;
     const pkg = pin.package;
     if (pkg === TERRAFORM_LEXICON_PKG) {
       const refusal2 = (probes.reader ?? terraformReaderState)().refusal;
@@ -25382,7 +25748,7 @@ function linkDemoPins(work, probes = {}) {
         remedy: `Install ${pkg} beside behold, then load the demo again.`
       };
     }
-    const link = join42(work, "node_modules", ...pkg.split("/"));
+    const link = join44(work, "node_modules", ...pkg.split("/"));
     if (!present(link)) {
       mkdirSync7(dirname16(link), { recursive: true });
       symlinkSync2(found.dir, link, "junction");
@@ -25417,13 +25783,13 @@ function linksTo(link, target) {
 }
 
 // src/demos.ts
-import { readFileSync as readFileSync31, existsSync as existsSync26, cpSync, mkdirSync as mkdirSync8 } from "node:fs";
-import { dirname as dirname17, isAbsolute as isAbsolute5, join as join43, relative as relative9, resolve as resolve29, sep as sep8 } from "node:path";
+import { readFileSync as readFileSync33, existsSync as existsSync26, cpSync, mkdirSync as mkdirSync8 } from "node:fs";
+import { dirname as dirname17, isAbsolute as isAbsolute5, join as join45, relative as relative9, resolve as resolve29, sep as sep8 } from "node:path";
 import { spawn as spawn8, spawnSync as spawnSync3 } from "node:child_process";
 function readCatalog(file, catalog) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync31(file, "utf8"));
+    raw = JSON.parse(readFileSync33(file, "utf8"));
   } catch {
     return [];
   }
@@ -25463,10 +25829,10 @@ function validEntry(e) {
   return true;
 }
 function loadDemoRegistry(pkgRoot3) {
-  const merged = readCatalog(join43(pkgRoot3, "demos.json"), "demos");
+  const merged = readCatalog(join45(pkgRoot3, "demos.json"), "demos");
   const seen = new Set(merged.map((e) => e.name));
   const named = process.env.BEHOLD_WORKBENCH;
-  for (const e of [...readCatalog(join43(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve29(named), "workbench") : []]) {
+  for (const e of [...readCatalog(join45(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve29(named), "workbench") : []]) {
     if (seen.has(e.name)) {
       process.stderr.write(`behold: workbench entry "${e.name}" collides with a demo already in the catalog \u2014 dropped
 `);
@@ -25513,7 +25879,7 @@ async function loadDemo(entry, opts) {
     say(`serving ${work} where it is \u2014 nothing copied`);
   } else if (!existsSync26(target)) {
     if (entry.source === "bundled" || entry.source === "local" && local) {
-      const from = entry.source === "bundled" ? join43(pkgRoot3, entry.dir) : local;
+      const from = entry.source === "bundled" ? join45(pkgRoot3, entry.dir) : local;
       if (!existsSync26(from)) return { ok: false, error: entry.source === "bundled" ? `this install has no bundled ${entry.dir}` : `${entry.path} is not checked out (looked in ${from})` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
@@ -25545,7 +25911,7 @@ async function loadDemo(entry, opts) {
     if (!pins.ok) return { ok: false, error: `${pins.error} ${pins.remedy}` };
     for (const p of pins.linked) say(`linked ${p.pkg} ${p.version} into the copy${p.was ? ` (the declaration pinned ${p.was}; now ${p.version})` : ""}`);
   }
-  if (!inPlace && existsSync26(join43(work, "package.json")) && !existsSync26(join43(work, "node_modules"))) {
+  if (!inPlace && existsSync26(join45(work, "package.json")) && !existsSync26(join45(work, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: work, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${work}` };
@@ -25562,7 +25928,7 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join43(work, d)) : [work] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join45(work, d)) : [work] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
@@ -25573,8 +25939,8 @@ function runStep(cmd, args, opts = {}) {
 }
 
 // src/server.ts
-var pkgRoot = join44(dirname18(fileURLToPath10(import.meta.url)), "..");
-var webRoot = join44(pkgRoot, "web");
+var pkgRoot = join46(dirname18(fileURLToPath10(import.meta.url)), "..");
+var webRoot = join46(pkgRoot, "web");
 var execFileP = async (cmd, args) => (await promisify3(execFile5)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
@@ -25625,7 +25991,7 @@ function tierFailure(tier, message2) {
 function beholdVersion() {
   try {
     const here = dirname18(fileURLToPath10(import.meta.url));
-    return JSON.parse(readFileSync32(join44(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync34(join46(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -25672,7 +26038,7 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
