@intentius/behold 0.8.0 → 0.9.1

package/dist/cli.js

@@ -1,8 +1,1047 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// node_modules/@intentius/chant-k8s-client/src/errors.ts
+function firstLine(text, max = 300) {
+  const line = text.split("\n").find((l) => l.trim().length > 0)?.trim();
+  if (!line) return void 0;
+  return line.length > max ? `${line.slice(0, max - 3)}...` : line;
+}
+var K8sApiError, K8sTransportError, K8sClientUnavailableError, ExecCredentialNotAllowedError, FieldManagerError, KubeConfigError, UnknownResourceError;
+var init_errors = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/errors.ts"() {
+    K8sApiError = class _K8sApiError extends Error {
+      constructor(statusCode, reason, apiMessage, target, status) {
+        super(
+          `${target ? `${target}: ` : ""}${apiMessage || "request failed"} (HTTP ${statusCode}${reason ? `, ${reason}` : ""})`
+        );
+        this.statusCode = statusCode;
+        this.reason = reason;
+        this.apiMessage = apiMessage;
+        this.target = target;
+        this.status = status;
+        this.name = "K8sApiError";
+      }
+      statusCode;
+      reason;
+      apiMessage;
+      target;
+      status;
+      /**
+       * Which cluster the failing read actually talked to, e.g.
+       * `context "k3d-fountain-local" (bound by k8s.profiles.local.context)`.
+       * Stamped by the client that issued the request (chant #1488) — a
+       * `read-failed` that does not name the cluster it read cost an afternoon on
+       * a laptop with two k3d clusters, so the failure carries it from birth.
+       */
+      contextNote;
+      /** The object is not there. The only failure that establishes absence. */
+      get notFound() {
+        return this.statusCode === 404 || this.reason === "NotFound";
+      }
+      /** RBAC denied the read. Proves nothing about whether the object exists. */
+      get forbidden() {
+        return this.statusCode === 403 || this.reason === "Forbidden";
+      }
+      /** No usable credentials for this cluster. */
+      get unauthorized() {
+        return this.statusCode === 401 || this.reason === "Unauthorized";
+      }
+      /**
+       * Server-side-apply field-ownership conflict. `./conflict.ts`'s
+       * {@link import("./conflict").FieldManagerConflictError} is the presented
+       * form (chant #1075); this predicate still answers for both.
+       */
+      get conflict() {
+        return this.statusCode === 409 || this.reason === "Conflict";
+      }
+      /**
+       * Build from a raw response body, which is a `Status` on every well-behaved
+       * Kubernetes error and occasionally plain text from a proxy in front of one.
+       */
+      static fromResponse(statusCode, body, target) {
+        let status;
+        try {
+          const parsed = JSON.parse(body);
+          if (parsed && typeof parsed === "object" && parsed.kind === "Status") {
+            status = parsed;
+          }
+        } catch {
+        }
+        const message = status?.message ?? firstLine(body) ?? "";
+        return new _K8sApiError(statusCode, status?.reason, message, target, status);
+      }
+    };
+    K8sTransportError = class extends Error {
+      constructor(message, target, options) {
+        super(target ? `${target}: ${message}` : message);
+        this.target = target;
+        this.name = "K8sTransportError";
+        if (options && "cause" in options) this.cause = options.cause;
+      }
+      target;
+      /** Which cluster context the failed request was aimed at — see {@link K8sApiError.contextNote}. */
+      contextNote;
+    };
+    K8sClientUnavailableError = class extends Error {
+      constructor(cause) {
+        super(
+          "the Kubernetes API client is unavailable \u2014 @kubernetes/client-node could not be loaded. Install it with `npm i @intentius/chant-k8s-client` (it is an optional dependency of @intentius/chant-lexicon-k8s, so `--omit=optional` installs skip it)."
