@intentius/behold 0.7.0 → 0.9.0

package/dist/cli.js

@@ -1,8 +1,1047 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// node_modules/@intentius/chant-k8s-client/src/errors.ts
+function firstLine(text, max = 300) {
+  const line = text.split("\n").find((l) => l.trim().length > 0)?.trim();
+  if (!line) return void 0;
+  return line.length > max ? `${line.slice(0, max - 3)}...` : line;
+}
+var K8sApiError, K8sTransportError, K8sClientUnavailableError, ExecCredentialNotAllowedError, FieldManagerError, KubeConfigError, UnknownResourceError;
+var init_errors = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/errors.ts"() {
+    K8sApiError = class _K8sApiError extends Error {
+      constructor(statusCode, reason, apiMessage, target, status) {
+        super(
+          `${target ? `${target}: ` : ""}${apiMessage || "request failed"} (HTTP ${statusCode}${reason ? `, ${reason}` : ""})`
+        );
+        this.statusCode = statusCode;
+        this.reason = reason;
+        this.apiMessage = apiMessage;
+        this.target = target;
+        this.status = status;
+        this.name = "K8sApiError";
+      }
+      statusCode;
+      reason;
+      apiMessage;
+      target;
+      status;
+      /**
+       * Which cluster the failing read actually talked to, e.g.
+       * `context "k3d-fountain-local" (bound by k8s.profiles.local.context)`.
+       * Stamped by the client that issued the request (chant #1488) — a
+       * `read-failed` that does not name the cluster it read cost an afternoon on
+       * a laptop with two k3d clusters, so the failure carries it from birth.
+       */
+      contextNote;
+      /** The object is not there. The only failure that establishes absence. */
+      get notFound() {
+        return this.statusCode === 404 || this.reason === "NotFound";
+      }
+      /** RBAC denied the read. Proves nothing about whether the object exists. */
+      get forbidden() {
+        return this.statusCode === 403 || this.reason === "Forbidden";
+      }
+      /** No usable credentials for this cluster. */
+      get unauthorized() {
+        return this.statusCode === 401 || this.reason === "Unauthorized";
+      }
+      /**
+       * Server-side-apply field-ownership conflict. `./conflict.ts`'s
+       * {@link import("./conflict").FieldManagerConflictError} is the presented
+       * form (chant #1075); this predicate still answers for both.
+       */
+      get conflict() {
+        return this.statusCode === 409 || this.reason === "Conflict";
+      }
+      /**
+       * Build from a raw response body, which is a `Status` on every well-behaved
+       * Kubernetes error and occasionally plain text from a proxy in front of one.
+       */
+      static fromResponse(statusCode, body, target) {
+        let status;
+        try {
+          const parsed = JSON.parse(body);
+          if (parsed && typeof parsed === "object" && parsed.kind === "Status") {
+            status = parsed;
+          }
+        } catch {
+        }
+        const message = status?.message ?? firstLine(body) ?? "";
+        return new _K8sApiError(statusCode, status?.reason, message, target, status);
+      }
+    };
+    K8sTransportError = class extends Error {
+      constructor(message, target, options) {
+        super(target ? `${target}: ${message}` : message);
+        this.target = target;
+        this.name = "K8sTransportError";
+        if (options && "cause" in options) this.cause = options.cause;
+      }
+      target;
+      /** Which cluster context the failed request was aimed at — see {@link K8sApiError.contextNote}. */
+      contextNote;
+    };
+    K8sClientUnavailableError = class extends Error {
+      constructor(cause) {
+        super(
+          "the Kubernetes API client is unavailable \u2014 @kubernetes/client-node could not be loaded. Install it with `npm i @intentius/chant-k8s-client` (it is an optional dependency of @intentius/chant-lexicon-k8s, so `--omit=optional` installs skip it)."
+        );
+        this.name = "K8sClientUnavailableError";
+        if (cause !== void 0) this.cause = cause;
+      }
+    };
+    ExecCredentialNotAllowedError = class extends Error {
+      constructor(command, allowed) {
+        super(
+          `k8s: the kubeconfig for this context authenticates with the exec credential plugin "${command}", which is not on chant's allowlist (${allowed.join(", ")}). An exec plugin is an arbitrary binary named in a file chant did not write. If "${command}" is expected, add it to k8s.execCredentialPlugins in chant.config.ts.`
+        );
+        this.command = command;
+        this.allowed = allowed;
+        this.name = "ExecCredentialNotAllowedError";
+      }
+      command;
+      allowed;
+    };
+    FieldManagerError = class extends Error {
+      constructor(message) {
+        super(`k8s: ${message}`);
+        this.name = "FieldManagerError";
+      }
+    };
+    KubeConfigError = class extends Error {
+      constructor(message) {
+        super(`k8s: ${message}`);
+        this.name = "KubeConfigError";
+      }
+    };
+    UnknownResourceError = class extends Error {
+      constructor(selectorText2, message) {
+        super(message ?? `k8s: the cluster's API discovery reports no resource matching "${selectorText2}"`);
+        this.selectorText = selectorText2;
+        this.name = "UnknownResourceError";
+      }
+      selectorText;
+    };
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/credentials.ts
+function execConfigOf(user) {
+  if (!user) return void 0;
+  if (user.exec) return user.exec;
+  const providerExec = user.authProvider?.config?.exec;
+  if (providerExec) return providerExec;
+  return void 0;
+}
+function execCommandName(command) {
+  const base = command.split(/[\\/]/).pop() ?? command;
+  return base.replace(/\.(exe|cmd|bat)$/i, "");
+}
+function assertExecCredentialAllowed(user, allowlist = DEFAULT_EXEC_ALLOWLIST) {
+  const exec = execConfigOf(user);
+  if (!exec?.command) return;
+  const name = execCommandName(exec.command);
+  if (allowlist.some((entry) => execCommandName(entry) === name)) return;
+  throw new ExecCredentialNotAllowedError(exec.command, allowlist);
+}
+function credentialPathOf(user) {
+  const exec = execConfigOf(user);
+  if (exec?.command) return { credential: "exec-plugin", execCommand: exec.command };
+  if (user?.authProvider?.name) return { credential: "auth-provider" };
+  if (user?.token) return { credential: "token" };
+  if (user?.certData || user?.certFile) return { credential: "client-certificate" };
+  if (user?.username) return { credential: "basic-auth" };
+  return { credential: "none" };
+}
+var DEFAULT_EXEC_ALLOWLIST;
+var init_credentials = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/credentials.ts"() {
+    init_errors();
+    DEFAULT_EXEC_ALLOWLIST = [
+      "aws",
+      // EKS — `aws eks get-token`
+      "aws-iam-authenticator",
+      // EKS, pre-`aws eks get-token`
+      "gke-gcloud-auth-plugin",
+      // GKE
+      "kubelogin",
+      // AKS
+      "kubectl"
+      // OIDC via `kubectl oidc-login`, and k3d/kind setups
+    ];
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/conflict.ts
+function renderConflictReport(report) {
+  const { conflicts, fieldManager, target } = report;
+  const subject = target ? `${target}` : "this object";
+  if (conflicts.length === 0) {
+    return `k8s: server-side apply of ${subject} was refused with a field-ownership conflict, but the API server reported no field causes${report.apiMessage ? ` \u2014 it said: ${report.apiMessage}` : ""}. chant applied as field manager "${fieldManager}".`;
+  }
+  const grouped = /* @__PURE__ */ new Map();
+  for (const conflict of conflicts) {
+    const list3 = grouped.get(conflict.manager) ?? [];
+    if (!list3.includes(conflict.field)) list3.push(conflict.field);
+    grouped.set(conflict.manager, list3);
+  }
+  const count = new Set(conflicts.map((c) => c.field)).size;
+  const lines = [
+    `k8s: server-side apply of ${subject} was refused \u2014 ${count} ${count === 1 ? "field is" : "fields are"} owned by another field manager.`,
+    ""
+  ];
+  for (const [manager, fields] of [...grouped].sort(([a], [b]) => a.localeCompare(b))) {
+    lines.push(`  "${manager}" owns:`);
+    for (const field of [...fields].sort()) lines.push(`    ${field}`);
+  }
+  lines.push(
+    "",
+    `chant applied as field manager "${fieldManager}". Taking these fields means the managers above`,
+    `stop owning them, and will contest them again on their next apply.`,
+    "",
+    "chant does not force this for you. Either:",
+    "  - remove the contested fields from your chant source, leaving them to their current owner; or",
+    "  - re-run this apply with force-conflicts on, deliberately (the `force: true` activity argument,",
+    "    or `forceConflicts: true` on ApplyOp), which transfers ownership to chant."
+  );
+  return lines.join("\n");
+}
+function parseFieldConflicts(status, message) {
+  const fromCauses = causesOf(status);
+  if (fromCauses.length > 0) return fromCauses;
+  return parseConflictMessage(message ?? status?.message ?? "");
+}
+function causesOf(status) {
+  const details = status?.details;
+  if (!details || typeof details !== "object") return [];
+  const causes = details.causes;
+  if (!Array.isArray(causes)) return [];
+  const out = [];
+  for (const raw of causes) {
+    if (!raw || typeof raw !== "object") continue;
+    if (raw.type !== void 0 && raw.type !== "FieldManagerConflict") continue;
+    const field = typeof raw.field === "string" ? raw.field : void 0;
+    if (!field) continue;
+    const { manager, apiVersion } = parseCauseMessage(raw.message ?? "");
+    out.push({
+      manager: manager ?? "an unnamed manager",
+      field,
+      ...apiVersion ? { apiVersion } : {}
+    });
+  }
+  return out;
+}
+function parseCauseMessage(message) {
+  const manager = /conflicts? with "([^"]+)"/.exec(message)?.[1];
+  const apiVersion = /\busing ([^\s:]+)\b/.exec(message)?.[1];
+  return { ...manager ? { manager } : {}, ...apiVersion ? { apiVersion } : {} };
+}
+function parseConflictMessage(message) {
+  if (!message) return [];
+  const out = [];
+  let manager;
+  let apiVersion;
+  for (const rawLine of message.split("\n")) {
+    const line = rawLine.trim();
+    if (line.length === 0) continue;
+    const header = /conflicts? with "([^"]+)"(?: using ([^\s:]+))?/.exec(line);
+    if (header) {
+      manager = header[1];
+      apiVersion = header[2];
+      const inline = /:\s*(\.[^\s]+)$/.exec(line);
+      if (inline) out.push({ manager, field: inline[1], ...apiVersion ? { apiVersion } : {} });
+      continue;
+    }
+    const bullet = /^-\s*(\S.*)$/.exec(line);
+    if (bullet && manager) {
+      out.push({ manager, field: bullet[1].trim(), ...apiVersion ? { apiVersion } : {} });
+    }
+  }
+  return out;
+}
+function asFieldManagerConflict(error, fieldManager) {
+  if (!(error instanceof K8sApiError) || !error.conflict) return error;
+  if (error instanceof FieldManagerConflictError) return error;
+  return new FieldManagerConflictError(
+    error.statusCode,
+    error.apiMessage,
+    parseFieldConflicts(error.status, error.apiMessage),
+    fieldManager,
+    error.target,
+    error.status
+  );
+}
+var FieldManagerConflictError;
+var init_conflict = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/conflict.ts"() {
+    init_errors();
+    FieldManagerConflictError = class extends K8sApiError {
+      /** Every contested field, in the order the server reported them. */
+      conflicts;
+      /** The field manager chant applied as, and which was refused. */
+      fieldManager;
+      constructor(statusCode, apiMessage, conflicts, fieldManager, target, status) {
+        super(statusCode, status?.reason ?? "Conflict", apiMessage, target, status);
+        this.name = "FieldManagerConflictError";
+        this.conflicts = conflicts;
+        this.fieldManager = fieldManager;
+        this.message = renderConflictReport({ conflicts, fieldManager, target, apiMessage });
+      }
+      /** Contested paths grouped by the manager that owns them, managers sorted. */
+      get byManager() {
+        const grouped = {};
+        for (const conflict of this.conflicts) {
+          (grouped[conflict.manager] ??= []).push(conflict.field);
+        }
+        return Object.fromEntries(
+          Object.entries(grouped).sort(([a], [b]) => a.localeCompare(b)).map(([manager, fields]) => [manager, [...fields].sort()])
+        );
+      }
+      /** The competing managers, sorted. */
+      get managers() {
+        return Object.keys(this.byManager);
+      }
+      /** The contested paths, sorted and deduplicated. */
+      get fields() {
+        return [...new Set(this.conflicts.map((c) => c.field))].sort();
+      }
+    };
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/field-manager.ts
+function fieldManagerFor(identity) {
+  const stack = identity?.stack?.trim();
+  if (!stack) return CHANT_FIELD_MANAGER;
+  const manager = `${CHANT_FIELD_MANAGER}${FIELD_MANAGER_SEPARATOR}${stack}`;
+  assertValidFieldManager(manager, stack);
+  return manager;
+}
+function assertValidFieldManager(manager, stack) {
+  const source = stack === void 0 ? `field manager "${manager}"` : `ownership.stack "${stack}"`;
+  if (manager.length === 0) {
+    throw new FieldManagerError(`${source} produces an empty field manager, which the API server rejects`);
+  }
+  if (manager.length > FIELD_MANAGER_MAX_LENGTH) {
+    throw new FieldManagerError(
+      `${source} produces the field manager "${manager}" (${manager.length} characters), over the API server's ${FIELD_MANAGER_MAX_LENGTH}-character limit`
+    );
+  }
+  const badIndex = [...manager].findIndex((ch) => {
+    const code = ch.codePointAt(0) ?? 0;
+    return code <= 32 || code === 127;
+  });
+  if (badIndex !== -1) {
+    throw new FieldManagerError(
+      `${source} produces the field manager "${manager}", which contains whitespace or a control character at position ${badIndex}. A field manager is an identity recorded on every object chant applies; keep it to printable, space-free text.`
+    );
+  }
+}
+function isChantFieldManager(manager) {
+  if (!manager) return false;
+  return manager === CHANT_FIELD_MANAGER || manager.startsWith(`${CHANT_FIELD_MANAGER}${FIELD_MANAGER_SEPARATOR}`);
+}
+function chantStackOf(manager) {
+  if (!manager || !isChantFieldManager(manager)) return void 0;
+  const stack = manager.slice(CHANT_FIELD_MANAGER.length + FIELD_MANAGER_SEPARATOR.length);
+  return stack.length > 0 ? stack : void 0;
+}
+var CHANT_FIELD_MANAGER, FIELD_MANAGER_SEPARATOR, FIELD_MANAGER_MAX_LENGTH;
+var init_field_manager = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/field-manager.ts"() {
+    init_errors();
+    CHANT_FIELD_MANAGER = "chant";
+    FIELD_MANAGER_SEPARATOR = ":";
+    FIELD_MANAGER_MAX_LENGTH = 128;
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/concurrency.ts
+async function mapConcurrent(items, fn, limit = DEFAULT_CONCURRENCY) {
+  const width = Math.max(1, Math.min(limit, items.length));
+  const results = new Array(items.length);
+  let next = 0;
+  async function worker() {
+    while (true) {
+      const index = next++;
+      if (index >= items.length) return;
+      results[index] = await fn(items[index], index);
+    }
+  }
+  await Promise.all(Array.from({ length: width }, () => worker()));
+  return results;
+}
+var DEFAULT_CONCURRENCY;
+var init_concurrency = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/concurrency.ts"() {
+    DEFAULT_CONCURRENCY = 8;
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/kubeconfig.ts
+import { delimiter } from "node:path";
+function kubeconfigPathList() {
+  const raw = process.env.KUBECONFIG;
+  if (!raw) return [];
+  return raw.split(delimiter).filter((f) => f.length > 0);
+}
+function mergeKubeconfigFiles(mod, files) {
+  const clusters = [];
+  const users = [];
+  const contexts = [];
+  const seenClusters = /* @__PURE__ */ new Set();
+  const seenUsers = /* @__PURE__ */ new Set();
+  const seenContexts = /* @__PURE__ */ new Set();
+  let currentContext;
+  for (const file of files) {
+    const part = new mod.KubeConfig();
+    try {
+      part.loadFromFile(file);
+    } catch {
+      continue;
+    }
+    for (const cluster of part.getClusters()) {
+      if (seenClusters.has(cluster.name)) continue;
+      seenClusters.add(cluster.name);
+      clusters.push(cluster);
+    }
+    for (const user of part.getUsers()) {
+      if (seenUsers.has(user.name)) continue;
+      seenUsers.add(user.name);
+      users.push(user);
+    }
+    for (const context of part.getContexts()) {
+      if (seenContexts.has(context.name)) continue;
+      seenContexts.add(context.name);
+      contexts.push(context);
+    }
+    if (currentContext === void 0) {
+      const current = part.getCurrentContext();
+      if (current) currentContext = current;
+    }
+  }
+  const kc = new mod.KubeConfig();
+  kc.loadFromOptions({ clusters, users, contexts, currentContext });
+  return kc;
+}
+function loadKubeConfig(mod, options = {}) {
+  if (options.kubeconfig !== void 0) {
+    const kc2 = new mod.KubeConfig();
+    kc2.loadFromString(options.kubeconfig);
+    return { kc: kc2, source: "explicit-string" };
+  }
+  if (options.kubeconfigPath !== void 0) {
+    const kc2 = new mod.KubeConfig();
+    kc2.loadFromFile(options.kubeconfigPath);
+    return { kc: kc2, source: "explicit-path" };
+  }
+  const files = kubeconfigPathList();
+  if (files.length > 1) return { kc: mergeKubeconfigFiles(mod, files), source: "default" };
+  const kc = new mod.KubeConfig();
+  kc.loadFromDefault(void 0, true);
+  return { kc, source: kc.getCurrentContext() === "inCluster" ? "in-cluster" : "default" };
+}
+var init_kubeconfig = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/kubeconfig.ts"() {
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/client.ts
+async function loadClientNode() {
+  if (!clientNodeModule) {
+    clientNodeModule = import("@kubernetes/client-node").catch((err) => {
+      clientNodeModule = void 0;
+      throw new K8sClientUnavailableError(err);
+    });
+  }
+  return clientNodeModule;
+}
+async function isK8sClientAvailable() {
+  try {
+    await loadClientNode();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readAmbientContext(options = {}) {
+  try {
+    const { kc } = loadKubeConfig(await loadClientNode(), options);
+    return kc.getCurrentContext() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readKubeconfigView(options = {}) {
+  let kc;
+  try {
+    ({ kc } = loadKubeConfig(await loadClientNode(), options));
+  } catch {
+    return { contexts: [] };
+  }
+  try {
+    const servers = /* @__PURE__ */ new Map();
+    for (const cluster of kc.getClusters()) servers.set(cluster.name, cluster.server || void 0);
+    const contexts = kc.getContexts().map((context) => {
+      const server = servers.get(context.cluster);
+      return {
+        name: context.name,
+        cluster: context.cluster ?? "",
+        ...context.user ? { user: context.user } : {},
+        ...context.namespace ? { namespace: context.namespace } : {},
+        ...server ? { server } : {}
+      };
+    });
+    return { contexts, ...kc.getCurrentContext() ? { currentContext: kc.getCurrentContext() } : {} };
+  } catch {
+    return { contexts: [] };
+  }
+}
+async function createK8sClient(options = {}) {
+  const mod = await loadClientNode();
+  const { kc, source: kubeconfigSource } = loadKubeConfig(mod, options);
+  if (options.context !== void 0) {
+    if (!kc.getContextObject(options.context)) {
+      const known = kc.getContexts().map((c) => c.name);
+      throw new KubeConfigError(
+        `the kubeconfig has no context named "${options.context}" (it has ${known.length > 0 ? known.map((n) => `"${n}"`).join(", ") : "no contexts at all"}). This is the context the environment is bound to via k8s.profiles.<env>.context.`
+      );
+    }
+    kc.setCurrentContext(options.context);
+  }
+  const cluster = kc.getCurrentCluster();
+  if (!cluster) {
+    throw new KubeConfigError(
+      `the kubeconfig resolves to no cluster for context "${kc.getCurrentContext() || "(unset)"}"`
+    );
+  }
+  const user = kc.getCurrentUser();
+  assertExecCredentialAllowed(user, options.execAllowlist ?? DEFAULT_EXEC_ALLOWLIST);
+  const provenance = {
+    server: cluster.server,
+    context: kc.getCurrentContext() || void 0,
+    contextSource: options.contextSource ?? "ambient",
+    kubeconfigSource,
+    ...credentialPathOf(user)
+  };
+  const configuration = mod.createConfiguration({
+    baseServer: new mod.ServerConfiguration(cluster.server, {}),
+    authMethods: { default: kc },
+    ...options.requestLayer ? {
+      httpApi: mod.wrapHttpLibrary({
+        send: (request) => Promise.resolve(
+          options.requestLayer.send(request)
+        )
+      })
+    } : {}
+  });
+  const defaultNamespace = kc.getContextObject(kc.getCurrentContext())?.namespace || "default";
+  const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
+  const contextNote = `context "${provenance.context ?? "(unset)"}" (${options.contextLabel ?? provenance.contextSource})`;
+  function noted(err) {
+    err.contextNote = contextNote;
+    return err;
+  }
+  const discoveryCache = /* @__PURE__ */ new Map();
+  let rootDiscoveryCache;
+  async function send(path, method, opts = {}) {
+    const ctx = configuration.baseServer.makeRequestContext(path, method);
+    ctx.setHeaderParam("Accept", "application/json");
+    for (const [key, value] of Object.entries(opts.query ?? {})) ctx.setQueryParam(key, value);
+    if (opts.body !== void 0) {
+      ctx.setHeaderParam("Content-Type", opts.contentType ?? "application/json");
+      ctx.setBody(opts.body);
+    }
+    if (opts.signal) ctx.setSignal(opts.signal);
+    await kc.applySecurityAuthentication(ctx);
+    let response;
+    try {
+      response = await configuration.httpApi.send(ctx).toPromise();
+    } catch (err) {
+      throw noted(
+        new K8sTransportError(err instanceof Error ? err.message : String(err), opts.target ?? `${method} ${path}`, {
+          cause: err
+        })
+      );
+    }
+    let text;
+    try {
+      text = await response.body.text();
+    } catch (err) {
+      throw noted(
+        new K8sTransportError(
+          `response body could not be read: ${err instanceof Error ? err.message : String(err)}`,
+          opts.target ?? `${method} ${path}`,
+          { cause: err }
+        )
+      );
+    }
+    return { status: response.httpStatusCode, body: text };
+  }
+  async function sendJson(path, method, opts = {}) {
+    const { status, body } = await send(path, method, opts);
+    if (status < 200 || status > 299) {
+      throw noted(K8sApiError.fromResponse(status, body, opts.target));
+    }
+    try {
+      return JSON.parse(body);
+    } catch (err) {
+      throw noted(
+        new K8sTransportError(
+          `the API server returned HTTP ${status} with a body that is not JSON`,
+          opts.target ?? `${method} ${path}`,
+          { cause: err }
+        )
+      );
+    }
+  }
+  async function apiResourceList(apiVersion, signal) {
+    const cached = discoveryCache.get(apiVersion);
+    if (cached) return cached;
+    const pending = (async () => {
+      try {
+        return await sendJson(apiVersionPath(apiVersion), "GET", {
+          signal,
+          target: `discovery ${apiVersion}`
+        });
+      } catch (err) {
+        if (err instanceof K8sApiError && err.notFound) return null;
+        discoveryCache.delete(apiVersion);
+        throw err;
+      }
+    })();
+    discoveryCache.set(apiVersion, pending);
+    return pending;
+  }
+  async function rootDiscovery(signal) {
+    if (rootDiscoveryCache) return rootDiscoveryCache;
+    rootDiscoveryCache = (async () => {
+      const core = await sendJson("/api", "GET", {
+        signal,
+        target: "discovery /api"
+      });
+      const groups = await sendJson("/apis", "GET", { signal, target: "discovery /apis" });
+      return {
+        coreVersions: core.versions ?? ["v1"],
+        groups: (groups.groups ?? []).map((group) => ({
+          preferred: group.preferredVersion?.groupVersion,
+          versions: (group.versions ?? []).map((v) => v.groupVersion).filter((gv) => typeof gv === "string" && gv.length > 0)
+        }))
+      };
+    })().catch((err) => {
+      rootDiscoveryCache = void 0;
+      throw err;
+    });
+    return rootDiscoveryCache;
+  }
+  async function servedGroupVersions(signal) {
+    const root = await rootDiscovery(signal);
+    const out = [...root.coreVersions];
+    for (const group of root.groups) {
+      if (group.preferred) out.push(group.preferred);
+      for (const gv of group.versions) {
+        if (gv !== group.preferred) out.push(gv);
+      }
+    }
+    return [...new Set(out)];
+  }
+  async function preferredGroupVersions(signal) {
+    const root = await rootDiscovery(signal);
+    const core = root.coreVersions.includes("v1") ? "v1" : root.coreVersions[0];
+    const out = core ? [core] : [];
+    for (const group of root.groups) {
+      const gv = group.preferred ?? group.versions[0];
+      if (gv) out.push(gv);
+    }
+    return [...new Set(out)];
+  }
+  function toInfo(apiVersion, entry) {
+    const [group, version] = splitApiVersion(apiVersion);
+    return {
+      name: entry.name ?? "",
+      singularName: entry.singularName || void 0,
+      kind: entry.kind ?? "",
+      namespaced: entry.namespaced === true,
+      verbs: entry.verbs ?? [],
+      shortNames: entry.shortNames,
+      group,
+      version,
+      apiVersion
+    };
+  }
+  async function resolveByGvk(apiVersion, kind, signal) {
+    const list4 = await apiResourceList(apiVersion, signal);
+    if (!list4) return void 0;
+    const entry = (list4.resources ?? []).find((r) => r.kind === kind && !(r.name ?? "").includes("/"));
+    return entry ? toInfo(apiVersion, entry) : void 0;
+  }
+  async function resolveByResourceString(resource, group, signal) {
+    const dot = resource.indexOf(".");
+    const bare = dot === -1 ? resource : resource.slice(0, dot);
+    const fromString = dot === -1 ? void 0 : resource.slice(dot + 1);
+    const wantedGroup = fromString ?? group;
+    const needle = bare.toLowerCase();
+    const all = await servedGroupVersions(signal);
+    const candidates = wantedGroup === void 0 ? all : all.filter((gv) => splitApiVersion(gv)[0] === (wantedGroup === "" ? "" : wantedGroup));
+    const lists = await mapConcurrent(
+      candidates,
+      async (gv) => ({ gv, list: await apiResourceList(gv, signal).catch(() => null) }),
+      concurrency
+    );
+    const matchers = [
+      (r) => (r.name ?? "").toLowerCase() === needle,
+      (r) => (r.singularName ?? "").toLowerCase() === needle,
+      (r) => (r.kind ?? "").toLowerCase() === needle,
+      (r) => (r.shortNames ?? []).some((s) => s.toLowerCase() === needle)
+    ];
+    for (const matches of matchers) {
+      for (const { gv, list: list4 } of lists) {
+        const entry = (list4?.resources ?? []).find((r) => !(r.name ?? "").includes("/") && matches(r));
+        if (entry) return toInfo(gv, entry);
+      }
+    }
+    return void 0;
+  }
+  async function resolve8(selector, signal) {
+    return "apiVersion" in selector ? resolveByGvk(selector.apiVersion, selector.kind, signal) : resolveByResourceString(selector.resource, selector.group, signal);
+  }
+  async function resolveOrThrow(selector, signal) {
+    const info = await resolve8(selector, signal);
+    if (!info) throw new UnknownResourceError(selectorText(selector));
+    return info;
+  }
+  function objectPath(info, name, namespace) {
+    const parts = [apiVersionPath(info.apiVersion)];
+    if (info.namespaced) parts.push("namespaces", encodeURIComponent(namespace || defaultNamespace));
+    parts.push(info.name);
+    if (name) parts.push(encodeURIComponent(name));
+    return parts.join("/");
+  }
+  async function pathFor(ref, signal) {
+    const info = await resolve8({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
+    if (!info) return void 0;
+    return objectPath(info, ref.name, ref.namespace);
+  }
+  async function read(ref, opts = {}) {
+    const info = await resolveOrThrow({ apiVersion: ref.apiVersion, kind: ref.kind }, opts.signal);
+    return sendJson(objectPath(info, ref.name, ref.namespace), "GET", {
+      signal: opts.signal,
+      target: refText(ref)
+    });
+  }
+  async function readIfPresent(ref, opts = {}) {
+    try {
+      return await read(ref, opts);
+    } catch (err) {
+      if (err instanceof K8sApiError && err.notFound) return void 0;
+      throw err;
+    }
+  }
+  async function list3(selector, opts = {}) {
+    const info = await resolveOrThrow(selector, opts.signal);
+    const items = [];
+    let cont;
+    do {
+      const query = {};
+      if (cont) query.continue = cont;
+      if (opts.labelSelector) query.labelSelector = opts.labelSelector;
+      const page = await sendJson(
+        // Omitting the namespace segment lists across all namespaces, which is
+        // what `kubectl get <kind> -A` does and what the import path wants.
+        opts.namespace ? objectPath(info, void 0, opts.namespace) : `${apiVersionPath(info.apiVersion)}/${info.name}`,
+        "GET",
+        {
+          signal: opts.signal,
+          query: Object.keys(query).length > 0 ? query : void 0,
+          target: `list ${selectorText(selector)}`
+        }
+      );
+      items.push(...page.items ?? []);
+      cont = page.metadata?.continue || void 0;
+    } while (cont);
+    return items;
+  }
+  async function apply(object, opts = {}) {
+    const apiVersion = object.apiVersion;
+    const kind = object.kind;
+    if (!apiVersion || !kind) {
+      throw new KubeConfigError(
+        `cannot apply an object without both apiVersion and kind (got apiVersion=${String(apiVersion)}, kind=${String(kind)})`
+      );
+    }
+    const name = object.metadata?.name;
+    if (!name) {
+      throw new KubeConfigError(`cannot apply a ${apiVersion} ${kind} without metadata.name`);
+    }
+    const fieldManager = opts.fieldManager ?? CHANT_FIELD_MANAGER;
+    assertValidFieldManager(fieldManager);
+    const info = await resolveOrThrow({ apiVersion, kind }, opts.signal);
+    const query = {
+      fieldManager,
+      force: String(opts.force ?? false)
+    };
+    if (opts.dryRun) query.dryRun = "All";
+    try {
+      return await sendJson(objectPath(info, name, object.metadata?.namespace), "PATCH", {
+        // Server-side apply. JSON is valid YAML, so the JSON body is accepted
+        // under the apply-patch content type without a YAML round trip.
+        contentType: "application/apply-patch+yaml",
+        body: JSON.stringify(object),
+        query,
+        signal: opts.signal,
+        target: refText({ apiVersion, kind, name, namespace: object.metadata?.namespace })
+      });
+    } catch (err) {
+      throw asFieldManagerConflict(err, fieldManager);
+    }
+  }
+  async function readLog(ref, opts = {}) {
+    const info = await resolveOrThrow({ apiVersion: ref.apiVersion, kind: ref.kind }, opts.signal);
+    const query = {};
+    if (opts.container) query.container = opts.container;
+    if (opts.previous) query.previous = "true";
+    if (opts.tailLines !== void 0) query.tailLines = String(opts.tailLines);
+    if (opts.sinceSeconds !== void 0) query.sinceSeconds = String(opts.sinceSeconds);
+    if (opts.timestamps) query.timestamps = "true";
+    const target = `${refText(ref)} logs`;
+    const { status, body } = await send(`${objectPath(info, ref.name, ref.namespace)}/log`, "GET", {
+      query: Object.keys(query).length > 0 ? query : void 0,
+      signal: opts.signal,
+      target
+    });
+    if (status < 200 || status > 299) {
+      throw noted(K8sApiError.fromResponse(status, body, target));
+    }
+    return body;
+  }
+  async function remove(ref, opts = {}) {
+    const info = await resolveOrThrow({ apiVersion: ref.apiVersion, kind: ref.kind }, opts.signal);
+    const query = {};
+    if (opts.propagationPolicy) query.propagationPolicy = opts.propagationPolicy;
+    if (opts.dryRun) query.dryRun = "All";
+    await sendJson(objectPath(info, ref.name, ref.namespace), "DELETE", {
+      signal: opts.signal,
+      query: Object.keys(query).length > 0 ? query : void 0,
+      target: refText(ref)
+    });
+  }
+  async function resourcesOf(apiVersion, signal) {
+    const list4 = await apiResourceList(apiVersion, signal);
+    if (!list4) return [];
+    return (list4.resources ?? []).filter((r) => !(r.name ?? "").includes("/")).map((entry) => toInfo(apiVersion, entry));
+  }
+  return {
+    provenance,
+    defaultNamespace,
+    resolve: resolve8,
+    read,
+    pathFor,
+    readIfPresent,
+    list: list3,
+    readLog,
+    apply,
+    delete: remove,
+    concurrently: (items, fn) => mapConcurrent(items, fn, concurrency),
+    resources: resourcesOf,
+    preferredGroupVersions,
+    discoveryCacheKeys: () => [...discoveryCache.keys()].sort()
+  };
+}
+function apiVersionPath(apiVersion) {
+  return apiVersion.includes("/") ? `/apis/${apiVersion}` : `/api/${apiVersion}`;
+}
+function splitApiVersion(apiVersion) {
+  const slash = apiVersion.indexOf("/");
+  return slash === -1 ? ["", apiVersion] : [apiVersion.slice(0, slash), apiVersion.slice(slash + 1)];
+}
+function selectorText(selector) {
+  return "apiVersion" in selector ? `${selector.apiVersion} ${selector.kind}` : selector.group ? `${selector.resource}.${selector.group}` : selector.resource;
+}
+function refText(ref) {
+  return `${ref.apiVersion} ${ref.kind} ${ref.namespace ? `${ref.namespace}/` : ""}${ref.name}`;
+}
+var clientNodeModule;
+var init_client = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/client.ts"() {
+    init_errors();
+    init_credentials();
+    init_conflict();
+    init_field_manager();
+    init_concurrency();
+    init_kubeconfig();
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/managed-fields.ts
+function managedFieldsOf(object) {
+  const entries = object?.metadata?.managedFields;
+  if (!Array.isArray(entries)) return [];
+  return entries.filter((e) => e !== null && typeof e === "object").map((e) => e);
+}
+function fieldSetsOf(object) {
+  return managedFieldsOf(object).filter((entry) => typeof entry.manager === "string" && entry.manager.length > 0).map((entry) => ({
+    manager: entry.manager,
+    operation: entry.operation ?? "Update",
+    ...entry.apiVersion !== void 0 ? { apiVersion: entry.apiVersion } : {},
+    ...entry.subresource !== void 0 ? { subresource: entry.subresource } : {},
+    ...entry.time !== void 0 ? { time: entry.time } : {},
+    fields: fieldPathsOf(entry.fieldsV1)
+  }));
+}
+function managersOf(object) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of managedFieldsOf(object)) {
+    if (typeof entry.manager === "string" && entry.manager.length > 0) seen.add(entry.manager);
+  }
+  return [...seen];
+}
+function fieldsOwnedBy(object, manager, options = {}) {
+  const matches = typeof manager === "function" ? manager : (m) => m === manager;
+  const paths = /* @__PURE__ */ new Set();
+  for (const set of fieldSetsOf(object)) {
+    if (!matches(set.manager)) continue;
+    if (set.subresource !== void 0 && options.includeSubresources !== true) continue;
+    for (const path of set.fields) paths.add(path);
+  }
+  return [...paths].sort();
+}
+function chantOwnedFields(object, options = {}) {
+  return fieldsOwnedBy(object, isChantFieldManager, options);
+}
+function fieldOwners(object, options = {}) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const set of fieldSetsOf(object)) {
+    if (set.subresource !== void 0 && options.includeSubresources !== true) continue;
+    for (const path of set.fields) {
+      const list3 = owners.get(path) ?? [];
+      if (!list3.includes(set.manager)) list3.push(set.manager);
+      owners.set(path, list3);
+    }
+  }
+  return owners;
+}
+function fieldPathsOf(fieldsV1, prefix = "") {
+  return [...collect(fieldsV1, prefix, /* @__PURE__ */ new Set())].sort();
+}
+function collect(node, prefix, into) {
+  if (node === null || typeof node !== "object" || Array.isArray(node)) return into;
+  for (const [key, child] of Object.entries(node)) {
+    if (key === ".") {
+      if (prefix !== "") into.add(prefix);
+      continue;
+    }
+    const segment = renderSegment(key);
+    if (segment === void 0) continue;
+    const path = `${prefix}${segment}`;
+    into.add(path);
+    collect(child, path, into);
+  }
+  return into;
+}
+function renderSegment(key) {
+  if (key.startsWith("f:")) return `.${key.slice(2)}`;
+  if (key.startsWith("i:")) return `[${key.slice(2)}]`;
+  if (key.startsWith("v:")) return `[=${key.slice(2)}]`;
+  if (key.startsWith("k:")) return renderKeySegment(key.slice(2));
+  return void 0;
+}
+function renderKeySegment(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return `[${json}]`;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return `[${json}]`;
+  const parts = Object.entries(parsed).map(
+    ([name, value]) => `${name}=${JSON.stringify(value)}`
+  );
+  return `[${parts.join(",")}]`;
+}
+var init_managed_fields = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/managed-fields.ts"() {
+    init_field_manager();
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  CHANT_FIELD_MANAGER: () => CHANT_FIELD_MANAGER,
+  DEFAULT_CONCURRENCY: () => DEFAULT_CONCURRENCY,
+  DEFAULT_EXEC_ALLOWLIST: () => DEFAULT_EXEC_ALLOWLIST,
+  ExecCredentialNotAllowedError: () => ExecCredentialNotAllowedError,
+  FIELD_MANAGER_MAX_LENGTH: () => FIELD_MANAGER_MAX_LENGTH,
+  FIELD_MANAGER_SEPARATOR: () => FIELD_MANAGER_SEPARATOR,
+  FieldManagerConflictError: () => FieldManagerConflictError,
+  FieldManagerError: () => FieldManagerError,
+  K8sApiError: () => K8sApiError,
+  K8sClientUnavailableError: () => K8sClientUnavailableError,
+  K8sTransportError: () => K8sTransportError,
+  KubeConfigError: () => KubeConfigError,
+  UnknownResourceError: () => UnknownResourceError,
+  apiVersionPath: () => apiVersionPath,
+  asFieldManagerConflict: () => asFieldManagerConflict,
+  assertExecCredentialAllowed: () => assertExecCredentialAllowed,
+  assertValidFieldManager: () => assertValidFieldManager,
+  chantOwnedFields: () => chantOwnedFields,
+  chantStackOf: () => chantStackOf,
+  createK8sClient: () => createK8sClient,
+  credentialPathOf: () => credentialPathOf,
+  execCommandName: () => execCommandName,
+  execConfigOf: () => execConfigOf,
+  fieldManagerFor: () => fieldManagerFor,
+  fieldOwners: () => fieldOwners,
+  fieldPathsOf: () => fieldPathsOf,
+  fieldSetsOf: () => fieldSetsOf,
+  fieldsOwnedBy: () => fieldsOwnedBy,
+  isChantFieldManager: () => isChantFieldManager,
+  isK8sClientAvailable: () => isK8sClientAvailable,
+  loadClientNode: () => loadClientNode,
+  managedFieldsOf: () => managedFieldsOf,
+  managersOf: () => managersOf,
+  mapConcurrent: () => mapConcurrent,
+  parseConflictMessage: () => parseConflictMessage,
+  parseFieldConflicts: () => parseFieldConflicts,
+  readAmbientContext: () => readAmbientContext,
+  readKubeconfigView: () => readKubeconfigView,
+  refText: () => refText,
+  renderConflictReport: () => renderConflictReport,
+  renderSegment: () => renderSegment,
+  selectorText: () => selectorText,
+  splitApiVersion: () => splitApiVersion
+});
+var init_src = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/index.ts"() {
+    init_client();
+    init_errors();
+    init_field_manager();
+    init_conflict();
+    init_managed_fields();
+    init_credentials();
+    init_concurrency();
+  }
+});
+
 // src/cli.ts
-import { resolve as resolve3, dirname as dirname5, join as join13, relative as relative2, sep } from "node:path";
-import { realpathSync, existsSync as existsSync10, cpSync } from "node:fs";
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { resolve as resolve7, dirname as dirname6, join as join17 } from "node:path";
+import { realpathSync, existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { spawn as spawn5 } from "node:child_process";
 