   }
 }
 function carveRoutes(app, reportPath, demo) {
-  const load2 = () => readCarveReport(reportPath, (p) => readFileSync32(p, "utf8"));
+  const load2 = () => readCarveReport(reportPath, (p) => readFileSync34(p, "utf8"));
   const carveDirs = [dirname18(reportPath), ...demo ? [demo.out] : []];
   const carveStates = () => readCarveStates(carveDirs, nodeCarveIo, 0);
   const emittedNodes = async (states) => {
@@ -25908,13 +26274,18 @@ function cardPrefixesOf(ir) {
   const byStack = ir.groups.byStack;
   return byStack && Object.keys(byStack).length ? byStack : void 0;
 }
-function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffer(), runner = new OpRunner({
-  projectDir: cfg.projectDir,
-  broadcaster,
-  onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
-})) {
+function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffer(), given) {
+  const runner = cfg.public ? new ReadOnlyRunner() : given ?? new OpRunner({
+    projectDir: cfg.projectDir,
+    broadcaster,
+    onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
+  });
   const app = new Hono();
-  const guard = { allowedHosts: allowedHostsFrom(cfg.allowedHosts ?? []), ...cfg.host ? { boundHost: cfg.host } : {} };
+  const guard = {
+    allowedHosts: allowedHostsFrom(cfg.allowedHosts ?? []),
+    ...cfg.host ? { boundHost: cfg.host } : {},
+    ...cfg.public ? { public: true } : {}
+  };
   app.use("*", async (c, next) => {
     const verdict3 = guardRequest(
       {
@@ -25925,9 +26296,13 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       },
       guard
     );
-    if (!verdict3.ok) return c.json({ error: verdict3.error, code: "request-refused" }, verdict3.status);
+    if (!verdict3.ok) {
+      if (verdict3.status === 405) c.header("allow", "GET, HEAD, OPTIONS");
+      return c.json({ error: verdict3.error, code: verdict3.status === 405 ? "public" : "request-refused" }, verdict3.status);
+    }
     await next();
   });
+  if (cfg.public) publicRoutes(app, webRoot);
   setChoudoufuRunner(cfg.choudoufu?.run);
   setEstateLexiconRead(cfg.choudoufu ? cfg.choudoufu.lexicon ?? null : void 0);
   setServedWorkspace(cfg.workspace);
@@ -25985,6 +26360,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   };
   const estateSourceRoots = async (opts) => (await Promise.all((cfg.projectDirs ?? []).map(async (dir) => [await graphPath(dir, opts), dir]))).flat();
   app.get("/healthz", (c) => c.json({ ok: true, projectDir: cfg.projectDir, env: cfg.env ?? null, frames: frames.size }));
+  kioskRoute(app, webRoot, !!cfg.terragucci);
   app.get("/api/frames", (c) => c.json({ frames: frames.summaries() }));
   app.get("/lanes", (c) => {
     const all = frames.all();
@@ -26068,8 +26444,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join44(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join44(cfg.projectDir, "scripts/local/local-up.sh");
+    const down = join46(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join46(cfg.projectDir, "scripts/local/local-up.sh");
     if (!existsSync27(down) || !existsSync27(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
@@ -26091,7 +26467,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const dirs = [];
     const declared = [];
     for (const f of discoverOpIrs(estateDirs)) {
-      const parsed = readOpIr(f.path, (p) => readFileSync32(p, "utf8"));
+      const parsed = readOpIr(f.path, (p) => readFileSync34(p, "utf8"));
       if (!parsed.ok) continue;
       const mine = declaredConvergeOps([parsed.ir]);
       if (!mine.length) continue;
@@ -26271,7 +26647,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   });
   app.get("/api/project", async (c) => {
     const { environments: declaredEnvs, lexicons, stacks, k8sProfiles } = await detectProject(cfg.projectDir);
-    const environments = declaredEnvs.length === 0 && (cfg.projectDirs ?? [cfg.projectDir]).some((d) => memberKindOf(d) === "choudoufu") ? ["live"] : declaredEnvs;
+    const environments = cfg.public ? [] : declaredEnvs.length === 0 && (cfg.projectDirs ?? [cfg.projectDir]).some((d) => memberKindOf(d) === "choudoufu") ? ["live"] : declaredEnvs;
     const k8sTarget = lexicons.includes("k8s") ? resolveK8sTarget(k8sProfiles, cfg.env, await loadKubeconfig()) : void 0;
     const axes = deployAxes(tierEnvVar, lexicons, k8sTarget);
     const emittedOps = discoverOpIrs(estateDirs).length;
@@ -26305,6 +26681,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       currentEnv: cfg.env ?? null,
       // v0.1.0 preview: the SPA hides git/PR ops + arbitrary-project affordances.
