@intentius/behold 0.29.2 → 0.29.4

package/dist/cli.js

@@ -2209,11 +2209,133 @@ var init_scratch = __esm({
   }
 });
 
+// src/terragucci-components.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+function isTerragucciComponents(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const d = v;
+  if (d.schema !== TERRAGUCCI_COMPONENTS_SCHEMA) return false;
+  const roots = d.roots;
+  if (typeof roots !== "object" || roots === null || Array.isArray(roots)) return false;
+  for (const r of Object.values(roots)) {
+    if (typeof r !== "object" || r === null || typeof r.dir !== "string") return false;
+  }
+  if (!Array.isArray(d.components)) return false;
+  for (const c of d.components) {
+    const comp = c;
+    if (typeof comp?.name !== "string" || !isStrings(comp.dependsOn) || !Array.isArray(comp.deploy)) return false;
+    for (const p of comp.deploy) {
+      const phase2 = p;
+      if (typeof phase2?.phase !== "string" || !Array.isArray(phase2.steps)) return false;
+      if (!phase2.steps.every((s) => typeof s?.kind === "string")) return false;
+    }
+  }
+  const pipeline = d.pipeline;
+  if (typeof pipeline !== "object" || pipeline === null || !Array.isArray(pipeline.jobs)) return false;
+  for (const j of pipeline.jobs) {
+    const job = j;
+    if (typeof job?.name !== "string" || !isStrings(job.needs) || !isStrings(job.applies)) return false;
+    if (job.wave !== void 0 && typeof job.wave !== "number") return false;
+  }
+  return true;
+}
+function readTerragucciComponents(dir) {
+  let text;
+  try {
+    text = readFileSync3(join3(dir, TERRAGUCCI_COMPONENTS_FILE), "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(text);
+    return isTerragucciComponents(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function declaredRootScan(decl) {
+  const norm2 = (d) => d.replace(/^\.\/+/, "").replace(/\/+$/, "") || ".";
+  return { roots: Object.entries(decl.roots).map(([name, r]) => ({ name, dir: norm2(r.dir) })), skipped: [] };
+}
+function terragucciComponentModule(decl) {
+  const lines2 = [
+    "// Generated by behold (#571) from terragucci.components.json, so chant can",
+    "// draw this repo's roots as components. Written OUTSIDE the repo and",
+    "// rewritten on each read; the repo is untouched.",
+    ""
+  ];
+  decl.components.forEach((c, i) => {
+    const component = {
+      name: c.name,
+      dependsOn: c.dependsOn,
+      deploy: c.deploy.map((p) => ({
+        phase: p.phase,
+        steps: p.steps.map((s) => s.kind === "terraform-apply" && s.noRollback === void 0 ? { ...s, noRollback: SCAFFOLD_NO_ROLLBACK } : s)
+      }))
+    };
+    lines2.push(`export const component${i} = ${JSON.stringify(component)};`);
+  });
+  lines2.push("");
+  return lines2.join("\n");
+}
+function componentRoots(c) {
+  return c.deploy.flatMap((p) => p.steps.filter((s) => s.kind === "terraform-apply" && typeof s.root === "string").map((s) => s.root));
+}
+function componentJobs(decl) {
+  const out = {};
+  for (const c of decl.components) {
+    const keys = /* @__PURE__ */ new Set([c.name, ...componentRoots(c)]);
+    const jobs = decl.pipeline.jobs.filter((j) => j.applies.some((a) => keys.has(a)));
+    if (!jobs.length) continue;
+    const primary = jobs.find((j) => j.wave !== void 0) ?? jobs[0];
+    const others = jobs.filter((j) => j !== primary).map((j) => j.name);
+    out[c.name] = {
+      component: c.name,
+      jobName: primary.name,
+      needs: primary.needs,
+      ...primary.wave !== void 0 ? { wave: primary.wave } : {},
+      ...others.length ? { alsoIn: others } : {}
+    };
+  }
+  return out;
+}
+function waveTitles(ir, decl) {
+  const byWave = ir.groups?.byWave ?? {};
+  const jobs = componentJobs(decl);
+  const order = decl.pipeline.jobs.map((j) => j.name);
+  const out = {};
+  for (const [key, members] of Object.entries(byWave)) {
+    const names = new Set(members.map((m) => jobs[m]?.jobName).filter((n) => !!n));
+    if (names.size) out[key] = order.filter((n) => names.has(n)).join(" + ");
+  }
+  return out;
+}
+function componentRootMap(decl) {
+  const out = {};
+  for (const c of decl.components) {
+    const root = componentRoots(c)[0];
+    if (root) out[c.name] = root;
+  }
+  return out;
+}
+var TERRAGUCCI_COMPONENTS_FILE, TERRAGUCCI_COMPONENTS_SCHEMA, TERRAGUCCI_COMPONENT_MODULE, isStrings, SCAFFOLD_NO_ROLLBACK;
+var init_terragucci_components = __esm({
+  "src/terragucci-components.ts"() {
+    "use strict";
+    TERRAGUCCI_COMPONENTS_FILE = "terragucci.components.json";
+    TERRAGUCCI_COMPONENTS_SCHEMA = "terragucci.components/v1";
+    TERRAGUCCI_COMPONENT_MODULE = "terragucci.component.ts";
+    isStrings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
+    SCAFFOLD_NO_ROLLBACK = "applied by terragucci's pipeline; behold only draws this";
+  }
+});
+
 // src/terraform-member.ts
 import { createHash } from "node:crypto";
 import { createRequire } from "node:module";
-import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, readlinkSync, realpathSync, symlinkSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename, dirname as dirname2, join as join3, relative, resolve, sep } from "node:path";
+import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync4, readdirSync as readdirSync2, readlinkSync, realpathSync, symlinkSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename, dirname as dirname2, join as join4, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 function notARoot(rel, sources) {
@@ -2232,7 +2354,7 @@ function tfSources(dir) {
   const out = [];
   for (const name of names) {
     try {
-      out.push(readFileSync3(join3(dir, name), "utf8"));
+      out.push(readFileSync4(join4(dir, name), "utf8"));
     } catch {
     }
   }
@@ -2254,7 +2376,7 @@ function discoverTerraformRoots(estate) {
     }
     for (const e of entries) {
       if (!e.isDirectory() || SKIP_DIRS.has(e.name) || e.name.startsWith(".")) continue;
-      walk(join3(dir, e.name), depth + 1);
+      walk(join4(dir, e.name), depth + 1);
     }
   };
   walk(root, 0);
@@ -2283,9 +2405,9 @@ function terraformRootsNoteShort(scan) {
   const roots = `${scan.roots.length} root${scan.roots.length === 1 ? "" : "s"}`;
   return scan.skipped.length ? `${roots} \xB7 ${scan.skipped.length} skipped` : roots;
 }
-function declaredPeerRange(pkg, manifestDir = join3(beholdDir(), "..")) {
+function declaredPeerRange(pkg, manifestDir = join4(beholdDir(), "..")) {
   try {
-    const manifest = JSON.parse(readFileSync3(join3(manifestDir, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync4(join4(manifestDir, "package.json"), "utf8"));
     return manifest.peerDependencies?.[pkg];
   } catch {
     return void 0;
@@ -2295,7 +2417,7 @@ function resolvedVersion(pkg, from = beholdDir()) {
   return resolvedPackage(pkg, from)?.version;
 }
 function resolvedPackage(pkg, from = beholdDir()) {
-  const req = createRequire(join3(resolve(from), "noop.js"));
+  const req = createRequire(join4(resolve(from), "noop.js"));
   let entry;
   try {
     entry = req.resolve(pkg);
@@ -2305,7 +2427,7 @@ function resolvedPackage(pkg, from = beholdDir()) {
   let dir = dirname2(entry);
   for (; ; ) {
     try {
-      const manifest = JSON.parse(readFileSync3(join3(dir, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync4(join4(dir, "package.json"), "utf8"));
       if (manifest.name === pkg) return { dir, version: manifest.version ?? "" };
     } catch {
     }
@@ -2332,7 +2454,7 @@ function terraformReaderState(from = beholdDir()) {
   };
 }
 function beholdNodeModules(from = beholdDir()) {
-  const req = createRequire(join3(resolve(from), "noop.js"));
+  const req = createRequire(join4(resolve(from), "noop.js"));
   let entry;
   try {
     entry = req.resolve("@intentius/chant");
@@ -2355,7 +2477,7 @@ function terraformScratchDir(estate, tmp = tmpdir(), flavour = "tf") {
     root = realpathSync(root);
   } catch {
   }
-  const dir = join3(root, name);
+  const dir = join4(root, name);
   if (dir === target || dir.startsWith(target + sep)) {
     throw new Error(`scratch discipline: the generated reader config for ${target} would land inside the estate (${dir})`);
   }
@@ -2392,26 +2514,37 @@ function relink(path, target) {
   }
   symlinkSync(target, path);
 }
-function writeTerraformScratchProject(estate, scan, tmp = tmpdir(), flavour = "tf") {
+function writeTerraformScratchProject(estate, scan, tmp = tmpdir(), flavour = "tf", components) {
   const target = resolve(estate);
   const dir = terraformScratchDir(target, tmp, flavour);
   mkdirSync2(dir, { recursive: true });
-  relink(join3(dir, ESTATE_LINK), target);
+  relink(join4(dir, ESTATE_LINK), target);
   const modules = beholdNodeModules();
-  if (modules) relink(join3(dir, "node_modules"), modules);
+  if (modules) relink(join4(dir, "node_modules"), modules);
   const write = (path, text) => {
-    if (!existsSync3(path) || readFileSync3(path, "utf8") !== text) writeFileSync2(path, text);
+    if (!existsSync3(path) || readFileSync4(path, "utf8") !== text) writeFileSync2(path, text);
   };
-  write(join3(dir, "package.json"), SCRATCH_PACKAGE_JSON);
-  write(join3(dir, "chant.config.ts"), terraformScratchConfig(scan, ESTATE_LINK, flavour));
+  write(join4(dir, "package.json"), SCRATCH_PACKAGE_JSON);
+  write(join4(dir, "chant.config.ts"), terraformScratchConfig(scan, ESTATE_LINK, flavour));
+  const module = join4(dir, TERRAGUCCI_COMPONENT_MODULE);
+  if (components) write(module, terragucciComponentModule(components));
+  else if (existsSync3(module)) write(module, "// terragucci.components.json is gone; no components.\nexport {};\n");
   return dir;
 }
+function terraformMemberScan(dir) {
+  const components = readTerragucciComponents(dir);
+  return components ? { scan: declaredRootScan(components), components } : { scan: discoverTerraformRoots(dir) };
+}
+function terraformMemberProject(dir) {
+  const { scan, components } = terraformMemberScan(dir);
+  return { project: writeTerraformScratchProject(dir, scan, void 0, "tf", components), ...components ? { components } : {} };
+}
 function terraformReadDetail(detail) {
   return Math.max(detail ?? 2, 2);
 }
 async function readTerraformMember(dir, opts, state = terraformReaderState()) {
   if (state.refusal) throw new TerraformReadError(state.refusal, dir);
-  const scan = discoverTerraformRoots(dir);
+  const { scan, components } = terraformMemberScan(dir);
   if (!scan.roots.length) {
     throw new TerraformReadError(
       {
@@ -2422,7 +2555,7 @@ async function readTerraformMember(dir, opts, state = terraformReaderState()) {
       dir
     );
   }
-  const project = writeTerraformScratchProject(dir, scan);
+  const project = writeTerraformScratchProject(dir, scan, void 0, "tf", components);
   const { live: _live, overlay: _overlay, env: _env, ...source2 } = opts;
   const detail = terraformReadDetail(source2.detail);
   const { graphIr: graphIr2 } = await Promise.resolve().then(() => (init_chant(), chant_exports));
@@ -2434,6 +2567,7 @@ var init_terraform_member = __esm({
     "use strict";
     init_terraform_lens();
     init_scratch();
+    init_terragucci_components();
     TERRAFORM_LEXICON_PKG = "@intentius/chant-lexicon-terraform";
     HCL_PARSER_PKG = "@cdktn/hcl2json";
     ROOT_SCAN_DEPTH = 3;
@@ -2975,8 +3109,8 @@ var init_member_kind = __esm({
 });
 
 // src/project.ts
-import { readFileSync as readFileSync4, existsSync as existsSync4 } from "node:fs";
-import { join as join4 } from "node:path";
+import { readFileSync as readFileSync5, existsSync as existsSync4 } from "node:fs";
+import { join as join5 } from "node:path";
 import { pathToFileURL } from "node:url";
 function readBehaviour(raw) {
   const b = raw.behaviour;
@@ -2997,7 +3131,7 @@ function readMember(v) {
 }
 function chantConfigPath(projectDir) {
   for (const name of CONFIG_NAMES) {
-    const p = join4(projectDir, name);
+    const p = join5(projectDir, name);
     if (existsSync4(p)) return p;
   }
   return void 0;
@@ -3091,7 +3225,7 @@ async function detectProject(projectDir) {
     if (info.environments.length || info.lexicons.length || info.sourceDir || info.stacks?.length) return info;
   } catch {
   }
-  const content = readFileSync4(path, "utf8");
+  const content = readFileSync5(path, "utf8");
   const sourceDir = parseStringLiteral(content, "sourceDir");
   const environments = parseEnvironmentNames(content);
   return {
@@ -3131,10 +3265,10 @@ function readExecutor(cfg) {
   return Object.keys(out).length ? out : void 0;
 }
 function loadBeholdConfig(projectDir) {
-  const path = join4(projectDir, BEHOLD_CONFIG_NAME);
+  const path = join5(projectDir, BEHOLD_CONFIG_NAME);
   if (!existsSync4(path)) return {};
   try {
-    const raw = JSON.parse(readFileSync4(path, "utf8"));
+    const raw = JSON.parse(readFileSync5(path, "utf8"));
     const tiers = readTiers(raw);
     const members = Array.isArray(raw.members) ? raw.members.map(readMember).filter((m) => !!m) : [];
     const executor = readExecutor(raw);
@@ -3151,7 +3285,7 @@ function loadBeholdConfig(projectDir) {
 }
 function readWorkspaces(projectDir) {
   try {
-    const raw = JSON.parse(readFileSync4(join4(projectDir, "package.json"), "utf8"));
+    const raw = JSON.parse(readFileSync5(join5(projectDir, "package.json"), "utf8"));
     const ws = Array.isArray(raw.workspaces) ? raw.workspaces : raw.workspaces?.packages;
     return Array.isArray(ws) ? ws.filter((w) => typeof w === "string") : [];
   } catch {
@@ -3176,12 +3310,12 @@ function detectProjectShape(projectDir) {
         invalid.push({ dir: m.dir, invalid: `member kind "${m.kind}" has no reader in this behold` });
         continue;
       }
-      if (spec2.probe(join4(projectDir, m.dir))) members.push(m);
+      if (spec2.probe(join5(projectDir, m.dir))) members.push(m);
       else invalid.push({ dir: m.dir, invalid: `declared as ${m.kind}, but ${m.dir} has no ${spec2.expects}` });
     }
   } else {
     for (const dir of readWorkspaces(projectDir)) {
-      const kind = memberKindOf(join4(projectDir, dir));
+      const kind = memberKindOf(join5(projectDir, dir));
       if (kind) members.push({ dir, kind });
     }
   }
@@ -3213,7 +3347,7 @@ var init_project = __esm({
 // src/member-source.ts
 import { createHash as createHash2 } from "node:crypto";
 import { readdirSync as readdirSync3, statSync } from "node:fs";
-import { join as join5, relative as relative2, resolve as resolve2 } from "node:path";
+import { join as join6, relative as relative2, resolve as resolve2 } from "node:path";
 function setStampExclusions(next) {
   exclusions = new Map([...next].map(([k, v]) => [resolve2(k), new Set(v.map((d) => resolve2(d)))]));
 }
@@ -3226,7 +3360,7 @@ function memberSourceStamp(dir) {
     const entries = readdirSync3(at2, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
     for (const e of entries) {
       if (SKIP.has(e.name)) continue;
-      const path = join5(at2, e.name);
+      const path = join6(at2, e.name);
       if (e.isDirectory()) {
         if (!skipDirs?.has(path)) walk(path);
         continue;
@@ -4779,15 +4913,15 @@ var init_yaml = __esm({
 });
 