+        );
+        this.name = "K8sClientUnavailableError";
+        if (cause !== void 0) this.cause = cause;
+      }
+    };
+    ExecCredentialNotAllowedError = class extends Error {
+      constructor(command, allowed) {
+        super(
+          `k8s: the kubeconfig for this context authenticates with the exec credential plugin "${command}", which is not on chant's allowlist (${allowed.join(", ")}). An exec plugin is an arbitrary binary named in a file chant did not write. If "${command}" is expected, add it to k8s.execCredentialPlugins in chant.config.ts.`
+        );
+        this.command = command;
+        this.allowed = allowed;
+        this.name = "ExecCredentialNotAllowedError";
+      }
+      command;
+      allowed;
+    };
+    FieldManagerError = class extends Error {
+      constructor(message) {
+        super(`k8s: ${message}`);
+        this.name = "FieldManagerError";
+      }
+    };
+    KubeConfigError = class extends Error {
+      constructor(message) {
+        super(`k8s: ${message}`);
+        this.name = "KubeConfigError";
+      }
+    };
+    UnknownResourceError = class extends Error {
+      constructor(selectorText2, message) {
+        super(message ?? `k8s: the cluster's API discovery reports no resource matching "${selectorText2}"`);
+        this.selectorText = selectorText2;
+        this.name = "UnknownResourceError";
+      }
+      selectorText;
+    };
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/credentials.ts
+function execConfigOf(user) {
+  if (!user) return void 0;
+  if (user.exec) return user.exec;
+  const providerExec = user.authProvider?.config?.exec;
+  if (providerExec) return providerExec;
+  return void 0;
+}
+function execCommandName(command) {
+  const base = command.split(/[\\/]/).pop() ?? command;
+  return base.replace(/\.(exe|cmd|bat)$/i, "");
+}
+function assertExecCredentialAllowed(user, allowlist = DEFAULT_EXEC_ALLOWLIST) {
+  const exec = execConfigOf(user);
+  if (!exec?.command) return;
+  const name = execCommandName(exec.command);
+  if (allowlist.some((entry) => execCommandName(entry) === name)) return;
+  throw new ExecCredentialNotAllowedError(exec.command, allowlist);
+}
+function credentialPathOf(user) {
+  const exec = execConfigOf(user);
+  if (exec?.command) return { credential: "exec-plugin", execCommand: exec.command };
+  if (user?.authProvider?.name) return { credential: "auth-provider" };
+  if (user?.token) return { credential: "token" };
+  if (user?.certData || user?.certFile) return { credential: "client-certificate" };
+  if (user?.username) return { credential: "basic-auth" };
+  return { credential: "none" };
+}
+var DEFAULT_EXEC_ALLOWLIST;
+var init_credentials = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/credentials.ts"() {
+    init_errors();
+    DEFAULT_EXEC_ALLOWLIST = [
+      "aws",
+      // EKS — `aws eks get-token`
+      "aws-iam-authenticator",
+      // EKS, pre-`aws eks get-token`
+      "gke-gcloud-auth-plugin",
+      // GKE
+      "kubelogin",
+      // AKS
+      "kubectl"
+      // OIDC via `kubectl oidc-login`, and k3d/kind setups
+    ];
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/conflict.ts
+function renderConflictReport(report) {
+  const { conflicts, fieldManager, target } = report;
+  const subject = target ? `${target}` : "this object";
+  if (conflicts.length === 0) {
+    return `k8s: server-side apply of ${subject} was refused with a field-ownership conflict, but the API server reported no field causes${report.apiMessage ? ` \u2014 it said: ${report.apiMessage}` : ""}. chant applied as field manager "${fieldManager}".`;
+  }
+  const grouped = /* @__PURE__ */ new Map();
+  for (const conflict of conflicts) {
+    const list3 = grouped.get(conflict.manager) ?? [];
+    if (!list3.includes(conflict.field)) list3.push(conflict.field);
+    grouped.set(conflict.manager, list3);
+  }
+  const count = new Set(conflicts.map((c) => c.field)).size;
+  const lines = [
+    `k8s: server-side apply of ${subject} was refused \u2014 ${count} ${count === 1 ? "field is" : "fields are"} owned by another field manager.`,
+    ""
+  ];
+  for (const [manager, fields] of [...grouped].sort(([a], [b]) => a.localeCompare(b))) {
+    lines.push(`  "${manager}" owns:`);
+    for (const field of [...fields].sort()) lines.push(`    ${field}`);
+  }
+  lines.push(
+    "",
+    `chant applied as field manager "${fieldManager}". Taking these fields means the managers above`,
+    `stop owning them, and will contest them again on their next apply.`,
+    "",
+    "chant does not force this for you. Either:",
+    "  - remove the contested fields from your chant source, leaving them to their current owner; or",
+    "  - re-run this apply with force-conflicts on, deliberately (the `force: true` activity argument,",
+    "    or `forceConflicts: true` on ApplyOp), which transfers ownership to chant."