       ...cfg.previewMode ? { previewMode: true } : {},
+      // #569: a public view; the SPA hides every control that writes.
+      ...cfg.public ? { publicMode: true } : {},
       // #489: a terragucci repo is applied by its pipeline; the SPA offers no
       // write at all, and the write routes refuse with the same words.
       ...tgConfig() ? { terragucci: { config: tgConfig(), ...terragucciRefusal(tgConfig(), "deploying from behold") } } : {},
@@ -26369,7 +26747,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       // true is a flag the SPA can read as "absent means no".
       memberKinds,
       ...runtimeCapable ? { runtimeCapable: true } : {},
-      targets: deployTargets(lexicons, k8sTarget),
+      // #569: a public view offers no target: `?target=` is refused there.
+      targets: cfg.public ? [] : deployTargets(lexicons, k8sTarget),
       // Where the k8s binding came from, so the SPA never implies behold chose
       // it (#106). Absent for a project with no k8s lexicon or no resolvable
       // context.
@@ -26382,7 +26761,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const body = await c.req.json().catch(() => ({}));
     const dir = typeof body.dir === "string" && body.dir.trim() ? resolve30(body.dir.trim()) : "";
     if (!dir || !existsSync27(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync27(join44(dir, "chant.config.ts"))) {
+    if (!existsSync27(join46(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -26495,6 +26874,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   const layoutDir = () => cfg.workspace?.root ?? cfg.projectDir;
   const layoutWriteBlock = () => {
     if (cfg.previewMode) return "the layout sidecar is read-only in preview mode";
+    if (cfg.public) return "a public view doesn't write to the project";
     if (cfg.carveReport) return "a carve report isn't a project \u2014 there's nowhere to keep a hand layout";
     if (cfg.layoutWrites === false) return "a static export captures a snapshot \u2014 it doesn't write to the project";
     return unwritableReason(layoutDir());
@@ -26685,7 +27065,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const parsedOps = [];
         for (const f of files) {
-          const parsed = readOpIr(f.path, (p) => readFileSync32(p, "utf8"));
+          const parsed = readOpIr(f.path, (p) => readFileSync34(p, "utf8"));
           if (!parsed.ok) return c.json(parsed.refusal, 422);
           parsedOps.push(parsed.ir);
         }
@@ -26698,8 +27078,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const runState = runner.runState;
         const ranOp = runState.op ? parsedOps.find((o) => o.name === runState.op) : void 0;
-        const join49 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
-        const opsIr = join49 ? paintPlayhead(declaredIr, join49, runState.gate) : declaredIr;
+        const join51 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
+        const opsIr = join51 ? paintPlayhead(declaredIr, join51, runState.gate) : declaredIr;
         const { svg: svg2 } = renderGraph(opsIr, { boxes: "byStack" });
         const operator = runner.noteDeclaredConvergeOps(declaredConvergeOps(parsedOps));
         return c.json({
@@ -26712,7 +27092,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
             target: null,
             mode: "ops",
             ops: parsedOps.length,
-            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join49)} ${operatorNote(operator)}`,
+            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join51)} ${operatorNote(operator)}`,
             // The operator strip's own model: the ConvergeOps this project
             // declares, plus whatever the last status read said. `declared`
             // without a `strip` is the honest starting state — a loop exists and
@@ -26823,7 +27203,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync27(join44(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync27(join46(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -27460,7 +27840,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (!c.req.path.startsWith("/api/") && c.res.ok && !c.res.headers.has("cache-control")) c.res.headers.set("cache-control", "no-cache");
   });
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join44(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join46(rel, "index.html") }));
   return app;
 }
 async function bootLocalEmulators(dir, who) {
@@ -27489,11 +27869,11 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync27(join44(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync27(join46(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
-  const runner = new OpRunner({
+  const runner = cfg.public ? new ReadOnlyRunner() : new OpRunner({
     projectDir: cfg.projectDir,
     broadcaster,
     onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
@@ -27501,7 +27881,7 @@ async function startServer(cfg) {
   if (!cfg.host && process.env.BEHOLD_HOST) cfg.host = process.env.BEHOLD_HOST;
   const app = createApp(cfg, broadcaster, frames, runner);
   const autoSync = cfg.autoSync ?? "off";
-  if (!cfg.carveReport && !servedProductRepo(cfg.projectDirs ?? [cfg.projectDir])) {
+  if (!cfg.public && !cfg.carveReport && !servedProductRepo(cfg.projectDirs ?? [cfg.projectDir])) {
     void readoptDispatchedRun(cfg, runner).then((result) => {
       if (result.outcome === "readopted") {
         process.stdout.write(`  re-adopted dispatched run ${result.run.runId} (${result.run.workflow}) \u2014 following via gh
@@ -27525,7 +27905,7 @@ async function startServer(cfg) {
   const memberTag = (dir) => (cfg.projectDirs?.length ?? 0) > 1 ? ` [${basename5(dir)}]` : "";
   const onPollDrift = (dir, movedLexicons) => {
     broadcaster.emit("changed", dir);
-    if (autoSync === "off") return;
+    if (autoSync === "off" || cfg.public) return;
     const guarded = servedProductRepo(cfg.projectDirs ?? [cfg.projectDir]);
     if (guarded) {
       broadcaster.emit("op", `\u27F3 auto-sync (${autoSync})${memberTag(dir)} declined: ${productRefusal(guarded, "auto-sync").error}`);
@@ -27634,7 +28014,8 @@ async function startServer(cfg) {
       `behold \u2192 http://localhost:${info.port}
   project: ${cfg.projectDir}${cfg.env ? `  env: ${cfg.env}` : ""}${auto}${localTag}
   read-only, watching for edits${poll}. lanes: /lanes. Ctrl-C to stop.