 // src/carve-manifest.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
-import { dirname as dirname3, isAbsolute, join as join6, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { dirname as dirname3, isAbsolute, join as join7, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
 function parseCarveManifest(value) {
   if (!isRecord4(value)) return null;
   if (value.version !== 1 && value.version !== 2) return null;
   if (typeof value.target !== "string" || !value.target) return null;
   return value;
 }
-function readCarveManifest(path, readFile2 = (p) => readFileSync5(p, "utf8")) {
+function readCarveManifest(path, readFile2 = (p) => readFileSync6(p, "utf8")) {
   let text;
   try {
     text = readFile2(path);
@@ -4865,7 +4999,7 @@ function listCarveManifests(dir, io = nodeCarveIo, depth = MANIFEST_SCAN_DEPTH)
       return;
     }
     for (const name of entries) {
-      const full = join6(d, name);
+      const full = join7(d, name);
       if (name.endsWith(CARVE_MANIFEST_SUFFIX)) {
         out.push(full);
         continue;
@@ -5096,7 +5230,7 @@ var init_carve_manifest = __esm({
           return false;
         }
       },
-      readFile: (p) => readFileSync5(p, "utf8")
+      readFile: (p) => readFileSync6(p, "utf8")
     };
     MANIFEST_SCAN_DEPTH = 2;
     SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", "dist", "cdk.out", ".terraform", ".git"]);
@@ -5207,10 +5341,10 @@ __export(chant_exports, {
   stripAnsi: () => stripAnsi
 });
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname4, join as join7, resolve as resolve5 } from "node:path";
+import { dirname as dirname4, join as join8, resolve as resolve5 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 function envOverridesFor(opts) {
   const overrides = { ...opts.spawnEnv ?? {} };
@@ -5250,7 +5384,7 @@ function packageManifestFrom(req, name) {
   let dir = dirname4(entry);
   for (; ; ) {
     try {
-      const pkg = createRequire2(import.meta.url)(join7(dir, "package.json"));
+      const pkg = createRequire2(import.meta.url)(join8(dir, "package.json"));
       if (pkg.name === name) return { root: dir, manifest: pkg };
     } catch {
     }
@@ -5264,10 +5398,10 @@ function chantPackageFrom(req) {
   const found = packageManifestFrom(req, "@intentius/chant");
   if (!found) return void 0;
   const { root, manifest } = found;
-  return { root, bin: join7(root, manifest.bin?.chant ?? "bin/chant"), ...manifest.version ? { version: manifest.version } : {} };
+  return { root, bin: join8(root, manifest.bin?.chant ?? "bin/chant"), ...manifest.version ? { version: manifest.version } : {} };
 }
 function resolveLexicons(projectDir, lexicons) {
-  const req = createRequire2(join7(resolve5(projectDir), "noop.js"));
+  const req = createRequire2(join8(resolve5(projectDir), "noop.js"));
   return lexicons.map((lexicon) => {
     const pkg = `@intentius/chant-lexicon-${lexicon}`;
     const found = packageManifestFrom(req, pkg);
@@ -5280,7 +5414,7 @@ function chantBinFrom(req) {
 function resolveChant(projectDir) {
   const own = chantPackageFrom(createRequire2(import.meta.url));
   if (projectDir) {
-    const fromProject = chantPackageFrom(createRequire2(join7(resolve5(projectDir), "noop.js")));
+    const fromProject = chantPackageFrom(createRequire2(join8(resolve5(projectDir), "noop.js")));
     if (fromProject) return { source: fromProject.root === own?.root ? "behold" : "project", ...fromProject };
   }
   if (own) return { source: "behold", ...own };
@@ -5289,7 +5423,7 @@ function resolveChant(projectDir) {
 function chantFloor() {
   try {
     const here = dirname4(fileURLToPath2(import.meta.url));
-    const pkg = JSON.parse(readFileSync6(join7(here, "..", "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync7(join8(here, "..", "package.json"), "utf8"));
     return pkg.dependencies?.["@intentius/chant"]?.replace(/^[^0-9]*/, "") || void 0;
   } catch {
     return void 0;
@@ -5449,7 +5583,7 @@ function runCommandStream(cmd, args, cwd, onLine) {
   return { pid: proc.pid ?? -1, kill: () => proc.kill(), done };
 }
 function legacyGraphPath(projectDir) {
-  const src = join7(projectDir, "src");
+  const src = join8(projectDir, "src");
   return existsSync5(src) ? src : projectDir;
 }
 async function graphPath(projectDir, opts = {}) {
@@ -5475,7 +5609,7 @@ async function graphIr(projectDir, opts = {}) {
   return dropForeignDeclarations(ir, projectDir);
 }
 async function clusterRootGraphIr(projectDir, opts = {}) {
-  if (!existsSync5(join7(projectDir, "cluster"))) return void 0;
+  if (!existsSync5(join8(projectDir, "cluster"))) return void 0;
   const { live: _live, overlay: _overlay, env: _env, ...sourceOnly } = opts;
   try {
     return await runChantJson(graphArgs("cluster", "ir", sourceOnly, false), projectDir, envOverridesFor(sourceOnly));
@@ -8904,8 +9038,8 @@ __export(tree_exports, {
   workingTree: () => workingTree
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { readdirSync as readdirSync10, readFileSync as readFileSync19, statSync as statSync8 } from "node:fs";
-import { join as join26 } from "node:path";
+import { readdirSync as readdirSync10, readFileSync as readFileSync20, statSync as statSync8 } from "node:fs";
+import { join as join27 } from "node:path";
 function joinPath(...parts) {
   return parts.filter((p) => p !== "" && p !== ".").join("/");
 }
@@ -8914,7 +9048,7 @@ function workingTree(root) {
     label: "",
     stat(path) {
       try {
-        const s = statSync8(join26(root, path));
+        const s = statSync8(join27(root, path));
         return s.isDirectory() ? "dir" : s.isFile() ? "file" : void 0;
       } catch {
         return void 0;
@@ -8923,7 +9057,7 @@ function workingTree(root) {
     list(path) {
       let dirents;
       try {
-        dirents = readdirSync10(join26(root, path), { withFileTypes: true });
+        dirents = readdirSync10(join27(root, path), { withFileTypes: true });
       } catch {
         return void 0;
       }
@@ -8932,7 +9066,7 @@ function workingTree(root) {
         let type = d.isDirectory() ? "dir" : d.isFile() ? "file" : void 0;
         if (!type && d.isSymbolicLink()) {
           try {
-            const s = statSync8(join26(root, path, d.name));
+            const s = statSync8(join27(root, path, d.name));
             type = s.isDirectory() ? "dir" : s.isFile() ? "file" : void 0;
           } catch {
           }
@@ -8942,10 +9076,10 @@ function workingTree(root) {
       return out;
     },
     read(path) {
-      return readFileSync19(join26(root, path), "utf-8");
+      return readFileSync20(join27(root, path), "utf-8");
     },
     bytes(path) {
-      return readFileSync19(join26(root, path));
+      return readFileSync20(join27(root, path));
     }
   };
 }
@@ -9547,12 +9681,12 @@ var init_identity_gate_rule = __esm({
 });
 
 // node_modules/@intentius/chant/src/workspace/class-data.ts
-import { existsSync as existsSync17, readFileSync as readFileSync20, statSync as statSync9 } from "node:fs";
-import { dirname as dirname7, join as join27, posix, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync21, statSync as statSync9 } from "node:fs";
+import { dirname as dirname7, join as join28, posix, resolve as resolve14 } from "node:path";
 function diskFiles(dir) {
   return (path) => {
     try {
-      return readFileSync20(join27(dir, ...path.split("/")), "utf-8");
+      return readFileSync21(join28(dir, ...path.split("/")), "utf-8");
     } catch {
       return void 0;
     }
@@ -9560,9 +9694,9 @@ function diskFiles(dir) {
 }
 function findInstalledPackage(name, fromDir) {
   for (let dir = resolve14(fromDir); ; dir = dirname7(dir)) {
-    const candidate = join27(dir, "node_modules", ...name.split("/"));
+    const candidate = join28(dir, "node_modules", ...name.split("/"));
     try {
-      if (statSync9(candidate).isDirectory() && existsSync17(join27(candidate, "package.json"))) return candidate;
+      if (statSync9(candidate).isDirectory() && existsSync17(join28(candidate, "package.json"))) return candidate;
     } catch {
     }
     if (dirname7(dir) === dir) return void 0;
@@ -10012,10 +10146,10 @@ var init_jsonc = __esm({
 });
 
 // node_modules/@intentius/chant/src/package-version.ts
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync22 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function readChantPackageVersion() {
-  return JSON.parse(readFileSync21(fileURLToPath4(new URL("../package.json", import.meta.url)), "utf-8")).version;
+  return JSON.parse(readFileSync22(fileURLToPath4(new URL("../package.json", import.meta.url)), "utf-8")).version;
 }
 var init_package_version = __esm({
   "node_modules/@intentius/chant/src/package-version.ts"() {
@@ -10814,8 +10948,8 @@ var init_declaration = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve33, dirname as dirname21, join as join50 } from "node:path";
-import { realpathSync as realpathSync3, existsSync as existsSync30, readFileSync as readFileSync38, rmSync as rmSync4 } from "node:fs";
+import { resolve as resolve33, dirname as dirname21, join as join51 } from "node:path";
+import { realpathSync as realpathSync3, existsSync as existsSync30, readFileSync as readFileSync39, rmSync as rmSync4 } from "node:fs";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawn as spawn9, spawnSync as spawnSync4 } from "node:child_process";
 
@@ -10873,8 +11007,8 @@ import { serve } from "@hono/node-server";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { existsSync as existsSync27, readFileSync as readFileSync34 } from "node:fs";
-import { basename as basename5, dirname as dirname18, join as join46, relative as relative10, resolve as resolve30, sep as sep9 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync35 } from "node:fs";
+import { basename as basename5, dirname as dirname18, join as join47, relative as relative10, resolve as resolve30, sep as sep9 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -10962,8 +11096,8 @@ function mergeClusterRoot(ir, clusterIr, running) {
 }
 
 // src/helm-releases.ts
-import { existsSync as existsSync6, readdirSync as readdirSync5, readFileSync as readFileSync7, statSync as statSync3 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync5, readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
+import { join as join9 } from "node:path";
 var RELEASE_KEY = /^release\/([^/]+)\/(.+)$/;
 function declaredChartNames(ir) {
   const names = /* @__PURE__ */ new Set();
@@ -10983,12 +11117,12 @@ function matchesDeclaredChart(chart, declared) {
 }
 function discoverReleaseUnits(projectDir) {
   const owners = /* @__PURE__ */ new Map();
-  const roots = [join8(projectDir, "src"), join8(projectDir, "ops")];
+  const roots = [join9(projectDir, "src"), join9(projectDir, "ops")];
   const files = [];
   const walk = (dir, depth) => {
     if (depth > 4 || !existsSync6(dir)) return;
     for (const f of readdirSync5(dir)) {
-      const p = join8(dir, f);
+      const p = join9(dir, f);
       let s;
       try {
         s = statSync3(p);
@@ -11003,7 +11137,7 @@ function discoverReleaseUnits(projectDir) {
   for (const file of files) {
     let content;
     try {
-      content = readFileSync7(file, "utf8");
+      content = readFileSync8(file, "utf8");
     } catch {
       continue;
     }
@@ -11058,8 +11192,8 @@ function synthesizeHelmReleases(ir, observed, owners) {
 init_yaml();
 init_chant();
 import { execFileSync, spawn as spawn3 } from "node:child_process";
-import { readdirSync as readdirSync6, readFileSync as readFileSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { join as join10 } from "node:path";
 
 // src/ci-run.ts
 function pipelineProgress(pipeline) {
@@ -11155,7 +11289,7 @@ function workflowsDir(projectDir) {
     root = execFileSync("git", ["-C", projectDir, "rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || projectDir;
   } catch {
   }
-  return join9(root, ".github", "workflows");
+  return join10(root, ".github", "workflows");
 }
 function committedWorkflows(projectDir) {
   const dir = workflowsDir(projectDir);
@@ -11168,7 +11302,7 @@ function committedWorkflows(projectDir) {
   const out = [];
   for (const f of files) {
     try {
-      out.push(parseWorkflow(f, readFileSync8(join9(dir, f), "utf8")));
+      out.push(parseWorkflow(f, readFileSync9(join10(dir, f), "utf8")));
     } catch {
     }
   }
@@ -11358,22 +11492,22 @@ function joinCiProgress(ir, state) {
 }
 
 // src/ci-run-store.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync3, rmSync } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync3, rmSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join10, resolve as resolve6 } from "node:path";
+import { join as join11, resolve as resolve6 } from "node:path";
 function slug(projectDir) {
   return resolve6(projectDir).replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(-80);
 }
 function defaultRoot() {
-  return process.env.BEHOLD_CI_RUN_DIR ?? join10(homedir2(), ".behold", "ci-runs");
+  return process.env.BEHOLD_CI_RUN_DIR ?? join11(homedir2(), ".behold", "ci-runs");
 }
 function dispatchedRunPath(projectDir, root = defaultRoot()) {
-  return join10(root, `${slug(projectDir)}.json`);
+  return join11(root, `${slug(projectDir)}.json`);
 }
 function saveDispatchedRun(run3, root = defaultRoot()) {
   try {
     const path = dispatchedRunPath(run3.projectDir, root);
-    mkdirSync3(join10(path, ".."), { recursive: true });
+    mkdirSync3(join11(path, ".."), { recursive: true });
     writeFileSync3(path, JSON.stringify({ version: 1, ...run3 }, null, 2) + "\n");
   } catch {
   }
@@ -11382,7 +11516,7 @@ function readDispatchedRun(projectDir, root) {
   try {
     const path = dispatchedRunPath(projectDir, root);
     if (!existsSync7(path)) return void 0;
-    const parsed = JSON.parse(readFileSync9(path, "utf8"));
+    const parsed = JSON.parse(readFileSync10(path, "utf8"));
     if (parsed?.version !== 1 || typeof parsed.runId !== "number") return void 0;
     if (resolve6(parsed.projectDir) !== resolve6(projectDir)) return void 0;
     return parsed;
@@ -12500,7 +12634,7 @@ init_carve_manifest();
 init_carve_manifest();
 init_chant();
 import { readdirSync as readdirSync7, statSync as statSync4 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 
 // src/member-ir.ts
 init_member_source();
@@ -12582,7 +12716,7 @@ function hasAnyCarveManifest(dir, io = fsIo) {
     for (const name of entries) {
       if (name.endsWith(CARVE_MANIFEST_SUFFIX)) return true;
       if (name.startsWith(".") || SKIP2.has(name)) continue;
-      const full = join11(d, name);
+      const full = join12(d, name);
       if (io.isDirectory(full) && walk(full)) return true;
     }
     return false;
@@ -12624,7 +12758,7 @@ async function carveStatesUnder(dirs) {
 init_read_scheduler();
 init_chant();
 import { statSync as statSync5 } from "node:fs";
-import { join as join13, resolve as resolve10, sep as sep4 } from "node:path";
+import { join as join14, resolve as resolve10, sep as sep4 } from "node:path";
 import { composeStacks, shortStackNames } from "@intentius/pinhole";
 