+  );
+  return lines.join("\n");
+}
+function parseFieldConflicts(status, message) {
+  const fromCauses = causesOf(status);
+  if (fromCauses.length > 0) return fromCauses;
+  return parseConflictMessage(message ?? status?.message ?? "");
+}
+function causesOf(status) {
+  const details = status?.details;
+  if (!details || typeof details !== "object") return [];
+  const causes = details.causes;
+  if (!Array.isArray(causes)) return [];
+  const out = [];
+  for (const raw of causes) {
+    if (!raw || typeof raw !== "object") continue;
+    if (raw.type !== void 0 && raw.type !== "FieldManagerConflict") continue;
+    const field = typeof raw.field === "string" ? raw.field : void 0;
+    if (!field) continue;
+    const { manager, apiVersion } = parseCauseMessage(raw.message ?? "");
+    out.push({
+      manager: manager ?? "an unnamed manager",
+      field,
+      ...apiVersion ? { apiVersion } : {}
+    });
+  }
+  return out;
+}
+function parseCauseMessage(message) {
+  const manager = /conflicts? with "([^"]+)"/.exec(message)?.[1];
+  const apiVersion = /\busing ([^\s:]+)\b/.exec(message)?.[1];
+  return { ...manager ? { manager } : {}, ...apiVersion ? { apiVersion } : {} };
+}
+function parseConflictMessage(message) {
+  if (!message) return [];
+  const out = [];
+  let manager;
+  let apiVersion;
+  for (const rawLine of message.split("\n")) {
+    const line = rawLine.trim();
+    if (line.length === 0) continue;
+    const header = /conflicts? with "([^"]+)"(?: using ([^\s:]+))?/.exec(line);
+    if (header) {
+      manager = header[1];
+      apiVersion = header[2];
+      const inline = /:\s*(\.[^\s]+)$/.exec(line);
+      if (inline) out.push({ manager, field: inline[1], ...apiVersion ? { apiVersion } : {} });
+      continue;
+    }
+    const bullet = /^-\s*(\S.*)$/.exec(line);
+    if (bullet && manager) {
+      out.push({ manager, field: bullet[1].trim(), ...apiVersion ? { apiVersion } : {} });
+    }
+  }
+  return out;
+}
+function asFieldManagerConflict(error, fieldManager) {
+  if (!(error instanceof K8sApiError) || !error.conflict) return error;
+  if (error instanceof FieldManagerConflictError) return error;
+  return new FieldManagerConflictError(
+    error.statusCode,
+    error.apiMessage,
+    parseFieldConflicts(error.status, error.apiMessage),
+    fieldManager,
+    error.target,
+    error.status
+  );
+}
+var FieldManagerConflictError;
+var init_conflict = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/conflict.ts"() {
+    init_errors();
+    FieldManagerConflictError = class extends K8sApiError {
+      /** Every contested field, in the order the server reported them. */
+      conflicts;
+      /** The field manager chant applied as, and which was refused. */
+      fieldManager;
+      constructor(statusCode, apiMessage, conflicts, fieldManager, target, status) {
+        super(statusCode, status?.reason ?? "Conflict", apiMessage, target, status);
+        this.name = "FieldManagerConflictError";
+        this.conflicts = conflicts;
+        this.fieldManager = fieldManager;
+        this.message = renderConflictReport({ conflicts, fieldManager, target, apiMessage });
+      }
+      /** Contested paths grouped by the manager that owns them, managers sorted. */
+      get byManager() {
+        const grouped = {};
+        for (const conflict of this.conflicts) {
+          (grouped[conflict.manager] ??= []).push(conflict.field);
+        }
+        return Object.fromEntries(
+          Object.entries(grouped).sort(([a], [b]) => a.localeCompare(b)).map(([manager, fields]) => [manager, [...fields].sort()])
+        );
+      }
+      /** The competing managers, sorted. */
+      get managers() {
+        return Object.keys(this.byManager);
+      }
+      /** The contested paths, sorted and deduplicated. */
+      get fields() {
+        return [...new Set(this.conflicts.map((c) => c.field))].sort();
+      }
+    };
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/field-manager.ts
+function fieldManagerFor(identity) {
+  const stack = identity?.stack?.trim();
+  if (!stack) return CHANT_FIELD_MANAGER;
+  const manager = `${CHANT_FIELD_MANAGER}${FIELD_MANAGER_SEPARATOR}${stack}`;
+  assertValidFieldManager(manager, stack);
+  return manager;
+}
+function assertValidFieldManager(manager, stack) {
+  const source = stack === void 0 ? `field manager "${manager}"` : `ownership.stack "${stack}"`;
+  if (manager.length === 0) {