-`
+` + (cfg.public ? `  public: GET, HEAD and OPTIONS only; no op runner; answers ${["localhost", ...allowedHostsFrom(cfg.allowedHosts ?? [])].join(", ")}.
+` : "")
     );
     void detectProject(cfg.projectDir).then(({ environments, lexicons }) => {
       const envs = environments.length ? environments.join(", ") : "(none declared \u2014 env picker shows only source)";
@@ -27662,8 +28043,8 @@ init_chant();
 
 // src/workspace-convert.ts
 init_chant();
-import { existsSync as existsSync28, mkdirSync as mkdirSync9, readFileSync as readFileSync33, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { basename as basename6, dirname as dirname19, join as join45, relative as relative11, resolve as resolve31, sep as sep10 } from "node:path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync9, readFileSync as readFileSync35, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { basename as basename6, dirname as dirname19, join as join47, relative as relative11, resolve as resolve31, sep as sep10 } from "node:path";
 import { shortStackNames as shortStackNames2 } from "@intentius/pinhole";
 init_project();
 init_terraform_member();
@@ -27681,10 +28062,10 @@ function unique(name, taken) {
 var posix4 = (p) => p.split(sep10).join("/");
 function installedVersion(pkg, dir) {
   for (let at2 = resolve31(dir); ; at2 = dirname19(at2)) {
-    const manifest = join45(at2, "node_modules", ...pkg.split("/"), "package.json");
+    const manifest = join47(at2, "node_modules", ...pkg.split("/"), "package.json");
     if (existsSync28(manifest)) {
       try {
-        const v = JSON.parse(readFileSync33(manifest, "utf8")).version;
+        const v = JSON.parse(readFileSync35(manifest, "utf8")).version;
         return typeof v === "string" ? v : void 0;
       } catch {
         return void 0;
@@ -27695,7 +28076,7 @@ function installedVersion(pkg, dir) {
 }
 function planConversion(rootArg) {
   const root = resolve31(rootArg);
-  const existing = DECLARATION_FILES.find((f) => existsSync28(join45(root, f)));
+  const existing = DECLARATION_FILES.find((f) => existsSync28(join47(root, f)));
   if (existing) return { ok: false, error: `${root} already has ${existing}; there is nothing to convert.` };
   const shape = detectProjectShape(root);
   if (shape.kind !== "estate" || !shape.members?.length || shape.membersFrom === "itself") {
@@ -27716,10 +28097,10 @@ function planConversion(rootArg) {
       const scan = discoverTerraformRoots(abs[i]);
       for (const r of scan.roots) {
         const name2 = unique(declarationName(r.name), taken);
-        members.push({ name: name2, dir: r.dir === "." ? dir : posix4(join45(dir, r.dir)), kind: "terraform" });
+        members.push({ name: name2, dir: r.dir === "." ? dir : posix4(join47(dir, r.dir)), kind: "terraform" });
         moves.push({ from: `${short}/${r.name}/`, to: `${name2}/${name2}/` });
       }
-      for (const s of scan.skipped) notes.push(`${posix4(join45(dir, s.dir))} is not declared: ${s.why}.`);
+      for (const s of scan.skipped) notes.push(`${posix4(join47(dir, s.dir))} is not declared: ${s.why}.`);
       if (scan.roots.length > 1) notes.push(`${dir} held ${scan.roots.length} Terraform roots; each is its own member now, since a chant terraform member is one root.`);
       return;
     }
@@ -27762,7 +28143,7 @@ function moveLayoutIds(file, moves) {
   return { version: 1, lenses };
 }
 function applyConversion(plan) {
-  const declarationFile = join45(plan.root, DECLARATION_FILES[0]);
+  const declarationFile = join47(plan.root, DECLARATION_FILES[0]);
   if (existsSync28(declarationFile)) throw new Error(`${declarationFile} appeared while converting; nothing was written`);
   writeFileSync7(declarationFile, `${JSON.stringify(plan.declaration, null, 2)}
 `);
@@ -27773,7 +28154,7 @@ function applyConversion(plan) {
   else if (existsSync28(target)) layout = { skipped: `${target} already exists; the layout in ${plan.layoutFrom} was left alone` };
   else {
     const moved = moveLayoutIds(readLayoutFile(dirname19(dirname19(plan.layoutFrom))), plan.moves);
-    mkdirSync9(join45(plan.root, LAYOUT_DIR), { recursive: true });