 // src/server.ts
 import { Hono } from "hono";
@@ -33,41 +1072,32 @@ function targetEnvOverrides(targets, chosen) {
 }
 
 // src/k8s-target.ts
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-var run = promisify(execFile);
 var EMPTY = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
-function str(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function readKubeconfigJson(json) {
+function kubeconfigFromView(view) {
   const contexts = /* @__PURE__ */ new Map();
-  for (const entry of json.contexts ?? []) {
-    const name = str(entry?.name);
-    const cluster = str(entry?.context?.cluster);
-    if (name && cluster) contexts.set(name, cluster);
-  }
   const servers = /* @__PURE__ */ new Map();
-  for (const entry of json.clusters ?? []) {
-    const name = str(entry?.name);
-    const server = str(entry?.cluster?.server);
-    if (name && server) servers.set(name, server);
+  for (const entry of view.contexts) {
+    if (entry.name && entry.cluster) contexts.set(entry.name, entry.cluster);
+    if (entry.cluster && entry.server) servers.set(entry.cluster, entry.server);
   }
-  const current = str(json["current-context"]);
-  return { contexts, servers, ...current ? { currentContext: current } : {} };
+  return { contexts, servers, ...view.currentContext ? { currentContext: view.currentContext } : {} };
+}
+async function loadKubeconfig(options = {}) {
+  const client = await k8sClient();
+  if (!client) return EMPTY;
+  return kubeconfigFromView(await client.readKubeconfigView(options));
+}
+async function ambientContext(options = {}) {
+  const client = await k8sClient();
+  return client ? await client.readAmbientContext(options) : void 0;
 }
-async function loadKubeconfig(exec = defaultExec) {
+async function k8sClient() {
   try {
-    const stdout = await exec("kubectl", ["config", "view", "--raw", "-o", "json"]);
-    return readKubeconfigJson(JSON.parse(stdout));
+    return await Promise.resolve().then(() => (init_src(), src_exports));
   } catch {
-    return EMPTY;
+    return void 0;
   }
 }
-async function defaultExec(cmd, args) {
-  const { stdout } = await run(cmd, args, { encoding: "utf8", timeout: 1e4 });
-  return stdout;
-}
 function resolveK8sTarget(profiles, env, kubeconfig) {
   const declared = env ? profiles?.[env]?.context : void 0;
   const context = declared ?? kubeconfig.currentContext;
@@ -87,11 +1117,11 @@ function contextBindsCluster(context, clusterName) {
 import { streamSSE } from "hono/streaming";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { serve } from "@hono/node-server";
-import { fileURLToPath } from "node:url";
-import { execFile as execFile4 } from "node:child_process";
-import { promisify as promisify4 } from "node:util";
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname3, join as join10, relative, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
+import { dirname as dirname4, join as join15, relative as relative3, resolve as resolve5, sep as sep4 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -125,8 +1155,9 @@ function addRecent(dir, now = () => (/* @__PURE__ */ new Date()).toISOString())
 
 // src/chant.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
 import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 import { dirname as dirname2, join as join3, resolve } from "node:path";
 
 // src/project.ts
@@ -135,7 +1166,7 @@ import { join as join2 } from "node:path";
 import { pathToFileURL } from "node:url";
 var CONFIG_NAMES = ["chant.config.ts", "chant.config.mts", "chant.config.js", "chant.config.mjs"];
 var BEHOLD_CONFIG_NAME = ".behold.json";
-function configPath(projectDir) {
+function chantConfigPath(projectDir) {
   for (const name of CONFIG_NAMES) {
     const p = join2(projectDir, name);
     if (existsSync2(p)) return p;
@@ -222,7 +1253,7 @@ function parseStringLiteral(content, key) {
   return m?.[1];
 }
 async function detectProject(projectDir) {
-  const path = configPath(projectDir);
+  const path = chantConfigPath(projectDir);
   if (!path) return { environments: [], lexicons: [] };
   try {
     const mod = await import(pathToFileURL(path).href);
@@ -253,11 +1284,30 @@ function loadBeholdConfig(projectDir) {
   try {
     const raw = JSON.parse(readFileSync2(path, "utf8"));
     const tiers = readTiers(raw);
-    return tiers ? { tiers } : {};
+    const members = Array.isArray(raw.members) ? raw.members.filter((m) => typeof m === "string" && !!m) : [];
+    return { ...tiers ? { tiers } : {}, ...members.length ? { members } : {} };
   } catch {
     return {};
   }
 }
+function readWorkspaces(projectDir) {
+  try {
+    const raw = JSON.parse(readFileSync2(join2(projectDir, "package.json"), "utf8"));
+    const ws = Array.isArray(raw.workspaces) ? raw.workspaces : raw.workspaces?.packages;
+    return Array.isArray(ws) ? ws.filter((w) => typeof w === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function detectProjectShape(projectDir) {
+  const configFile = chantConfigPath(projectDir);
+  if (configFile) return { kind: "project", configFile };
+  const declared = loadBeholdConfig(projectDir).members;
+  const from = declared ? "behold-config" : "workspaces";
+  const members = (declared ?? readWorkspaces(projectDir)).filter((m) => !!chantConfigPath(join2(projectDir, m)));
+  if (members.length) return { kind: "estate", members, membersFrom: from };
+  return { kind: "none" };
+}
 
 // node_modules/@intentius/chant/src/yaml.ts
 function parseYAML(content) {
@@ -543,21 +1593,21 @@ function graphFlags(opts) {
   if (opts.env) flags.push("--env", opts.env);
   if (opts.live) flags.push("--live");
   if (opts.overlay) flags.push("--overlay");
+  if (opts.namespace) flags.push("--namespace", opts.namespace);
   return flags;
 }
-function chantBinFrom(req) {
+function packageManifestFrom(req, name) {
   let entry;
   try {
-    entry = req.resolve("@intentius/chant");
+    entry = req.resolve(name);
   } catch {
     return void 0;
   }
   let dir = dirname2(entry);
   for (; ; ) {
-    const manifest = join3(dir, "package.json");
     try {
-      const pkg = createRequire(import.meta.url)(manifest);
-      if (pkg.name === "@intentius/chant") return join3(dir, pkg.bin?.chant ?? "bin/chant");
+      const pkg = createRequire(import.meta.url)(join3(dir, "package.json"));
+      if (pkg.name === name) return { root: dir, manifest: pkg };
     } catch {
     }
     const parent = dirname2(dir);
@@ -566,14 +1616,52 @@ function chantBinFrom(req) {
   }
   return void 0;
 }
-function chantBin(projectDir) {
+function chantPackageFrom(req) {
+  const found = packageManifestFrom(req, "@intentius/chant");
+  if (!found) return void 0;
+  const { root, manifest } = found;
+  return { root, bin: join3(root, manifest.bin?.chant ?? "bin/chant"), ...manifest.version ? { version: manifest.version } : {} };
+}
+function resolveLexicons(projectDir, lexicons) {
+  const req = createRequire(join3(resolve(projectDir), "noop.js"));
+  return lexicons.map((lexicon) => {
+    const pkg = `@intentius/chant-lexicon-${lexicon}`;
+    const found = packageManifestFrom(req, pkg);
+    return { lexicon, pkg, installed: !!found, ...found?.manifest.version ? { version: found.manifest.version } : {} };
+  });
+}
+function resolveChant(projectDir) {
+  const own = chantPackageFrom(createRequire(import.meta.url));
   if (projectDir) {
-    const fromProject = chantBinFrom(createRequire(join3(resolve(projectDir), "noop.js")));
-    if (fromProject) return fromProject;
+    const fromProject = chantPackageFrom(createRequire(join3(resolve(projectDir), "noop.js")));
+    if (fromProject) return { source: fromProject.root === own?.root ? "behold" : "project", ...fromProject };
   }
-  const own = chantBinFrom(createRequire(import.meta.url));
-  if (own) return own;
-  return "chant";
+  if (own) return { source: "behold", ...own };
+  return { source: "path", bin: "chant" };
+}
+function chantFloor() {
+  try {
+    const here = dirname2(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(readFileSync3(join3(here, "..", "package.json"), "utf8"));
+    return pkg.dependencies?.["@intentius/chant"]?.replace(/^[^0-9]*/, "") || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function meetsFloor(version, floor) {
+  if (!version || !floor) return true;
+  const parts = (v) => v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10));
+  const a = parts(version);
+  const b = parts(floor);
+  if (a.some(Number.isNaN) || b.some(Number.isNaN)) return true;
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const d = (a[i] ?? 0) - (b[i] ?? 0);
+    if (d !== 0) return d > 0;
+  }
+  return true;
+}
+function chantBin(projectDir) {
+  return resolveChant(projectDir).bin;
 }
 function runChantRaw(args, projectDir, envOverride) {
   return new Promise((resolvePromise, reject) => {
@@ -746,10 +1834,10 @@ function applyArgs(target, env) {
 }
 