 // src/overlay-ir.ts
@@ -12783,7 +12917,7 @@ init_chant();
 init_floor();
 init_member_source();
 import { existsSync as existsSync8 } from "node:fs";
-import { join as join12, resolve as resolve9 } from "node:path";
+import { join as join13, resolve as resolve9 } from "node:path";
 
 // src/workspace-reader.ts
 init_chant();
@@ -12855,7 +12989,7 @@ function rootReader(root, env) {
 // src/workspace.ts
 var DECLARATION_FILES = ["chant.workspace.json", "chant.workspace.jsonc"];
 function findDeclaration(dir) {
-  const found = DECLARATION_FILES.filter((f) => existsSync8(join12(dir, f)));
+  const found = DECLARATION_FILES.filter((f) => existsSync8(join13(dir, f)));
   if (found.length > 1) return { ambiguous: true };
   return found.length === 1 ? { file: found[0] } : void 0;
 }
@@ -13250,7 +13384,7 @@ function pathAlignment(declared, dir, isDir = realIsDir) {
   const have = root.split(sep4).filter(Boolean);
   for (let k = Math.min(want.length, have.length); k >= 1; k--) {
     if (!have.slice(-k).every((s, i) => s === want[i])) continue;
-    if (!isDir(join13(root, ...want.slice(k)))) continue;
+    if (!isDir(join14(root, ...want.slice(k)))) continue;
     return k;
   }
   return 0;
@@ -13280,10 +13414,10 @@ function joinNamespaceBindings(members, isDir = realIsDir) {
     if (!winner || tied) continue;
     const prev = best.get(winner.dir);
     if (prev === "ambiguous") continue;
-    const join51 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join51 });
+    const join52 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join52 });
     else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join51 });
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join52 });
   }
   return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
 }
@@ -14013,7 +14147,7 @@ function projectHelmLogical(ir) {
 
 // src/logical-kustomize.ts
 import { existsSync as existsSync9 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function overlayBoxTitle(name) {
   return `overlay ${name}`;
 }
@@ -14033,7 +14167,7 @@ function kustomizationRoot(bases, dir, exists) {
   let current = dir;
   for (let i = 0; i < 4 && current; i++) {
     for (const base of bases) {
-      if (exists(join14(base, current, "kustomization.yaml")) || exists(join14(base, current, "kustomization.yml"))) {
+      if (exists(join15(base, current, "kustomization.yaml")) || exists(join15(base, current, "kustomization.yml"))) {
         return current;
       }
     }
@@ -14738,6 +14872,32 @@ function resourcesByComponent(ir, known) {
   }
   return byComponent;
 }
+var TERRAFORM_ESTATE_BLOCKS = /* @__PURE__ */ new Set(["resource", "data", "module"]);
+function terraformBlockOf(n) {
+  const block = n.attrs?.block;
+  if (typeof block === "string") return block;
+  return n.kind.startsWith("Terraform::") ? n.kind.slice("Terraform::".length).toLowerCase() : void 0;
+}
+function resourcesByRoot(ir, rootOf2) {
+  const byComponent = {};
+  const componentsOf = /* @__PURE__ */ new Map();
+  for (const [component, root] of Object.entries(rootOf2)) {
+    byComponent[component] = [];
+    componentsOf.set(root, [...componentsOf.get(root) ?? [], component]);
+  }
+  for (const n of ir.nodes) {
+    const root = n.attrs?.root;
+    const block = terraformBlockOf(n);
+    if (typeof root !== "string" || block !== void 0 && !TERRAFORM_ESTATE_BLOCKS.has(block)) continue;
+    for (const component of componentsOf.get(root) ?? []) {
+      byComponent[component].push({ id: n.id, kind: n.kind, lexicon: n.lexicon, physicalId: n.physicalId, ownership: n.ownership });
+    }
+  }
+  return byComponent;
+}
+
+// src/server.ts
+init_terragucci_components();
 
 // src/reconcile.ts
 var DISRUPTION_SEVERITY = {
@@ -14817,17 +14977,17 @@ function summarizePlan(plan, byComponent, nonResource) {
 import {
   layoutIr,
   layoutArchitecture,
-  renderSvg,
+  renderSvg as pinholeRenderSvg,
   renderMorphHtml,
   cardSizes,
   registerPack
 } from "@intentius/pinhole";
 
 // src/icon-packs.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-import { dirname as dirname5, join as join15 } from "node:path";
+import { readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname5, join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-var ICON_ROOT = join15(dirname5(fileURLToPath3(import.meta.url)), "..", "web", "icons");
+var ICON_ROOT = join16(dirname5(fileURLToPath3(import.meta.url)), "..", "web", "icons");
 var cache4 = /* @__PURE__ */ new Map();
 function unprefix(body) {
   return body.replace(/\s(?:inkscape|sodipodi):[\w-]+\s*=\s*(["'])[\s\S]*?\1/g, "").replace(/\sxlink:href\s*=/g, " href=");
@@ -14849,7 +15009,7 @@ function plate(glyph) {
 function loadIcon(rel) {
   const hit = cache4.get(rel);
   if (hit) return hit;
-  const raw = readFileSync10(join15(ICON_ROOT, `${rel}.svg`), "utf8");
+  const raw = readFileSync11(join16(ICON_ROOT, `${rel}.svg`), "utf8");
   const open = raw.indexOf("<svg");
   const openEnd = raw.indexOf(">", open);
   const close = raw.lastIndexOf("</svg");
@@ -15754,7 +15914,332 @@ function stackOrderNoteShort(graph) {
   return bits.join(" \xB7 ");
 }
 