+    mkdirSync9(join47(plan.root, LAYOUT_DIR), { recursive: true });
     const tmp = `${target}.tmp`;
     writeFileSync7(tmp, `${JSON.stringify(moved, null, 2)}
 `);
@@ -27784,9 +28165,9 @@ function applyConversion(plan) {
 }
 
 // src/export.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, copyFileSync, cpSync as cpSync2, readFileSync as readFileSync34, readdirSync as readdirSync14, existsSync as existsSync29, realpathSync as realpathSync2 } from "node:fs";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, copyFileSync, cpSync as cpSync2, readFileSync as readFileSync36, readdirSync as readdirSync14, existsSync as existsSync29, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join46, dirname as dirname20, basename as basename7, relative as relative12, resolve as resolve32, sep as sep11 } from "node:path";
+import { join as join48, dirname as dirname20, basename as basename7, relative as relative12, resolve as resolve32, sep as sep11 } from "node:path";
 import { createHash as createHash11 } from "node:crypto";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 var LENS_PARAMS = ["collapse", "components", "detail", "env", "logical", "ops", "radial", "stacks", "tier"];
@@ -27843,24 +28224,24 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join46(dirname20(fileURLToPath11(import.meta.url)), "..", "web");
+  return join48(dirname20(fileURLToPath11(import.meta.url)), "..", "web");
 }
 function pkgRoot2() {
-  return join46(dirname20(fileURLToPath11(import.meta.url)), "..");
+  return join48(dirname20(fileURLToPath11(import.meta.url)), "..");
 }
 var NOTICE_FILES = ["LICENSE", "THIRD_PARTY.md"];
 function copyNotices(outDir, root = pkgRoot2()) {
   const copied = [];
   for (const f of NOTICE_FILES) {
-    if (!existsSync29(join46(root, f))) continue;
-    copyFileSync(join46(root, f), join46(outDir, f));
+    if (!existsSync29(join48(root, f))) continue;
+    copyFileSync(join48(root, f), join48(outDir, f));
     copied.push(f);
   }
-  const lic = join46(root, "licenses");
+  const lic = join48(root, "licenses");
   if (existsSync29(lic)) {
-    mkdirSync10(join46(outDir, "licenses"), { recursive: true });
+    mkdirSync10(join48(outDir, "licenses"), { recursive: true });
     for (const f of readdirSync14(lic)) {
-      copyFileSync(join46(lic, f), join46(outDir, "licenses", f));
+      copyFileSync(join48(lic, f), join48(outDir, "licenses", f));
       copied.push(`licenses/${f}`);
     }
   }
@@ -27885,7 +28266,7 @@ async function runExport(cfg, outDir, opts = {}) {
     ...proj.sqlYodeler ? { sqlYodeler: true } : {}
   };
   const scrub = exportScrubber(cfg);
-  const snapDir = join46(outDir, "snapshots");
+  const snapDir = join48(outDir, "snapshots");
   mkdirSync10(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
@@ -27894,7 +28275,7 @@ async function runExport(cfg, outDir, opts = {}) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = scrub(shapeSnapshot(key, await res.text(), opts));
     const file = slug3(key, body);
-    writeFileSync8(join46(snapDir, file), body);
+    writeFileSync8(join48(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -27916,29 +28297,29 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync8(join46(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync34(join46(webDir(), "index.html"), "utf8").replace(
+  writeFileSync8(join48(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync36(join48(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync8(join46(outDir, "index.html"), html);
+  writeFileSync8(join48(outDir, "index.html"), html);
   for (const f of readdirSync14(webDir())) {
     if (f === "index.html" || f.endsWith(".test.js")) continue;
-    cpSync2(join46(webDir(), f), join46(outDir, f), { recursive: true });
+    cpSync2(join48(webDir(), f), join48(outDir, f), { recursive: true });
   }
-  writeFileSync8(join46(outDir, "README.md"), BUNDLE_README);
+  writeFileSync8(join48(outDir, "README.md"), BUNDLE_README);
   copyNotices(outDir);
   const name = workerName(cfg.projectDir, opts.name);
   writeFileSync8(
-    join46(outDir, "wrangler.jsonc"),
+    join48(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