 // src/cluster-root.ts
-import { execFile as execFile2 } from "node:child_process";
-import { promisify as promisify2 } from "node:util";
-var run2 = promisify2(execFile2);
-async function runningK3dClusters(exec = defaultExec2) {
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var run = promisify(execFile);
+async function runningK3dClusters(exec = defaultExec) {
   try {
     const out = await exec("k3d", ["cluster", "list", "--no-headers"]);
     const clusters = /* @__PURE__ */ new Map();
@@ -765,8 +1853,8 @@ async function runningK3dClusters(exec = defaultExec2) {
     return void 0;
   }
 }
-async function defaultExec2(cmd, args) {
-  const { stdout } = await run2(cmd, args, { encoding: "utf8", timeout: 1e4 });
+async function defaultExec(cmd, args) {
+  const { stdout } = await run(cmd, args, { encoding: "utf8", timeout: 1e4 });
   return stdout;
 }
 function k3dClusterName(node) {
@@ -798,7 +1886,7 @@ function mergeClusterRoot(ir, clusterIr, running) {
 }
 
 // src/helm-releases.ts
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
+import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
 import { join as join4 } from "node:path";
 var RELEASE_KEY = /^release\/([^/]+)\/(.+)$/;
 function declaredChartNames(ir) {
@@ -839,7 +1927,7 @@ function discoverReleaseUnits(projectDir) {
   for (const file of files) {
     let content;
     try {
-      content = readFileSync3(file, "utf8");
+      content = readFileSync4(file, "utf8");
     } catch {
       continue;
     }
@@ -892,7 +1980,7 @@ function synthesizeHelmReleases(ir, observed, owners) {
 
 // src/gh-run.ts
 import { spawn as spawn2 } from "node:child_process";
-import { readdirSync as readdirSync2, readFileSync as readFileSync4 } from "node:fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync5 } from "node:fs";
 import { join as join5 } from "node:path";
 
 // src/ci-run.ts
@@ -947,19 +2035,19 @@ function finishPipelineProgress(state, exitCode) {
 }
 
 // src/gh-run.ts
-var defaultGhExec = (args) => new Promise((resolve4) => {
+var defaultGhExec = (args) => new Promise((resolve8) => {
   let out = "";
   let proc;
   try {
     proc = spawn2("gh", args, { stdio: ["ignore", "pipe", "pipe"] });
   } catch {
-    resolve4({ code: 127, out: "" });
+    resolve8({ code: 127, out: "" });
     return;
   }
   proc.stdout.on("data", (d) => out += d);
   proc.stderr.on("data", (d) => out += d);
-  proc.on("error", () => resolve4({ code: 127, out }));
-  proc.on("close", (code) => resolve4({ code: code ?? 1, out }));
+  proc.on("error", () => resolve8({ code: 127, out }));
+  proc.on("close", (code) => resolve8({ code: code ?? 1, out }));
 });
 async function ghReady(exec = defaultGhExec) {
   const { code, out } = await exec(["auth", "status"]);
@@ -993,7 +2081,7 @@ function pickWorkflow(projectDir, pipeline) {
   for (const f of files) {
     let text;
     try {
-      text = readFileSync4(join5(dir, f), "utf8");
+      text = readFileSync5(join5(dir, f), "utf8");
     } catch {
       continue;
     }
@@ -1103,11 +2191,11 @@ function joinCiProgress(ir, state) {
   }
   for (const n of ir.nodes) {
     if (n.kind !== "Component") continue;
-    const run4 = byComponent.get(n.id);
-    if (!run4) continue;
+    const run3 = byComponent.get(n.id);
+    if (!run3) continue;
     const attrs = n.attrs ??= {};
-    attrs.ci = run4.status;
-    attrs._ciJob = run4.job;
+    attrs.ci = run3.status;
+    attrs._ciJob = run3.job;
   }
   return ir;
 }
@@ -1272,14 +2360,14 @@ var WORKLOAD_KINDS = /* @__PURE__ */ new Set([
 function rec(v) {
   return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 }
-function str2(v) {
+function str(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function namespaceOf(n) {
-  return str2(rec(n.attrs?.metadata)?.namespace) ?? "default";
+  return str(rec(n.attrs?.metadata)?.namespace) ?? "default";
 }
 function nameOf(n) {
-  return str2(rec(n.attrs?.metadata)?.name);
+  return str(rec(n.attrs?.metadata)?.name);
 }
 function labelRecord(v) {
   const r = rec(v);
@@ -1309,12 +2397,21 @@ var FLUX_SOURCE_KINDS = /* @__PURE__ */ new Set([
   "K8s::Flux::HelmChart",
   "K8s::Flux::Bucket"
 ]);
-function sourceRefOf(refObj, referrer) {
+function sourceRefOf(refObj, referrer, defaultKind) {
   const ref = rec(refObj);
-  const kind = str2(ref?.kind);
-  const name = str2(ref?.name);
+  const kind = str(ref?.kind) ?? defaultKind;
+  const name = str(ref?.name);
   if (!kind || !name) return void 0;
-  return { kind, name, namespace: str2(ref?.namespace) ?? namespaceOf(referrer) };
+  return { kind, name, namespace: str(ref?.namespace) ?? namespaceOf(referrer) };
+}
+function namedRefOf(refObj, referrer) {
+  const ref = rec(refObj);
+  const name = str(ref?.name);
+  if (!name) return void 0;
+  return { name, namespace: str(ref?.namespace) ?? namespaceOf(referrer) };
+}
+function list(v) {
+  return Array.isArray(v) ? v : [];
 }
 function helmReleaseSourceRef(n) {
   return rec(rec(rec(n.attrs?.spec)?.chart)?.spec)?.sourceRef;
@@ -1322,7 +2419,7 @@ function helmReleaseSourceRef(n) {
 function ingressBackendServices(n) {
   const spec = rec(n.attrs?.spec);
   const out = [];
-  const backendName = (b) => str2(rec(rec(b)?.service)?.name);
+  const backendName = (b) => str(rec(rec(b)?.service)?.name);
   const fromDefault = backendName(spec?.defaultBackend);
   if (fromDefault) out.push(fromDefault);
   const rules = Array.isArray(spec?.rules) ? spec.rules : [];
@@ -1343,19 +2440,38 @@ function deriveK8sEdges(nodes) {
     if (from !== to) out.push({ from, to, kind: "ref", viaAttr, inferred: true });
   };
   const workloads = k8s.filter((n) => WORKLOAD_KINDS.has(n.kind));
-  const servicesByNsName = /* @__PURE__ */ new Map();
-  const sourcesByKindNsName = /* @__PURE__ */ new Map();
+  const byKindNsName = /* @__PURE__ */ new Map();
+  const appProjectsByName = /* @__PURE__ */ new Map();
   for (const n of k8s) {
     const name = nameOf(n);
     if (!name) continue;
-    if (n.kind === "K8s::Core::Service") servicesByNsName.set(`${namespaceOf(n)}/${name}`, n);
-    if (FLUX_SOURCE_KINDS.has(n.kind)) sourcesByKindNsName.set(`${shortKind(n.kind)}/${namespaceOf(n)}/${name}`, n);
+    byKindNsName.set(`${n.kind}\0${namespaceOf(n)}\0${name}`, n);
+    if (n.kind === "K8s::Argo::AppProject") {
+      const same = appProjectsByName.get(name) ?? [];
+      same.push(n);
+      appProjectsByName.set(name, same);
+    }
   }
-  const addSourceRef = (n, refObj, viaAttr) => {
-    const ref = sourceRefOf(refObj, n);
+  const lookup = (kind, namespace, name) => byKindNsName.get(`${kind}\0${namespace}\0${name}`);
+  const addFluxRef = (n, refObj, viaAttr, allowed, defaultKind) => {
+    const ref = sourceRefOf(refObj, n, defaultKind);
+    if (!ref || ref.name === "*") return;
+    const kind = `K8s::Flux::${ref.kind}`;
+    if (allowed && !allowed.has(kind)) return;
+    const target = lookup(kind, ref.namespace, ref.name);
+    if (target) add(n.id, target.id, viaAttr);
+  };
+  const addSourceRef = (n, refObj, viaAttr, defaultKind) => addFluxRef(n, refObj, viaAttr, FLUX_SOURCE_KINDS, defaultKind);
+  const addNamedRef = (n, refObj, kind, viaAttr) => {
+    const ref = namedRefOf(refObj, n);
     if (!ref) return;
-    const source = sourcesByKindNsName.get(`${ref.kind}/${ref.namespace}/${ref.name}`);
-    if (source) add(n.id, source.id, viaAttr);
+    const target = lookup(kind, ref.namespace, ref.name);
+    if (target) add(n.id, target.id, viaAttr);
+  };
+  const addProject = (n, project, viaAttr) => {
+    const candidates = project ? appProjectsByName.get(project) ?? [] : [];
+    const target = candidates.length === 1 ? candidates[0] : candidates.find((p) => namespaceOf(p) === namespaceOf(n));
+    if (target) add(n.id, target.id, viaAttr);
   };
   for (const n of k8s) {
     if (n.kind === "K8s::Core::Service") {
@@ -1370,15 +2486,15 @@ function deriveK8sEdges(nodes) {
     }
     if (n.kind === "K8s::Networking::Ingress") {
       for (const svcName of ingressBackendServices(n)) {
-        const svc = servicesByNsName.get(`${namespaceOf(n)}/${svcName}`);
+        const svc = lookup("K8s::Core::Service", namespaceOf(n), svcName);
         if (svc) add(n.id, svc.id, "ingress backend");
       }
       continue;
     }
     if (n.kind === "K8s::Autoscaling::HorizontalPodAutoscaler") {
       const ref = rec(rec(n.attrs?.spec)?.scaleTargetRef);
-      const refKind = str2(ref?.kind);
-      const refName = str2(ref?.name);
+      const refKind = str(ref?.kind);
+      const refName = str(ref?.name);
       if (!refKind || !refName) continue;
       for (const w of workloads) {
         if (namespaceOf(w) !== namespaceOf(n)) continue;
@@ -1388,10 +2504,36 @@ function deriveK8sEdges(nodes) {
     }
     if (n.kind === "K8s::Flux::Kustomization") {
       addSourceRef(n, rec(n.attrs?.spec)?.sourceRef, "sourceRef");
+      for (const dep of list(rec(n.attrs?.spec)?.dependsOn)) {
+        addNamedRef(n, dep, "K8s::Flux::Kustomization", "dependsOn");
+      }
       continue;
     }
     if (n.kind === "K8s::Flux::HelmRelease") {
       addSourceRef(n, helmReleaseSourceRef(n), "chart sourceRef");
+      continue;
+    }
+    if (n.kind === "K8s::Flux::ImagePolicy") {
+      addNamedRef(n, rec(n.attrs?.spec)?.imageRepositoryRef, "K8s::Flux::ImageRepository", "imageRepositoryRef");
+      continue;
+    }
+    if (n.kind === "K8s::Flux::ImageUpdateAutomation") {
+      addSourceRef(n, rec(n.attrs?.spec)?.sourceRef, "sourceRef", "GitRepository");
+      continue;
+    }
+    if (n.kind === "K8s::Flux::Alert") {
+      addNamedRef(n, rec(n.attrs?.spec)?.providerRef, "K8s::Flux::Provider", "providerRef");
+      for (const src of list(rec(n.attrs?.spec)?.eventSources)) {
+        addFluxRef(n, src, "eventSource");
+      }
+      continue;
+    }
+    if (n.kind === "K8s::Argo::Application") {
+      addProject(n, str(rec(n.attrs?.spec)?.project), "project");
+      continue;
+    }
+    if (n.kind === "K8s::Argo::ApplicationSet") {
+      addProject(n, str(rec(rec(rec(n.attrs?.spec)?.template)?.spec)?.project), "template project");
     }
   }
   return out;
@@ -1883,6 +3025,13 @@ function metaStr(node, key) {
   const v = meta?.[key];
   return typeof v === "string" ? v : void 0;
 }
+function destinationNamespace(n) {
+  if (n.kind !== "K8s::Argo::Application") return void 0;
+  const spec = n.attrs?.spec;
+  const dest = spec?.destination;
+  const ns = dest?.namespace;
+  return typeof ns === "string" && ns.length > 0 ? ns : void 0;
+}
 function declaredNamespaces(nodes) {
   const out = /* @__PURE__ */ new Set();
   for (const n of nodes) {
@@ -1893,6 +3042,8 @@ function declaredNamespaces(nodes) {
     }
     const ns = metaStr(n, "namespace");
     if (ns) out.add(ns);
+    const dest = destinationNamespace(n);
+    if (dest) out.add(dest);
   }
   return out;
 }
@@ -2223,9 +3374,9 @@ function enrichedRefs(ir, aws, byId) {
   const producersByName = /* @__PURE__ */ new Map();
   for (const ex of ir.exports ?? []) {
     if (!ex.node || !byId.has(ex.node)) continue;
-    const list = producersByName.get(ex.name) ?? producersByName.set(ex.name, []).get(ex.name);
-    if (isExample(byId.get(ex.node))) list.push(ex.node);
-    else list.unshift(ex.node);
+    const list3 = producersByName.get(ex.name) ?? producersByName.set(ex.name, []).get(ex.name);
+    if (isExample(byId.get(ex.node))) list3.push(ex.node);
+    else list3.unshift(ex.node);
   }
   const exportNames = [...producersByName.keys()].sort((a, b) => b.length - a.length);
   const bridge = (paramId, producers) => {
@@ -2586,9 +3737,12 @@ function logicalKept(before, after) {
   if (after > 0 && after * 3 >= before) return void 0;
   return after === 0 ? `logical projected nothing from ${before} resources \u2014 it is a cloud-topology lens, and this estate declares none of the kinds it nests (behold#74)` : `logical kept ${after} of ${before} resources \u2014 it is a cloud-topology lens, and the rest are kinds it does not nest (behold#74)`;
 }
-function edgelessNote(zoom, ir) {
+function edgelessNote(zoom, ir, detail) {
   if (zoom === "components" || zoom === "logical") return void 0;
   if (ir.nodes.length === 0 || ir.edges.length > 0) return void 0;
+  if (detail !== void 0 && detail < 3) {
+    return "no edges at this detail \u2014 sourceRef/dependsOn and other attrs-derived references only appear at detail 3 (\u2318K \u2192 attributes, or add &detail=3)";
+  }
   return "no edges \u2014 nothing in this estate references anything else";
 }
 var CLUSTER_SCOPED = /* @__PURE__ */ new Set([
@@ -2607,9 +3761,14 @@ function namespaceMismatchNote(nodes) {
   if (!k8s.some((n) => n.attrs?._status === "good")) return void 0;
   return `${pending.length} pending k8s objects declare no metadata.namespace \u2014 if a controller stamps it at apply time (e.g. Flux's targetNamespace), the live read looked in "default", not where they run`;
 }
-function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore) {
+function namespaceJoinNote(joined) {
+  if (joined.length === 0) return void 0;
+  const each = joined.map((j) => `${j.name} in "${j.namespace}"`).join(", ");
+  return `read ${each} \u2014 the namespace the estate's own Kustomization targetNamespace binds, not the app project's own declaration`;
+}
+function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore, detail) {
   const primary = zoom === "logical" && logicalBefore !== void 0 ? logicalKept(logicalBefore, ir.nodes.length) : zoomNote(zoom, ir, compositeEdgesAttached);
-  const notes = [primary, edgelessNote(zoom, ir)].filter((n) => n !== void 0);
+  const notes = [primary, edgelessNote(zoom, ir, detail)].filter((n) => n !== void 0);
   return notes.length ? notes.join(" \xB7 ") : void 0;
 }
 function tierMismatchNote(ir, tiers, currentTier) {
@@ -2713,7 +3872,289 @@ function summarizePlan(plan, byComponent, nonResource) {
 }
 