+// src/edge-route.ts
+var NUM = "(-?[\\d.]+(?:e[-+]?\\d+)?)";
+var CARD_PAD = 12;
+var LABEL_PAD = 3;
+var GUTTER = 24;
+var STUB = 16;
+var RADIUS = 8;
+var PORT_GAP = 16;
+var r1 = (n) => Math.round(n * 10) / 10;
+function svgGeometry(svg) {
+  const cards = /* @__PURE__ */ new Map();
+  const card = new RegExp(`<g data-node-id="([^"]*)"[^>]*><rect x="${NUM}" y="${NUM}" width="${NUM}" height="${NUM}"`, "g");
+  for (const m of svg.matchAll(card)) {
+    if (!cards.has(m[1])) cards.set(m[1], { x: +m[2], y: +m[3], w: +m[4], h: +m[5] });
+  }
+  const rich = new RegExp(`<foreignObject x="${NUM}" y="${NUM}" width="${NUM}" height="${NUM}" data-node-id="([^"]*)"`, "g");
+  for (const m of svg.matchAll(rich)) {
+    if (!cards.has(m[5])) cards.set(m[5], { x: +m[1], y: +m[2], w: +m[3], h: +m[4] });
+  }
+  const labels = [];
+  const box = new RegExp(`<rect(?: data-group-id="[^"]*")? x="${NUM}" y="${NUM}" width="${NUM}" height="${NUM}" rx="16"[^>]*/>((?:<text [^>]*>[^<]*</text>)?)`, "g");
+  for (const m of svg.matchAll(box)) {
+    const [x, y, w] = [+m[1], +m[2], +m[3]];
+    const title = /<text x="(-?[\d.]+)" y="(-?[\d.]+)"[^>]*>([^<]*)<\/text>/.exec(m[5] ?? "");
+    if (title) {
+      const chars = title[3].replace(/&[a-z]+;|&#\d+;/g, "x").length;
+      labels.push({ x: +title[1] - 4, y: +title[2] - 14, w: chars * 7.8 + 8, h: 20 });
+    }
+    labels.push({ x: x + w - 44, y: y + 6, w: 38, h: 26 });
+  }
+  const badge = /<text x="(-?[\d.]+)" y="(-?[\d.]+)" text-anchor="end"[^>]*font-size="11" font-weight="600">([^<]*)<\/text>/g;
+  for (const m of svg.matchAll(badge)) {
+    const chars = m[3].replace(/&[a-z]+;|&#\d+;/g, "x").length;
+    labels.push({ x: +m[1] - chars * 7 - 4, y: +m[2] - 13, w: chars * 7 + 8, h: 18 });
+  }
+  return { cards, labels };
+}
+var inflate = (r, p) => ({ x: r.x - p, y: r.y - p, w: r.w + 2 * p, h: r.h + 2 * p });
+var overlaps = (a, b) => a.x < b.x + b.w && b.x < a.x + a.w && a.y < b.y + b.h && b.y < a.y + a.h;
+function segmentHits(p, q, r) {
+  let t0 = 0;
+  let t1 = 1;
+  const dx = q.x - p.x;
+  const dy = q.y - p.y;
+  const clip2 = (den, num3) => {
+    if (den === 0) return num3 >= 0;
+    const t2 = num3 / den;
+    if (den < 0) {
+      if (t2 > t1) return false;
+      if (t2 > t0) t0 = t2;
+    } else {
+      if (t2 < t0) return false;
+      if (t2 < t1) t1 = t2;
+    }
+    return true;
+  };
+  const e = 1e-6;
+  if (!clip2(-dx, p.x - (r.x + e))) return false;
+  if (!clip2(dx, r.x + r.w - e - p.x)) return false;
+  if (!clip2(-dy, p.y - (r.y + e))) return false;
+  if (!clip2(dy, r.y + r.h - e - p.y)) return false;
+  return t1 > t0;
+}
+var cubicAt = (p0, p1, p2, p3, t2) => {
+  const u = 1 - t2;
+  const k = (a, b, c, d) => u * u * u * a + 3 * u * u * t2 * b + 3 * u * t2 * t2 * c + t2 * t2 * t2 * d;
+  return { x: k(p0.x, p1.x, p2.x, p3.x), y: k(p0.y, p1.y, p2.y, p3.y) };
+};
+function frameOf(dir) {
+  switch (dir) {
+    case "down":
+      return { to: (p) => p, from: (p) => p, rect: (r) => r };
+    case "up":
+      return { to: (p) => ({ x: p.x, y: -p.y }), from: (p) => ({ x: p.x, y: -p.y }), rect: (r) => ({ x: r.x, y: -(r.y + r.h), w: r.w, h: r.h }) };
+    case "right":
+      return { to: (p) => ({ x: p.y, y: p.x }), from: (p) => ({ x: p.y, y: p.x }), rect: (r) => ({ x: r.y, y: r.x, w: r.h, h: r.w }) };
+    case "left":
+      return { to: (p) => ({ x: p.y, y: -p.x }), from: (p) => ({ x: -p.y, y: p.x }), rect: (r) => ({ x: r.y, y: -(r.x + r.w), w: r.h, h: r.w }) };
+  }
+}
+var EXIT = {
+  down: ["bottom", "top"],
+  up: ["top", "bottom"],
+  right: ["right", "left"],
+  left: ["left", "right"]
+};
+function directionOf2(a, b) {
+  const below = b.y - (a.y + a.h);
+  const above = a.y - (b.y + b.h);
+  const right = b.x - (a.x + a.w);
+  const left = a.x - (b.x + b.w);
+  const v = Math.max(below, above);
+  const h = Math.max(right, left);
+  if (v < 0 && h < 0) return null;
+  if (v >= h) return below >= above ? "down" : "up";
+  return right >= left ? "right" : "left";
+}
+var portOn = (r, side, off) => {
+  switch (side) {
+    case "bottom":
+      return { x: r.x + r.w / 2 + off, y: r.y + r.h };
+    case "top":
+      return { x: r.x + r.w / 2 + off, y: r.y };
+    case "left":
+      return { x: r.x, y: r.y + r.h / 2 + off };
+    case "right":
+      return { x: r.x + r.w, y: r.y + r.h / 2 + off };
+  }
+};
+function roundedPath(pts) {
+  const clean = pts.filter((p, i) => i === 0 || Math.hypot(p.x - pts[i - 1].x, p.y - pts[i - 1].y) > 0.01);
+  let d = `M ${r1(clean[0].x)} ${r1(clean[0].y)}`;
+  for (let i = 1; i < clean.length - 1; i++) {
+    const [p, c, n] = [clean[i - 1], clean[i], clean[i + 1]];
+    const l1 = Math.hypot(c.x - p.x, c.y - p.y);
+    const l2 = Math.hypot(n.x - c.x, n.y - c.y);
+    const r = Math.min(RADIUS, l1 / 2, l2 / 2);
+    const a = { x: c.x - (c.x - p.x) / l1 * r, y: c.y - (c.y - p.y) / l1 * r };
+    const b = { x: c.x + (n.x - c.x) / l2 * r, y: c.y + (n.y - c.y) / l2 * r };
+    d += ` L ${r1(a.x)} ${r1(a.y)} Q ${r1(c.x)} ${r1(c.y)} ${r1(b.x)} ${r1(b.y)}`;
+  }
+  const last = clean[clean.length - 1];
+  return `${d} L ${r1(last.x)} ${r1(last.y)}`;
+}
+function polylineCrossings(pts, blocks) {
+  let n = 0;
+  for (const r of blocks) {
+    for (let i = 1; i < pts.length; i++) {
+      if (segmentHits(pts[i - 1], pts[i], r)) {
+        n++;
+        break;
+      }
+    }
+  }
+  return n;
+}
+function routeEdge(input) {
+  const dir = directionOf2(input.from, input.to);
+  if (!dir) return null;
+  const f = frameOf(dir);
+  const [outSide, inSide] = EXIT[dir];
+  const a = f.to(portOn(input.from, outSide, input.fromOffset ?? 0));
+  const b = f.to(portOn(input.to, inSide, input.toOffset ?? 0));
+  const A = f.rect(input.from);
+  const B = f.rect(input.to);
+  const blocks = [
+    ...input.obstacles.map((r) => inflate(f.rect(r), CARD_PAD)),
+    ...(input.labels ?? []).map((r) => inflate(f.rect(r), LABEL_PAD)),
+    inflate(A, -0.5),
+    inflate(B, -0.5)
+  ];
+  const back = (pts2) => pts2.map((p) => f.from(p));
+  const mid = (a.y + b.y) / 2;
+  const c1 = { x: a.x, y: mid };
+  const c2 = { x: b.x, y: mid };
+  const n = Math.max(8, Math.ceil(Math.hypot(b.x - a.x, b.y - a.y) / 4));
+  const curve = [];
+  for (let s = 0; s <= n; s++) curve.push(cubicAt(a, c1, c2, b, s / n));
+  const curveHits = polylineCrossings(curve, blocks);
+  if (curveHits === 0) {
+    const [p0, p1, p2, p3] = back([a, c1, c2, b]);
+    return {
+      d: `M ${r1(p0.x)} ${r1(p0.y)} C ${r1(p1.x)} ${r1(p1.y)}, ${r1(p2.x)} ${r1(p2.y)}, ${r1(p3.x)} ${r1(p3.y)}`,
+      points: back(curve),
+      curved: true,
+      crossings: 0
+    };
+  }
+  const stub = Math.max(4, Math.min(STUB, (b.y - a.y) / 3));
+  const y1 = a.y + stub;
+  const y2 = b.y - stub;
+  const candidates = [];
+  for (const ym of [mid, y1, y2]) candidates.push([a, { x: a.x, y: ym }, { x: b.x, y: ym }, b]);
+  const gutters = /* @__PURE__ */ new Set();
+  const lane = input.fromOffset ?? 0;
+  for (const r of [...blocks.slice(0, -2), inflate(A, CARD_PAD), inflate(B, CARD_PAD)]) {
+    if (r.y + r.h < Math.min(a.y, b.y) - 200 || r.y > Math.max(a.y, b.y) + 200) continue;
+    for (const g of [r.x - GUTTER + CARD_PAD, r.x + r.w + GUTTER - CARD_PAD]) {
+      gutters.add(g + lane);
+      gutters.add(g);
+    }
+  }
+  for (const g of gutters) candidates.push([a, { x: a.x, y: y1 }, { x: g, y: y1 }, { x: g, y: y2 }, { x: b.x, y: y2 }, b]);
+  const length = (pts2) => pts2.slice(1).reduce((s, p, i) => s + Math.abs(p.x - pts2[i].x) + Math.abs(p.y - pts2[i].y), 0);
+  candidates.sort((p, q) => length(p) - length(q));
+  let best = null;
+  for (const pts2 of candidates) {
+    const hits3 = polylineCrossings(pts2, blocks);
+    if (hits3 === 0) {
+      best = { pts: pts2, hits: hits3 };
+      break;
+    }
+    if (!best || hits3 < best.hits) best = { pts: pts2, hits: hits3 };
+  }
+  if (!best || best.hits >= curveHits) {
+    const [p0, p1, p2, p3] = back([a, c1, c2, b]);
+    return {
+      d: `M ${r1(p0.x)} ${r1(p0.y)} C ${r1(p1.x)} ${r1(p1.y)}, ${r1(p2.x)} ${r1(p2.y)}, ${r1(p3.x)} ${r1(p3.y)}`,
+      points: back(curve),
+      curved: true,
+      crossings: curveHits
+    };
+  }
+  const pts = back(best.pts);
+  return { d: roundedPath(pts), points: pts, curved: false, crossings: best.hits };
+}
+function chipSpot(points, w, h, blocks) {
+  if (points.length < 2) return null;
+  const cum = [0];
+  for (let i = 1; i < points.length; i++) cum.push(cum[i - 1] + Math.hypot(points[i].x - points[i - 1].x, points[i].y - points[i - 1].y));
+  const total = cum[cum.length - 1];
+  const at2 = (s) => {
+    let i = 1;
+    while (i < cum.length - 1 && cum[i] < s) i++;
+    const seg = cum[i] - cum[i - 1] || 1;
+    const t2 = (s - cum[i - 1]) / seg;
+    return { x: points[i - 1].x + (points[i].x - points[i - 1].x) * t2, y: points[i - 1].y + (points[i].y - points[i - 1].y) * t2 };
+  };
+  const beside = [{ x: 0, y: 0 }, { x: w / 2 + 4, y: 0 }, { x: -(w / 2 + 4), y: 0 }, { x: 0, y: h / 2 + 4 }, { x: 0, y: -(h / 2 + 4) }];
+  for (const nudge of beside) {
+    for (const frac2 of [0.5, 0.4, 0.6, 0.3, 0.7, 0.2, 0.8, 0.12, 0.88]) {
+      const on = at2(total * frac2);
+      const c = { x: on.x + nudge.x, y: on.y + nudge.y };
+      const chip = { x: c.x - w / 2, y: c.y - h / 2, w, h };
+      if (!blocks.some((r) => overlaps(chip, r))) return c;
+    }
+  }
+  return null;
+}
+var PORT_REACH = 40;
+function clearOfLabels(card, side, offsets, labels) {
+  const along = side === "top" || side === "bottom";
+  const len = along ? card.w : card.h;
+  const margin = 14;
+  const lo = -len / 2 + margin - Math.min(...offsets);
+  const hi = len / 2 - margin - Math.max(...offsets);
+  const probe2 = (shift) => offsets.every((off) => {
+    const p = portOn(card, side, off + shift);
+    const reach = along ? { x: p.x - 2, y: side === "top" ? p.y - PORT_REACH : p.y, w: 4, h: PORT_REACH } : { x: side === "left" ? p.x - PORT_REACH : p.x, y: p.y - 2, w: PORT_REACH, h: 4 };
+    return !labels.some((l) => overlaps(reach, inflate(l, LABEL_PAD)));
+  });
+  if (probe2(0)) return 0;
+  for (let step = 4; step <= len; step += 4) {
+    if (step <= hi && probe2(step)) return step;
+    if (-step >= lo && probe2(-step)) return -step;
+  }
+  return 0;
+}
+var EDGE = new RegExp(
+  // The line group pinhole's `Canvas.edge` writes, then (optionally) the chip
+  // group `Canvas.edgeLabel` writes straight after it.
+  `<g data-edge-from="([^"]*)" data-edge-to="([^"]*)"([^>]*)><path class="pin-edge-line([^"]*)" d="([^"]*)"([^>]*)/><path d="([^"]*)"([^>]*)/></g>(?:<g data-edge-from="([^"]*)" data-edge-to="([^"]*)"([^>]*)><rect x="${NUM}" y="${NUM}" width="${NUM}" height="${NUM}"([^>]*)/><text x="${NUM}" y="${NUM}")?`,
+  "g"
+);
+function routeEdges(svg) {
+  if (!svg.includes("pin-edge-line")) return svg;
+  const geo = svgGeometry(svg);
+  const found = [...svg.matchAll(EDGE)];
+  if (!found.length) return svg;
+  const dirs = found.map((m) => {
+    const a = geo.cards.get(m[1]);
+    const b = geo.cards.get(m[2]);
+    return a && b && m[1] !== m[2] ? directionOf2(a, b) : null;
+  });
+  const sides = /* @__PURE__ */ new Map();
+  const ends = found.map((m, i) => {
+    const dir = dirs[i];
+    if (!dir) return null;
+    const [outSide, inSide] = EXIT[dir];
+    const a = geo.cards.get(m[1]);
+    const b = geo.cards.get(m[2]);
+    const horiz = dir === "down" || dir === "up";
+    const centre = (r) => horiz ? r.x + r.w / 2 : r.y + r.h / 2;
+    const pair = [
+      { edge: i, card: m[1], side: outSide, toward: centre(b), offset: 0 },
+      { edge: i, card: m[2], side: inSide, toward: centre(a), offset: 0 }
+    ];
+    for (const e of pair) {
+      const key = `${e.card}\0${e.side}`;
+      const list3 = sides.get(key) ?? [];
+      list3.push(e);
+      sides.set(key, list3);
+    }
+    return pair;
+  });
+  for (const list3 of sides.values()) {
+    const card = geo.cards.get(list3[0].card);
+    const side = list3[0].side;
+    const len = side === "top" || side === "bottom" ? card.w : card.h;
+    if (list3.length > 1) {
+      const gap = Math.min(PORT_GAP, len * 0.7 / (list3.length - 1));
+      list3.sort((p, q) => p.toward - q.toward || p.edge - q.edge);
+      list3.forEach((e, k2) => e.offset = (k2 - (list3.length - 1) / 2) * gap);
+    }
+    const shift = clearOfLabels(card, side, list3.map((e) => e.offset), geo.labels);
+    if (shift) list3.forEach((e) => e.offset += shift);
+  }
+  const cardRects = [...geo.cards.entries()];
+  const chips = [];
+  let k = -1;
+  return svg.replace(EDGE, (whole, ...g) => {
+    k++;
+    const pair = ends[k];
+    if (!pair) return whole;
+    const [from, to] = [g[0], g[1]];
+    const obstacles = cardRects.filter(([id]) => id !== from && id !== to).map(([, r]) => r);
+    const route = routeEdge({ from: geo.cards.get(from), to: geo.cards.get(to), fromOffset: pair[0].offset, toOffset: pair[1].offset, obstacles, labels: geo.labels });
+    if (!route) return whole;
+    let out = `<g data-edge-from="${from}" data-edge-to="${to}"${g[2]}><path class="pin-edge-line${g[3]}" d="${route.d}"${g[5]}/><path d="${route.d}"${g[7]}/></g>`;
+    if (g[8] === void 0) return out;
+    const [rx, ry, rw, rh, tx, ty] = [g[11], g[12], g[13], g[14], g[16], g[17]].map(Number);
+    const blocks = [...[...geo.cards.values()].map((r) => inflate(r, 2)), ...geo.labels, ...chips];
+    const spot = chipSpot(route.points, rw, rh, blocks);
+    const c = spot ?? { x: rx + rw / 2, y: ry + rh / 2 };
+    const dx = c.x - (rx + rw / 2);
+    const dy = c.y - (ry + rh / 2);
+    chips.push({ x: rx + dx - 2, y: ry + dy - 2, w: rw + 4, h: rh + 4 });
+    out += `<g data-edge-from="${g[8]}" data-edge-to="${g[9]}"${g[10]}><rect x="${r1(rx + dx)}" y="${r1(ry + dy)}" width="${g[13]}" height="${g[14]}"${g[15]}/><text x="${r1(tx + dx)}" y="${r1(ty + dy)}"`;
+    return out;
+  });
+}
+
 // src/render.ts
+function renderSvg(...args) {
+  return routeEdges(pinholeRenderSvg(...args));
+}
 registerPack({ lexicon: "k8s", iconFor: k8sIconFor });
 registerPack({ lexicon: "helm", iconFor: helmIconFor });
 registerPack({ lexicon: SQL_LEXICON, iconFor: sqlIconFor, fields: sqlCardFields });
@@ -15856,6 +16341,12 @@ function renderGraph(irIn, opts = {}) {
       box.title = title === box.id && box.parent !== void 0 && title.startsWith(`${box.parent}/`) ? title.slice(box.parent.length + 1) : title;
     }
   }
+  if (boxKey === "byWave" && opts.waveTitles) {
+    for (const box of layout.groups ?? []) {
+      const title = box.id === void 0 ? void 0 : opts.waveTitles[box.id];
+      if (title !== void 0) box.title = title;
+    }
+  }
   const svg = renderSvg(ir, layout, {
     fit: true,
     hideTitle: true,
@@ -16604,7 +17095,7 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
     n.y += (k * 7 % 5 - 2) * 0.4;
   });
   for (let iter = 0; iter < 2500; iter++) {
-    let overlaps = 0;
+    let overlaps2 = 0;
     for (let a = 0; a < nodes.length; a++) {
       for (let b = a + 1; b < nodes.length; b++) {
         const dx = nodes[b].x - nodes[a].x;
@@ -16614,7 +17105,7 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
         const ox = sepW - Math.abs(dx);
         const oy = sepH - Math.abs(dy);
         if (ox <= 0 || oy <= 0) continue;
-        overlaps++;
+        overlaps2++;
         const d = Math.hypot(dx, dy) || 0.01;
         const push = Math.min(ox, oy) * 0.75 + 2;
         const ux = dx / d;
@@ -16625,7 +17116,7 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
         nodes[b].y += uy * push;
       }
     }
-    if (overlaps === 0) break;
+    if (overlaps2 === 0) break;
   }
   const minX = Math.min(...nodes.map((n) => n.x - wOf(n) / 2));
   const minY = Math.min(...nodes.map((n) => n.y - hOf(n) / 2));
@@ -16653,12 +17144,12 @@ init_carve_manifest();
 
 // src/carve-actions.ts
 init_chant();
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join18, relative as relative4, resolve as resolve11, sep as sep5 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync14, readdirSync as readdirSync8, statSync as statSync6 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join19, relative as relative4, resolve as resolve11, sep as sep5 } from "node:path";
 
 // src/layout.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4, accessSync, constants } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync12, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4, accessSync, constants } from "node:fs";
+import { join as join17 } from "node:path";
 var LAYOUT_DIR = ".behold";
 var LAYOUT_FILE = "layout.json";
 var MAX_BODY_BYTES = 64 * 1024;
@@ -16667,7 +17158,7 @@ var MAX_IDS_PER_LENS = 2e3;
 var MAX_LENSES = 64;
 var MAX_ID_LENGTH = 512;
 var MAX_LENS_LENGTH = 128;
-var NUM = ["dx", "dy", "dw", "dh"];
+var NUM2 = ["dx", "dy", "dw", "dh"];
 function slug2(s) {
   return String(s ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
 }
@@ -16684,7 +17175,7 @@ function normalizeDeltas(raw) {
   for (const [id, d] of Object.entries(raw)) {
     if (!id || id.length > MAX_ID_LENGTH || id === "__proto__" || !d || typeof d !== "object") continue;
     const clean = {};
-    for (const k of NUM) {
+    for (const k of NUM2) {
       const v = Number(d[k]);
       if (Number.isFinite(v) && v !== 0) clean[k] = v;
     }
@@ -16699,7 +17190,7 @@ function lensFromQuery(params) {
   return [slug2(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug2(`stack-${stack}`) : null].filter(Boolean).join("+");
 }
 function layoutPath(projectDir) {
-  return join16(projectDir, LAYOUT_DIR, LAYOUT_FILE);
+  return join17(projectDir, LAYOUT_DIR, LAYOUT_FILE);
 }
 function unwritableReason(projectDir) {
   if (!projectDir || !existsSync10(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
@@ -16715,7 +17206,7 @@ function readLayoutFile(projectDir) {
   const file = layoutPath(projectDir);
   try {
     if (!existsSync10(file)) return empty;
-    const raw = readFileSync11(file, "utf8");
+    const raw = readFileSync12(file, "utf8");
     if (raw.length > MAX_FILE_BYTES) return empty;
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || !parsed.lenses || typeof parsed.lenses !== "object") return empty;
@@ -16755,7 +17246,7 @@ function writeLens(projectDir, lens, deltas) {
   }
   const body = JSON.stringify({ version: 1, lenses }, null, 2) + "\n";
   if (body.length > MAX_FILE_BYTES) throw new LayoutTooLarge(`a layout sidecar is capped at ${MAX_FILE_BYTES} bytes`);
-  mkdirSync4(join16(projectDir, LAYOUT_DIR), { recursive: true });
+  mkdirSync4(join17(projectDir, LAYOUT_DIR), { recursive: true });
   const tmp = `${file}.tmp`;
   writeFileSync4(tmp, body, "utf8");
   renameSync(tmp, file);
@@ -16841,8 +17332,8 @@ function reanchorEdges(svg, moved) {
 // src/carve-live.ts
 init_scratch();
 import { spawn as spawn4 } from "node:child_process";
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, existsSync as existsSync11 } from "node:fs";
-import { join as join17 } from "node:path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync5, existsSync as existsSync11 } from "node:fs";
+import { join as join18 } from "node:path";
 var LIVE_CONTAINER = "behold-carve-floci";
 var LIVE_PORT = 4602;
 var LIVE_IMAGE = "floci/floci:1.5.34";
@@ -16902,9 +17393,9 @@ async function teardownScratchFloci() {
   await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
 }
 async function applyIntoFloci(fromDir, step) {
-  const template = join17(fromDir, "floci-override.tf.disabled");
+  const template = join18(fromDir, "floci-override.tf.disabled");
   if (!existsSync11(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
-  writeFileSync5(join17(fromDir, "floci_override.tf"), armOverride(readFileSync12(template, "utf8"), LIVE_PORT));
+  writeFileSync5(join18(fromDir, "floci_override.tf"), armOverride(readFileSync13(template, "utf8"), LIVE_PORT));
   const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
   if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
   const apply = await step(
@@ -16954,7 +17445,7 @@ async function runCarveObserve(demo, select) {
       "run `behold demo carve --live` (needs docker + terraform)"
     );
   }
-  if (!existsSync12(join18(demo.out, "src"))) {
+  if (!existsSync12(join19(demo.out, "src"))) {
     return refuse6("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
   }
   const args = ["lifecycle", "diff", "prod", "--live", "--json"];
@@ -17052,7 +17543,7 @@ function readArtifacts(demo, dir, filter) {
     for (const name of entries) {
       if (out.length >= MAX_ARTIFACTS) return;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join18(d, name);
+      const full = join19(d, name);
       let st;
       try {
         st = statSync6(full);
@@ -17067,7 +17558,7 @@ function readArtifacts(demo, dir, filter) {
       if (!filter(rel)) continue;
       let text = "";
       try {
-        text = readFileSync13(full, "utf8");
+        text = readFileSync14(full, "utf8");
       } catch {
         continue;
       }
@@ -17099,7 +17590,7 @@ async function runCarveEmit(demo, select) {
   const block = carveWriteBlock(demo);
   if (block) return refuse6("read-only", block, "Start the walkthrough with `behold demo carve`.");
   mkdirSync5(demo.out, { recursive: true });
-  const reportFile = join18(demo.out, `${carveSlug(select)}-boundary.json`);
+  const reportFile = join19(demo.out, `${carveSlug(select)}-boundary.json`);
   const args = [
     "carve",
     "emit",
@@ -17128,10 +17619,10 @@ async function runCarveEmit(demo, select) {
   }
   let boundary = null;
   try {
-    boundary = JSON.parse(readFileSync13(reportFile, "utf8"));
+    boundary = JSON.parse(readFileSync14(reportFile, "utf8"));
   } catch {
   }
-  const lintPath = relative4(demo.project, join18(demo.out, "src")).split(sep5).join("/");
+  const lintPath = relative4(demo.project, join19(demo.out, "src")).split(sep5).join("/");
   const lintArgs = ["lint", lintPath];
   const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
     code: 127,
@@ -17194,8 +17685,8 @@ async function runCarveBridge(demo, select) {
 }
 