       2
     ) + "\n"
   );
-  writeFileSync8(join46(outDir, "manifest.json"), JSON.stringify({ ...manifest, files: bundleFiles(outDir).filter((f) => f !== "manifest.json") }, null, 2));
+  writeFileSync8(join48(outDir, "manifest.json"), JSON.stringify({ ...manifest, files: bundleFiles(outDir).filter((f) => f !== "manifest.json") }, null, 2));
   process.stdout.write(
     `behold export \u2192 ${outDir}
   ${ok} snapshots${failed ? ` (${failed} endpoint error(s) captured as-is)` : ""}
@@ -27947,11 +28328,11 @@ async function runExport(cfg, outDir, opts = {}) {
 `
   );
 }
-var isRecord20 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var isRecord21 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function dropSource(v) {
   if (Array.isArray(v)) return v.forEach(dropSource);
-  if (!isRecord20(v)) return;
-  if (isRecord20(v.attrs)) delete v.attrs.source;
+  if (!isRecord21(v)) return;
+  if (isRecord21(v.attrs)) delete v.attrs.source;
   for (const x of Object.values(v)) dropSource(x);
 }
 function shapeSnapshot(key, body, opts = {}) {
@@ -27961,7 +28342,7 @@ function shapeSnapshot(key, body, opts = {}) {
   } catch {
     return body;
   }
-  if (!isRecord20(doc)) return body;
+  if (!isRecord21(doc)) return body;
   if (key === "/api/project") {
     delete doc.recents;
     delete doc.approver;
@@ -28031,11 +28412,11 @@ function manifestFiles(text) {
   } catch {
     return [];
   }
-  const map = isRecord20(doc) && isRecord20(doc.keyToFile) ? doc.keyToFile : {};
+  const map = isRecord21(doc) && isRecord21(doc.keyToFile) ? doc.keyToFile : {};
   return Object.values(map).filter((f) => typeof f === "string" && /^snapshots\/[A-Za-z0-9=_.-]+$/.test(f) && !f.includes(".."));
 }
 function bundleFiles(outDir) {
-  return readdirSync14(outDir, { recursive: true, withFileTypes: true }).filter((d) => d.isFile()).map((d) => relative12(outDir, join46(d.parentPath, d.name)).split(sep11).join("/")).sort();
+  return readdirSync14(outDir, { recursive: true, withFileTypes: true }).filter((d) => d.isFile()).map((d) => relative12(outDir, join48(d.parentPath, d.name)).split(sep11).join("/")).sort();
 }
 async function publishBundle(outDir, target, client) {
   const files = bundleFiles(outDir);
@@ -28051,7 +28432,7 @@ async function publishBundle(outDir, target, client) {
   }
   const last = ["manifest.json", "index.html"];
   const order = [...files.filter((f) => !last.includes(f)), ...last.filter((f) => files.includes(f))];
-  for (const f of order) await client.put(at2(f), readFileSync34(join46(outDir, f)), contentType(f), CONTENT_ADDRESSED.test(f) ? IMMUTABLE : NO_CACHE);
+  for (const f of order) await client.put(at2(f), readFileSync36(join48(outDir, f)), contentType(f), CONTENT_ADDRESSED.test(f) ? IMMUTABLE : NO_CACHE);
   const wrote = new Set(files);
   const removed = [];
   for (const f of previous) {
@@ -28103,8 +28484,8 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 
 // src/publish-snapshots.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { readFileSync as readFileSync35 } from "node:fs";
-import { join as join47 } from "node:path";
+import { readFileSync as readFileSync37 } from "node:fs";
+import { join as join49 } from "node:path";
 var DEFAULT_KEEP = 30;
 var SNAPSHOT_REPORTS_BASE = "../../../";
 var COMMIT = /^[0-9a-f]{7,64}$/;
@@ -28129,12 +28510,12 @@ function resolveCommit2(dir, given) {
     return { sha };
   }
 }
-var isRecord21 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var isRecord22 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function parseHistory(text) {
   const doc = JSON.parse(text);
   if (!Array.isArray(doc)) throw new Error("history.json is not an array");
-  const str15 = (v) => typeof v === "string" ? v : "";
-  return doc.filter((e) => isRecord21(e) && typeof e.commit === "string" && COMMIT.test(e.commit)).map((e) => ({ commit: e.commit, at: str15(e.at), project: str15(e.project), generated: str15(e.generated) }));
+  const str16 = (v) => typeof v === "string" ? v : "";
+  return doc.filter((e) => isRecord22(e) && typeof e.commit === "string" && COMMIT.test(e.commit)).map((e) => ({ commit: e.commit, at: str16(e.at), project: str16(e.project), generated: str16(e.generated) }));