 // src/render.ts
-import { layoutIr, layoutArchitecture, renderSvg, cardSizes } from "@intentius/pinhole";
+import { layoutIr, layoutArchitecture, renderSvg, cardSizes, registerPack } from "@intentius/pinhole";
+
+// src/icon-packs.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+import { dirname as dirname3, join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var ICON_ROOT = join7(dirname3(fileURLToPath2(import.meta.url)), "..", "web", "icons");
+var cache = /* @__PURE__ */ new Map();
+function unprefix(body) {
+  return body.replace(/\s(?:inkscape|sodipodi):[\w-]+\s*=\s*(["'])[\s\S]*?\1/g, "").replace(/\sxlink:href\s*=/g, " href=");
+}
+var PLATE_FILL = "#ffffff";
+var PLATE_INSET = 0.1;
+var PLATED = /* @__PURE__ */ new Set(["cncf/helm"]);
+function plate(glyph) {
+  const [minX, minY, w, h] = glyph.viewBox.trim().split(/[\s,]+/).map(Number);
+  const side = Math.max(w, h);
+  const cx = minX + w / 2;
+  const cy = minY + h / 2;
+  const k = 1 - 2 * PLATE_INSET;
+  const round = (n) => Math.round(n * 1e4) / 1e4;
+  const ground = `<rect x="${round(cx - side / 2)}" y="${round(cy - side / 2)}" width="${round(side)}" height="${round(side)}" rx="${round(side * 0.18)}" fill="${PLATE_FILL}"/>`;
+  const inset = `translate(${round(cx * (1 - k))} ${round(cy * (1 - k))}) scale(${k})`;
+  return { ...glyph, body: `${ground}<g transform="${inset}">${glyph.body}</g>` };
+}
+function loadIcon(rel) {
+  const hit = cache.get(rel);
+  if (hit) return hit;
+  const raw = readFileSync6(join7(ICON_ROOT, `${rel}.svg`), "utf8");
+  const open = raw.indexOf("<svg");
+  const openEnd = raw.indexOf(">", open);
+  const close = raw.lastIndexOf("</svg");
+  if (open < 0 || openEnd < 0 || close < 0) throw new Error(`malformed vendored icon: ${rel}.svg`);
+  const viewBox = /\bviewBox\s*=\s*(["'])(.*?)\1/.exec(raw.slice(open, openEnd))?.[2];
+  if (!viewBox) throw new Error(`vendored icon has no viewBox: ${rel}.svg`);
+  const bare = { body: unprefix(raw.slice(openEnd + 1, close).trim()), colored: true, viewBox };
+  const glyph = PLATED.has(rel) ? plate(bare) : bare;
+  cache.set(rel, glyph);
+  return glyph;
+}
+var K8S_ICON_BY_KIND = {
+  "K8s::Apiextensions::CustomResourceDefinition": "crd",
+  "K8s::Apps::DaemonSet": "ds",
+  "K8s::Apps::Deployment": "deploy",
+  "K8s::Apps::ReplicaSet": "rs",
+  "K8s::Apps::StatefulSet": "sts",
+  "K8s::Autoscaling::HorizontalPodAutoscaler": "hpa",
+  "K8s::Batch::CronJob": "cronjob",
+  "K8s::Batch::Job": "job",
+  "K8s::Core::ConfigMap": "cm",
+  "K8s::Core::Endpoints": "ep",
+  "K8s::Core::LimitRange": "limits",
+  "K8s::Core::Namespace": "ns",
+  "K8s::Core::PersistentVolume": "pv",
+  "K8s::Core::PersistentVolumeClaim": "pvc",
+  "K8s::Core::Pod": "pod",
+  "K8s::Core::PodTemplate": "pod",
+  "K8s::Core::ReplicationController": "rs",
+  // the pre-ReplicaSet spelling of the same thing
+  "K8s::Core::ResourceQuota": "quota",
+  "K8s::Core::Secret": "secret",
+  "K8s::Core::Service": "svc",
+  "K8s::Core::ServiceAccount": "sa",
+  "K8s::Core::Volume": "vol",
+  "K8s::Networking::Ingress": "ing",
+  "K8s::Networking::IngressClass": "ing",
+  "K8s::Networking::NetworkPolicy": "netpol",
+  "K8s::Rbac::ClusterRole": "c-role",
+  "K8s::Rbac::ClusterRoleBinding": "crb",
+  "K8s::Rbac::Role": "role",
+  "K8s::Rbac::RoleBinding": "rb",
+  "K8s::Storage::StorageClass": "sc"
+};
+var K8S_MARK_BY_PREFIX = [
+  ["K8s::Flux::", "cncf/flux"],
+  ["K8s::Argo::", "cncf/argo"]
+];
+var HELM_MARK_KINDS = /* @__PURE__ */ new Set(["Helm::Chart", "Helm::Release"]);
+function k8sIconFor(kind) {
+  for (const [prefix, rel] of K8S_MARK_BY_PREFIX) {
+    if (kind.startsWith(prefix)) return loadIcon(rel);
+  }
+  const stem = K8S_ICON_BY_KIND[kind];
+  return stem ? loadIcon(`k8s/${stem}`) : void 0;
+}
+function helmIconFor(kind) {
+  return HELM_MARK_KINDS.has(kind) ? loadIcon("cncf/helm") : void 0;
+}
+
+// src/carve-lens.ts
+var SUPPORTED_MAJOR = 1;
+var refuse = (error, remedy) => ({ ok: false, refusal: { error, code: "carve-report", remedy } });
+var HOW_TO_GET_ONE = "Generate one with `chant carve advise --from <terraform-dir> --report report.json` (chant's read-only Terraform peelability advisor), then `behold carve report.json`.";
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parseCarveReport(value) {
+  if (!isRecord(value)) {
+    return refuse("That file isn't a carve report \u2014 its top level isn't a JSON object.", HOW_TO_GET_ONE);
+  }
+  if (!Array.isArray(value.resources)) {
+    return refuse(
+      "That JSON doesn't look like a carve report \u2014 it has no `resources` array.",
+      HOW_TO_GET_ONE
+    );
+  }
+  const bad = value.resources.findIndex(
+    (r) => !isRecord(r) || typeof r.address !== "string" || typeof r.score !== "number" || typeof r.band !== "string"
+  );
+  if (bad >= 0) {
+    return refuse(
+      `That JSON has a \`resources\` array, but entry ${bad} isn't a scored resource (needs a string \`address\`, a numeric \`score\` and a string \`band\`).`,
+      HOW_TO_GET_ONE
+    );
+  }
+  const version = value.version ?? value.schemaVersion;
+  if (version !== void 0) {
+    const major = Number(String(version).split(".")[0]);
+    if (!Number.isFinite(major) || major !== SUPPORTED_MAJOR) {
+      return refuse(
+        `This carve report declares schema version ${String(version)}; behold reads version ${SUPPORTED_MAJOR}.`,
+        "Upgrade behold, or render the report with a behold that speaks its version."
+      );
+    }
+  }
+  return { ok: true, report: value };
+}
+function readCarveReport(path, readFile) {
+  let text;
+  try {
+    text = readFile(path);
+  } catch (err) {
+    return refuse(
+      `Couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`,
+      HOW_TO_GET_ONE
+    );
+  }
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch (err) {
+    return refuse(
+      `${path} isn't valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+      HOW_TO_GET_ONE
+    );
+  }
+  return parseCarveReport(json);
+}
+function statusForBand(band, score) {
+  switch (band) {
+    case "clean leaf":
+      return "good";
+    case "carvable w/ edits":
+      return "warn";
+    case "leave in Terraform":
+      return "neutral";
+    default:
+      return score >= 80 ? "good" : score >= 50 ? "warn" : "neutral";
+  }
+}
+function verdictForStatus(status) {
+  return status === "good" ? "carve now" : status === "warn" ? "boundary work" : "leave in Terraform";
+}
+function tfTypeOf(address, kind) {
+  if (kind === "module" || address.startsWith("module.")) return "module";
+  const dot = address.indexOf(".");
+  return dot > 0 ? address.slice(0, dot) : address;
+}
+var directionOf = (e) => e.direction ?? "inbound";
+function boundaryEdgesOf(r) {
+  const b = r.boundary;
+  if (!b) return [];
+  const list3 = Array.isArray(b) ? b : [...b.inbound ?? [], ...b.outbound ?? []];
+  return list3.filter((e) => isRecord(e) && typeof e.survivor === "string" && typeof e.carved === "string");
+}
+function scoreArithmetic(r) {
+  const b = r.breakdown;
+  if (!b || b.tier === null) return `${r.score} (no known native mapping \u2014 nothing to carve into)`;
+  const p = b.penalties ?? {};
+  const terms = [];
+  if (p.inbound) terms.push(`- 12x${b.inbound ?? 0} inbound`);
+  if (p.outbound) terms.push(`- 4x${b.outbound ?? 0} outbound`);
+  if (p.tier) terms.push(`- 15x${(b.tier ?? 1) - 1} tier${b.tier}`);
+  if (p.dynamic) terms.push(`- 10 dynamic`);
+  if (p.instances) terms.push(`- 3x${(b.instances ?? 1) - 1} instances`);
+  if (!terms.length) return `100 (no penalties) = ${r.score}`;
+  const raw = 100 + Object.values(p).reduce((s, n) => s + (n ?? 0), 0);
+  const clamped = raw !== r.score ? ` (clamped from ${raw})` : "";
+  return `100 ${terms.join(" ")} = ${r.score}${clamped}`;
+}
+function boundaryWorkOf(r) {
+  const b = r.breakdown;
+  if (!b || b.tier === null) return "no known native mapping (unsupported provider/type)";
+  const parts = [];
+  if (b.inbound) parts.push(`${b.inbound} inbound (a data-source patch each)`);
+  if (b.outbound) parts.push(`${b.outbound} outbound (a deferred input each)`);
+  if ((b.tier ?? 1) > 1) parts.push(`tier ${b.tier} map`);
+  if (b.hasDynamic) parts.push("count/for_each/data present");
+  if ((b.instances ?? 1) > 1) parts.push(`${b.instances} instances`);
+  return parts.length ? parts.join(", ") : "clean 1:1 native map, no boundary edges";
+}
+function carveCardFields(node) {
+  const score = node.attrs.score;
+  const carve = node.attrs.carve;
+  if (typeof score !== "number") return void 0;
+  return [
+    { label: "score", value: String(score) },
+    ...typeof carve === "string" ? [{ label: "carve", value: carve }] : []
+  ];
+}
+function carveReportToIr(report) {
+  const resources = report.resources ?? [];
+  const known = new Set(resources.map((r) => r.address));
+  const nodes = resources.map((r) => {
+    const status = statusForBand(r.band, r.score);
+    const b = r.breakdown ?? {};
+    const edges2 = boundaryEdgesOf(r);
+    const patches = edges2.filter((e) => e.carved === r.address && directionOf(e) === "inbound").map((e) => e.survivor);
+    const inputs = edges2.filter((e) => e.carved === r.address && directionOf(e) === "outbound").map((e) => e.survivor);
+    return {
+      id: r.address,
+      kind: tfTypeOf(r.address, r.kind),
+      lexicon: "terraform",
+      attrs: {
+        // The drift palette's channel — `_`-prefixed, so it paints the card and
+        // stays out of both the card's fields and the inspect pane's list.
+        _status: status,
+        score: r.score,
+        carve: verdictForStatus(status),
+        band: r.band,
+        arithmetic: scoreArithmetic(r),
+        boundaryWork: boundaryWorkOf(r),
+        ...r.mapsTo ? { mapsTo: r.mapsTo } : {},
+        tier: b.tier === null || b.tier === void 0 ? "none" : b.tier,
+        inbound: b.inbound ?? 0,
+        outbound: b.outbound ?? 0,
+        instances: b.instances ?? 1,
+        dynamic: b.hasDynamic ?? false,
+        // The predicted diff, when the report carries the edge lists: who needs
+        // a `data` source the moment this is carved, and what becomes a
+        // deploy-time input. Absent (not empty) when the report has no lists —
+        // "none" and "not reported" are different claims.
+        ...patches.length ? { patchOnCarve: patches.join(", ") } : {},
+        ...inputs.length ? { deferredInputs: inputs.join(", ") } : {}
+      }
+    };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const edges = [];
+  for (const r of resources) {
+    for (const e of boundaryEdgesOf(r)) {
+      const direction = directionOf(e);
+      const from = direction === "inbound" ? e.survivor : e.carved;
+      const to = direction === "inbound" ? e.carved : e.survivor;
+      if (!known.has(from) || !known.has(to)) continue;
+      const key = `${from}|${to}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      edges.push({
+        from,
+        to,
+        kind: "ref",
+        viaAttr: direction,
+        ...e.attrs?.length ? { toAttr: e.attrs.join(", ") } : {}
+      });
+    }
+  }
+  const byStack = {};
+  for (const order of ["good", "warn", "neutral"]) {
+    const members = resources.filter((r) => statusForBand(r.band, r.score) === order).map((r) => r.address);
+    if (members.length) byStack[verdictForStatus(order)] = members;
+  }
+  return { nodes, edges, groups: { byStack } };
+}
+function carveNote(report, ir) {
+  const counts = Object.entries(report.bands ?? {}).filter(([, n]) => n > 0).map(([band, n]) => `${n} ${band}`).join(" \xB7 ");
+  const head = `chant carve advisory${report.from ? ` for ${report.from}` : ""}${counts ? ` \u2014 ${counts}` : ""}`;
+  if (ir.edges.length) return `${head}. Read-only: nothing is emitted, patched, or applied.`;
+  return `${head}. This report carries per-resource boundary COUNTS but no edge lists, so no boundary edges are drawn (chant#1636). Read-only: nothing is emitted, patched, or applied.`;
+}
+
+// src/render.ts
+registerPack({ lexicon: "k8s", iconFor: k8sIconFor });
+registerPack({ lexicon: "helm", iconFor: helmIconFor });
+registerPack({ lexicon: "terraform", iconFor: () => void 0, fields: carveCardFields });
 function renderArchitecture(ir, byContainer, opts = {}) {
   const spread = Math.min(1.5, ir.edges.length / Math.max(ir.nodes.length, 1));
   const layout = layoutArchitecture(ir, byContainer, {
@@ -2744,6 +4185,59 @@ function renderGraph(ir, opts = {}) {
   });
   return { svg };
 }
+function renderBanded(ir, opts = {}) {
+  const bands = ir.groups.byStack ?? {};
+  const size = footprints(ir);
+  const dims = (id) => size.get(id) ?? { w: NODE_W, h: NODE_H };
+  const ids = ir.nodes.map((n) => n.id);
+  const cellW = Math.max(NODE_W, ...ids.map((id) => dims(id).w));
+  const cellH = Math.max(NODE_H, ...ids.map((id) => dims(id).h));
+  const GAP = 28;
+  const PAD = 24;
+  const TITLE = 34;
+  const BAND_GAP = 26;
+  const cols = Math.max(1, Math.round(Math.sqrt(ids.length * (cellH + GAP) * 2 / (cellW + GAP))));
+  const contentW = cols * cellW + (cols - 1) * GAP;
+  const panelW = contentW + PAD * 2;
+  const claimed = new Set(Object.values(bands).flat());
+  const orphans = ids.filter((id) => !claimed.has(id));
+  const panels = [
+    ...Object.entries(bands).map(([title, members]) => [title, members.filter((id) => size.has(id))]),
+    ...orphans.length ? [["unbanded", orphans]] : []
+  ].filter(([, members]) => members.length > 0);
+  const statusOf = new Map(ir.nodes.map((n) => [n.id, n.attrs?._status]));
+  const placed = [];
+  const boxes = [];
+  let top = 0;
+  for (const [title, members] of panels) {
+    const rows = Math.ceil(members.length / cols);
+    const panelH = TITLE + PAD + rows * cellH + (rows - 1) * GAP + PAD;
+    members.forEach((id, i) => {
+      placed.push({
+        id,
+        x: PAD + i % cols * (cellW + GAP) + cellW / 2,
+        y: top + TITLE + PAD + Math.floor(i / cols) * (cellH + GAP) + cellH / 2
+      });
+    });
+    const statuses = new Set(members.map((id) => statusOf.get(id)));
+    const status = statuses.size === 1 ? [...statuses][0] : void 0;
+    boxes.push({ title, x: panelW / 2, y: top + panelH / 2, w: panelW, h: panelH, ...status ? { status } : {} });
+    top += panelH + BAND_GAP;
+  }
+  const height = Math.max(1, top - BAND_GAP);
+  const layout = {
+    width: panelW,
+    height,
+    nodes: placed.map((p) => ({ id: p.id, x: p.x, y: height - p.y }))
+  };
+  const svg = renderSvg(ir, layout, {
+    fit: true,
+    hideTitle: true,
+    groups: boxes.map((b) => ({ ...b, y: height - b.y })),
+    ...opts.theme ? { theme: opts.theme } : {}
+  });
+  return { svg };
+}
 var NODE_W = 175;
 var NODE_H = 104;
 function footprints(ir) {
@@ -2908,9 +4402,374 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
   layout.height = Math.max(...nodes.map((n) => n.y + hOf(n) / 2)) + pad;
 }
 
+// src/carve-actions.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { isAbsolute, join as join9, relative, resolve as resolve2, sep } from "node:path";
+
+// src/layout.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync7, renameSync, rmSync, writeFileSync as writeFileSync2, accessSync, constants } from "node:fs";
+import { join as join8 } from "node:path";
+var LAYOUT_DIR = ".behold";
+var LAYOUT_FILE = "layout.json";
+var MAX_BODY_BYTES = 64 * 1024;
+var MAX_FILE_BYTES = 256 * 1024;
+var MAX_IDS_PER_LENS = 2e3;
+var MAX_LENSES = 64;
+var MAX_ID_LENGTH = 512;
+var MAX_LENS_LENGTH = 128;
+var NUM = ["dx", "dy", "dw", "dh"];
+function slug(s) {
+  return String(s ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
+}
+function normalizeLens(raw) {
+  if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_LENS_LENGTH) return null;
+  const parts = raw.split("+").map((p) => slug(p)).filter((p) => p && p !== "unknown");
+  if (!parts.length) return null;
+  const key = parts.join("+");
+  return key === "__proto__" || key === "constructor" || key === "prototype" ? null : key;
+}
+function normalizeDeltas(raw) {
+  const out = {};
+  if (!raw || typeof raw !== "object") return out;
+  for (const [id, d] of Object.entries(raw)) {
+    if (!id || id.length > MAX_ID_LENGTH || id === "__proto__" || !d || typeof d !== "object") continue;
+    const clean = {};
+    for (const k of NUM) {
+      const v = Number(d[k]);
+      if (Number.isFinite(v) && v !== 0) clean[k] = v;
+    }
+    if (Object.keys(clean).length) out[id] = clean;
+    if (Object.keys(out).length >= MAX_IDS_PER_LENS) break;
+  }
+  return out;
+}
+function lensFromQuery(params) {
+  const zoom = params.get("components") === "1" ? "components" : params.get("logical") === "1" ? "logical" : params.get("runtime") === "1" ? "runtime" : { 1: "composites", 2: "resources", 3: "attributes" }[Number(params.get("detail") ?? 2)] ?? "resources";
+  const stack = params.get("stack");
+  return [slug(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug(`stack-${stack}`) : null].filter(Boolean).join("+");
+}
+function layoutPath(projectDir) {
+  return join8(projectDir, LAYOUT_DIR, LAYOUT_FILE);
+}
+function unwritableReason(projectDir) {
+  if (!projectDir || !existsSync6(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
+  try {
+    accessSync(projectDir, constants.W_OK);
+  } catch {
+    return "the served project directory is read-only";
+  }
+  return null;
+}
+function readLayoutFile(projectDir) {
+  const empty = { version: 1, lenses: {} };
+  const file = layoutPath(projectDir);
+  try {
+    if (!existsSync6(file)) return empty;
+    const raw = readFileSync7(file, "utf8");
+    if (raw.length > MAX_FILE_BYTES) return empty;
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || !parsed.lenses || typeof parsed.lenses !== "object") return empty;
+    const lenses = {};
+    for (const [lens, deltas] of Object.entries(parsed.lenses)) {
+      const key = normalizeLens(lens);
+      if (!key) continue;
+      const clean = normalizeDeltas(deltas);
+      if (Object.keys(clean).length) lenses[key] = clean;
+      if (Object.keys(lenses).length >= MAX_LENSES) break;
+    }
+    return { version: 1, lenses };
+  } catch {
+    return empty;
+  }
+}
+function readLens(projectDir, lens) {
+  const key = normalizeLens(lens);
+  if (!key) return {};
+  return readLayoutFile(projectDir).lenses[key] ?? {};
+}
+var LayoutTooLarge = class extends Error {
+};
+function writeLens(projectDir, lens, deltas) {
+  const key = normalizeLens(lens);
+  if (!key) throw new Error(`not a lens key: ${String(lens)}`);
+  const clean = normalizeDeltas(deltas);
+  const current = readLayoutFile(projectDir);
+  const lenses = { ...current.lenses };
+  if (Object.keys(clean).length) lenses[key] = clean;
+  else delete lenses[key];
+  if (Object.keys(lenses).length > MAX_LENSES) throw new LayoutTooLarge(`a layout sidecar holds at most ${MAX_LENSES} lenses`);
+  const file = layoutPath(projectDir);
+  if (!Object.keys(lenses).length) {
+    rmSync(file, { force: true });
+    return { lens: key, deltas: clean, bytes: 0 };
+  }
+  const body = JSON.stringify({ version: 1, lenses }, null, 2) + "\n";
+  if (body.length > MAX_FILE_BYTES) throw new LayoutTooLarge(`a layout sidecar is capped at ${MAX_FILE_BYTES} bytes`);
+  mkdirSync2(join8(projectDir, LAYOUT_DIR), { recursive: true });
+  const tmp = `${file}.tmp`;
+  writeFileSync2(tmp, body, "utf8");
+  renameSync(tmp, file);
+  return { lens: key, deltas: clean, bytes: body.length };
+}
+function nodeTransform(base, d) {
+  const dx = d.dx || 0;
+  const dy = d.dy || 0;
+  if (!dx && !dy) return base;
+  return `translate(${dx}, ${dy}) ${base}`.trim();
+}
+function pathAnchors(d) {
+  const n = String(d || "").match(/-?\d*\.?\d+(?:e[-+]?\d+)?/gi);
+  if (!n || n.length < 4) return null;
+  return { sx: +n[0], sy: +n[1], ex: +n[n.length - 2], ey: +n[n.length - 1] };
+}
+function straightEdge(anchors, from, to) {
+  const { sx, sy, ex, ey } = anchors;
+  return `M ${sx + (from && from.dx || 0)} ${sy + (from && from.dy || 0)} L ${ex + (to && to.dx || 0)} ${ey + (to && to.dy || 0)}`;
+}
+function unescapeAttr(v) {
+  return v.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function attrOf(tag, name) {
+  const m = new RegExp(`\\b${name}="([^"]*)"`).exec(tag);
+  return m ? unescapeAttr(m[1]) : null;
+}
+function groupEnd(svg, from) {
+  const tok = /<g\b|<\/g\s*>/g;
+  tok.lastIndex = from;
+  let depth = 1;
+  let m;
+  while (m = tok.exec(svg)) {
+    if (m[0][1] === "/") {
+      depth--;
+      if (!depth) return m.index;
+    } else depth++;
+  }
+  return svg.length;
+}
+function applyLayoutToSvg(svg, deltas) {
+  const moved = {};
+  for (const [id, d] of Object.entries(normalizeDeltas(deltas))) if (d.dx || d.dy) moved[id] = d;
+  if (!Object.keys(moved).length || typeof svg !== "string" || !svg) return { svg, applied: 0 };
+  const placed = /* @__PURE__ */ new Set();
+  let out = svg.replace(/<g\b([^>]*?)(\/?)>/g, (tag, attrs, selfClose) => {
+    const id = attrOf(attrs, "data-node-id");
+    const d = id ? moved[id] : void 0;
+    if (!id || !d) return tag;
+    placed.add(id);
+    const base = /\btransform="([^"]*)"/.exec(attrs);
+    const next = nodeTransform(base ? base[1] : "", d);
+    if (base) return `<g${attrs.replace(base[0], () => `transform="${next}"`)}${selfClose}>`;
+    return `<g${attrs}${/\s$/.test(attrs) ? "" : " "}transform="${next}"${selfClose}>`;
+  });
+  out = reanchorEdges(out, moved);
+  return { svg: out, applied: placed.size };
+}
+function reanchorEdges(svg, moved) {
+  const open = /<g\b([^>]*\bdata-edge-from="[^"]*"[^>]*?)(\/?)>/g;
+  let out = "";
+  let cursor = 0;
+  let m;
+  while (m = open.exec(svg)) {
+    const bodyStart = m.index + m[0].length;
+    if (m[2] === "/") continue;
+    const bodyEnd = groupEnd(svg, bodyStart);
+    open.lastIndex = bodyEnd;
+    const from = moved[attrOf(m[1], "data-edge-from") ?? ""];
+    const to = moved[attrOf(m[1], "data-edge-to") ?? ""];
+    if (!from && !to) continue;
+    const body = svg.slice(bodyStart, bodyEnd);
+    const first = /<path\b[^>]*\bd="([^"]*)"/.exec(body);
+    const anchors = first ? pathAnchors(first[1]) : null;
+    if (!anchors) continue;
+    const d = straightEdge(anchors, from, to);
+    out += svg.slice(cursor, bodyStart) + body.replace(/(<path\b[^>]*\bd=")([^"]*)(")/g, (_t, a, _d, z) => a + d + z);
+    cursor = bodyEnd;
+  }
+  return out + svg.slice(cursor);
+}
+
+// src/carve-actions.ts
+var MAX_ARTIFACT_BYTES = 64 * 1024;
+var MAX_ARTIFACTS = 24;
+var MAX_OUTPUT_BYTES = 32 * 1024;
+var refuse2 = (code, error, remedy) => ({
+  ok: false,
+  refusal: { error, code, remedy }
+});
+var BUILD_CAVEAT = 'The gate shown is `chant lint`, not `chant build`. `carve emit` folds the bucket\'s versioning and public-access-block sub-resources into the carve set but does not yet carry them as native props, so `chant build` fails two AWS policy rules on source the advisor scored 88 (chant#1637). example-carve/README.md, "Known rough edge in emit", has the full statement.';
+function insideDemo(root, p) {
+  const rel = relative(resolve2(root), resolve2(p));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function selectFromReport(report, raw) {
+  if (typeof raw !== "string" || !raw || raw.length > 512) return null;
+  return (report?.resources ?? []).some((r) => r.address === raw) ? raw : null;
+}
+function carveWriteBlock(demo) {
+  if (!demo) {
+    return "this server isn't running a carve demo \u2014 the carve actions only exist inside a `behold demo carve` copy";
+  }
+  if (!existsSync7(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
+  if (!insideDemo(demo.root, demo.out)) return "the carve output directory is outside the demo copy";
+  return unwritableReason(demo.root);
+}
+function readArtifacts(demo, dir, filter) {
+  const out = [];
+  const walk = (d, depth) => {
+    if (out.length >= MAX_ARTIFACTS || depth > 2) return;
+    let entries;
+    try {
+      entries = readdirSync3(d).sort();
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (out.length >= MAX_ARTIFACTS) return;
+      if (name === "node_modules" || name.startsWith(".")) continue;
+      const full = join9(d, name);
+      let st;
+      try {
+        st = statSync2(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(full, depth + 1);
+        continue;
+      }
+      const rel = relative(demo.root, full).split(sep).join("/");
+      if (!filter(rel)) continue;
+      let text = "";
+      try {
+        text = readFileSync8(full, "utf8");
+      } catch {
+        continue;
+      }
+      const truncated = text.length > MAX_ARTIFACT_BYTES;
+      out.push({
+        path: rel,
+        kind: (name.split(".").pop() ?? "").toLowerCase(),
+        bytes: st.size,
+        text: truncated ? text.slice(0, MAX_ARTIFACT_BYTES) : text,
+        truncated
+      });
+    }
+  };
+  walk(dir, 0);
+  return out;
+}
+function carveSlug(select) {
+  return select.replace(/[^A-Za-z0-9_]+/g, "-");
+}
+var clip = (s) => s.length > MAX_OUTPUT_BYTES ? s.slice(0, MAX_OUTPUT_BYTES) + "\n\u2026 (truncated)" : s;
+function shortenIn(arg, root) {
+  return arg.startsWith(root + sep) ? arg.slice(root.length + 1) : arg === root ? "." : arg;
+}
+function merge(r, root) {
+  const joined = stripAnsi([r.stdout, r.stderr].filter((s) => s.trim()).join("\n").trim());
+  return clip(joined.split(root + sep).join("").split(root).join("."));
+}
+async function runCarveEmit(demo, select) {
+  const block = carveWriteBlock(demo);
+  if (block) return refuse2("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  mkdirSync3(demo.out, { recursive: true });
+  const reportFile = join9(demo.out, `${carveSlug(select)}-boundary.json`);
+  const args = [
+    "carve",
+    "emit",
+    "--from",
+    demo.from,
+    ...demo.state ? ["--state", demo.state] : [],
+    "--select",
+    select,
+    "--output",
+    demo.out,
+    "--report",
+    reportFile
+  ];
+  const run3 = await runChantRaw(args, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  const output = merge(run3, demo.root);
+  if (run3.code !== 0) {
+    return refuse2(
+      "carve-action",
+      `chant carve emit exited ${run3.code}: ${output || "(no output)"}`,
+      "The offline emit needs `@cdktf/hcl2json` in the demo copy and the demo's own chant install \u2014 `npm install` in the copy's `app/` and re-run `behold demo carve`."
+    );
+  }
+  let boundary = null;
+  try {
+    boundary = JSON.parse(readFileSync8(reportFile, "utf8"));
+  } catch {
+  }
+  const lintPath = relative(demo.project, join9(demo.out, "src")).split(sep).join("/");
+  const lintArgs = ["lint", lintPath];
+  const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  return {
+    ok: true,
+    select,
+    command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
+    output,
+    // Emitted source first, scaffolding after: `src/assets.ts` is the thing the
+    // step is about, and a package.json sorting above it buries the answer.
+    artifacts: readArtifacts(demo, demo.out, (rel) => /\.(ts|json)$/.test(rel) && !rel.endsWith("tsconfig.json")).sort(
+      (a, b) => Number(!/\/src\//.test(a.path)) - Number(!/\/src\//.test(b.path))
+    ),
+    boundary,
+    lint: { ok: lint.code === 0, code: lint.code, command: `chant ${lintArgs.join(" ")}`, output: merge(lint, demo.root) },
+    buildCaveat: BUILD_CAVEAT
+  };
+}
+async function runCarveBridge(demo, select) {
+  const block = carveWriteBlock(demo);
+  if (block) return refuse2("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  mkdirSync3(demo.out, { recursive: true });
+  const args = [
+    "carve",
+    "bridge",
+    "--from",
+    demo.from,
+    ...demo.state ? ["--state", demo.state] : [],
+    "--select",
+    select,
+    "--output",
+    demo.out
+  ];
+  const run3 = await runChantRaw(args, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  const output = merge(run3, demo.root);
+  if (run3.code !== 0) {
+    return refuse2(
+      "carve-action",
+      `chant carve bridge exited ${run3.code}: ${output || "(no output)"}`,
+      "Run the Emit step first \u2014 bridge reads the carve manifest emit leaves in the output directory."
+    );
+  }
+  const slug3 = carveSlug(select);
+  const all = readArtifacts(demo, demo.out, (rel) => /\.(tf|md|patch)$/.test(rel));
+  return {
+    ok: true,
+    select,
+    command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
+    output,
+    runbook: all.find((a) => a.path.endsWith(`${slug3}-runbook.md`)) ?? null,
+    proposals: all.filter((a) => !a.path.endsWith(`${slug3}-runbook.md`))
+  };
+}
+
 // src/ops.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync5, existsSync as existsSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync9, existsSync as existsSync8 } from "node:fs";
+import { join as join10 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -2932,11 +4791,11 @@ function discoverOps(projectDir) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const sub of ["ops", "src", "."]) {
-    const dir = join7(projectDir, sub);
-    if (!existsSync6(dir)) continue;
-    for (const f of readdirSync3(dir)) {
+    const dir = join10(projectDir, sub);
+    if (!existsSync8(dir)) continue;
+    for (const f of readdirSync4(dir)) {
       if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync5(join7(dir, f), "utf8");
+      const content = readFileSync9(join10(dir, f), "utf8");
       const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
       if (!name || seen.has(name)) continue;
       seen.add(name);
@@ -3049,6 +4908,133 @@ function classifyHealth(status) {
   if (HEALTHY.test(text)) return "healthy";
   return "unknown";
 }
+function rec2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
+}
+function str2(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function statusTree(o) {
+  const attrs = rec2(o.attributes);
+  if (!attrs) return void 0;
+  return rec2(attrs.status) ?? attrs;
+}
+var ARGO_HEALTH = {
+  Healthy: "healthy",
+  Degraded: "degraded",
+  Progressing: "progressing",
+  Suspended: "progressing",
+  Missing: "progressing",
+  Unknown: "unknown"
+};
+var ARGO_SYNC = {
+  Synced: "healthy",
+  OutOfSync: "progressing",
+  Unknown: "unknown"
+};
+var ARGO_ERROR_CONDITION = /Error$/;
+function argoErrorMessage(tree) {
+  const conditions = tree?.conditions;
+  if (!Array.isArray(conditions)) return void 0;
+  for (const c of conditions) {
+    const type = str2(rec2(c)?.type);
+    if (!type || !ARGO_ERROR_CONDITION.test(type)) continue;
+    const message = str2(rec2(c)?.message);
+    if (message) return message;
+  }
+  return void 0;
+}
+function argoVerdict(o) {
+  if (o.type !== "K8s::Argo::Application") return void 0;
+  const tree = statusTree(o);
+  let health = str2(rec2(tree?.health)?.status);
+  let sync = str2(rec2(tree?.sync)?.status);
+  if (!health && !sync) {
+    const word = str2(o.status);
+    if (word === "READY") {
+      health = "Healthy";
+      sync = "Synced";
+    } else if (word && word in ARGO_SYNC) {
+      sync = word;
+      health = "Healthy";
+    } else if (word && word in ARGO_HEALTH) health = word;
+  }
+  const verdicts = [health ? ARGO_HEALTH[health] : void 0, sync ? ARGO_SYNC[sync] : void 0].filter(
+    (v) => v !== void 0
+  );
+  if (verdicts.length === 0) return void 0;
+  const pair = [health ? `health=${health}` : void 0, sync ? `sync=${sync}` : void 0].filter(Boolean).join(", ");
+  const message = argoErrorMessage(tree);
+  const detail = message ? `${pair}: ${message}` : pair;
+  for (const rung of ["degraded", "progressing", "unknown"]) {
+    if (verdicts.includes(rung)) return { health: rung, detail };
+  }
+  return { health: "healthy", detail };
+}
+var FLUX_PENDING_REASON = /^(progressing|reconciling)/i;
+function readyFromConditions(tree) {
+  const conditions = tree?.conditions;
+  if (!Array.isArray(conditions)) return void 0;
+  for (const c of conditions) {
+    const cond = rec2(c);
+    if (!cond || cond.type !== "Ready") continue;
+    const status = str2(cond.status);
+    if (status !== "True" && status !== "False" && status !== "Unknown") continue;
+    return { status, reason: str2(cond.reason) };
+  }
+  return void 0;
+}
+function readyFromChantConditions(o) {
+  const conditions = rec2(o.attributes)?.conditions;
+  if (!Array.isArray(conditions)) return void 0;
+  for (const c of conditions) {
+    if (typeof c !== "string") continue;
+    const m = /^Ready(?:=([^:]*))?(?::|$)/.exec(c.trim());
+    if (!m) continue;
+    const reason = m[1]?.trim() || void 0;
+    return { status: reason && FLUX_PENDING_REASON.test(reason) ? "Unknown" : "False", reason };
+  }
+  return void 0;
+}
+function readyFromStatusWord(o) {
+  const word = str2(o.status);
+  if (!word || word === "PRESENT") return void 0;
+  if (word === "READY") return { status: "True" };
+  if (word === "NOT-READY") return { status: "False" };
+  return { status: FLUX_PENDING_REASON.test(word) ? "Unknown" : "False", reason: word };
+}
+function describeReady(ready) {
+  return `Ready=${ready.status}${ready.reason ? ` (${ready.reason})` : ""}`;
+}
+function revisionVerdict(tree) {
+  const applied = str2(tree?.lastAppliedRevision);
+  const attempted = str2(tree?.lastAttemptedRevision);
+  if (!applied || !attempted || applied === attempted) return void 0;
+  return { health: "progressing", detail: `applied ${applied}, attempted ${attempted}` };
+}
+var FLUX_TYPE_PREFIX = "K8s::Flux::";
+function fluxVerdict(o) {
+  if (!o.type?.startsWith(FLUX_TYPE_PREFIX)) return void 0;
+  const tree = statusTree(o);
+  const ready = readyFromConditions(tree) ?? readyFromChantConditions(o) ?? readyFromStatusWord(o);
+  if (ready?.status === "False") return { health: "degraded", detail: describeReady(ready) };
+  if (ready?.status === "Unknown") return { health: "progressing", detail: describeReady(ready) };
+  if (ready?.status === "True") return revisionVerdict(tree) ?? { health: "healthy", detail: describeReady(ready) };
+  const conditions = tree?.conditions;
+  const reconciling = Array.isArray(conditions) && conditions.some((c) => {
+    const cond = rec2(c);
+    return cond?.type === "Reconciling" && cond.status === "True";
+  });
+  if (reconciling) return { health: "progressing", detail: "Reconciling=True" };
+  if (!str2(o.status) || o.status === "PRESENT") {
+    return { health: "progressing", detail: "no Ready condition yet" };
+  }
+  return void 0;
+}
+function classifyObservedHealth(observed) {
+  if (!observed) return { health: "unknown" };
+  return argoVerdict(observed) ?? fluxVerdict(observed) ?? { health: classifyHealth(observed.status) };
+}
 