 // src/ops.ts
-import { readdirSync as readdirSync9, readFileSync as readFileSync14, existsSync as existsSync13 } from "node:fs";
-import { join as join19 } from "node:path";
+import { readdirSync as readdirSync9, readFileSync as readFileSync15, existsSync as existsSync13 } from "node:fs";
+import { join as join20 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -17217,11 +17708,11 @@ function discoverOps(projectDir) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const sub of ["ops", "src", "."]) {
-    const dir = join19(projectDir, sub);
+    const dir = join20(projectDir, sub);
     if (!existsSync13(dir)) continue;
     for (const f of readdirSync9(dir)) {
       if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync14(join19(dir, f), "utf8");
+      const content = readFileSync15(join20(dir, f), "utf8");
       const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
       if (!name || seen.has(name)) continue;
       seen.add(name);
@@ -17244,13 +17735,13 @@ function discoverOps(projectDir) {
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
 function opIrPath(projectDir, name) {
-  return join19(projectDir, "dist", "ops", name, "op.json");
+  return join20(projectDir, "dist", "ops", name, "op.json");
 }
 function discoverOpIrs(projectDirs) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const dir of projectDirs) {
-    const root = join19(dir, "dist", "ops");
+    const root = join20(dir, "dist", "ops");
     if (!existsSync13(root)) continue;
     for (const name of readdirSync9(root)) {
       if (seen.has(name)) continue;
@@ -17490,11 +17981,11 @@ var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
 function tookLabel(ms) {
   return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
 }
-function paintPlayhead(ir, join51, gate) {
-  if (!join51.byNode.size && !join51.at) return ir;
+function paintPlayhead(ir, join52, gate) {
+  if (!join52.byNode.size && !join52.at) return ir;
   const nodes = ir.nodes.map((node) => {
-    const run3 = join51.byNode.get(node.id);
-    const here = join51.at === node.id;
+    const run3 = join52.byNode.get(node.id);
+    const here = join52.at === node.id;
     if (!run3 && !here) return node;
     const isGate = node.attrs?._step === "gate";
     const attrs = { ...node.attrs };
@@ -17509,7 +18000,7 @@ function paintPlayhead(ir, join51, gate) {
     if (here) {
       attrs._playhead = true;
       attrs._status = isGate && gate ? "warn" : "accent";
-      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join51.atReason ?? "here";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join52.atReason ?? "here";
       if (isGate && gate?.description) attrs.gateDescription = gate.description;
     }
     return { ...node, attrs };
@@ -17531,11 +18022,11 @@ function pendingGateCard(op, gate, ir) {
     }
   };
 }
-function playheadNote(state, join51) {
+function playheadNote(state, join52) {
   if (!state.op) {
     return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
-  const settled = join51 ? join51.byNode.size : state.records.length;
+  const settled = join52 ? join52.byNode.size : state.records.length;
   const bits = [];
   const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
   if (state.status === "running") {
@@ -17551,9 +18042,9 @@ function playheadNote(state, join51) {
   } else if (state.gateNote) {
     bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
   }
-  if (join51?.unplaced.length) {
+  if (join52?.unplaced.length) {
     bits.push(
-      `${join51.unplaced.length} record${join51.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join51.unplaced.length === 1 ? "is" : "are"} not painted`
+      `${join52.unplaced.length} record${join52.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join52.unplaced.length === 1 ? "is" : "are"} not painted`
     );
   }
   if (!bits.length) return `${head}.`;
@@ -18224,8 +18715,8 @@ var OpRunner = class {
 };
 
 // src/public-mode.ts
-import { readFileSync as readFileSync15 } from "node:fs";
-import { join as join20 } from "node:path";
+import { readFileSync as readFileSync16 } from "node:fs";
+import { join as join21 } from "node:path";
 var ReadOnlyRunner = class {
   running = null;
   applyProgress = initialApplyProgress;
@@ -18288,7 +18779,7 @@ function publicReadRefusal(path, query) {
 }
 var PUBLIC_FLAG = "<script>window.__BEHOLD_PUBLIC__ = true;</script>";
 function publicPage(webRoot2) {
-  const html = readFileSync15(join20(webRoot2, "index.html"), "utf8");
+  const html = readFileSync16(join21(webRoot2, "index.html"), "utf8");
   return html.replace("</head>", `  ${PUBLIC_FLAG}
   </head>`);
 }
@@ -18305,8 +18796,8 @@ function publicRoutes(app, webRoot2) {
 
 // src/substrates.ts
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync17 } from "node:fs";
+import { join as join22 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
@@ -18335,11 +18826,11 @@ async function dockerRunning(run3, nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync14(join21(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync14(join22(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync16(join21(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync17(join22(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -18391,7 +18882,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync14(join21(projectDir, marker))) continue;
+    if (!existsSync14(join22(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -18425,7 +18916,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync14(join21(projectDir, ".github", "workflows"))) {
+  if (existsSync14(join22(projectDir, ".github", "workflows"))) {
     const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -18438,7 +18929,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync16(join21(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync17(join22(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -18581,8 +19072,8 @@ function statusVocabulary(kinds) {
 }
 
 // src/behaviour.ts
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join22 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join23 } from "node:path";
 var rec5 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 var str6 = (v) => typeof v === "string" && v.trim().length > 0 ? v : void 0;
 var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
@@ -18689,7 +19180,7 @@ var FIRST_TOTAL_SHOWN = "two members stated an estate total; the first is shown"
 var behaviourFileName = (env) => `behaviour.${env}.json`;
 var realRead = (path) => {
   try {
-    return readFileSync17(path, "utf8");
+    return readFileSync18(path, "utf8");
   } catch {
     return void 0;
   }
@@ -18747,7 +19238,7 @@ function attachBehaviour(ir, members, env, readFile2 = realRead) {
     }
     const file = behaviourFileName(env);
     looked.push(`${label}/${file}`);
-    const raw = readFile2(join22(m.dir, file));
+    const raw = readFile2(join23(m.dir, file));
     if (raw === void 0) {
       sources.set(label, "none");
       continue;
@@ -19183,7 +19674,7 @@ init_choudoufu_live();
 init_choudoufu_member();
 import { mkdtempSync, rmSync as rmSync3 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var isRecord10 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var refuse7 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var CREDS2 = "Give behold the ambient read-only AWS credentials the estate's `plan` needs (AWS_PROFILE, or AWS_ENDPOINT_URL for an emulator), then re-check live with plan.";
@@ -19257,8 +19748,8 @@ var planArgv = (out) => ({
   show: ["show", "-json", out]
 });
 async function readChoudoufuPlan(dir, run3 = captureChoudoufu) {
-  const scratch = mkdtempSync(join23(tmpdir2(), "behold-choudoufu-plan-"));
-  const file = join23(scratch, "plan.tfplan");
+  const scratch = mkdtempSync(join24(tmpdir2(), "behold-choudoufu-plan-"));
+  const file = join24(scratch, "plan.tfplan");
   const argv = planArgv(file);
   try {
     const planRun = await run3(argv.plan, dir);
@@ -19290,8 +19781,8 @@ init_choudoufu_refs();
 // src/choudoufu-moves.ts
 init_choudoufu_member();
 init_choudoufu_live();
-import { existsSync as existsSync15, readFileSync as readFileSync18 } from "node:fs";
-import { join as join24, relative as relative5 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync19 } from "node:fs";
+import { join as join25, relative as relative5 } from "node:path";
 var isRecord11 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var refuse8 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var HOW_TO_GET_ONE2 = "A plan is the live-mv workbench's carve.json: `{from, estates[], moves[{address, from, to}]}` \u2014 the workbench's plan phase writes one, or write it by hand.";
@@ -19311,7 +19802,7 @@ function parseCarvePlan(value) {
     }
   };
 }
-function readCarvePlan(path, readFile2 = (p) => readFileSync18(p, "utf8")) {
+function readCarvePlan(path, readFile2 = (p) => readFileSync19(p, "utf8")) {
   let text;
   try {
     text = readFile2(path);
@@ -19327,7 +19818,7 @@ function readCarvePlan(path, readFile2 = (p) => readFileSync18(p, "utf8")) {
 function discoverCarvePlans(memberDirs, base) {
   const out = [];
   for (const dir of memberDirs) {
-    const p = join24(dir, "carve.json");
+    const p = join25(dir, "carve.json");
     if (existsSync15(p)) out.push(relative5(base, p));
   }
   return out;
@@ -19558,24 +20049,24 @@ function getRuntime() {
 
 // node_modules/@intentius/chant/src/lifecycle/member-ledger.ts
 import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname8, join as join28, relative as relative6, resolve as resolve15, sep as sep6 } from "node:path";
+import { dirname as dirname8, join as join29, relative as relative6, resolve as resolve15, sep as sep6 } from "node:path";
 
 // node_modules/@intentius/chant/src/project-root.ts
 import { existsSync as existsSync16 } from "fs";
-import { dirname as dirname6, join as join25, resolve as resolve13 } from "path";
+import { dirname as dirname6, join as join26, resolve as resolve13 } from "path";
 var WORKSPACE_DECLARATION_FILES = ["chant.workspace.json", "chant.workspace.jsonc"];
 function findWorkspaceRoot(startDir) {
   const start = resolve13(startDir);
   let top;
   for (let dir = start; ; dir = dirname6(dir)) {
-    if (existsSync16(join25(dir, ".git"))) {
+    if (existsSync16(join26(dir, ".git"))) {
       top = dir;
       break;
     }
     if (dirname6(dir) === dir) break;
   }
   for (let dir = start; ; dir = dirname6(dir)) {
-    const [json2, jsonc] = WORKSPACE_DECLARATION_FILES.map((name) => join25(dir, name));
+    const [json2, jsonc] = WORKSPACE_DECLARATION_FILES.map((name) => join26(dir, name));
     const hasJson = existsSync16(json2);
     const hasJsonc = existsSync16(jsonc);
     if (hasJson && hasJsonc) return { dir, file: json2, conflicting: jsonc };
@@ -19637,7 +20128,7 @@ async function ledgerIn(root, dir) {
   }
   let outer = FLAT;
   const parent = dirname8(root);
-  if (parent !== root && !existsSync18(join28(root, ".git"))) {
+  if (parent !== root && !existsSync18(join29(root, ".git"))) {
     const outerFound = findWorkspaceRoot(parent);
     if (outerFound) outer = await ledgerIn(outerFound.dir, root);
   }
@@ -20192,7 +20683,7 @@ function decideOverride(input) {
 
 // src/terragucci-repo.ts
 import { existsSync as existsSync19 } from "node:fs";
-import { dirname as dirname9, join as join29, resolve as resolve16 } from "node:path";
+import { dirname as dirname9, join as join30, resolve as resolve16 } from "node:path";
 var TERRAGUCCI_CONFIG_NAMES = ["terragucci.yml", "terragucci.yaml", "terragucci.json", "terragucci.ts"];
 function terragucciConfig(dir) {
   return walkUp(dir, TERRAGUCCI_CONFIG_NAMES);
@@ -20201,10 +20692,10 @@ function walkUp(dir, names) {
   let at2 = resolve16(dir);
   for (; ; ) {
     for (const name of names) {
-      const file = join29(at2, name);
+      const file = join30(at2, name);
       if (existsSync19(file)) return file;
     }
-    if (existsSync19(join29(at2, ".git"))) return void 0;
+    if (existsSync19(join30(at2, ".git"))) return void 0;
     const up = dirname9(at2);
     if (up === at2) return void 0;
     at2 = up;
@@ -20638,6 +21129,7 @@ function allowedHostsFrom(flag = [], env = process.env.BEHOLD_ALLOWED_HOSTS) {
 // src/server.ts
 init_member_kind();
 init_terraform_member();
+init_terraform_lens();
 
 // src/doctor.ts
 init_chant();
@@ -21007,7 +21499,7 @@ init_foreign();
 
 // src/events.ts
 import { watch, existsSync as existsSync20 } from "node:fs";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -21025,7 +21517,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync20(join30(projectDir, "src")) ? join30(projectDir, "src") : projectDir;
+  const dir = existsSync20(join31(projectDir, "src")) ? join31(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -21328,13 +21820,13 @@ async function emulatorDown(projectDir) {
 
 // src/terragucci-view.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { dirname as dirname13, join as join39, relative as relative8, sep as sep7 } from "node:path";
+import { dirname as dirname13, join as join40, relative as relative8, sep as sep7 } from "node:path";
 init_terraform_member();
 
 // src/terragucci-reports.ts
-import { readFileSync as readFileSync23, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync24, statSync as statSync10 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname10, join as join33, resolve as resolve20 } from "node:path";
+import { dirname as dirname10, join as join34, resolve as resolve20 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { Ajv2020 } from "ajv/dist/2020.js";
 
@@ -21343,12 +21835,12 @@ import { execFile as execFile4 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync21, mkdirSync as mkdirSync6, readdirSync as readdirSync11 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename3, isAbsolute as isAbsolute4, join as join32, resolve as resolve19 } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute4, join as join33, resolve as resolve19 } from "node:path";
 
 // node_modules/@intentius/chant/src/gate-decision.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { readFileSync as readFileSync22 } from "node:fs";
-import { join as join31, posix as posix3 } from "node:path";
+import { readFileSync as readFileSync23 } from "node:fs";
+import { join as join32, posix as posix3 } from "node:path";
 