+    throw new FieldManagerError(`${source} produces an empty field manager, which the API server rejects`);
+  }
+  if (manager.length > FIELD_MANAGER_MAX_LENGTH) {
+    throw new FieldManagerError(
+      `${source} produces the field manager "${manager}" (${manager.length} characters), over the API server's ${FIELD_MANAGER_MAX_LENGTH}-character limit`
+    );
+  }
+  const badIndex = [...manager].findIndex((ch) => {
+    const code = ch.codePointAt(0) ?? 0;
+    return code <= 32 || code === 127;
+  });
+  if (badIndex !== -1) {
+    throw new FieldManagerError(
+      `${source} produces the field manager "${manager}", which contains whitespace or a control character at position ${badIndex}. A field manager is an identity recorded on every object chant applies; keep it to printable, space-free text.`
+    );
+  }
+}
+function isChantFieldManager(manager) {
+  if (!manager) return false;
+  return manager === CHANT_FIELD_MANAGER || manager.startsWith(`${CHANT_FIELD_MANAGER}${FIELD_MANAGER_SEPARATOR}`);
+}
+function chantStackOf(manager) {
+  if (!manager || !isChantFieldManager(manager)) return void 0;
+  const stack = manager.slice(CHANT_FIELD_MANAGER.length + FIELD_MANAGER_SEPARATOR.length);
+  return stack.length > 0 ? stack : void 0;
+}
+var CHANT_FIELD_MANAGER, FIELD_MANAGER_SEPARATOR, FIELD_MANAGER_MAX_LENGTH;
+var init_field_manager = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/field-manager.ts"() {
+    init_errors();
+    CHANT_FIELD_MANAGER = "chant";
+    FIELD_MANAGER_SEPARATOR = ":";
+    FIELD_MANAGER_MAX_LENGTH = 128;
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/concurrency.ts
+async function mapConcurrent(items, fn, limit = DEFAULT_CONCURRENCY) {
+  const width = Math.max(1, Math.min(limit, items.length));
+  const results = new Array(items.length);
+  let next = 0;
+  async function worker() {
+    while (true) {
+      const index = next++;
+      if (index >= items.length) return;
+      results[index] = await fn(items[index], index);
+    }
+  }
+  await Promise.all(Array.from({ length: width }, () => worker()));
+  return results;
+}
+var DEFAULT_CONCURRENCY;
+var init_concurrency = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/concurrency.ts"() {
+    DEFAULT_CONCURRENCY = 8;
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/kubeconfig.ts
+import { delimiter } from "node:path";
+function kubeconfigPathList() {
+  const raw = process.env.KUBECONFIG;
+  if (!raw) return [];
+  return raw.split(delimiter).filter((f) => f.length > 0);
+}
+function mergeKubeconfigFiles(mod, files) {
+  const clusters = [];
+  const users = [];
+  const contexts = [];
+  const seenClusters = /* @__PURE__ */ new Set();
+  const seenUsers = /* @__PURE__ */ new Set();
+  const seenContexts = /* @__PURE__ */ new Set();
+  let currentContext;
+  for (const file of files) {
+    const part = new mod.KubeConfig();
+    try {
+      part.loadFromFile(file);
+    } catch {
+      continue;
+    }
+    for (const cluster of part.getClusters()) {
+      if (seenClusters.has(cluster.name)) continue;
+      seenClusters.add(cluster.name);
+      clusters.push(cluster);
+    }
+    for (const user of part.getUsers()) {
+      if (seenUsers.has(user.name)) continue;
+      seenUsers.add(user.name);
+      users.push(user);
+    }
+    for (const context of part.getContexts()) {
+      if (seenContexts.has(context.name)) continue;
+      seenContexts.add(context.name);
+      contexts.push(context);
+    }
+    if (currentContext === void 0) {
+      const current = part.getCurrentContext();
+      if (current) currentContext = current;
+    }
+  }
+  const kc = new mod.KubeConfig();
+  kc.loadFromOptions({ clusters, users, contexts, currentContext });
+  return kc;
+}
+function loadKubeConfig(mod, options = {}) {
+  if (options.kubeconfig !== void 0) {
+    const kc2 = new mod.KubeConfig();
+    kc2.loadFromString(options.kubeconfig);
+    return { kc: kc2, source: "explicit-string" };
+  }
+  if (options.kubeconfigPath !== void 0) {
+    const kc2 = new mod.KubeConfig();
+    kc2.loadFromFile(options.kubeconfigPath);
+    return { kc: kc2, source: "explicit-path" };
+  }
+  const files = kubeconfigPathList();
+  if (files.length > 1) return { kc: mergeKubeconfigFiles(mod, files), source: "default" };
+  const kc = new mod.KubeConfig();
+  kc.loadFromDefault(void 0, true);
+  return { kc, source: kc.getCurrentContext() === "inCluster" ? "in-cluster" : "default" };
+}