 // src/apply.ts
 var PROGRESS_EVENT_TYPES = /* @__PURE__ */ new Set([
@@ -3335,23 +5321,23 @@ var OpRunner = class {
 
 // src/substrates.ts
 import { spawn as spawn3 } from "node:child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
+import { join as join11 } from "node:path";
 import { platform } from "node:os";
 function probe(cmd, args) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve8) => {
     let out = "";
     let proc;
     try {
       proc = spawn3(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve4({ code: 127, out: "" });
+      resolve8({ code: 127, out: "" });
       return;
     }
     proc.stdout.on("data", (d) => out += d);
     proc.stderr.on("data", (d) => out += d);
-    proc.on("error", () => resolve4({ code: 127, out }));
-    proc.on("close", (code) => resolve4({ code: code ?? 1, out }));
+    proc.on("error", () => resolve8({ code: 127, out }));
+    proc.on("close", (code) => resolve8({ code: code ?? 1, out }));
   });
 }
 async function dockerAvailable() {
@@ -3364,11 +5350,11 @@ async function dockerRunning(nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync7(join8(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync9(join11(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync6(join8(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync10(join11(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -3418,7 +5404,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync7(join8(projectDir, marker))) continue;
+    if (!existsSync9(join11(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -3448,7 +5434,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync7(join8(projectDir, ".github", "workflows"))) {
+  if (existsSync9(join11(projectDir, ".github", "workflows"))) {
     const gh = await probe("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -3461,7 +5447,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync6(join8(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync10(join11(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -3473,8 +5459,8 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
   }
   if (lexicons.includes("helm")) {
     const helm = await probe("helm", ["version", "--short"]);
-    const ambient = helm.code === 0 && !boundContext ? await probe("kubectl", ["config", "current-context"]) : { code: 127, out: "" };
-    const ctx = boundContext ?? (ambient.code === 0 ? ambient.out.trim() : "");
+    const ambient = helm.code === 0 && !boundContext ? await ambientContext() : void 0;
+    const ctx = boundContext ?? ambient ?? "";
     subs.push({
       name: "helm",
       label: "Helm",
@@ -3524,9 +5510,9 @@ function pickAutoSyncOps(mode, ops, running, movedLexicons, suspended = /* @__PU
 }
 
 // src/history.ts
-import { execFile as execFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
-var execFileAsync = promisify3(execFile3);
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync = promisify2(execFile2);
 var SEP = "";
 function parseGitLog(stdout) {
   return stdout.split("\n").map((l) => l.trim()).filter(Boolean).map((line) => {
@@ -3565,6 +5551,8 @@ async function openRollbackBranches(projectDir, env) {
 }
 
 // src/estate.ts
+import { statSync as statSync3 } from "node:fs";
+import { join as join12, resolve as resolve3, sep as sep2 } from "node:path";
 import { composeStacks, shortStackNames } from "@intentius/pinhole";
 async function composeEstate(projectDirs, opts = {}) {
   const names = shortStackNames(projectDirs);
@@ -3573,23 +5561,126 @@ async function composeEstate(projectDirs, opts = {}) {
   );
   return composeStacks(stacks);
 }
-var firstLine = (e) => {
+var firstLine2 = (e) => {
   const msg = e instanceof Error ? e.message : String(e);
   const m = msg.match(/exited \d+:\s*([\s\S]*)/);
   return (m ? m[1] : msg).split("\n")[0].trim().slice(0, 160);
 };
+function namespaceRuntimeOwners(name, ir) {
+  const own = new Set(ir.nodes.map((n) => n.id));
+  for (const n of ir.nodes) {
+    if (n.runtimeOwner && own.has(n.runtimeOwner)) n.runtimeOwner = `${name}/${n.runtimeOwner}`;
+  }
+  return ir;
+}
+var NAMESPACE_JOIN_FLOOR = "0.44.5";
+var rec3 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+var str3 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
+var realIsDir = (p) => {
+  try {
+    return statSync3(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+function declaredNamespaceBindings(ir) {
+  const out = [];
+  for (const n of ir.nodes) {
+    if (n.kind !== "K8s::Flux::Kustomization") continue;
+    const spec = rec3(n.attrs?.spec);
+    const namespace = str3(spec?.targetNamespace);
+    const path = str3(spec?.path);
+    if (namespace && path) out.push({ path, namespace });
+  }
+  return out;
+}
+function awaitsNamespaceBinding(ir) {
+  const namespaced = ir.nodes.filter((n) => n.lexicon === "k8s" && !CLUSTER_SCOPED.has(n.kind ?? ""));
+  if (namespaced.length === 0) return false;
+  return namespaced.every((n) => !str3(rec3(n.attrs?.metadata)?.namespace));
+}
+function declaredSegments(path) {
+  if (path.startsWith("/")) return void 0;
+  const segs = path.split("/").filter((s) => s !== "" && s !== ".");
+  if (segs.length === 0 || segs.includes("..")) return void 0;
+  return segs;
+}
+function pathAlignment(declared, dir, isDir = realIsDir) {
+  const want = declaredSegments(declared);
+  if (!want) return 0;
+  const root = resolve3(dir);
+  const have = root.split(sep2).filter(Boolean);
+  for (let k = Math.min(want.length, have.length); k >= 1; k--) {
+    if (!have.slice(-k).every((s, i) => s === want[i])) continue;
+    if (!isDir(join12(root, ...want.slice(k)))) continue;
+    return k;
+  }
+  return 0;
+}
+function joinNamespaceBindings(members, isDir = realIsDir) {
+  const bindings = members.flatMap(
+    (m) => m.ir ? declaredNamespaceBindings(m.ir).map((b) => ({ ...b, declaredBy: m.dir })) : []
+  );
+  if (bindings.length === 0) return [];
+  const awaiting = members.filter((m) => m.ir && awaitsNamespaceBinding(m.ir));
+  if (awaiting.length === 0) return [];
+  const best = /* @__PURE__ */ new Map();
+  for (const b of bindings) {
+    let winner;
+    let tied = false;
+    for (const m of awaiting) {
+      if (m.dir === b.declaredBy) continue;
+      const score = pathAlignment(b.path, m.dir, isDir);
+      if (score === 0) continue;
+      if (!winner || score > winner.score) {
+        winner = { dir: m.dir, score };
+        tied = false;
+      } else if (score === winner.score) {
+        tied = true;
+      }
+    }
+    if (!winner || tied) continue;
+    const prev = best.get(winner.dir);
+    if (prev === "ambiguous") continue;
+    const join18 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join18 });
+    else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join18 });
+  }
+  return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
+}
+async function estateNamespaceScopes(projectDirs, opts, isDir = realIsDir) {
+  if (projectDirs.length < 2) return /* @__PURE__ */ new Map();
+  const { live: _live, overlay: _overlay, namespace: _namespace, ...src } = opts;
+  const irs = await Promise.all(projectDirs.map((dir) => graphIr(dir, { ...src, detail: 3 }).catch(() => void 0)));
+  const scopes = /* @__PURE__ */ new Map();
+  for (const j of joinNamespaceBindings(projectDirs.map((dir, i) => ({ dir, ir: irs[i] })), isDir)) {
+    if (!meetsFloor(resolveChant(j.dir).version, NAMESPACE_JOIN_FLOOR)) continue;
+    scopes.set(j.dir, j.namespace);
+  }
+  return scopes;
+}
+function withoutJoinedMembers(nodes, joined) {
+  if (joined.length === 0) return [...nodes];
+  return nodes.filter((n) => !joined.some((j) => n.id.startsWith(`${j.name}/`)));
+}
 async function composeEstateOverlay(projectDirs, opts, classify) {
   const names = shortStackNames(projectDirs);
   const unobserved = [];
   const dropped = [];
+  const joined = [];
   const stacks = new Array(projectDirs.length);
+  const scopes = await estateNamespaceScopes(projectDirs, opts);
   await Promise.all(
     projectDirs.map(async (dir, i) => {
       const name = names[i];
+      const namespace = scopes.get(dir);
       try {
-        stacks[i] = { name, ir: classify(await graphIr(dir, { ...opts, live: true, overlay: true })) };
+        const live = { ...opts, live: true, overlay: true, ...namespace ? { namespace } : {} };
+        stacks[i] = { name, ir: namespaceRuntimeOwners(name, classify(await graphIr(dir, live))) };
+        if (namespace) joined.push({ name, namespace });
       } catch (err) {
-        const reason = firstLine(err);
+        const reason = firstLine2(err);
         try {
           const { env: _env, live: _live, overlay: _overlay, ...srcOpts } = opts;
           const src = await graphIr(dir, srcOpts);
@@ -3597,7 +5688,7 @@ async function composeEstateOverlay(projectDirs, opts, classify) {
           stacks[i] = { name, ir: src };
           unobserved.push({ name, reason });
         } catch (err2) {
-          dropped.push({ name, reason: firstLine(err2) });
+          dropped.push({ name, reason: firstLine2(err2) });
         }
       }
     })
@@ -3608,13 +5699,16 @@ async function composeEstateOverlay(projectDirs, opts, classify) {
     observed: present.length - unobserved.length,
     total: projectDirs.length,
     unobserved,
-    dropped
+    dropped,
+    // Concurrent reads finish in whatever order the clusters answer; the note
+    // this feeds should read the same twice.
+    joined: joined.sort((a, b) => a.name.localeCompare(b.name))
   };
 }
 
 // src/events.ts
-import { watch, existsSync as existsSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { watch, existsSync as existsSync10 } from "node:fs";
+import { join as join13 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -3632,7 +5726,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync8(join9(projectDir, "src")) ? join9(projectDir, "src") : projectDir;
+  const dir = existsSync10(join13(projectDir, "src")) ? join13(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -3740,19 +5834,21 @@ import { renderMorphHtml, layoutIr as layoutIr2 } from "@intentius/pinhole";
 function safeJson(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c");
 }
+var LANES_MONO = `ui-monospace, "SF Mono", SFMono-Regular, "Cascadia Code", "JetBrains Mono", "IBM Plex Mono", Menlo, Consolas, monospace`;
 var LANES_CSS = `
-body { background: var(--bg, #0d1117); color: var(--fg, #e6edf3); padding-bottom: 150px; }
-#behold-lanes { position: fixed; left: 0; right: 0; bottom: 0; background: var(--bg, #0d1117);
-  border-top: 1px solid var(--line, #30363d); padding: 8px 12px 10px; font: 12px ui-sans-serif, system-ui, sans-serif; color: var(--muted, #8b949e); }
+body { background: var(--bg, #1e1e2e); color: var(--fg, #cdd6f4); padding-bottom: 150px; }
+#behold-lanes { position: fixed; left: 0; right: 0; bottom: 0; background: var(--bg, #1e1e2e);
+  border-top: 1px solid var(--line, #3b3c4a); padding: 8px 12px 10px; font: 11px/1.5 ${LANES_MONO}; color: var(--muted, #777a8c); }
 #behold-lanes .hd { display: flex; gap: 14px; align-items: baseline; margin-bottom: 4px; }
-#behold-lanes .hd .rt { color: var(--foreign, #d29922); }
-#behold-lanes .hd a { color: var(--pending, #58a6ff); text-decoration: none; margin-left: auto; }
+#behold-lanes .hd .rt { color: var(--foreign, #f9e2af); }
+#behold-lanes .hd a { color: var(--pending, #89b4fa); text-decoration: none; margin-left: auto; }
 #behold-lanes canvas { display: block; width: 100%; cursor: pointer; }
 #behold-diff { position: fixed; right: 12px; bottom: 156px; width: 260px; max-height: 40vh; overflow: auto;
-  background: var(--panel, #161b22); border: 1px solid var(--line, #30363d); border-radius: 6px; padding: 10px 12px; font: 12px ui-sans-serif, system-ui, sans-serif;
-  color: var(--fg, #e6edf3); display: none; }
-#behold-diff h4 { margin: 0 0 6px; font-size: 12px; color: var(--muted, #8b949e); }
-#behold-diff .a { color: var(--managed, #3fb950); } #behold-diff .r { color: var(--degraded, #f85149); } #behold-diff .c { color: var(--foreign, #d29922); }`;
+  background: var(--panel, #2e2f40); border: 1px solid var(--rule, #4e4f64); border-radius: 3px; padding: 10px 12px; font: 11px/1.5 ${LANES_MONO};
+  color: var(--fg, #cdd6f4); display: none; }
+#behold-diff h4 { margin: 0 0 6px; font: 600 10.5px/1.4 ui-sans-serif, system-ui, sans-serif;
+  text-transform: uppercase; letter-spacing: .07em; color: var(--muted, #777a8c); }
+#behold-diff .a { color: var(--managed, #a6e3a1); } #behold-diff .r { color: var(--degraded, #f38ba8); } #behold-diff .c { color: var(--foreign, #f9e2af); }`;
 var THEME_BOOT = `<script type="module">import { initTheme, onThemeChange, mountThemePicker } from "/theme.js"; initTheme(); mountThemePicker(document.getElementById("behold-lanes-pickers")); onThemeChange(() => window.dispatchEvent(new Event("behold-theme")));</script>`;
 function laneStripScript(frames) {
   return `<script>
@@ -3778,7 +5874,7 @@ const LF = ${safeJson(frames)};
     const inNow = now !== undefined, inPrev = prev !== undefined;
     return inNow !== inPrev || (inNow && inPrev && now !== prev);
   }
-  const color = s => s === "good" ? css("--managed", "#3fb950") : s === "warn" ? css("--foreign", "#d29922") : s === "accent" ? css("--pending", "#58a6ff") : css("--edge", "#6e7681");
+  const color = s => s === "good" ? css("--managed", "#a6e3a1") : s === "warn" ? css("--foreign", "#f9e2af") : s === "accent" ? css("--pending", "#89b4fa") : css("--edge", "#56596d");
 
   function draw() {
     const dpr = window.devicePixelRatio || 1;
@@ -3787,22 +5883,22 @@ const LF = ${safeJson(frames)};
     c.clearRect(0, 0, host.clientWidth, H); c.font = "12px ui-sans-serif, system-ui, sans-serif";
     subs.forEach((s, r) => {
       const y = padT + r * rowH + rowH / 2;
-      c.fillStyle = offset[s] ? css("--foreign", "#d29922") : css("--muted", "#8b949e"); c.textAlign = "left"; c.fillText(s, 8, y + 4);
-      c.strokeStyle = css("--line", "#21262d"); c.beginPath(); c.moveTo(padL, y); c.lineTo(host.clientWidth - padR, y); c.stroke();
+      c.fillStyle = offset[s] ? css("--foreign", "#f9e2af") : css("--muted", "#777a8c"); c.textAlign = "left"; c.fillText(s, 8, y + 4);
+      c.strokeStyle = css("--line", "#3b3c4a"); c.beginPath(); c.moveTo(padL, y); c.lineTo(host.clientWidth - padR, y); c.stroke();
       LF.forEach((f, i) => {
         if (!f.byLexicon[s]) return;
         // dot per substrate; brighter when a node in this substrate changed at i
         const changed = Object.keys(f.status).some(id => f.lexicon[id] === s && changedAt(id, i));
         const hi = focus && f.lexicon[focus] === s && changedAt(focus, i);
-        c.fillStyle = hi ? css("--fg", "#f0f6fc") : changed ? color(mode(f, s)) : css("--line", "#30363d");
+        c.fillStyle = hi ? css("--fg", "#cdd6f4") : changed ? color(mode(f, s)) : css("--line", "#3b3c4a");
         c.beginPath(); c.arc(xOf(i, s), y, i === cur ? 5 : hi ? 4.5 : 3.5, 0, 7); c.fill();
       });
     });
-    const px = baseX(cur); c.strokeStyle = css("--pending", "#58a6ff"); c.lineWidth = 1.5;
+    const px = baseX(cur); c.strokeStyle = css("--pending", "#89b4fa"); c.lineWidth = 1.5;
     c.beginPath(); c.moveTo(px, padT - 2); c.lineTo(px, padT + subs.length * rowH); c.stroke();
-    if (pair != null) { const qx = baseX(pair); c.strokeStyle = css("--foreign", "#d29922"); c.setLineDash([3,3]);
+    if (pair != null) { const qx = baseX(pair); c.strokeStyle = css("--foreign", "#f9e2af"); c.setLineDash([3,3]);
       c.beginPath(); c.moveTo(qx, padT - 2); c.lineTo(qx, padT + subs.length * rowH); c.stroke(); c.setLineDash([]); }
-    c.fillStyle = css("--fg", "#e6edf3"); c.textAlign = "center"; c.fillText(LF[cur].name, px, padT + subs.length * rowH + 16);
+    c.fillStyle = css("--fg", "#cdd6f4"); c.textAlign = "center"; c.fillText(LF[cur].name, px, padT + subs.length * rowH + 16);
     document.getElementById("behold-lanes-meta").textContent =
       LF.length + " frames \xB7 frame " + (cur + 1) + "/" + LF.length + (focus ? " \xB7 focus " + focus : "");
     document.getElementById("behold-lanes-rt").style.display = anyOffset() ? "inline" : "none";
@@ -3907,9 +6003,108 @@ async function emulatorDown(projectDir) {
   await runChantRaw(["emulator", "down"], projectDir);
 }
 