 // node_modules/@intentius/chant/src/lifecycle/gate-applied.ts
 function appliedGatePath(op) {
@@ -21457,7 +21949,7 @@ function pinnedClassesAt(repo, base, pins, packages) {
     }
     let installed2;
     try {
-      installed2 = JSON.parse(readFileSync22(join31(dir, "package.json"), "utf-8")).version;
+      installed2 = JSON.parse(readFileSync23(join32(dir, "package.json"), "utf-8")).version;
     } catch {
       installed2 = void 0;
     }
@@ -22052,7 +22544,7 @@ var realGit = (args, o = {}) => new Promise((res) => {
 });
 var redact = (s) => s.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/gi, "$1");
 function cacheDir(origin, root = tmpdir3()) {
-  return join32(root, `${CACHE_PREFIX}${createHash8("sha256").update(origin).digest("hex").slice(0, 16)}`);
+  return join33(root, `${CACHE_PREFIX}${createHash8("sha256").update(origin).digest("hex").slice(0, 16)}`);
 }
 var inflight = /* @__PURE__ */ new Map();
 function serially(key, fn) {
@@ -22071,7 +22563,7 @@ function fetchable(url, checkout) {
 async function fetchIntoCache(git3, origin, cache6) {
   assertScratch(basename3(cache6));
   return serially(cache6, async () => {
-    if (!existsSync21(join32(cache6, "HEAD"))) {
+    if (!existsSync21(join33(cache6, "HEAD"))) {
       if (existsSync21(cache6) && readdirSync11(cache6).length > 0) return { ok: false, error: `${cache6} exists and is not behold's lifecycle cache; behold leaves it alone` };
       mkdirSync6(cache6, { recursive: true });
       const init = await git3(["init", "--bare", "-q", cache6]);
@@ -22259,7 +22751,7 @@ function structural(name, doc) {
 var compiledSchemas = /* @__PURE__ */ new Map();
 function schemaStamp(dist) {
   try {
-    const files = [join33(dist, "..", "package.json"), ...Object.values(SCHEMA_FILES).map((f) => join33(dist, f))];
+    const files = [join34(dist, "..", "package.json"), ...Object.values(SCHEMA_FILES).map((f) => join34(dist, f))];
     return [dist, ...files.map((f) => {
       const st = statSync10(f);
       return `${st.mtimeMs}:${st.size}`;
@@ -22269,10 +22761,10 @@ function schemaStamp(dist) {
   }
 }
 function compileSchemas(dist) {
-  const version = JSON.parse(readFileSync23(join33(dist, "..", "package.json"), "utf8")).version ?? "";
+  const version = JSON.parse(readFileSync24(join34(dist, "..", "package.json"), "utf8")).version ?? "";
   const ajv = new Ajv2020({ strict: false, allErrors: false });
   const compiled4 = Object.fromEntries(
-    Object.keys(SCHEMA_FILES).map((n) => [n, ajv.compile(JSON.parse(readFileSync23(join33(dist, SCHEMA_FILES[n]), "utf8")))])
+    Object.keys(SCHEMA_FILES).map((n) => [n, ajv.compile(JSON.parse(readFileSync24(join34(dist, SCHEMA_FILES[n]), "utf8")))])
   );
   return {
     validation: { by: "schema", terragucci: version },
@@ -22289,7 +22781,7 @@ function terragucciValidator(dirs = []) {
   for (const from of [...dirs, dirname10(fileURLToPath5(import.meta.url))]) {
     let entry;
     try {
-      entry = createRequire4(join33(resolve20(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
+      entry = createRequire4(join34(resolve20(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
     } catch {
       continue;
     }
@@ -22630,11 +23122,11 @@ function joinTerragucci(read, nodes, roots) {
 // src/terragucci-source.ts
 import { spawn as spawn7 } from "node:child_process";
 import { readFile } from "node:fs/promises";
-import { join as join34, resolve as resolve21 } from "node:path";
+import { join as join35, resolve as resolve21 } from "node:path";
 
 // src/s3-object.ts
 import { createHash as createHash9, createHmac } from "node:crypto";
-import { readFileSync as readFileSync24 } from "node:fs";
+import { readFileSync as readFileSync25 } from "node:fs";
 var S3Error = class extends Error {
   /** The HTTP status S3 answered, when it answered. */
   status;
@@ -22681,7 +23173,7 @@ function s3FromEnv(bucket, env = process.env) {
 async function assumeRole(w, fetchFn) {
   let token;
   try {
-    token = readFileSync24(w.tokenFile, "utf8").trim();
+    token = readFileSync25(w.tokenFile, "utf8").trim();
   } catch (e) {
     throw new S3Error(`cannot read the OIDC token in ${w.tokenFile}: ${e.message}`);
   }
@@ -22878,7 +23370,7 @@ function terragucciSource(spec2, opts = {}) {
     location: dir,
     async read(key) {
       try {
-        return await readFile(join34(dir, ...trim(key).split("/")), "utf8");
+        return await readFile(join35(dir, ...trim(key).split("/")), "utf8");
       } catch (e) {
         if (e.code === "ENOENT") return void 0;
         throw e;
@@ -22888,9 +23380,9 @@ function terragucciSource(spec2, opts = {}) {
 }
 
 // src/terragucci-timeline.ts
-import { readFileSync as readFileSync25, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync26, statSync as statSync11 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
-import { dirname as dirname11, join as join35, resolve as resolve22 } from "node:path";
+import { dirname as dirname11, join as join36, resolve as resolve22 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { Ajv2020 as Ajv20202 } from "ajv/dist/2020.js";
 var AUDIT_SCHEMA = "terragucci.audit/v1";
@@ -22931,12 +23423,12 @@ function auditValidator(dirs = []) {
   for (const from of [...dirs, dirname11(fileURLToPath6(import.meta.url))]) {
     let dist;
     try {
-      dist = dirname11(createRequire5(join35(resolve22(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
+      dist = dirname11(createRequire5(join36(resolve22(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
     } catch {
       continue;
     }
-    const pkg = join35(dist, "..", "package.json");
-    const file = join35(dist, AUDIT_SCHEMA_FILE);
+    const pkg = join36(dist, "..", "package.json");
+    const file = join36(dist, AUDIT_SCHEMA_FILE);
     let stamp;
     try {
       stamp = [dist, ...[pkg, file].map((f) => {
@@ -22950,8 +23442,8 @@ function auditValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync25(pkg, "utf8")).version ?? "";
-      v = compileAuditSchema(JSON.parse(readFileSync25(file, "utf8")), version);
+      const version = JSON.parse(readFileSync26(pkg, "utf8")).version ?? "";
+      v = compileAuditSchema(JSON.parse(readFileSync26(file, "utf8")), version);
     } catch {
       continue;
     }
@@ -23147,7 +23639,7 @@ function terragucciTimelineRoute(app, source2, opts = {}) {
 // src/terragucci-poll.ts
 import { createHash as createHash10 } from "node:crypto";
 import { stat } from "node:fs/promises";
-import { join as join36, resolve as resolve23 } from "node:path";
+import { join as join37, resolve as resolve23 } from "node:path";
 import { streamSSE } from "hono/streaming";
 var TERRAGUCCI_POLL_SECS = 30;
 var INDEX_KEY = "index.json";
@@ -23198,7 +23690,7 @@ function indexProbe(spec2, opts = {}) {
       return verdict2(prev, etag);
     };
   }
-  const file = join36(resolve23(opts.cwd ?? process.cwd(), spec2), name);
+  const file = join37(resolve23(opts.cwd ?? process.cwd(), spec2), name);
   return async (prev) => {
     try {
       const s = await stat(file);
@@ -23353,9 +23845,9 @@ function terragucciLaneRoutes(app, o, base, forget) {
 }
 
 // src/terragucci-progress.ts
-import { readFileSync as readFileSync26, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync27, statSync as statSync12 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import { dirname as dirname12, join as join37, resolve as resolve24 } from "node:path";
+import { dirname as dirname12, join as join38, resolve as resolve24 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { Ajv2020 as Ajv20203 } from "ajv/dist/2020.js";
 var RUN_SCHEMA = "terragucci.run/v1";
@@ -23400,12 +23892,12 @@ function runValidator(dirs = []) {
   for (const from of [...dirs, dirname12(fileURLToPath7(import.meta.url))]) {
     let dist;
     try {
-      dist = dirname12(createRequire6(join37(resolve24(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
+      dist = dirname12(createRequire6(join38(resolve24(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json"));
     } catch {
       continue;
     }
-    const pkg = join37(dist, "..", "package.json");
-    const file = join37(dist, RUN_SCHEMA_FILE);
+    const pkg = join38(dist, "..", "package.json");
+    const file = join38(dist, RUN_SCHEMA_FILE);
     let stamp;
     try {
       stamp = [dist, ...[pkg, file].map((f) => {
@@ -23419,8 +23911,8 @@ function runValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync26(pkg, "utf8")).version ?? "";
-      v = compileRunSchema(JSON.parse(readFileSync26(file, "utf8")), version);
+      const version = JSON.parse(readFileSync27(pkg, "utf8")).version ?? "";
+      v = compileRunSchema(JSON.parse(readFileSync27(file, "utf8")), version);
     } catch {
       continue;
     }
@@ -23713,11 +24205,12 @@ function terragucciProgressRoute(app, progress) {
 }
 
 // src/terragucci-demo.ts
-import { readFileSync as readFileSync27 } from "node:fs";
-import { join as join38 } from "node:path";
+import { readFileSync as readFileSync28 } from "node:fs";
+import { join as join39 } from "node:path";
 var DEMO_KEY = "demo.json";
 var DEMO_READ_TTL_MS = 2e3;
 var DEMO_STEPS = ["pull-request", "planned", "merged", "applying", "waiting", "approved", "failed", "resumed", "applied", "reset", "stalled"];
+var DEMO_ABOUT_FIELDS = ["changes", "watch", "shows"];
 var UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/;
 var isRecord17 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var str13 = (v) => typeof v === "string";
@@ -23737,6 +24230,10 @@ function demoProblem(doc) {
   }
   if (doc.pull !== null && !int(doc.pull)) return "pull is neither an integer nor null";
   if (doc.commit !== null && !str13(doc.commit)) return "commit is neither a string nor null";
+  if (doc.about !== void 0 && doc.about !== null) {
+    if (!isRecord17(doc.about)) return "about is neither an object nor null";
+    for (const f of DEMO_ABOUT_FIELDS) if (!str13(doc.about[f]) || !doc.about[f].trim()) return `about.${f} is not a non-empty string`;
+  }
   return void 0;
 }
 async function readDemo(source2, now = /* @__PURE__ */ new Date()) {
@@ -23771,7 +24268,8 @@ async function readDemo(source2, now = /* @__PURE__ */ new Date()) {
       started_at: d.started_at,
       next: d.next ? { action: d.next.action, at: d.next.at } : null,
       pull: d.pull,
-      commit: d.commit
+      commit: d.commit,
+      about: d.about ? { changes: d.about.changes, watch: d.about.watch, shows: d.about.shows } : null
     }
   };
 }
@@ -23792,7 +24290,7 @@ function kioskRoute(app, webRoot2, enabled) {
         404
       );
     }
-    return new Response(readFileSync27(join38(webRoot2, "kiosk.html"), "utf8"), { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
+    return new Response(readFileSync28(join39(webRoot2, "kiosk.html"), "utf8"), { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
   });
 }
 
@@ -23951,7 +24449,7 @@ function checkoutRoots(dirs, base = repoBase(dirs)) {
   for (const m of estateMembers(dirs)) {
     if (m.kind !== "terraform") continue;
     for (const r of discoverTerraformRoots(m.dir).roots) {
-      const path = relative8(base, join39(m.dir, r.dir)).split(sep7).join("/") || ".";
+      const path = relative8(base, join40(m.dir, r.dir)).split(sep7).join("/") || ".";
       out.push({ member: m.name, name: r.name, path });
     }
   }
@@ -24511,8 +25009,8 @@ function lifecycleHistoryRoute(app, base, opts = {}) {
 }
 
 // src/lifecycle-releases.ts
-import { existsSync as existsSync22, readFileSync as readFileSync28 } from "node:fs";
-import { join as join40 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync29 } from "node:fs";
+import { join as join41 } from "node:path";
 
 // node_modules/@intentius/chant/src/lifecycle/legacy-digest.ts
 import { resolve as resolve25 } from "node:path";
@@ -24625,10 +25123,10 @@ function memberNote(l) {
 // src/lifecycle-releases.ts
 var WAVES_SPEC_FILE = "yodel-waves.json";
 function waveOrder(checkout) {
-  const p = join40(checkout, WAVES_SPEC_FILE);
+  const p = join41(checkout, WAVES_SPEC_FILE);
   if (!existsSync22(p)) return void 0;
   try {
-    const doc = JSON.parse(readFileSync28(p, "utf8"));
+    const doc = JSON.parse(readFileSync29(p, "utf8"));
     const names = (doc.waves ?? []).map((w) => w?.name).filter((n) => typeof n === "string" && n.length > 0);
     return names.length ? [...new Set(names)] : void 0;
   } catch {
@@ -24636,7 +25134,7 @@ function waveOrder(checkout) {
   }
 }
 function hasReleaseLedgerHint(checkout) {
-  return existsSync22(join40(checkout, "yodel.config.ts")) || existsSync22(join40(checkout, WAVES_SPEC_FILE));
+  return existsSync22(join41(checkout, "yodel.config.ts")) || existsSync22(join41(checkout, WAVES_SPEC_FILE));
 }
 function orderEnvironments(envs, waves) {
   const seen = new Set(envs);
@@ -24678,7 +25176,7 @@ function releaseCells(ledgers, order, sources) {
 }
 async function copyCheckoutRef(git3, checkout, cache6) {
   assertScratch(cache6.split(/[\\/]/).pop());
-  if (!existsSync22(join40(cache6, "HEAD"))) {
+  if (!existsSync22(join41(cache6, "HEAD"))) {
     const init = await git3(["init", "--bare", "-q", cache6]);
     if (init.code !== 0) return false;
   }
@@ -24781,8 +25279,8 @@ function releasesRoutes(app, base, opts = {}) {
 }
 
 // src/sql-yodeler-lane.ts
-import { existsSync as existsSync23, readdirSync as readdirSync12, readFileSync as readFileSync29 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync23, readdirSync as readdirSync12, readFileSync as readFileSync30 } from "node:fs";
+import { join as join42 } from "node:path";
 var YODEL_APPLY_OP = "yodel-apply";
 var YODEL_HEAD_PLANS_DIR = headPlansPath(YODEL_APPLY_OP, "").dir;
 function parseYodelWaves(text, path = WAVES_SPEC_FILE) {
@@ -24814,16 +25312,16 @@ function parseYodelWaves(text, path = WAVES_SPEC_FILE) {
   return { path, waves };
 }
 function readYodelWaves(checkout) {
-  const p = join41(checkout, WAVES_SPEC_FILE);
+  const p = join42(checkout, WAVES_SPEC_FILE);
   if (!existsSync23(p)) return void 0;
   try {
-    return parseYodelWaves(readFileSync29(p, "utf8"));
+    return parseYodelWaves(readFileSync30(p, "utf8"));
   } catch (e) {
     return { path: WAVES_SPEC_FILE, waves: [], error: e instanceof Error ? e.message : String(e) };
   }
 }
 function migrateOpEnvironments(checkout) {
-  const dir = join41(checkout, "ops");
+  const dir = join42(checkout, "ops");
   if (!existsSync23(dir)) return [];
   try {
     return readdirSync12(dir).map((f) => /^migrate-(.+)\.op\.ts$/.exec(f)?.[1]).filter((e) => !!e).sort();
@@ -24946,16 +25444,16 @@ function sqlYodelerLaneRoute(app, checkout, opts = {}) {
 