 }
 function nextHistory(old, entry, keep) {
   const all = [entry, ...old.filter((e) => e.commit !== entry.commit)];
@@ -28146,9 +28527,9 @@ var BUNDLE_PATH = /^[A-Za-z0-9=_.@+-]+(\/[A-Za-z0-9=_.@+-]+)*$/;
 var insideBundle = (f) => typeof f === "string" && BUNDLE_PATH.test(f) && !f.split("/").some((p) => p === "." || p === "..");
 function commitFiles(manifestText) {
   const doc = JSON.parse(manifestText);
-  if (!isRecord21(doc)) return ["manifest.json"];
+  if (!isRecord22(doc)) return ["manifest.json"];
   const listed = Array.isArray(doc.files) ? doc.files.filter(insideBundle) : [];
-  const snaps = isRecord21(doc.keyToFile) ? Object.values(doc.keyToFile).filter(insideBundle) : [];
+  const snaps = isRecord22(doc.keyToFile) ? Object.values(doc.keyToFile).filter(insideBundle) : [];
   const rest = [.../* @__PURE__ */ new Set([...listed, ...snaps])].filter((f) => f !== "index.html" && f !== "manifest.json").sort();
   return ["index.html", ...rest, "manifest.json"];
 }
@@ -28192,7 +28573,7 @@ async function publishSnapshot(outDir, target, commit, client, opts = {}) {
   const keep = opts.keep ?? DEFAULT_KEEP;
   if (!Number.isInteger(keep) || keep < 1) throw new Error(`--keep takes a whole number of at least 1, not ${keep}`);
   const at2 = (f) => `${target.prefix}/${f}`;
-  const local = JSON.parse(readFileSync35(join47(outDir, "manifest.json"), "utf8"));
+  const local = JSON.parse(readFileSync37(join49(outDir, "manifest.json"), "utf8"));
   const generated = local.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const entry = { commit: sha, at: commit.at ?? generated, project: opts.project ?? local.projectDir ?? "", generated };
   const bundle = await publishBundle(outDir, { bucket: target.bucket, prefix: at2(sha) }, client);
@@ -28260,6 +28641,7 @@ Usage:
                 [--yodel-report <file|dir>]
                 [--publish s3://<bucket>/<prefix>/views/<name> [--commit <sha>] [--keep <n>]]
   behold serve <project-dir\u2026> [--port <n>] [--host <addr>] [--allow-host <name,\u2026>] [--hud <url>] [--env <name>] [--poll <secs>] [--local]
+                [--public] [--terragucci <src> [--terragucci-project <p>] [--terragucci-poll <secs>]]
                 [--yodel-report <file|dir>]
   behold carve <report.json> [--port <n>]
 
@@ -28325,6 +28707,19 @@ Options:
   --allow-host <n,\u2026>  serve only: names besides loopback behold answers to, and
                       whose pages may write (BEHOLD_ALLOWED_HOSTS too). For a
                       proxy that frames behold, or --host 0.0.0.0.
+  --public            serve only: a read-only view anyone may load, for a
+                      public host (#569). behold builds no op runner, refuses
+                      every method but GET, HEAD and OPTIONS (405), and refuses
+                      (403) every read that runs a command or uses your
+                      credentials and isn't part of the view: the op tools,
+                      the live overlay and its plan, diff, reconcile, CI,
+                      doctor, substrates, history, workspace gates and why,
+                      choudoufu moves. The page shows no control that writes
+                      or asks for those. One project directory only; not with
+                      --env, --poll, --local or --auto-sync. It still binds
+                      127.0.0.1: put a proxy in front and pass the public name
+                      with --allow-host. With --terragucci, the poll defaults
+                      to 10 s.
   --hud <url>         serve only: where hud reviews this workspace's records
                       (BEHOLD_HUD_URL too). A proposed decision in a member's
                       or a card's "why" links to its review there (#471).
@@ -28343,7 +28738,8 @@ Options:
                       serve with --terragucci only: while a page is open, ask
                       whether index.json changed (If-None-Match, or its mtime)
                       and fetch chant/lifecycle (the gates and locks) every
-                      <secs> (default 30), and push what moved to the page.