+// src/demos.ts
+import { readFileSync as readFileSync11, existsSync as existsSync11, cpSync } from "node:fs";
+import { join as join14, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
+import { spawn as spawn4, spawnSync } from "node:child_process";
+function loadDemoRegistry(pkgRoot2) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync11(join14(pkgRoot2, "demos.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  const list3 = raw?.demos;
+  if (!Array.isArray(list3)) return [];
+  return list3.filter((e) => {
+    const d = e;
+    if (!d || typeof d.name !== "string" || !d.name || typeof d.description !== "string") return false;
+    if (d.source === "bundled") {
+      if (typeof d.dir !== "string" || !d.dir) return false;
+    } else if (d.source === "git") {
+      if (typeof d.repo !== "string" || !d.repo) return false;
+    } else {
+      return false;
+    }
+    if (!Array.isArray(d.requires) || d.requires.some((r) => typeof r !== "string")) return false;
+    if (!d.serve || typeof d.serve !== "object") return false;
+    if (d.serve.dirs !== void 0 && (!Array.isArray(d.serve.dirs) || d.serve.dirs.some((x) => typeof x !== "string") || !d.serve.dirs.length))
+      return false;
+    if (d.serve.carve !== void 0) {
+      const c = d.serve.carve;
+      const rel = (v) => typeof v === "string" && !!v && !v.startsWith("/") && !v.split("/").includes("..");
+      if (!c || typeof c !== "object") return false;
+      if (!rel(c.report) || !rel(c.from) || !rel(c.project) || !rel(c.out)) return false;
+      if (c.state !== void 0 && !rel(c.state)) return false;
+      if (!`${c.out}/`.startsWith(`${c.project}/`)) return false;
+    }
+    return true;
+  });
+}
+function missingRequirements(entry) {
+  const bins = entry.source === "git" && !entry.requires.includes("git") ? [...entry.requires, "git"] : entry.requires;
+  const finder = process.platform === "win32" ? "where" : "which";
+  return bins.filter((bin) => spawnSync(finder, [bin], { stdio: "ignore" }).status !== 0);
+}
+function fetchesFromNetwork(entry) {
+  return entry.source === "git";
+}
+function demoTargetDir(entry, cwd = process.cwd()) {
+  const legacy = resolve4(cwd, "behold-demo");
+  if (entry.name === "writes" && existsSync11(legacy)) return legacy;
+  return resolve4(cwd, "behold-demos", entry.name);
+}
+async function loadDemo(entry, opts) {
+  const { pkgRoot: pkgRoot2, target } = opts;
+  const say = (line) => opts.log?.(`behold demo ${entry.name} \u2192 ${line}`);
+  if (!existsSync11(target)) {
+    if (entry.source === "bundled") {
+      const bundled = join14(pkgRoot2, entry.dir);
+      if (!existsSync11(bundled)) return { ok: false, error: `this install has no bundled ${entry.dir}` };
+      say(`copying to ${target} (it's yours \u2014 edit it)`);
+      try {
+        cpSync(bundled, target, {
+          recursive: true,
+          filter: (src) => !relative2(bundled, src).split(sep3).includes("node_modules")
+        });
+      } catch (err) {
+        return { ok: false, error: `copy failed: ${err instanceof Error ? err.message : String(err)}` };
+      }
+    } else {
+      say(`cloning ${entry.repo} to ${target}`);
+      if (await runStep("git", ["clone", "--depth", "1", entry.repo, target]) !== 0) {
+        return { ok: false, error: `clone of ${entry.repo} failed` };
+      }
+    }
+  } else {
+    say(`reusing ${target}`);
+  }
+  if (existsSync11(join14(target, "package.json")) && !existsSync11(join14(target, "node_modules"))) {
+    say("npm install\u2026");
+    if (await runStep("npm", ["install"], { cwd: target, shell: process.platform === "win32" }) !== 0) {
+      return { ok: false, error: `npm install failed in ${target}` };
+    }
+  }
+  if (entry.setup) {
+    say(entry.setup);
+    if (await runStep(entry.setup, [], { cwd: target, shell: true }) !== 0) {
+      return { ok: false, error: `setup failed (${entry.setup})` };
+    }
+  }
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join14(target, d)) : [target] };
+}
+function runStep(cmd, args, opts = {}) {
+  return new Promise((res) => {
+    const child = spawn4(cmd, args, { stdio: "inherit", cwd: opts.cwd, shell: opts.shell ?? false });
+    child.on("error", () => res(-1));
+    child.on("close", (code) => res(code ?? 1));
+  });
+}
+
 // src/server.ts
-var webRoot = join10(dirname3(fileURLToPath(import.meta.url)), "..", "web");
-var execFileP = async (cmd, args) => (await promisify4(execFile4)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
+var pkgRoot = join15(dirname4(fileURLToPath3(import.meta.url)), "..");
+var webRoot = join15(pkgRoot, "web");
+var execFileP = async (cmd, args) => (await promisify3(execFile3)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
   const opts = {};
@@ -3957,8 +6152,8 @@ function tierFailure(tier, message) {
 }
 function beholdVersion() {
   try {
-    const here = dirname3(fileURLToPath(import.meta.url));
-    return JSON.parse(readFileSync7(join10(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    const here = dirname4(fileURLToPath3(import.meta.url));
+    return JSON.parse(readFileSync12(join15(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -4002,12 +6197,125 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
     return null;
   }
 }
+function carveRoutes(app, reportPath, demo) {
+  const load = () => readCarveReport(reportPath, (p) => readFileSync12(p, "utf8"));
+  const demoBlock = () => carveWriteBlock(demo);
+  const demoInfo = () => {
+    if (!demo) return null;
+    const block = demoBlock();
+    return {
+      root: demo.root,
+      from: demo.from,
+      state: demo.state ?? null,
+      project: demo.project,
+      out: demo.out,
+      // Paths the UI can print without leaking the operator's whole home dir.
+      outLabel: relative3(demo.root, demo.out).split(sep4).join("/"),
+      fromLabel: relative3(demo.root, demo.from).split(sep4).join("/"),
+      runnable: !block,
+      ...block ? { reason: block } : {},
+      ...demo.degraded ? { degraded: demo.degraded } : {},
+      buildCaveat: BUILD_CAVEAT
+    };
+  };
+  app.get("/api/carve", (c) => {
+    const parsed = load();
+    return parsed.ok ? c.json(parsed.report) : c.json(parsed.refusal, 422);
+  });
+  app.get("/api/graph", (c) => {
+    const parsed = load();
+    if (!parsed.ok) return c.json(parsed.refusal, 422);
+    const ir = carveReportToIr(parsed.report);
+    const { svg } = renderBanded(ir);
+    return c.json({
+      ir,
+      svg,
+      meta: {
+        projectDir: reportPath,
+        env: null,
+        tier: null,
+        target: null,
+        carve: true,
+        // A demo whose own advisor run failed says so on the statusbar, not
+        // only in the terminal the viewer isn't looking at.
+        note: carveNote(parsed.report, ir) + (demo?.degraded ? ` Degraded: ${demo.degraded}` : "")
+      }
+    });
+  });
+  app.get("/api/project", (c) => {
+    const parsed = load();
+    return c.json({
+      projectDir: reportPath,
+      recents: [],
+      // No envs, tiers, stacks or targets: a peelability report is a static
+      // analysis of foreign Terraform, so every picker that would imply a live
+      // axis stays empty and the SPA renders none of them.
+      environments: [],
+      lexicons: ["terraform"],
+      currentEnv: null,
+      targets: [],
+      carve: parsed.ok ? {
+        report: reportPath,
+        from: parsed.report.from ?? null,
+        count: parsed.report.count ?? parsed.report.resources.length,
+        bands: parsed.report.bands ?? {},
+        advisory: parsed.report.advisory ?? null,
+        demo: demoInfo()
+      } : { report: reportPath, demo: demoInfo() }
+    });
+  });
+  const runStep2 = async (c, run3) => {
+    const block = demoBlock();
+    if (block) {
+      return c.json(
+        {
+          error: block,
+          code: "read-only",
+          remedy: "The carve steps run inside a demo copy \u2014 start the walkthrough with `behold demo carve`."
+        },
+        403
+      );
+    }
+    if (!(c.req.header("content-type") ?? "").includes("application/json")) {
+      return c.json({ error: "send application/json", code: "carve-select", remedy: 'POST {"select": "<terraform address>"}' }, 415);
+    }
+    const text = await c.req.text().catch(() => "");
+    if (text.length > 4096) return c.json({ error: "a carve step body is capped at 4096 bytes", code: "carve-select", remedy: 'POST {"select": "\u2026"}' }, 413);
+    let body;
+    try {
+      body = JSON.parse(text || "null");
+    } catch {
+      return c.json({ error: "body must be JSON", code: "carve-select", remedy: 'POST {"select": "<terraform address>"}' }, 400);
+    }
+    const parsed = load();
+    const select = selectFromReport(parsed.ok ? parsed.report : void 0, body?.select);
+    if (!select) {
+      return c.json(
+        {
+          error: `\`select\` must name a resource this report ranks \u2014 ${JSON.stringify(body?.select ?? null)} isn't one of them.`,
+          code: "carve-select",
+          remedy: "Pick a card in the graph, or read the addresses off GET /api/carve."
+        },
+        400
+      );
+    }
+    const result = await run3(demo, select);
+    return result.ok ? c.json(result) : c.json(result.refusal, 422);
+  };
+  app.post("/api/carve/emit", (c) => runStep2(c, runCarveEmit));
+  app.post("/api/carve/bridge", (c) => runStep2(c, runCarveBridge));
+  app.get("/api/substrates", (c) => c.json({ substrates: [] }));
+  app.get("/api/history", (c) => c.json({ commits: [] }));
+  app.get("/api/resources", (c) => c.json({ byComponent: {} }));
+  app.get("/api/ci", (c) => c.json({ stages: [], jobs: [], forge: null }));
+}
 function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffer(), runner = new OpRunner({
   projectDir: cfg.projectDir,
   broadcaster,
   onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
 })) {
   const app = new Hono();
+  if (cfg.carveReport) carveRoutes(app, cfg.carveReport, cfg.carveDemo);
   let beholdConfig = loadBeholdConfig(cfg.projectDir);
   let tierEnvVar = beholdConfig.tiers?.envVar;
   const boundK8sContext = async (env) => {
@@ -4019,13 +6327,14 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       return void 0;
     }
   };
+  const estateSourceRoots = async (opts) => (await Promise.all((cfg.projectDirs ?? []).map(async (dir) => [await graphPath(dir, opts), dir]))).flat();
   app.get("/healthz", (c) => c.json({ ok: true, projectDir: cfg.projectDir, env: cfg.env ?? null, frames: frames.size }));
   app.get("/api/frames", (c) => c.json({ frames: frames.summaries() }));
   app.get("/lanes", (c) => {
     const all = frames.all();
     if (all.length < 2) {
       return c.html(
-        `<!doctype html><meta charset=utf-8><script type="module">import { initTheme } from "/theme.js"; initTheme();</script><body style="font:14px system-ui;background:var(--bg,#0d1117);color:var(--muted,#8b949e);padding:2rem"><h3 style="color:var(--fg,#e6edf3)">deployment lanes</h3><p>${all.length} frame(s) captured \u2014 need at least two to scrub.</p><p>Frames accrue when the estate moves: hit <b style="color:var(--fg,#e6edf3)">\u21BB Refresh</b> (captures the current live state), run a <b style="color:var(--fg,#e6edf3)">Sync</b>/Adopt, edit the source, or serve with <code>--poll</code> against a moving environment. Then reload.</p><p><a href="/" style="color:var(--pending,#58a6ff);text-decoration:none">\u2190 back to the graph</a></p></body>`
+        `<!doctype html><meta charset=utf-8><script type="module">import { initTheme } from "/theme.js"; initTheme();</script><body style="font:14px system-ui;background:var(--bg,#1e1e2e);color:var(--muted,#777a8c);padding:2rem"><h3 style="color:var(--fg,#cdd6f4)">deployment lanes</h3><p>${all.length} frame(s) captured \u2014 need at least two to scrub.</p><p>Frames accrue when the estate moves: hit <b style="color:var(--fg,#cdd6f4)">\u21BB Refresh</b> (captures the current live state), run a <b style="color:var(--fg,#cdd6f4)">Sync</b>/Adopt, edit the source, or serve with <code>--poll</code> against a moving environment. Then reload.</p><p><a href="/" style="color:var(--pending,#58a6ff);text-decoration:none">\u2190 back to the graph</a></p></body>`
       );
     }
     return c.html(renderLanes(all, frames.summaries()));
@@ -4091,9 +6400,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join10(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join10(cfg.projectDir, "scripts/local/local-up.sh");
-    if (!existsSync9(down) || !existsSync9(up)) {
+    const down = join15(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join15(cfg.projectDir, "scripts/local/local-up.sh");
+    if (!existsSync12(down) || !existsSync12(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
     if (!runner.bringUp("reset local emulator", "bash", ["-c", "bash scripts/local/local-down.sh && bash scripts/local/local-up.sh"], cfg.projectDir)) {
@@ -4170,26 +6479,29 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   app.post("/api/project/open", async (c) => {
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve2(body.dir.trim()) : "";
-    if (!dir || !existsSync9(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync9(join10(dir, "chant.config.ts"))) {
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve5(body.dir.trim()) : "";
+    if (!dir || !existsSync12(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
+    if (!existsSync12(join15(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
+    switchServedProject([dir]);
+    return c.json({ ok: true, projectDir: dir });
+  });
+  const switchServedProject = (dirs, env) => {
     addRecent(cfg.projectDir);
-    cfg.projectDir = dir;
-    cfg.projectDirs = void 0;
-    cfg.env = void 0;
-    beholdConfig = loadBeholdConfig(dir);
+    cfg.projectDir = dirs[0];
+    cfg.projectDirs = dirs.length > 1 ? dirs : void 0;
+    cfg.env = env;
+    beholdConfig = loadBeholdConfig(dirs[0]);
     tierEnvVar = beholdConfig.tiers?.envVar;
-    runner.retarget(dir);
-    addRecent(dir);
-    cfg.onProjectSwitch?.(dir);
+    runner.retarget(dirs[0]);
+    for (const d of dirs) addRecent(d);
+    cfg.onProjectSwitch?.(dirs[0]);
     broadcaster.emit("changed");
-    return c.json({ ok: true, projectDir: dir });
-  });
+  };
   app.post("/api/project/reveal", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve2(body.dir.trim()) : cfg.projectDir;
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve5(body.dir.trim()) : cfg.projectDir;
     const known = /* @__PURE__ */ new Set([cfg.projectDir, ...cfg.projectDirs ?? [], ...listRecents().map((r) => r.dir)]);
     if (!known.has(dir)) return c.json({ error: "not a served or recent project directory" }, 400);
     const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
@@ -4200,6 +6512,144 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
     }
   });
+  const demoRow = (e) => {
+    const missing = missingRequirements(e);
+    const target = demoTargetDir(e);
+    return {
+      name: e.name,
+      description: e.description,
+      requires: e.requires,
+      source: e.source,
+      // #268's consent half: a git entry is cloned from a public repo, so the
+      // button says so (and names the repo) BEFORE anything is fetched.
+      fetches: fetchesFromNetwork(e),
+      ...e.repo ? { repo: e.repo } : {},
+      target,
+      loaded: existsSync12(target),
+      satisfiable: missing.length === 0,
+      // #254: the carve walkthrough runs fine here — it just isn't a project
+      // to switch INTO. Carve mode claims `/api/graph` and `/api/project` at
+      // app creation (see carveRoutes), so a running server cannot become one;
+      // the row stays in the catalog, disabled, saying what to run instead.
+      ...e.serve.carve ? { switchable: false } : {},
+      ...missing.length ? { reason: `needs ${missing.join(", ")} on PATH` } : e.serve.carve ? { reason: `serves a carve report, not a project \u2014 run \`behold demo ${e.name}\`` } : {}
+    };
+  };
+  app.get(
+    "/api/demos",
+    (c) => c.json({
+      demos: loadDemoRegistry(pkgRoot).map(demoRow),
+      ...cfg.previewMode ? { locked: "loading a demo is locked in preview mode" } : {}
+    })
+  );
+  let loadingDemo = null;
+  app.post("/api/demos/open", async (c) => {
+    if (cfg.previewMode) return c.json({ error: "loading a demo is locked in preview mode" }, 403);
+    const body = await c.req.json().catch(() => ({}));
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    const entry = loadDemoRegistry(pkgRoot).find((e) => e.name === name);
+    if (!entry) {
+      return c.json({ error: `no "${name || "(no name given)"}" in this install's demo catalog` }, 400);
+    }
+    const missing = missingRequirements(entry);
+    if (missing.length) return c.json({ error: `${entry.name} needs ${missing.join(", ")} on PATH` }, 400);
+    if (entry.serve.carve) {
+      return c.json(
+        {
+          error: `${entry.name} serves a carve report, not a chant project \u2014 a running server can't switch into carve mode.`,
+          remedy: `Run \`behold demo ${entry.name}\` in a terminal.`
+        },
+        400
+      );
+    }
+    if (loadingDemo) return c.json({ error: `${loadingDemo} is still loading` }, 409);
+    loadingDemo = entry.name;
+    try {
+      const target = demoTargetDir(entry);
+      const loaded = await loadDemo(entry, { pkgRoot, target, log: (line) => process.stdout.write(line + "\n") });
+      if (!loaded.ok) return c.json({ error: loaded.error }, 500);
+      const dirs = loaded.serveDirs;
+      if (!existsSync12(join15(dirs[0], "chant.config.ts"))) {
+        return c.json({ error: `${entry.name} loaded to ${target} but ${dirs[0]} has no chant.config.ts` }, 500);
+      }
+      if (entry.serve.local) {
+        if (cfg.emulators?.length) await emulatorDown(cfg.projectDir).catch(() => {
+        });
+        cfg.local = true;
+        cfg.emulators = await bootLocalEmulators(dirs[0], `behold demo ${entry.name} --local`);
+      }
+      switchServedProject(dirs, entry.serve.env);
+      return c.json({ ok: true, demo: entry.name, projectDir: dirs[0], projectDirs: dirs, env: entry.serve.env ?? null });
+    } finally {
+      loadingDemo = null;
+    }
+  });
+  const layoutWriteBlock = () => {
+    if (cfg.previewMode) return "the layout sidecar is read-only in preview mode";
+    if (cfg.carveReport) return "a carve report isn't a project \u2014 there's nowhere to keep a hand layout";
+    if (cfg.layoutWrites === false) return "a static export captures a snapshot \u2014 it doesn't write to the project";
+    return unwritableReason(cfg.projectDir);
+  };
+  app.get("/api/layout", (c) => {
+    const block = layoutWriteBlock();
+    const shared = { path: layoutPath(cfg.projectDir), writable: !block, ...block ? { reason: block } : {} };
+    const raw = new URL(c.req.url).searchParams.get("lens");
+    if (raw === null) return c.json({ ...shared, lenses: readLayoutFile(cfg.projectDir).lenses });
+    const lens = normalizeLens(raw);
+    if (!lens) return c.json({ error: `not a lens key: ${raw}`, code: "bad-layout" }, 400);
+    return c.json({ ...shared, lens, deltas: readLens(cfg.projectDir, lens) });
+  });
+  app.post("/api/layout", async (c) => {
+    const block = layoutWriteBlock();
+    if (block) return c.json({ error: block, code: "read-only" }, 403);
+    if (!(c.req.header("content-type") ?? "").includes("application/json")) {
+      return c.json({ error: "send application/json", code: "bad-layout" }, 415);
+    }
+    const declared = Number(c.req.header("content-length") ?? 0);
+    if (declared > MAX_BODY_BYTES) return c.json({ error: `a layout body is capped at ${MAX_BODY_BYTES} bytes`, code: "too-large" }, 413);
+    const text = await c.req.text().catch(() => "");
+    if (text.length > MAX_BODY_BYTES) return c.json({ error: `a layout body is capped at ${MAX_BODY_BYTES} bytes`, code: "too-large" }, 413);
+    let body;
+    try {
+      body = JSON.parse(text || "null");
+    } catch {
+      return c.json({ error: "body must be JSON", code: "bad-layout" }, 400);
+    }
+    const lens = normalizeLens(body?.lens);
+    if (!lens) return c.json({ error: "body needs a `lens` key (the zoom stop, plus +radial / +stack-<name>)", code: "bad-layout" }, 400);
+    if (!body?.deltas || typeof body.deltas !== "object" || Array.isArray(body.deltas)) {
+      return c.json({ error: "body needs `deltas`: {<node id>: {dx,dy,dw,dh}}", code: "bad-layout" }, 400);
+    }
+    try {
+      const stored = writeLens(cfg.projectDir, lens, body.deltas);
+      return c.json({ ok: true, lens: stored.lens, deltas: stored.deltas, count: Object.keys(stored.deltas).length, path: layoutPath(cfg.projectDir) });
+    } catch (err) {
+      if (err instanceof LayoutTooLarge) return c.json({ error: err.message, code: "too-large" }, 413);
+      return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+    }
+  });
+  const bakeHandLayout = async (c, next) => {
+    await next();
+    const url = new URL(c.req.url);
+    if (url.searchParams.get("layout") !== "1") return;
+    const res = c.res;
+    if (!res || res.status !== 200 || !(res.headers.get("content-type") ?? "").includes("json")) return;
+    const lens = lensFromQuery(url.searchParams);
+    const deltas = readLens(cfg.projectDir, lens);
+    if (!Object.keys(deltas).length) return;
+    let body;
+    try {
+      body = await res.clone().json();
+    } catch {
+      return;
+    }
+    if (typeof body.svg !== "string") return;
+    const { svg, applied } = applyLayoutToSvg(body.svg, deltas);
+    if (!applied) return;
+    c.res = c.json({ ...body, svg, meta: { ...body.meta ?? {}, layout: { lens, applied } } });
+  };
+  app.use("/api/graph", bakeHandLayout);
+  app.use("/api/overlay", bakeHandLayout);
   app.get(
     "/api",
     (c) => c.json({
@@ -4211,8 +6661,29 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         { method: "GET", path: "/api/project", desc: "project info: dir, recents, environments, tiers, targets, stacks, preview lock" },
         { method: "POST", path: "/api/project/open", desc: "switch the served project: JSON body {dir} (validated; preview-locked)" },
         { method: "POST", path: "/api/project/reveal", desc: "open the OS file manager at a served/recent project dir: JSON body {dir?}" },
-        { method: "GET", path: "/api/graph", desc: "the graph {ir, svg, meta} \u2014 params: detail=0..3, components=1, logical=1, env, stack, tier, target, lens, up=1, down=1, radial=1" },
+        { method: "GET", path: "/api/demos", desc: "the bundled demo catalog: [{name, description, requires, satisfiable, reason?, fetches, repo?, target, loaded}]" },
+        {
+          method: "POST",
+          path: "/api/demos/open",
+          desc: "load a demo and serve it: JSON body {name} (a catalog name, never a path) \u2014 copies/clones, installs, runs its setup, then switches (preview-locked)"
+        },
+        { method: "GET", path: "/api/graph", desc: "the graph {ir, svg, meta} \u2014 params: detail=0..3, components=1, logical=1, env, stack, tier, target, lens, up=1, down=1, radial=1, layout=1" },
+        ...cfg.carveReport ? [
+          { method: "GET", path: "/api/carve", desc: "carve mode: the raw `chant carve advise --json` peelability report this server is rendering" },
+          {
+            method: "POST",
+            path: "/api/carve/emit",
+            desc: "carve demo only (#254): run `chant carve emit --state --select <addr>` into the demo copy \u2014 JSON body {select}; answers {artifacts, boundary, lint}"
+          },
+          {
+            method: "POST",
+            path: "/api/carve/bridge",
+            desc: "carve demo only (#254): run `chant carve bridge` (never --apply-rewrites) \u2014 JSON body {select}; answers {runbook, proposals}"
+          }
+        ] : [],
         { method: "GET", path: "/api/overlay", desc: "live drift overlay for ?env= \u2014 same shape/params as /api/graph, plus runtime=1" },
+        { method: "GET", path: "/api/layout", desc: "hand-layout sidecar (.behold/layout.json): ?lens=<key> \u2192 {lens, deltas, writable}; no lens \u2192 every lens" },
+        { method: "POST", path: "/api/layout", desc: "store one lens's deltas: JSON body {lens, deltas: {<node id>: {dx,dy,dw,dh}}} (the only file behold writes in your project)" },
         { method: "GET", path: "/api/diff", desc: "per-node live diff for ?env= \u2014 {env, nodes: {<id>: {observed, diff, health, fieldDrift}}}" },
         { method: "GET", path: "/api/reconcile", desc: "pending-change summary for ?env=" },
         { method: "GET", path: "/api/resources", desc: "component \u2192 declared resources" },
@@ -4244,10 +6715,31 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       let mode;
       let metaEnv = cfg.env ?? null;
       if (multi) {
-        ir = await composeEstate(cfg.projectDirs, opts);
+        ir = await composeEstate(cfg.projectDirs, logical ? { ...opts, detail: 3 } : opts);
         ir = addValueMatchEdges(ir);
         ir = addK8sDeclaredEdges(ir);
-        ir = addClusterAnchorEdges(ir, await boundK8sContext(metaEnv ?? void 0));
+        const estateContext = await boundK8sContext(metaEnv ?? void 0);
+        ir = addClusterAnchorEdges(ir, estateContext);
+        if (logical) {
+          const logicalBefore = ir.nodes.length;
+          const { ir: projected, byContainer } = projectTopology(ir, metaEnv ?? void 0, estateContext, await estateSourceRoots(opts));
+          const { svg: svg2 } = renderArchitecture(projected, byContainer);
+          const logicalNote = notesFor("logical", projected, void 0, logicalBefore);
+          return c.json({
+            ir: projected,
+            svg: svg2,
+            byContainer,
+            meta: {
+              projectDir: cfg.projectDir,
+              env: metaEnv,
+              tier: opts.tier ?? null,
+              target: opts.target ?? null,
+              mode: "logical",
+              estate: cfg.projectDirs.length,
+              ...logicalNote ? { note: logicalNote } : {}
+            }
+          });
+        }
       } else if (components) {
         ir = await componentGraphIr(cfg.projectDir, opts);
         const env = opts.env ?? cfg.env;
@@ -4283,13 +6775,13 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync9(join10(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync12(join15(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
       const { svg } = renderGraph(ir, multi ? { boxes: "byStack" } : { radial });
       const srcZoom = components ? "components" : logical ? "logical" : opts.detail === 1 ? "composites" : opts.detail === 3 ? "attributes" : "resources";
-      const estateLensNote = multi && (components || logical) ? `the ${components ? "components" : "logical"} lens doesn't apply to a composed estate yet \u2014 showing the composed entity graph` : void 0;
+      const estateLensNote = multi && components ? "the components lens doesn't apply to a composed estate yet \u2014 showing the composed entity graph" : void 0;
       const srcNote = multi ? estateLensNote : notesFor(srcZoom, ir, srcCompositeEdgesAttached);
       return c.json({
         ir,
@@ -4388,32 +6880,56 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       return c.json({ error: "overlay needs an environment \u2014 pick one, or start behold with --env <name>" }, 400);
     }
     const logical = new URL(c.req.url).searchParams.get("logical") === "1";
+    const runtime = new URL(c.req.url).searchParams.get("runtime") === "1";
     try {
       if (cfg.projectDirs && cfg.projectDirs.length > 1) {
-        const runtime = new URL(c.req.url).searchParams.get("runtime") === "1";
-        const est = await composeEstateOverlay(cfg.projectDirs, { ...tierTargetOpts(query), detail: query.detail, env }, reclassifyOverlay);
+        const detail = logical || runtime ? 3 : query.detail;
+        const est = await composeEstateOverlay(cfg.projectDirs, { ...tierTargetOpts(query), detail, env }, reclassifyOverlay);
         if (est.dropped.length === est.total) {
           return c.json({ error: `no project in the estate could be graphed \u2014 ${est.dropped.map((d) => `${d.name}: ${d.reason}`).join("; ")}` }, 500);
         }
-        let ir2 = pruneRuntimeChildren(est.ir);
-        if ((query.detail ?? 2) < 3) ir2 = pruneImports(ir2);
+        const composed = est.ir;
+        let ir2 = runtime ? attachRuntimeContainment(composed) : pruneRuntimeChildren(composed);
+        if ((detail ?? 2) < 3) ir2 = pruneImports(ir2);
         ir2 = addValueMatchEdges(ir2);
         ir2 = addK8sDeclaredEdges(ir2);
-        ir2 = addClusterAnchorEdges(ir2, await boundK8sContext(env));
-        const { svg: svg2 } = renderGraph(ir2, { boxes: "byStack" });
-        const lensNote = logical || runtime ? `the ${logical ? "logical" : "runtime"} lens doesn't apply to a composed estate yet \u2014 showing the composed entity overlay` : void 0;
+        const boundContext2 = await boundK8sContext(env);
+        ir2 = addClusterAnchorEdges(ir2, boundContext2);
         const coverNote = est.unobserved.length || est.dropped.length ? `live observe covered ${est.observed} of ${est.total} projects \u2014 ` + [
           ...est.unobserved.map((u) => `${u.name}: ${u.reason} (painted unobserved)`),
           ...est.dropped.map((d) => `${d.name}: dropped (${d.reason})`)
         ].join("; ") : void 0;
-        const note2 = [lensNote, coverNote, namespaceMismatchNote(ir2.nodes)].filter(Boolean).join(" \xB7 ");
+        if (logical) {
+          const logicalBefore = ir2.nodes.length;
+          const { ir: projected, byContainer } = projectTopology(ir2, env, boundContext2, await estateSourceRoots(query));
+          const { svg: svg3 } = renderArchitecture(projected, byContainer);
+          const note3 = [
+            notesFor("logical", projected, void 0, logicalBefore),
+            coverNote,
+            namespaceJoinNote(est.joined),
+            namespaceMismatchNote(withoutJoinedMembers(projected.nodes, est.joined))
+          ].filter(Boolean).join(" \xB7 ");
+          return c.json({
+            ir: projected,
+            svg: svg3,
+            byContainer,
+            meta: { projectDir: cfg.projectDir, env, mode: "logical", estate: est.total, ...note3 ? { note: note3 } : {} }
+          });
+        }
+        const { svg: svg2 } = renderGraph(ir2, { boxes: runtime ? "byContainer" : "byStack" });
+        const note2 = [
+          coverNote,
+          namespaceJoinNote(est.joined),
+          namespaceMismatchNote(withoutJoinedMembers(ir2.nodes, est.joined)),
+          runtime ? notesFor("runtime", ir2, void 0, void 0, detail) : void 0
+        ].filter(Boolean).join(" \xB7 ");
         return c.json({
           ir: ir2,
           svg: svg2,
           meta: { projectDir: cfg.projectDir, env, mode: "overlay", estate: est.total, ...note2 ? { note: note2 } : {} }
         });
       }
-      const opts = { ...query, live: true, overlay: true, env, ...logical ? { detail: 3 } : {} };
+      const opts = { ...query, live: true, overlay: true, env, ...logical || runtime ? { detail: 3 } : {} };
       let ir = reclassifyOverlay(await graphIr(cfg.projectDir, opts));
       const boundContext = await boundK8sContext(env);
       ir = mergeClusterRoot(ir, await clusterRootGraphIr(cfg.projectDir, query), await runningK3dClusters());
@@ -4423,7 +6939,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         applyHelmArtifacts(ir, observed);
         synthesizeHelmReleases(ir, observed, discoverReleaseUnits(cfg.projectDir));
       }
-      ir = new URL(c.req.url).searchParams.get("runtime") === "1" ? attachRuntimeContainment(ir) : pruneRuntimeChildren(ir);
+      ir = runtime ? attachRuntimeContainment(ir) : pruneRuntimeChildren(ir);
       if (logical) {
         const logicalBefore = ir.nodes.length;
         const { ir: projected, byContainer } = projectTopology(addK8sDeclaredEdges(addValueMatchEdges(ir)), env, boundContext, [await graphPath(cfg.projectDir, opts), cfg.projectDir]);
@@ -4448,10 +6964,10 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
       }
       const { svg } = renderGraph(ir, { boxes: "byContainer", radial: new URL(c.req.url).searchParams.get("radial") === "1" });
-      const zoom = new URL(c.req.url).searchParams.get("runtime") === "1" ? "runtime" : query.detail === 1 ? "composites" : query.detail === 3 ? "attributes" : "resources";
+      const zoom = runtime ? "runtime" : query.detail === 1 ? "composites" : query.detail === 3 ? "attributes" : "resources";
       const tierNote = tierMismatchNote(ir, beholdConfig.tiers, query.tier);
       const nsNote = namespaceMismatchNote(ir.nodes);
-      const zoomNotes = notesFor(zoom, ir, compositeEdgesAttached);
+      const zoomNotes = notesFor(zoom, ir, compositeEdgesAttached, void 0, opts.detail ?? 2);
       const note = [tierNote, nsNote, zoomNotes].filter(Boolean).join(" \xB7 ");
       return c.json({ ir, svg, meta: { projectDir: cfg.projectDir, env, mode: "overlay", ...note ? { note } : {} } });
     } catch (err) {
@@ -4512,10 +7028,12 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const nodes = {};
     for (const id of ids) {
       const observed = nodeObserved(parsed, id);
+      const verdict = classifyObservedHealth(observed);
       nodes[id] = {
         observed,
         diff: nodeDiff(parsed, id),
-        health: classifyHealth(observed?.status),
+        health: verdict.health,
+        ...verdict.detail ? { healthDetail: verdict.detail } : {},
         // Field-level (per-manager) drift (#87, chant#1181) — null when no
         // lexicon in this diff carries a `deep` section at all.
         fieldDrift: nodeFieldDrift(parsed, id)
@@ -4539,12 +7057,14 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       return c.json({ error: "diff output was not JSON \u2014 chant may predate --live --json (needs 0.18.7+)" }, 500);
     }
     const observed = nodeObserved(parsed, node);
+    const verdict = classifyObservedHealth(observed);
     return c.json({
       node,
       env,
       diff: nodeDiff(parsed, node),
       observed,
-      health: classifyHealth(observed?.status),
+      health: verdict.health,
+      ...verdict.detail ? { healthDetail: verdict.detail } : {},
       // Field-level (per-manager) drift (#87, chant#1181) — null when no
       // lexicon in this diff carries a `deep` section at all.
       fieldDrift: nodeFieldDrift(parsed, node)
@@ -4593,38 +7113,38 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
     return c.json({ started: true, component, env });
   });
-  const rel = relative(process.cwd(), webRoot) || ".";
+  const rel = relative3(process.cwd(), webRoot) || ".";
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join10(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join15(rel, "index.html") }));
   return app;
 }
-async function startServer(cfg) {
-  if (cfg.local) {
-    try {
-      const emulators = await emulatorUp(cfg.projectDir);
-      cfg.emulators = emulators;
-      if (emulators.length === 0) {
-        process.stderr.write(
-          "behold serve --local: no configured lexicon has a local emulator \u2014 serving without one.\n"
-        );
-      } else {
-        Object.assign(process.env, mergedEnv(emulators));
-        for (const e of emulators) {
-          process.stdout.write(`  local: ${e.lexicon} ${e.name} up on ${e.endpoint}
+async function bootLocalEmulators(dir, who) {
+  try {
+    const emulators = await emulatorUp(dir);
+    if (emulators.length === 0) {
+      process.stderr.write(`${who}: no configured lexicon has a local emulator \u2014 serving without one.
 `);
-        }
-      }
-    } catch (err) {
-      cfg.emulators = [];
-      process.stderr.write(
-        `behold serve --local: ${err instanceof Error ? err.message : String(err)}
+      return [];
+    }
+    Object.assign(process.env, mergedEnv(emulators));
+    for (const e of emulators) {
+      process.stdout.write(`  local: ${e.lexicon} ${e.name} up on ${e.endpoint}
+`);
+    }
+    return emulators;
+  } catch (err) {
+    process.stderr.write(
+      `${who}: ${err instanceof Error ? err.message : String(err)}
   Serving the source graph without the emulator \u2014 start Docker and restart to enable local deploys.
 `
-      );
-    }
+    );
+    return [];
   }
+}
+async function startServer(cfg) {
+  if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync9(join10(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync12(join15(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -4666,8 +7186,10 @@ async function startServer(cfg) {
       }
     }
   };
-  let stopWatch = watchSource(cfg.projectDir, onEstateChange);
-  let stopPoll = cfg.env && cfg.pollSecs ? startDriftPoll({
+  const carve = !!cfg.carveReport;
+  let stopWatch = carve ? () => {
+  } : watchSource(cfg.projectDir, onEstateChange);
+  let stopPoll = !carve && cfg.env && cfg.pollSecs ? startDriftPoll({
     intervalMs: cfg.pollSecs * 1e3,
     query: () => graphIr(cfg.projectDir, { live: true, overlay: true, env: cfg.env }),
     onChange: onPollDrift,
@@ -4685,7 +7207,7 @@ async function startServer(cfg) {
 `);
     void capture();
   };
-  void capture();
+  if (!carve) void capture();
   let shuttingDown = false;
   const shutdown = () => {
     if (shuttingDown) return;
@@ -4699,6 +7221,19 @@ async function startServer(cfg) {
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
   const server = serve({ fetch: app.fetch, port: cfg.port }, (info) => {
+    if (carve) {
+      process.stdout.write(
+        `behold \u2192 http://localhost:${info.port}
+  carve report: ${cfg.carveReport}
+  green = carve now, amber = boundary work, grey = leave in Terraform.
+` + (cfg.carveDemo ? `  walkthrough: the panel's Carve tab \u2014 advise \u2192 pick \u2192 emit \u2192 bridge \u2192 handoff \u2192 done.
+  Emit and bridge write only into ${cfg.carveDemo.out}; your Terraform is never edited.
+` + (cfg.carveDemo.degraded ? `  degraded: ${cfg.carveDemo.degraded}
+` : "") : `  Read-only advisory: behold emits nothing and touches no Terraform. Ctrl-C to stop.
+`)
+      );
+      return;
+    }
     const poll = cfg.env && cfg.pollSecs ? `, polling drift every ${cfg.pollSecs}s` : "";
     const auto = autoSync !== "off" ? `  auto-sync: ${autoSync}` : "";
     const localTag = cfg.emulators && cfg.emulators.length ? `  local: ${cfg.emulators.map((e) => e.name).join(", ")} up (creds-free \u2014 deploys hit the emulator)` : "";
@@ -4729,53 +7264,17 @@ async function startServer(cfg) {
   });
 }
 