 // src/terragucci-estate.ts
 init_yaml();
-import { existsSync as existsSync24, readFileSync as readFileSync30, statSync as statSync13 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync31, statSync as statSync13 } from "node:fs";
 import { createRequire as createRequire7 } from "node:module";
-import { dirname as dirname14, extname, join as join42, resolve as resolve26 } from "node:path";
+import { dirname as dirname14, extname, join as join43, resolve as resolve26 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { Ajv2020 as Ajv20204 } from "ajv/dist/2020.js";
 var RUN_SCHEMA2 = "terragucci.run/v1";
 function configProjects(file) {
   let text;
   try {
-    text = readFileSync30(file, "utf8");
+    text = readFileSync31(file, "utf8");
   } catch {
     return void 0;
   }
@@ -25006,16 +25504,16 @@ function runViewValidator(dirs = []) {
   for (const from of [...dirs, dirname14(fileURLToPath8(import.meta.url))]) {
     let entry;
     try {
-      entry = createRequire7(join42(resolve26(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
+      entry = createRequire7(join43(resolve26(from), "noop.js")).resolve("@intentius/terragucci/report.schema.json");
     } catch {
       continue;
     }
     const dist = dirname14(entry);
-    const schema = join42(dist, "run.schema.json");
+    const schema = join43(dist, "run.schema.json");
     let stamp;
     try {
       const st = statSync13(schema);
-      const pkg = statSync13(join42(dist, "..", "package.json"));
+      const pkg = statSync13(join43(dist, "..", "package.json"));
       stamp = `${schema}\0${st.mtimeMs}:${st.size}\0${pkg.mtimeMs}`;
     } catch {
       continue;
@@ -25024,8 +25522,8 @@ function runViewValidator(dirs = []) {
     if (hit) return hit;
     let v;
     try {
-      const version = JSON.parse(readFileSync30(join42(dist, "..", "package.json"), "utf8")).version ?? "";
-      const validate = new Ajv20204({ strict: false, allErrors: false }).compile(JSON.parse(readFileSync30(schema, "utf8")));
+      const version = JSON.parse(readFileSync31(join43(dist, "..", "package.json"), "utf8")).version ?? "";
+      const validate = new Ajv20204({ strict: false, allErrors: false }).compile(JSON.parse(readFileSync31(schema, "utf8")));
       v = {
         validation: { by: "schema", terragucci: version },
         check(doc) {
@@ -25080,8 +25578,8 @@ function controlEdges(views) {
 function siblingCheckout(project, base, projectOf = checkoutProject) {
   const name = project.split("/").filter(Boolean).pop();
   if (!name) return void 0;
-  const dir = join42(dirname14(resolve26(base)), name);
-  if (dir === resolve26(base) || !existsSync24(join42(dir, ".git"))) return void 0;
+  const dir = join43(dirname14(resolve26(base)), name);
+  if (dir === resolve26(base) || !existsSync24(join43(dir, ".git"))) return void 0;
   return projectOf(dir) === project ? dir : void 0;
 }
 var shellWord = (s) => /^[A-Za-z0-9_./:@%+=,-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
@@ -25288,9 +25786,9 @@ function controlRepoInfo(dirs) {
 }
 
 // src/yodel-report.ts
-import { readdirSync as readdirSync13, readFileSync as readFileSync31, statSync as statSync14 } from "node:fs";
+import { readdirSync as readdirSync13, readFileSync as readFileSync32, statSync as statSync14 } from "node:fs";
 import { createRequire as createRequire8 } from "node:module";
-import { basename as basename4, dirname as dirname15, join as join43, resolve as resolve27 } from "node:path";
+import { basename as basename4, dirname as dirname15, join as join44, resolve as resolve27 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { Ajv2020 as Ajv20205 } from "ajv/dist/2020.js";
 
@@ -25719,13 +26217,13 @@ var installed = /* @__PURE__ */ new Map();
 function packageRoot(from) {
   let entry;
   try {
-    entry = createRequire8(join43(resolve27(from), "noop.js")).resolve("@intentius/sql-yodeler");
+    entry = createRequire8(join44(resolve27(from), "noop.js")).resolve("@intentius/sql-yodeler");
   } catch {
     return void 0;
   }
   for (let d = dirname15(entry); d !== dirname15(d); d = dirname15(d)) {
     try {
-      const pkg = JSON.parse(readFileSync31(join43(d, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync32(join44(d, "package.json"), "utf8"));
       if (pkg.name === "@intentius/sql-yodeler") return d;
     } catch {
     }
@@ -25737,11 +26235,11 @@ function yodelValidator(dirs = []) {
     const root = packageRoot(from);
     if (!root) continue;
     try {
-      const version = JSON.parse(readFileSync31(join43(root, "package.json"), "utf8")).version ?? "";
+      const version = JSON.parse(readFileSync32(join44(root, "package.json"), "utf8")).version ?? "";
       const key = `${root}\0${version}`;
       let v = installed.get(key);
       if (!v) {
-        const load2 = (n) => JSON.parse(readFileSync31(join43(root, "schemas", `${n}.schema.json`), "utf8"));
+        const load2 = (n) => JSON.parse(readFileSync32(join44(root, "schemas", `${n}.schema.json`), "utf8"));
         v = compile({ common: load2("common"), report: load2("report"), drift: load2("drift") }, { by: "schema", from: "package", sqlYodeler: version });
         installed.set(key, v);
       }
@@ -25763,7 +26261,7 @@ function filesOf(source2) {
     return refuse14(`--yodel-report ${source2}: no such file or directory`, "Point --yodel-report at the file `yodel report --json` wrote, or the directory holding it.");
   }
   const dir = st.isDirectory() ? source2 : dirname15(source2);
-  const files = readdirSync13(dir).filter((f) => f.endsWith(".json")).sort().map((f) => join43(dir, f));
+  const files = readdirSync13(dir).filter((f) => f.endsWith(".json")).sort().map((f) => join44(dir, f));
   return st.isDirectory() ? { dir, files } : { dir, files, named: resolve27(source2) };
 }
 function readYodelReport(source2, validator2) {
@@ -25775,7 +26273,7 @@ function readYodelReport(source2, validator2) {
   for (const file of files) {
     let doc;
     try {
-      doc = JSON.parse(readFileSync31(file, "utf8"));
+      doc = JSON.parse(readFileSync32(file, "utf8"));
     } catch (e) {
       if (file === named) refuse14(`${basename4(file)} is not JSON: ${e instanceof Error ? e.message : String(e)}`, remedy);
       ignored.push(basename4(file));
@@ -25862,15 +26360,15 @@ function yodelReportRoute(app, source2, dirs) {
 
 // src/demo-pins.ts
 init_terraform_member();
-import { existsSync as existsSync25, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync32, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname16, join as join44, resolve as resolve28 } from "node:path";
+import { existsSync as existsSync25, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync33, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname16, join as join45, resolve as resolve28 } from "node:path";
 var isRecord21 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function linkDemoPins(work, probes = {}) {
-  const file = join44(work, "chant.workspace.json");
+  const file = join45(work, "chant.workspace.json");
   if (!existsSync25(file)) return { ok: true, linked: [] };
   let decl;
   try {
-    decl = JSON.parse(readFileSync32(file, "utf8"));
+    decl = JSON.parse(readFileSync33(file, "utf8"));
   } catch {
     return { ok: true, linked: [] };
   }
@@ -25893,7 +26391,7 @@ function linkDemoPins(work, probes = {}) {
         remedy: `Install ${pkg} beside behold, then load the demo again.`
       };
     }
-    const link = join44(work, "node_modules", ...pkg.split("/"));
+    const link = join45(work, "node_modules", ...pkg.split("/"));
     if (!present(link)) {
       mkdirSync7(dirname16(link), { recursive: true });
       symlinkSync2(found.dir, link, "junction");
@@ -25928,13 +26426,13 @@ function linksTo(link, target) {
 }
 
 // src/demos.ts
-import { readFileSync as readFileSync33, existsSync as existsSync26, cpSync, mkdirSync as mkdirSync8 } from "node:fs";
-import { dirname as dirname17, isAbsolute as isAbsolute5, join as join45, relative as relative9, resolve as resolve29, sep as sep8 } from "node:path";
+import { readFileSync as readFileSync34, existsSync as existsSync26, cpSync, mkdirSync as mkdirSync8 } from "node:fs";
+import { dirname as dirname17, isAbsolute as isAbsolute5, join as join46, relative as relative9, resolve as resolve29, sep as sep8 } from "node:path";
 import { spawn as spawn8, spawnSync as spawnSync3 } from "node:child_process";
 function readCatalog(file, catalog) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync33(file, "utf8"));
+    raw = JSON.parse(readFileSync34(file, "utf8"));
   } catch {
     return [];
   }
@@ -25974,10 +26472,10 @@ function validEntry(e) {
   return true;
 }
 function loadDemoRegistry(pkgRoot3) {
-  const merged = readCatalog(join45(pkgRoot3, "demos.json"), "demos");
+  const merged = readCatalog(join46(pkgRoot3, "demos.json"), "demos");
   const seen = new Set(merged.map((e) => e.name));
   const named = process.env.BEHOLD_WORKBENCH;
-  for (const e of [...readCatalog(join45(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve29(named), "workbench") : []]) {
+  for (const e of [...readCatalog(join46(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve29(named), "workbench") : []]) {
     if (seen.has(e.name)) {
       process.stderr.write(`behold: workbench entry "${e.name}" collides with a demo already in the catalog \u2014 dropped
 `);
@@ -26024,7 +26522,7 @@ async function loadDemo(entry, opts) {
     say(`serving ${work} where it is \u2014 nothing copied`);
   } else if (!existsSync26(target)) {
     if (entry.source === "bundled" || entry.source === "local" && local) {
-      const from = entry.source === "bundled" ? join45(pkgRoot3, entry.dir) : local;
+      const from = entry.source === "bundled" ? join46(pkgRoot3, entry.dir) : local;
       if (!existsSync26(from)) return { ok: false, error: entry.source === "bundled" ? `this install has no bundled ${entry.dir}` : `${entry.path} is not checked out (looked in ${from})` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
@@ -26056,7 +26554,7 @@ async function loadDemo(entry, opts) {
     if (!pins.ok) return { ok: false, error: `${pins.error} ${pins.remedy}` };
     for (const p of pins.linked) say(`linked ${p.pkg} ${p.version} into the copy${p.was ? ` (the declaration pinned ${p.was}; now ${p.version})` : ""}`);
   }
-  if (!inPlace && existsSync26(join45(work, "package.json")) && !existsSync26(join45(work, "node_modules"))) {
+  if (!inPlace && existsSync26(join46(work, "package.json")) && !existsSync26(join46(work, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: work, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${work}` };
@@ -26073,7 +26571,7 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join45(work, d)) : [work] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join46(work, d)) : [work] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
@@ -26084,8 +26582,8 @@ function runStep(cmd, args, opts = {}) {
 }
 
 // src/server.ts
-var pkgRoot = join46(dirname18(fileURLToPath10(import.meta.url)), "..");
-var webRoot = join46(pkgRoot, "web");
+var pkgRoot = join47(dirname18(fileURLToPath10(import.meta.url)), "..");
+var webRoot = join47(pkgRoot, "web");
 var execFileP = async (cmd, args) => (await promisify3(execFile5)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
@@ -26136,7 +26634,7 @@ function tierFailure(tier, message2) {
 function beholdVersion() {
   try {
     const here = dirname18(fileURLToPath10(import.meta.url));
-    return JSON.parse(readFileSync34(join46(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync35(join47(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -26183,7 +26681,7 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
   }
 }
 function carveRoutes(app, reportPath, demo) {
-  const load2 = () => readCarveReport(reportPath, (p) => readFileSync34(p, "utf8"));
+  const load2 = () => readCarveReport(reportPath, (p) => readFileSync35(p, "utf8"));
   const carveDirs = [dirname18(reportPath), ...demo ? [demo.out] : []];
   const carveStates = () => readCarveStates(carveDirs, nodeCarveIo, 0);
   const emittedNodes = async (states) => {
@@ -26589,8 +27087,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join46(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join46(cfg.projectDir, "scripts/local/local-up.sh");
+    const down = join47(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join47(cfg.projectDir, "scripts/local/local-up.sh");
     if (!existsSync27(down) || !existsSync27(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
@@ -26612,7 +27110,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const dirs = [];
     const declared = [];
     for (const f of discoverOpIrs(estateDirs)) {
-      const parsed = readOpIr(f.path, (p) => readFileSync34(p, "utf8"));
+      const parsed = readOpIr(f.path, (p) => readFileSync35(p, "utf8"));
       if (!parsed.ok) continue;
       const mine = declaredConvergeOps([parsed.ir]);
       if (!mine.length) continue;
@@ -26831,6 +27329,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       // #489: a terragucci repo is applied by its pipeline; the SPA offers no
       // write at all, and the write routes refuse with the same words.
       ...tgConfig() ? { terragucci: { config: tgConfig(), ...terragucciRefusal(tgConfig(), "deploying from behold") } } : {},
+      // #571: the repo declares its roots as components, so the page opens on
+      // the components zoom (web/app.js `bootZoom`).
+      ...servedTerragucciComponents() ? { terragucciComponents: true } : {},
       // #517: a SQL Yodeler repo is migrated by its pipeline; same contract.
       ...(() => {
         const r = guardedRepo();
@@ -26906,7 +27407,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const body = await c.req.json().catch(() => ({}));
     const dir = typeof body.dir === "string" && body.dir.trim() ? resolve30(body.dir.trim()) : "";
     if (!dir || !existsSync27(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync27(join46(dir, "chant.config.ts"))) {
+    if (!existsSync27(join47(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -27158,6 +27659,49 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       ]
     })
   );
+  const servedTerragucciComponents = () => (cfg.projectDirs?.length ?? 1) === 1 && memberKindOf(cfg.projectDir) === "terraform" ? readTerragucciComponents(cfg.projectDir) : void 0;
+  const terragucciResources = async (decl, opts) => {
+    try {
+      const entities = normalizeTerraformNodes(structuredClone(await memberIr(cfg.projectDir, { ...tierTargetOpts(opts), detail: 2 }, terraformVia)));
+      return resourcesByRoot(entities, componentRootMap(decl));
+    } catch {
+      return {};
+    }
+  };
+  const terragucciComponentsGraph = async (decl, opts) => {
+    const state = terraformReaderState();
+    if (state.refusal) throw new TerraformReadError(state.refusal, cfg.projectDir);
+    const { project } = terraformMemberProject(cfg.projectDir);
+    const ir = await componentGraphIr(project, tierTargetOpts(opts));
+    const titles = waveTitles(ir, decl);
+    const { svg } = renderGraph(ir, { waveTitles: titles });
+    const waves = Object.keys(ir.groups.byWave ?? {}).length;
+    const note = `${ir.nodes.length} root${ir.nodes.length === 1 ? "" : "s"} in ${waves} wave${waves === 1 ? "" : "s"}, from ${TERRAGUCCI_COMPONENTS_FILE}`;
+    return {
+      ir,
+      svg,
+      meta: {
+        projectDir: cfg.projectDir,
+        env: null,
+        tier: opts.tier ?? null,
+        target: opts.target ?? null,
+        components: true,
+        note,
+        // The CI facet's source on a terragucci repo: the declared jobs, not a
+        // chant-generated pipeline (`/api/ci`, which a public view refuses).
+        terragucciComponents: {
+          ...decl.pipeline.forge ? { forge: decl.pipeline.forge } : {},
+          ...decl.pipeline.path ? { pipeline: decl.pipeline.path } : {},
+          jobs: Object.values(componentJobs(decl)),
+          // component -> the root it applies: the live marks' join onto the
+          // reports' and run view's roots (web/terragucci-components-live.js).
+          roots: componentRootMap(decl),
+          waveTitles: titles,
+          resources: await terragucciResources(decl, opts)
+        }
+      }
+    };
+  };
   app.get("/api/graph", async (c) => {
     const url = new URL(c.req.url);
     const opts = optsFromQuery(url, tierEnvVar, cfg.projectDir);
@@ -27210,7 +27754,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const parsedOps = [];
         for (const f of files) {
-          const parsed = readOpIr(f.path, (p) => readFileSync34(p, "utf8"));
+          const parsed = readOpIr(f.path, (p) => readFileSync35(p, "utf8"));
           if (!parsed.ok) return c.json(parsed.refusal, 422);
           parsedOps.push(parsed.ir);
         }
@@ -27223,8 +27767,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const runState = runner.runState;
         const ranOp = runState.op ? parsedOps.find((o) => o.name === runState.op) : void 0;
-        const join51 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
-        const opsIr = join51 ? paintPlayhead(declaredIr, join51, runState.gate) : declaredIr;
+        const join52 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
+        const opsIr = join52 ? paintPlayhead(declaredIr, join52, runState.gate) : declaredIr;
         const { svg: svg2 } = renderGraph(opsIr, { boxes: "byStack" });
         const operator = runner.noteDeclaredConvergeOps(declaredConvergeOps(parsedOps));
         return c.json({
@@ -27237,7 +27781,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
             target: null,
             mode: "ops",
             ops: parsedOps.length,
-            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join51)} ${operatorNote(operator)}`,
+            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join52)} ${operatorNote(operator)}`,
             // The operator strip's own model: the ConvergeOps this project
             // declares, plus whatever the last status read said. `declared`
             // without a `strip` is the honest starting state — a loop exists and
@@ -27265,6 +27809,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         // workspace, so behold's own lexicon only speaks for a loose one.
         graph.edges.length === 0 && (multi ? cfg.projectDirs : [cfg.projectDir]).some((d) => memberKindOf(d) === "choudoufu" && !workspaceMemberOf(d)) ? choudoufuLexiconNote() : void 0
       );
+      const tgDecl = components ? servedTerragucciComponents() : void 0;
+      if (tgDecl) return c.json(await terragucciComponentsGraph(tgDecl, opts));
       let ir;
       let mode;
       let metaEnv = cfg.env ?? null;
@@ -27348,7 +27894,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync27(join46(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync27(join47(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -27490,6 +28036,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   app.get("/api/resources", async (c) => {
     const opts = optsFromQuery(new URL(c.req.url), tierEnvVar, cfg.projectDir);
     const env = opts.env ?? cfg.env;
+    const tgDecl = servedTerragucciComponents();
+    if (tgDecl) return c.json({ byComponent: await terragucciResources(tgDecl, opts) });
     const kind = memberKindOf(cfg.projectDir);
     if (kind && kind !== "chant") return c.json({ byComponent: {} });
     try {
@@ -27985,7 +28533,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (!c.req.path.startsWith("/api/") && c.res.ok && !c.res.headers.has("cache-control")) c.res.headers.set("cache-control", "no-cache");
   });
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join46(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join47(rel, "index.html") }));
   return app;
 }
 async function bootLocalEmulators(dir, who) {
@@ -28014,7 +28562,7 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync27(join46(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync27(join47(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -28188,8 +28736,8 @@ init_chant();
 