+                      <secs> (default 30, or 10 with --public), and push what
+                      moved to the page.
                       0 turns it off. The fetch goes into behold's own cache
                       (<tmpdir>/behold-lifecycle-*), never into the checkout.
   --yodel-report <file|dir>
@@ -28464,6 +28860,7 @@ ${USAGE}`);
   let terragucciProject;
   let terragucciPoll;
   let yodelReport;
+  let isPublic = false;
   const allowHosts = [];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
@@ -28478,6 +28875,7 @@ ${USAGE}`);
     else if (a === "--env") env = rest[++i];
     else if (a === "--poll") pollSecs = Number(rest[++i]);
     else if (a === "--local") local = true;
+    else if (a === "--public") isPublic = true;
     else if (a === "--auto-sync") {
       const m = rest[++i];
       if (!m || !isAutoSyncMode(m)) {
@@ -28537,6 +28935,23 @@ ${USAGE}`);
     process.stderr.write("behold serve: --terragucci-poll needs --terragucci\n");
     process.exit(2);
   }
+  if (isPublic && projectDirs.length > 1) {
+    process.stderr.write("behold serve: --public serves one project directory\n");
+    process.exit(2);
+  }
+  if (isPublic && local) {
+    process.stderr.write("behold serve: --public can't --local (it boots emulators and deploys to them)\n");
+    process.exit(2);
+  }
+  if (isPublic && (env || pollSecs !== void 0)) {
+    process.stderr.write("behold serve: --public can't --env or --poll (a live read uses your credentials)\n");
+    process.exit(2);
+  }
+  if (isPublic && autoSync !== "off") {
+    process.stderr.write("behold serve: --public can't --auto-sync (it runs Ops)\n");
+    process.exit(2);
+  }
+  if (isPublic && terragucci !== void 0 && terragucciPoll === void 0) terragucciPoll = PUBLIC_TERRAGUCCI_POLL_SECS;
   if (yodelReport !== void 0 && !yodelReport) {
     process.stderr.write("behold serve: --yodel-report needs the file `yodel report --json` wrote, or the directory holding it\n");
     process.exit(2);
@@ -28552,11 +28967,13 @@ ${USAGE}`);
     ...local ? { local: true } : {},
     ...host ? { host } : {},
     ...allowHosts.length ? { allowedHosts: allowHosts } : {},
+    ...isPublic ? { public: true, layoutWrites: false } : {},
     ...target.workspace && hud ? { hud } : {},
     ...yodelReport ? { yodelReport: resolve33(yodelReport) } : {},
     ...terragucci ? { terragucci: { source: terragucci, ...terragucciProject ? { project: terragucciProject } : {}, ...terragucciPoll !== void 0 ? { pollSecs: terragucciPoll } : {} } } : {}
   });
 }
+var PUBLIC_TERRAGUCCI_POLL_SECS = 10;
 async function serveTarget(dirs, verb) {
   const workspace = dirs.length === 1 && hasDeclaration(dirs[0]) ? await declaredWorkspace(dirs[0], verb) : void 0;
   if (workspace && workspace.members.length > 0) {
@@ -28608,7 +29025,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join48(dir, m.dir)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join50(dir, m.dir)).join(" ")}
 `
     );
     return;
@@ -28644,7 +29061,7 @@ async function runCarve(rest) {
     process.exit(2);
   }
   const reportPath = resolve33(fileArg);
-  const parsed = readCarveReport(reportPath, (p) => readFileSync36(p, "utf8"));
+  const parsed = readCarveReport(reportPath, (p) => readFileSync38(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
   ${parsed.refusal.remedy}
@@ -28710,7 +29127,7 @@ ${check.stdout || check.stderr}
   if (check.code !== 0) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot3 = join48(dirname21(fileURLToPath12(import.meta.url)), "..");
+  const pkgRoot3 = join50(dirname21(fileURLToPath12(import.meta.url)), "..");
   const registry2 = loadDemoRegistry(pkgRoot3);
   let port = 4600;
   let live2 = false;
@@ -28845,7 +29262,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     };
     process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
   }
-  if (existsSync30(join48(project, "package.json")) && !existsSync30(join48(project, "node_modules"))) {
+  if (existsSync30(join50(project, "package.json")) && !existsSync30(join50(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -28856,7 +29273,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     }
   }
   let degraded;
-  if (!existsSync30(join48(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
+  if (!existsSync30(join50(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
     process.stdout.write(`behold demo carve \u2192 npm install ${HCL_PARSER_PKG} (chant's HCL parser, ~2MB, once)\u2026
 `);
     const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", HCL_PARSER_PKG], target);