-// src/demos.ts
-import { readFileSync as readFileSync8 } from "node:fs";
-import { join as join11 } from "node:path";
-import { spawnSync } from "node:child_process";
-function loadDemoRegistry(pkgRoot) {
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync8(join11(pkgRoot, "demos.json"), "utf8"));
-  } catch {
-    return [];
-  }
-  const list = raw?.demos;
-  if (!Array.isArray(list)) return [];
-  return list.filter((e) => {
-    const d = e;
-    if (!d || typeof d.name !== "string" || !d.name || typeof d.description !== "string") return false;
-    if (d.source === "bundled") {
-      if (typeof d.dir !== "string" || !d.dir) return false;
-    } else if (d.source === "git") {
-      if (typeof d.repo !== "string" || !d.repo) return false;
-    } else {
-      return false;
-    }
-    if (!Array.isArray(d.requires) || d.requires.some((r) => typeof r !== "string")) return false;
-    if (!d.serve || typeof d.serve !== "object") return false;
-    if (d.serve.dirs !== void 0 && (!Array.isArray(d.serve.dirs) || d.serve.dirs.some((x) => typeof x !== "string") || !d.serve.dirs.length))
-      return false;
-    return true;
-  });
-}
-function missingRequirements(entry) {
-  const bins = entry.source === "git" && !entry.requires.includes("git") ? [...entry.requires, "git"] : entry.requires;
-  const finder = process.platform === "win32" ? "where" : "which";
-  return bins.filter((bin) => spawnSync(finder, [bin], { stdio: "ignore" }).status !== 0);
-}
-
 // src/export.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, copyFileSync, readFileSync as readFileSync9, readdirSync as readdirSync4 } from "node:fs";
-import { join as join12, dirname as dirname4, basename } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, copyFileSync, readFileSync as readFileSync13, readdirSync as readdirSync5 } from "node:fs";
+import { join as join16, dirname as dirname5, basename } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 var LENS_PARAMS = ["components", "detail", "env", "logical", "radial", "tier"];
 function canonicalKey(path, params) {
   const flat = params.get("components") === "1" || params.get("logical") === "1";
   const q = LENS_PARAMS.filter((k) => params.has(k) && !(flat && (k === "detail" || k === "radial"))).map((k) => `${k}=${params.get(k)}`).join("&");
   return q ? `${path}?${q}` : path;
 }
-function slug(key) {
+function slug2(key) {
   const base = key.replace(/^\//, "").replace(/[^a-zA-Z0-9=_.-]+/g, "_").slice(0, 120);
   return `${base}.json`;
 }
@@ -4815,7 +7314,7 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join12(dirname4(fileURLToPath2(import.meta.url)), "..", "web");
+  return join16(dirname5(fileURLToPath4(import.meta.url)), "..", "web");
 }
 function workerName(project, override) {
   const raw = override ?? `behold-${basename(project)}`;
@@ -4823,19 +7322,19 @@ function workerName(project, override) {
   return name || "behold-export";
 }
 async function runExport(cfg, outDir, opts = {}) {
-  const app = createApp(cfg);
+  const app = createApp({ ...cfg, layoutWrites: false });
   const proj = await (await app.request("/api/project")).json();
   const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [] };
-  const snapDir = join12(outDir, "snapshots");
-  mkdirSync2(snapDir, { recursive: true });
+  const snapDir = join16(outDir, "snapshots");
+  mkdirSync4(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
   let failed = 0;
   for (const key of captureKeys(axes)) {
-    const res = await app.request(key);
+    const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = await res.text();
-    const file = slug(key);
-    writeFileSync2(join12(snapDir, file), body);
+    const file = slug2(key);
+    writeFileSync3(join16(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -4847,21 +7346,21 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync2(join12(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync9(join12(webDir(), "index.html"), "utf8").replace(
+  writeFileSync3(join16(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync13(join16(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync2(join12(outDir, "index.html"), html);
-  for (const f of readdirSync4(webDir())) {
+  writeFileSync3(join16(outDir, "index.html"), html);
+  for (const f of readdirSync5(webDir())) {
     if (f === "index.html") continue;
-    copyFileSync(join12(webDir(), f), join12(outDir, f));
+    copyFileSync(join16(webDir(), f), join16(outDir, f));
   }
-  writeFileSync2(join12(outDir, "README.md"), BUNDLE_README);
+  writeFileSync3(join16(outDir, "README.md"), BUNDLE_README);
   const name = workerName(cfg.projectDir, opts.name);
-  writeFileSync2(
-    join12(outDir, "wrangler.jsonc"),
+  writeFileSync3(
+    join16(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
@@ -4908,14 +7407,248 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 (\`wrangler pages deploy .\`) all work.
 `;
 