 // src/workspace-convert.ts
 init_chant();
-import { existsSync as existsSync28, mkdirSync as mkdirSync9, readFileSync as readFileSync35, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { basename as basename6, dirname as dirname19, join as join47, relative as relative11, resolve as resolve31, sep as sep10 } from "node:path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync9, readFileSync as readFileSync36, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { basename as basename6, dirname as dirname19, join as join48, relative as relative11, resolve as resolve31, sep as sep10 } from "node:path";
 import { shortStackNames as shortStackNames2 } from "@intentius/pinhole";
 init_project();
 init_terraform_member();
@@ -28207,10 +28755,10 @@ function unique(name, taken) {
 var posix4 = (p) => p.split(sep10).join("/");
 function installedVersion(pkg, dir) {
   for (let at2 = resolve31(dir); ; at2 = dirname19(at2)) {
-    const manifest = join47(at2, "node_modules", ...pkg.split("/"), "package.json");
+    const manifest = join48(at2, "node_modules", ...pkg.split("/"), "package.json");
     if (existsSync28(manifest)) {
       try {
-        const v = JSON.parse(readFileSync35(manifest, "utf8")).version;
+        const v = JSON.parse(readFileSync36(manifest, "utf8")).version;
         return typeof v === "string" ? v : void 0;
       } catch {
         return void 0;
@@ -28221,7 +28769,7 @@ function installedVersion(pkg, dir) {
 }
 function planConversion(rootArg) {
   const root = resolve31(rootArg);
-  const existing = DECLARATION_FILES.find((f) => existsSync28(join47(root, f)));
+  const existing = DECLARATION_FILES.find((f) => existsSync28(join48(root, f)));
   if (existing) return { ok: false, error: `${root} already has ${existing}; there is nothing to convert.` };
   const shape = detectProjectShape(root);
   if (shape.kind !== "estate" || !shape.members?.length || shape.membersFrom === "itself") {
@@ -28242,10 +28790,10 @@ function planConversion(rootArg) {
       const scan = discoverTerraformRoots(abs[i]);
       for (const r of scan.roots) {
         const name2 = unique(declarationName(r.name), taken);
-        members.push({ name: name2, dir: r.dir === "." ? dir : posix4(join47(dir, r.dir)), kind: "terraform" });
+        members.push({ name: name2, dir: r.dir === "." ? dir : posix4(join48(dir, r.dir)), kind: "terraform" });
         moves.push({ from: `${short}/${r.name}/`, to: `${name2}/${name2}/` });
       }
-      for (const s of scan.skipped) notes.push(`${posix4(join47(dir, s.dir))} is not declared: ${s.why}.`);
+      for (const s of scan.skipped) notes.push(`${posix4(join48(dir, s.dir))} is not declared: ${s.why}.`);
       if (scan.roots.length > 1) notes.push(`${dir} held ${scan.roots.length} Terraform roots; each is its own member now, since a chant terraform member is one root.`);
       return;
     }
@@ -28288,7 +28836,7 @@ function moveLayoutIds(file, moves) {
   return { version: 1, lenses };
 }
 function applyConversion(plan) {
-  const declarationFile = join47(plan.root, DECLARATION_FILES[0]);
+  const declarationFile = join48(plan.root, DECLARATION_FILES[0]);
   if (existsSync28(declarationFile)) throw new Error(`${declarationFile} appeared while converting; nothing was written`);
   writeFileSync7(declarationFile, `${JSON.stringify(plan.declaration, null, 2)}
 `);
@@ -28299,7 +28847,7 @@ function applyConversion(plan) {
   else if (existsSync28(target)) layout = { skipped: `${target} already exists; the layout in ${plan.layoutFrom} was left alone` };
   else {
     const moved = moveLayoutIds(readLayoutFile(dirname19(dirname19(plan.layoutFrom))), plan.moves);
-    mkdirSync9(join47(plan.root, LAYOUT_DIR), { recursive: true });
+    mkdirSync9(join48(plan.root, LAYOUT_DIR), { recursive: true });
     const tmp = `${target}.tmp`;
     writeFileSync7(tmp, `${JSON.stringify(moved, null, 2)}
 `);
@@ -28310,9 +28858,9 @@ function applyConversion(plan) {
 }
 
 // src/export.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, copyFileSync, cpSync as cpSync2, readFileSync as readFileSync36, readdirSync as readdirSync14, existsSync as existsSync29, realpathSync as realpathSync2 } from "node:fs";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, copyFileSync, cpSync as cpSync2, readFileSync as readFileSync37, readdirSync as readdirSync14, existsSync as existsSync29, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join48, dirname as dirname20, basename as basename7, relative as relative12, resolve as resolve32, sep as sep11 } from "node:path";
+import { join as join49, dirname as dirname20, basename as basename7, relative as relative12, resolve as resolve32, sep as sep11 } from "node:path";
 import { createHash as createHash11 } from "node:crypto";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 var LENS_PARAMS = ["collapse", "components", "detail", "env", "logical", "ops", "radial", "stacks", "tier"];
@@ -28369,24 +28917,24 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join48(dirname20(fileURLToPath11(import.meta.url)), "..", "web");
+  return join49(dirname20(fileURLToPath11(import.meta.url)), "..", "web");
 }
 function pkgRoot2() {
-  return join48(dirname20(fileURLToPath11(import.meta.url)), "..");
+  return join49(dirname20(fileURLToPath11(import.meta.url)), "..");
 }
 var NOTICE_FILES = ["LICENSE", "THIRD_PARTY.md"];
 function copyNotices(outDir, root = pkgRoot2()) {
   const copied = [];
   for (const f of NOTICE_FILES) {
-    if (!existsSync29(join48(root, f))) continue;
-    copyFileSync(join48(root, f), join48(outDir, f));
+    if (!existsSync29(join49(root, f))) continue;
+    copyFileSync(join49(root, f), join49(outDir, f));
     copied.push(f);
   }
-  const lic = join48(root, "licenses");
+  const lic = join49(root, "licenses");
   if (existsSync29(lic)) {
-    mkdirSync10(join48(outDir, "licenses"), { recursive: true });
+    mkdirSync10(join49(outDir, "licenses"), { recursive: true });
     for (const f of readdirSync14(lic)) {
-      copyFileSync(join48(lic, f), join48(outDir, "licenses", f));
+      copyFileSync(join49(lic, f), join49(outDir, "licenses", f));
       copied.push(`licenses/${f}`);
     }
   }
@@ -28411,7 +28959,7 @@ async function runExport(cfg, outDir, opts = {}) {
     ...proj.sqlYodeler ? { sqlYodeler: true } : {}
   };
   const scrub = exportScrubber(cfg);
-  const snapDir = join48(outDir, "snapshots");
+  const snapDir = join49(outDir, "snapshots");
   mkdirSync10(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
@@ -28420,7 +28968,7 @@ async function runExport(cfg, outDir, opts = {}) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = scrub(shapeSnapshot(key, await res.text(), opts));
     const file = slug3(key, body);
-    writeFileSync8(join48(snapDir, file), body);
+    writeFileSync8(join49(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -28442,29 +28990,29 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync8(join48(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync36(join48(webDir(), "index.html"), "utf8").replace(
+  writeFileSync8(join49(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync37(join49(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync8(join48(outDir, "index.html"), html);
+  writeFileSync8(join49(outDir, "index.html"), html);
   for (const f of readdirSync14(webDir())) {
     if (f === "index.html" || f.endsWith(".test.js")) continue;
-    cpSync2(join48(webDir(), f), join48(outDir, f), { recursive: true });
+    cpSync2(join49(webDir(), f), join49(outDir, f), { recursive: true });
   }
-  writeFileSync8(join48(outDir, "README.md"), BUNDLE_README);
+  writeFileSync8(join49(outDir, "README.md"), BUNDLE_README);
   copyNotices(outDir);
   const name = workerName(cfg.projectDir, opts.name);
   writeFileSync8(
-    join48(outDir, "wrangler.jsonc"),
+    join49(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
       2
     ) + "\n"
   );
-  writeFileSync8(join48(outDir, "manifest.json"), JSON.stringify({ ...manifest, files: bundleFiles(outDir).filter((f) => f !== "manifest.json") }, null, 2));
+  writeFileSync8(join49(outDir, "manifest.json"), JSON.stringify({ ...manifest, files: bundleFiles(outDir).filter((f) => f !== "manifest.json") }, null, 2));
   process.stdout.write(
     `behold export \u2192 ${outDir}
   ${ok} snapshots${failed ? ` (${failed} endpoint error(s) captured as-is)` : ""}
@@ -28561,7 +29109,7 @@ function manifestFiles(text) {
   return Object.values(map).filter((f) => typeof f === "string" && /^snapshots\/[A-Za-z0-9=_.-]+$/.test(f) && !f.includes(".."));
 }
 function bundleFiles(outDir) {
-  return readdirSync14(outDir, { recursive: true, withFileTypes: true }).filter((d) => d.isFile()).map((d) => relative12(outDir, join48(d.parentPath, d.name)).split(sep11).join("/")).sort();
+  return readdirSync14(outDir, { recursive: true, withFileTypes: true }).filter((d) => d.isFile()).map((d) => relative12(outDir, join49(d.parentPath, d.name)).split(sep11).join("/")).sort();
 }
 async function publishBundle(outDir, target, client) {
   const files = bundleFiles(outDir);
@@ -28577,7 +29125,7 @@ async function publishBundle(outDir, target, client) {
   }
   const last = ["manifest.json", "index.html"];
   const order = [...files.filter((f) => !last.includes(f)), ...last.filter((f) => files.includes(f))];
-  for (const f of order) await client.put(at2(f), readFileSync36(join48(outDir, f)), contentType(f), CONTENT_ADDRESSED.test(f) ? IMMUTABLE : NO_CACHE);
+  for (const f of order) await client.put(at2(f), readFileSync37(join49(outDir, f)), contentType(f), CONTENT_ADDRESSED.test(f) ? IMMUTABLE : NO_CACHE);
   const wrote = new Set(files);
   const removed = [];
   for (const f of previous) {
@@ -28629,8 +29177,8 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 
 // src/publish-snapshots.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { readFileSync as readFileSync37 } from "node:fs";
-import { join as join49 } from "node:path";
+import { readFileSync as readFileSync38 } from "node:fs";
+import { join as join50 } from "node:path";
 var DEFAULT_KEEP = 30;
 var SNAPSHOT_REPORTS_BASE = "../../../";
 var COMMIT = /^[0-9a-f]{7,64}$/;
@@ -28718,7 +29266,7 @@ async function publishSnapshot(outDir, target, commit, client, opts = {}) {
   const keep = opts.keep ?? DEFAULT_KEEP;
   if (!Number.isInteger(keep) || keep < 1) throw new Error(`--keep takes a whole number of at least 1, not ${keep}`);
   const at2 = (f) => `${target.prefix}/${f}`;
-  const local = JSON.parse(readFileSync37(join49(outDir, "manifest.json"), "utf8"));
+  const local = JSON.parse(readFileSync38(join50(outDir, "manifest.json"), "utf8"));
   const generated = local.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const entry = { commit: sha, at: commit.at ?? generated, project: opts.project ?? local.projectDir ?? "", generated };
   const bundle = await publishBundle(outDir, { bucket: target.bucket, prefix: at2(sha) }, client);
@@ -29181,7 +29729,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join50(dir, m.dir)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join51(dir, m.dir)).join(" ")}
 `
     );
     return;
@@ -29217,7 +29765,7 @@ async function runCarve(rest) {
     process.exit(2);
   }
   const reportPath = resolve33(fileArg);
-  const parsed = readCarveReport(reportPath, (p) => readFileSync38(p, "utf8"));
+  const parsed = readCarveReport(reportPath, (p) => readFileSync39(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
   ${parsed.refusal.remedy}
@@ -29283,7 +29831,7 @@ ${check.stdout || check.stderr}
   if (check.code !== 0) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot3 = join50(dirname21(fileURLToPath12(import.meta.url)), "..");
+  const pkgRoot3 = join51(dirname21(fileURLToPath12(import.meta.url)), "..");
   const registry2 = loadDemoRegistry(pkgRoot3);
   let port = 4600;
   let live2 = false;
@@ -29418,7 +29966,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     };
     process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
   }
-  if (existsSync30(join50(project, "package.json")) && !existsSync30(join50(project, "node_modules"))) {
+  if (existsSync30(join51(project, "package.json")) && !existsSync30(join51(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -29429,7 +29977,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     }
   }
   let degraded;
-  if (!existsSync30(join50(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
+  if (!existsSync30(join51(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
     process.stdout.write(`behold demo carve \u2192 npm install ${HCL_PARSER_PKG} (chant's HCL parser, ~2MB, once)\u2026
 `);
     const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", HCL_PARSER_PKG], target);