+// src/doctor.ts
+import { relative as relative4, resolve as resolve6 } from "node:path";
+var list2 = (xs) => xs.join(", ");
+var EMPTY_KUBECONFIG = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
+function summarize(xs, max = 4) {
+  return xs.length <= max ? list2(xs) : `${list2(xs.slice(0, max))}, +${xs.length - max} more`;
+}
+function labelFor(root, target, estate) {
+  if (!estate) return "";
+  const rel = relative4(root, target);
+  return `${rel || "."}: `;
+}
+function chantCheck(root, targets, estate) {
+  const floor = chantFloor();
+  const resolutions = targets.map((t) => ({ target: t, res: resolveChant(t) }));
+  const missing = resolutions.filter(({ res }) => res.source !== "project");
+  const describe = ({ target, res }) => `${labelFor(root, target, estate)}${res.source === "project" ? `chant ${res.version ?? "(unknown version)"}` : "no chant installed"}`;
+  if (missing.length) {
+    return {
+      name: "chant",
+      status: "fail",
+      detail: `${list2(resolutions.map(describe))} \u2014 behold shells the project's own chant`,
+      fix: `Run \`npm install\` in ${list2(missing.map(({ target }) => relative4(root, target) || target))}`
+    };
+  }
+  const stale = resolutions.filter(({ res }) => !meetsFloor(res.version, floor));
+  const versions = list2(resolutions.map(describe));
+  if (stale.length) {
+    return {
+      name: "chant",
+      status: "warn",
+      detail: `${versions} \u2014 below behold's floor ${floor}`,
+      fix: "Bump @intentius/chant in the project (`npm install @intentius/chant@latest`) \u2014 older versions observe less."
+    };
+  }
+  return { name: "chant", status: "pass", detail: `${versions}${floor ? ` (behold's floor ${floor})` : ""}` };
+}
+function lexiconCheck(root, declared, estate) {
+  const missing = [];
+  const found = [];
+  for (const [target, lexicons] of declared) {
+    const label = labelFor(root, target, estate);
+    for (const r of resolveLexicons(target, lexicons)) {
+      (r.installed ? found : missing).push(`${label}${r.lexicon}${r.installed && r.version ? ` ${r.version}` : ""}`);
+    }
+  }
+  if (missing.length) {
+    return {
+      name: "lexicons",
+      status: "fail",
+      detail: `declared but not installed: ${list2(missing)}${found.length ? ` (installed: ${list2(found)})` : ""}`,
+      fix: "Run `npm install` in the project \u2014 chant can't graph source importing a lexicon it can't resolve."
+    };
+  }
+  if (!found.length) {
+    return { name: "lexicons", status: "pass", detail: "none declared" };
+  }
+  return { name: "lexicons", status: "pass", detail: `${found.length} installed: ${list2(found)}` };
+}
+function envCheck(envs, serveArg) {
+  if (!envs.length) {
+    return {
+      name: "envs",
+      status: "warn",
+      detail: "no environments declared \u2014 the declared graph serves, but there is no live overlay to pick",
+      fix: "Declare `environments` (or `k8s.profiles`) in chant.config.ts, then serve with `--env <name>`."
+    };
+  }
+  return { name: "envs", status: "pass", detail: `${list2(envs)} \u2014 \`behold serve ${serveArg} --env ${envs[0]}\` for the live overlay` };
+}
+function kubeCheck(lexicons, profiles, envs, kubeconfig) {
+  if (!lexicons.includes("k8s") && !lexicons.includes("helm")) {
+    return { name: "kube", status: "pass", detail: "no k8s or helm lexicon \u2014 no cluster binding to check" };
+  }
+  const ambient = kubeconfig.currentContext;
+  if (!kubeconfig.contexts.size) {
+    return {
+      name: "kube",
+      status: "warn",
+      detail: "no kubeconfig readable (none on this machine, or it has no contexts) \u2014 the declared graph still serves",
+      fix: "Point KUBECONFIG at your cluster's kubeconfig (or put one at ~/.kube/config), or run `behold demo k8s` for a throwaway k3d one."
+    };
+  }
+  const bound = envs.filter((e) => profiles[e]?.context);
+  if (!bound.length) {
+    return {
+      name: "kube",
+      status: "warn",
+      detail: `no k8s.profiles binding \u2014 chant falls back to the ambient current-context${ambient ? ` (${ambient})` : " (none set)"}`,
+      fix: "Declare `k8s.profiles.<env>.context` in chant.config.ts so the cluster the reads hit is explicit, not ambient."
+    };
+  }
+  const lines = [];
+  const unresolved = [];
+  const mismatched = [];
+  for (const env of bound) {
+    const context = profiles[env].context;
+    const target = resolveK8sTarget(profiles, env, kubeconfig);
+    if (!target) {
+      unresolved.push(`${env}: ${context}`);
+      continue;
+    }
+    lines.push(`${env}: ${target.label} at ${target.endpoint}`);
+    if (ambient && ambient !== target.label) mismatched.push(`${env}: ${target.label}`);
+  }
+  if (unresolved.length) {
+    return {
+      name: "kube",
+      status: "warn",
+      detail: `context not in the kubeconfig \u2014 ${list2(unresolved)}${lines.length ? `; bound: ${list2(lines)}` : ""}`,
+      fix: `Add the context to your kubeconfig, or point k8s.profiles at one you have (${summarize([...kubeconfig.contexts.keys()])}).`
+    };
+  }
+  if (mismatched.length) {
+    return {
+      name: "kube",
+      status: "warn",
+      detail: `bound ${list2(lines)}, but the ambient current-context is ${ambient} \u2014 chant refuses a live read on a mismatch`,
+      fix: `Run \`kubectl config use-context ${mismatched[0].split(": ")[1]}\` before the live overlay.`
+    };
+  }
+  return { name: "kube", status: "pass", detail: `bound ${list2(lines)}` };
+}
+function substrateCheck(substrates) {
+  if (!substrates.length) return { name: "substrates", status: "pass", detail: "none needed by this project" };
+  const detail = list2(substrates.map((s) => `${s.label} ${s.status}`));
+  const down = substrates.filter((s) => s.status === "down" || s.status === "blocked");
+  if (!down.length) return { name: "substrates", status: "pass", detail };
+  const named = down.map((s) => `${s.label} (${s.bringUp ? `${s.bringUp.cmd} ${s.bringUp.args.join(" ")}` : s.detail})`);
+  return {
+    name: "substrates",
+    status: "warn",
+    detail,
+    fix: `Bring up: ${list2(named)} \u2014 or \`behold serve <dir> --local\`, which boots the project's own emulators (needs Docker).`
+  };
+}
+function opsCheck(root, ops, chantSource, estate) {
+  const mcp = chantSource === "project" ? "chant MCP available (the project's own chant)" : "chant MCP unavailable until the project's chant is installed";
+  if (!ops.length) {
+    return {
+      name: "ops",
+      status: "warn",
+      detail: `no committed Ops (*.op.ts) \u2014 behold can show drift but has nothing to trigger; ${mcp}`,
+      fix: "Add an ApplyOp (code to cloud) or ReconcileOp (cloud to PR) under ops/ \u2014 behold triggers your Ops, it holds no apply creds."
+    };
+  }
+  const names = ops.map((o) => `${labelFor(root, o.dir, estate)}${o.name} (${o.kind})`);
+  return { name: "ops", status: "pass", detail: `${ops.length} committed: ${list2(names)}; ${mcp}` };
+}
+async function diagnose(dir, probes = {}) {
+  const root = resolve6(dir);
+  const shape = detectProjectShape(root);
+  const behold = beholdVersion();
+  if (shape.kind === "none") {
+    return {
+      behold,
+      dir: root,
+      kind: "none",
+      ok: false,
+      checks: [
+        {
+          name: "project",
+          status: "fail",
+          detail: `no chant.config.ts here, and no estate members declared (.behold.json \`members\`, or npm workspaces)`,
+          fix: "Point behold at a chant project (`behold doctor <dir>`), or run `behold demo` for a bundled working example."
+        }
+      ]
+    };
+  }
+  const estate = shape.kind === "estate";
+  const members = (shape.members ?? []).map((m) => resolve6(root, m));
+  const targets = estate ? members : [root];
+  const primary = targets[0];
+  const projectCheck = estate ? {
+    name: "project",
+    status: "pass",
+    detail: `estate of ${members.length} projects (${shape.membersFrom === "behold-config" ? ".behold.json members" : "npm workspaces"}): ${list2(
+      members.map((m) => relative4(root, m))
+    )}`
+  } : { name: "project", status: "pass", detail: `chant project (${relative4(root, shape.configFile)})` };
+  const infos = await Promise.all(targets.map(async (t) => ({ target: t, info: await detectProject(t) })));
+  const declared = new Map(infos.map(({ target, info }) => [target, info.lexicons]));
+  const lexicons = [...new Set(infos.flatMap(({ info }) => info.lexicons))];
+  const envs = [...new Set(infos.flatMap(({ info }) => info.environments))];
+  const profiles = {};
+  for (const { info } of infos) for (const [env, p] of Object.entries(info.k8sProfiles ?? {})) profiles[env] ??= p;
+  const kubeconfig = lexicons.includes("k8s") || lexicons.includes("helm") ? await (probes.loadKubeconfig ?? loadKubeconfig)() : EMPTY_KUBECONFIG;
+  const kube = kubeCheck(lexicons, profiles, envs, kubeconfig);
+  const boundContext = resolveK8sTarget(profiles, envs[0], kubeconfig)?.label;
+  const substrates = await (probes.detectSubstrates ?? detectSubstrates)(primary, false, boundContext);
+  const checks = [
+    projectCheck,
+    chantCheck(root, targets, estate),
+    lexiconCheck(root, declared, estate),
+    // An estate root is not itself servable — the hint has to name its members
+    // (`behold serve a b c`, #31), which is what a stranger would otherwise
+    // discover by having the root serve nothing.
+    envCheck(envs, estate ? shape.members.map((m) => `${dir.replace(/\/$/, "")}/${m}`).join(" ") : dir),
+    kube,
+    substrateCheck(substrates),
+    opsCheck(root, discoverEstateOps(targets), resolveChant(primary).source, estate)
+  ];
+  return { behold, dir: root, kind: shape.kind, ok: !checks.some((c) => c.status === "fail"), checks };
+}
+function formatReport(report) {
+  const lines = [`behold doctor ${report.behold} \u2014 ${report.dir}`, ""];
+  for (const c of report.checks) {
+    lines.push(`  ${c.status.padEnd(4)}  ${c.name.padEnd(10)}  ${c.detail}`);
+    if (c.fix) lines.push(`        ${"fix".padEnd(10)}  ${c.fix}`);
+  }
+  const tally = (s) => report.checks.filter((c) => c.status === s).length;
+  lines.push("", `  ${tally("pass")} pass, ${tally("warn")} warn, ${tally("fail")} fail`, "");
+  return lines.join("\n");
+}
+
 // src/cli.ts
 var USAGE = `behold \u2014 a live control plane on chant (read-only core)
 
 Usage:
   behold demo [name] [target-dir] [--port <n>] [--list]
+  behold doctor [project-dir] [--json]
   behold preview [project-dir] [--port <n>] [--emulator]
   behold export [project-dir] [--out <dir>] [--env <name>] [--name <worker>] [--emulator]
   behold serve <project-dir\u2026> [--port <n>] [--env <name>] [--poll <secs>] [--local]
+  behold carve <report.json> [--port <n>]
+
+  carve   Render a chant Terraform peelability report \u2014 the JSON from
+          \`chant carve advise --from <tf-dir> --json\` \u2014 as a graph. One card
+          per ranked resource, coloured by band: green = carve now, amber =
+          has boundary work, grey = leave in Terraform. Click a card for the
+          score arithmetic behind its rank. Read-only twice over: chant's
+          advisor emits nothing, and behold only draws what it says.
+          \`GET /api/carve\` serves the raw report to agents. behold parses no
+          Terraform and needs no Terraform tooling \u2014 the report is the contract.
+
+  doctor  Why won't this project serve well? A read-only diagnosis of
+          everything behold needs \u2014 the project's kind, its own chant install
+          and version, declared lexicons, the envs the picker will infer, the
+          kube context chant binds versus the ambient one, substrate
+          readiness, committed Ops \u2014 each line pass/warn/fail with a one-line
+          fix. Defaults to the current directory. Exits 0 iff nothing failed;
+          --json for machines. Starts no server and changes nothing.
 
   demo    The five-minute path from npm \u2014 no chant project needed. A catalog
           of demo estates (behold demo --list): bundled ones copy out of the
@@ -4923,9 +7656,13 @@ Usage:
           clone a public estate. Bare \`behold demo\` is the AWS example \u2014 an
           S3 bucket + policy on a local emulator: blue = declared, click
           Deploy, watch it turn green. \`behold demo k8s\` stands a workload
-          up on a throwaway k3d cluster instead. Needs Docker (and per-demo
-          tools --list names). Loaded demos land in the panel's recents, so
-          switching between them is the Scope tab.
+          up on a throwaway k3d cluster instead. \`behold demo carve\` is the
+          odd one out: no cluster, no Docker, no cloud \u2014 a half-migrated
+          Terraform/chant estate plus the six-step carve walkthrough on the
+          panel's Carve tab. Needs Docker (and per-demo tools --list names).
+          Loaded demos land in the panel's recents, so switching between them
+          is the Scope tab \u2014 which lists this whole catalog too (#268), one
+          click from any served project.
 
   export  Capture the live estate into a self-contained, interactive STATIC
           bundle (default ./behold-export) \u2014 every env/tier \xD7 zoom \xD7 radial,
@@ -4946,7 +7683,7 @@ Usage:
           overlay, and rollback act on it).
 
 Options:
-  --port <n>          Port (default 4600). preview/serve.
+  --port <n>          Port (default 4600). preview/serve/carve.
   --env <name>        Environment name \u2014 turns on the live drift overlay.
                       export/serve.
   --poll <secs>       Re-query live drift every <secs> and push updates (needs --env).
@@ -4977,13 +7714,15 @@ Options:
                       names, unlike --local; kept separate because Loom's own
                       \`scripts/local/local-up.sh\` Floci setup clashes on :4566
                       with chant's generic \`chant emulator up\`.
+  --json              doctor only: the report as JSON (stable keys) instead of
+                      the console lines \u2014 the AGENTS.md audience.
   --out <dir>         export only: output directory (default ./behold-export).
   --name <worker>     export only: Cloudflare Worker name in the generated
                       wrangler.jsonc.
   -h, --help          This text.
   -v, --version       Print the behold version.
 `;
-async function run3(argv) {
+async function run2(argv) {
   const [cmd, ...rest] = argv;
   if (!cmd || cmd === "-h" || cmd === "--help") {
     process.stdout.write(USAGE);
@@ -4997,6 +7736,10 @@ async function run3(argv) {
     await runDemo(rest);
     return;
   }
+  if (cmd === "doctor") {
+    await runDoctor(rest);
+    return;
+  }
   if (cmd === "preview") {
     await runPreview(rest);
     return;
@@ -5005,6 +7748,10 @@ async function run3(argv) {
     await runExportCmd(rest);
     return;
   }
+  if (cmd === "carve") {
+    await runCarve(rest);
+    return;
+  }
   if (cmd !== "serve") {
     process.stderr.write(`behold: unknown command '${cmd}'
 
@@ -5060,7 +7807,7 @@ ${USAGE}`);
     process.stderr.write("behold serve: --auto-sync needs --env and --poll (it acts on polled drift)\n");
     process.exit(2);
   }
-  const dirs = projectDirs.map((d) => resolve3(d));
+  const dirs = projectDirs.map((d) => resolve7(d));
   for (const d of dirs) warnIfNotChantProject(d);
   await startServer({
     projectDir: dirs[0],
@@ -5074,16 +7821,86 @@ ${USAGE}`);
   });
 }
 function warnIfNotChantProject(dir) {
-  if (existsSync10(join13(dir, "chant.config.ts"))) return;
+  const shape = detectProjectShape(dir);
+  if (shape.kind === "project") return;
+  if (shape.kind === "estate") {
+    process.stderr.write(
+      `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
+        Serve its members composed: behold serve ${shape.members.map((m) => join17(dir, m)).join(" ")}
+`
+    );
+    return;
+  }
   process.stderr.write(
     `behold: warning \u2014 ${dir} has no chant.config.ts; this doesn't look like a chant project.
-        No project yet? \`behold demo\` serves a bundled working example (needs Docker).
+        \`behold doctor ${dir}\` says what's missing. No project yet? \`behold demo\` serves a bundled working example (needs Docker).
+`
+  );
+}
+async function runCarve(rest) {
+  let port = 4600;
+  let fileArg;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--port") port = Number(rest[++i]);
+    else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
+    else if (!a.startsWith("-")) fileArg = a;
+    else {
+      process.stderr.write(`behold carve: unexpected argument '${a}'
+`);
+      process.exit(2);
+    }
+  }
+  if (!Number.isFinite(port)) {
+    process.stderr.write("behold carve: --port must be a number\n");
+    process.exit(2);
+  }
+  if (!fileArg) {
+    process.stderr.write(
+      "behold carve: missing <report.json>\n  Generate one: chant carve advise --from <terraform-dir> --report report.json\n"
+    );
+    process.exit(2);
+  }
+  const reportPath = resolve7(fileArg);
+  const parsed = readCarveReport(reportPath, (p) => readFileSync14(p, "utf8"));
+  if (!parsed.ok) {
+    process.stderr.write(`behold carve: ${parsed.refusal.error}
+  ${parsed.refusal.remedy}
+`);
+    process.exit(2);
+  }
+  process.stdout.write(
+    `behold carve \u2014 ${parsed.report.resources.length} resource(s)/module(s) ranked${parsed.report.from ? ` from ${parsed.report.from}` : ""}
 `
   );
+  await startServer({ projectDir: dirname6(reportPath), carveReport: reportPath, port });
+}
+async function runDoctor(rest) {
+  let json = false;
+  let dirArg;
+  for (const a of rest) {
+    if (a === "--json") json = true;
+    else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
+    else if (!a.startsWith("-")) dirArg = a;
+    else {
+      process.stderr.write(`behold doctor: unexpected argument '${a}'
+`);
+      process.exit(2);
+    }
+  }
+  const dir = dirArg ?? ".";
+  if (!existsSync13(resolve7(dir))) {
+    process.stderr.write(`behold doctor: no such directory: ${resolve7(dir)}
+`);
+    process.exit(2);
+  }
+  const report = await diagnose(dir);
+  process.stdout.write(json ? JSON.stringify(report, null, 2) + "\n" : formatReport(report));
+  if (!report.ok) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot = join13(dirname5(fileURLToPath3(import.meta.url)), "..");
-  const registry = loadDemoRegistry(pkgRoot);
+  const pkgRoot2 = join17(dirname6(fileURLToPath5(import.meta.url)), "..");
+  const registry = loadDemoRegistry(pkgRoot2);
   let port = 4600;
   let name;
   let dirArg;
@@ -5134,64 +7951,93 @@ async function runDemo(rest) {
 `);
     process.exit(2);
   }
-  const target = resolve3(
-    dirArg ?? (entry.name === "writes" && existsSync10("behold-demo") ? "behold-demo" : join13("behold-demos", entry.name))
-  );
-  if (!existsSync10(target)) {
-    if (entry.source === "bundled") {
-      const bundled = join13(pkgRoot, entry.dir);
-      if (!existsSync10(bundled)) {
-        process.stderr.write(`behold demo ${entry.name}: this install has no bundled ${entry.dir}
+  const target = dirArg ? resolve7(dirArg) : demoTargetDir(entry);
+  const loaded = await loadDemo(entry, { pkgRoot: pkgRoot2, target, log: (line) => process.stdout.write(line + "\n") });
+  if (!loaded.ok) {
+    process.stderr.write(`behold demo ${entry.name}: ${loaded.error}
 `);
-        process.exit(2);
-      }
-      process.stdout.write(`behold demo ${entry.name} \u2192 copying to ${target} (it's yours \u2014 edit it)
+    process.exit(1);
+  }
+  if (entry.serve.carve) {
+    await serveCarveDemo(target, entry.serve.carve, port);
+    return;
+  }
+  process.stdout.write(`behold demo ${entry.name} \u2192 serving. Blue = declared; Deploy turns it green.
 `);
-      cpSync(bundled, target, {
-        recursive: true,
-        filter: (src) => !relative2(bundled, src).split(sep).includes("node_modules")
-      });
-    } else {
-      process.stdout.write(`behold demo ${entry.name} \u2192 cloning ${entry.repo} to ${target}
+  const serveArgs = ["serve", ...loaded.serveDirs, "--port", String(port)];
+  if (entry.serve.local) serveArgs.push("--local");
+  if (entry.serve.env) serveArgs.push("--env", entry.serve.env);
+  await run2(serveArgs);
+}
+function spawnStep(cmd, args, cwd) {
+  return new Promise((res) => {
+    const child = spawn5(cmd, args, { stdio: "inherit", cwd, shell: process.platform === "win32" });
+    child.on("error", () => res(-1));
+    child.on("close", (code) => res(code ?? 1));
+  });
+}
+async function serveCarveDemo(target, carve, port) {
+  const at = (rel) => resolve7(target, rel);
+  const project = at(carve.project);
+  const from = at(carve.from);
+  const state = carve.state ? at(carve.state) : void 0;
+  const committed = at(carve.report);
+  if (existsSync13(join17(project, "package.json")) && !existsSync13(join17(project, "node_modules"))) {
+    process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
-      const r = spawnSync2("git", ["clone", "--depth", "1", entry.repo, target], { stdio: "inherit" });
-      if (r.status !== 0) {
-        process.stderr.write(`behold demo ${entry.name}: clone failed
+    const code = await spawnStep("npm", ["install"], project);
+    if (code !== 0) {
+      process.stderr.write(`behold demo carve: npm install failed in ${project}
 `);
-        process.exit(r.status ?? 1);
-      }
+      process.exit(code || 1);
     }
-  } else {
-    process.stdout.write(`behold demo ${entry.name} \u2192 reusing ${target}
-`);
   }
-  if (existsSync10(join13(target, "package.json")) && !existsSync10(join13(target, "node_modules"))) {
-    process.stdout.write(`behold demo ${entry.name} \u2192 npm install\u2026
-`);
-    const r = spawnSync2("npm", ["install"], { cwd: target, stdio: "inherit", shell: process.platform === "win32" });
-    if (r.status !== 0) {
-      process.stderr.write(`behold demo: npm install failed in ${target}${r.error ? ` (${r.error.message})` : ""}
-`);
-      process.exit(r.status ?? 1);
-    }
+  let degraded;
+  if (!existsSync13(join17(target, "node_modules", "@cdktf", "hcl2json"))) {
+    process.stdout.write("behold demo carve \u2192 npm install @cdktf/hcl2json (chant's HCL parser, ~2MB, once)\u2026\n");
+    const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", "@cdktf/hcl2json"], target);
+    if (code !== 0) degraded = "couldn't install @cdktf/hcl2json (chant's HCL parser) \u2014 no network?";
+  }
+  const report = at("carve-report.json");
+  if (!degraded) {
+    const bin = resolveChant(project).bin;
+    process.stdout.write("behold demo carve \u2192 chant carve advise (read-only; emits nothing)\u2026\n");
+    const code = await spawnStep(
+      bin,
+      ["carve", "advise", "--from", carve.from, ...carve.state ? ["--state", carve.state] : [], "--report", report],
+      target
+    );
+    if (code !== 0) degraded = `chant carve advise exited ${code}`;
   }
-  if (entry.setup) {
-    process.stdout.write(`behold demo ${entry.name} \u2192 ${entry.setup}
-`);
-    const r = spawnSync2(entry.setup, { cwd: target, stdio: "inherit", shell: true });
-    if (r.status !== 0) {
-      process.stderr.write(`behold demo ${entry.name}: setup failed (${entry.setup})
-`);
-      process.exit(r.status ?? 1);
-    }
+  const serving = !degraded && existsSync13(report) ? report : committed;
+  if (degraded) {
+    process.stderr.write(
+      `behold demo carve: ${degraded}
+        Serving the committed report (${carve.report}) instead \u2014 the bands are real, just not regenerated here.
+`
+    );
   }
-  process.stdout.write(`behold demo ${entry.name} \u2192 serving. Blue = declared; Deploy turns it green.
+  if (!existsSync13(serving)) {
+    process.stderr.write(`behold demo carve: no carve report at ${serving}
 `);
-  const serveDirs = entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join13(target, d)) : [target];
-  const serveArgs = ["serve", ...serveDirs, "--port", String(port)];
-  if (entry.serve.local) serveArgs.push("--local");
-  if (entry.serve.env) serveArgs.push("--env", entry.serve.env);
-  await run3(serveArgs);
+    process.exit(2);
+  }
+  process.stdout.write(
+    "behold demo carve \u2192 serving the walkthrough. Green = carve now; the Carve tab walks the six steps.\n"
+  );
+  await startServer({
+    projectDir: target,
+    carveReport: serving,
+    carveDemo: {
+      root: target,
+      from,
+      ...state ? { state } : {},
+      project,
+      out: at(carve.out),
+      ...degraded ? { degraded: `${degraded} \u2014 showing the committed report shipped with the demo.` } : {}
+    },
+    port
+  });
 }
 function injectEmulatorEnv(env) {
   process.env.LOOM_ENV ??= env ?? "local";
@@ -5215,8 +8061,8 @@ async function runPreview(rest) {
     process.stderr.write("behold preview: --port must be a number\n");
     process.exit(2);
   }
-  const projectDir = resolve3(dirArg ?? process.cwd());
-  if (!existsSync10(projectDir)) {
+  const projectDir = resolve7(dirArg ?? process.cwd());
+  if (!existsSync13(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -5236,26 +8082,26 @@ async function runPreview(rest) {
   await startServer({ projectDir, port, env: "local", previewMode: true });
 }
 async function runExportCmd(rest) {
-  let outDir = resolve3("behold-export");
+  let outDir = resolve7("behold-export");
   let env;
   let name;
   let dirArg;
   let emulator = false;
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--out") outDir = resolve3(rest[++i]);
+    if (a === "--out") outDir = resolve7(rest[++i]);
     else if (a === "--env") env = rest[++i];
     else if (a === "--name") name = rest[++i];
     else if (a === "--emulator") emulator = true;
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
   }
-  const projectDir = resolve3(dirArg ?? process.cwd());
+  const projectDir = resolve7(dirArg ?? process.cwd());
   if (emulator) {
     injectEmulatorEnv(env);
     env ??= "local";
   }
-  if (!existsSync10(projectDir)) {
+  if (!existsSync13(projectDir)) {
     process.stderr.write(`behold export: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -5266,18 +8112,18 @@ function isMainModule() {
   const entry = process.argv[1];
   if (!entry) return false;
   try {
-    return realpathSync(entry) === realpathSync(fileURLToPath3(import.meta.url));
+    return realpathSync(entry) === realpathSync(fileURLToPath5(import.meta.url));
   } catch {
     return false;
   }
 }
 if (isMainModule()) {
-  run3(process.argv.slice(2)).catch((err) => {
+  run2(process.argv.slice(2)).catch((err) => {
     process.stderr.write(`behold: fatal: ${err?.message ?? err}
 `);
     process.exit(3);
   });
 }
 export {
-  run3 as run
+  run2 as run
 };