+var init_kubeconfig = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/kubeconfig.ts"() {
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/client.ts
+async function loadClientNode() {
+  if (!clientNodeModule) {
+    clientNodeModule = import("@kubernetes/client-node").catch((err) => {
+      clientNodeModule = void 0;
+      throw new K8sClientUnavailableError(err);
+    });
+  }
+  return clientNodeModule;
+}
+async function isK8sClientAvailable() {
+  try {
+    await loadClientNode();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readAmbientContext(options = {}) {
+  try {
+    const { kc } = loadKubeConfig(await loadClientNode(), options);
+    return kc.getCurrentContext() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readKubeconfigView(options = {}) {
+  let kc;
+  try {
+    ({ kc } = loadKubeConfig(await loadClientNode(), options));
+  } catch {
+    return { contexts: [] };
+  }
+  try {
+    const servers = /* @__PURE__ */ new Map();
+    for (const cluster of kc.getClusters()) servers.set(cluster.name, cluster.server || void 0);
+    const contexts = kc.getContexts().map((context) => {
+      const server = servers.get(context.cluster);
+      return {
+        name: context.name,
+        cluster: context.cluster ?? "",
+        ...context.user ? { user: context.user } : {},
+        ...context.namespace ? { namespace: context.namespace } : {},
+        ...server ? { server } : {}
+      };
+    });
+    return { contexts, ...kc.getCurrentContext() ? { currentContext: kc.getCurrentContext() } : {} };
+  } catch {
+    return { contexts: [] };
+  }
+}
+async function createK8sClient(options = {}) {
+  const mod = await loadClientNode();
+  const { kc, source: kubeconfigSource } = loadKubeConfig(mod, options);
+  if (options.context !== void 0) {
+    if (!kc.getContextObject(options.context)) {
+      const known = kc.getContexts().map((c) => c.name);
+      throw new KubeConfigError(
+        `the kubeconfig has no context named "${options.context}" (it has ${known.length > 0 ? known.map((n) => `"${n}"`).join(", ") : "no contexts at all"}). This is the context the environment is bound to via k8s.profiles.<env>.context.`
+      );
+    }
+    kc.setCurrentContext(options.context);
+  }
+  const cluster = kc.getCurrentCluster();
+  if (!cluster) {
+    throw new KubeConfigError(
+      `the kubeconfig resolves to no cluster for context "${kc.getCurrentContext() || "(unset)"}"`
+    );
+  }
+  const user = kc.getCurrentUser();
+  assertExecCredentialAllowed(user, options.execAllowlist ?? DEFAULT_EXEC_ALLOWLIST);
+  const provenance = {
+    server: cluster.server,
+    context: kc.getCurrentContext() || void 0,
+    contextSource: options.contextSource ?? "ambient",
+    kubeconfigSource,
+    ...credentialPathOf(user)
+  };
+  const configuration = mod.createConfiguration({
+    baseServer: new mod.ServerConfiguration(cluster.server, {}),
+    authMethods: { default: kc },
+    ...options.requestLayer ? {
+      httpApi: mod.wrapHttpLibrary({
+        send: (request) => Promise.resolve(
+          options.requestLayer.send(request)
+        )
+      })
+    } : {}
+  });
+  const defaultNamespace = kc.getContextObject(kc.getCurrentContext())?.namespace || "default";
+  const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
+  const contextNote = `context "${provenance.context ?? "(unset)"}" (${options.contextLabel ?? provenance.contextSource})`;
+  function noted(err) {
+    err.contextNote = contextNote;
+    return err;
+  }
+  const discoveryCache = /* @__PURE__ */ new Map();
+  let rootDiscoveryCache;
+  async function send(path, method, opts = {}) {
+    const ctx = configuration.baseServer.makeRequestContext(path, method);
+    ctx.setHeaderParam("Accept", "application/json");
+    for (const [key, value] of Object.entries(opts.query ?? {})) ctx.setQueryParam(key, value);
+    if (opts.body !== void 0) {
+      ctx.setHeaderParam("Content-Type", opts.contentType ?? "application/json");
+      ctx.setBody(opts.body);
+    }
+    if (opts.signal) ctx.setSignal(opts.signal);
+    await kc.applySecurityAuthentication(ctx);
+    let response;
+    try {
+      response = await configuration.httpApi.send(ctx).toPromise();
+    } catch (err) {
+      throw noted(
+        new K8sTransportError(err instanceof Error ? err.message : String(err), opts.target ?? `${method} ${path}`, {
+          cause: err
+        })
+      );
+    }
+    let text;
+    try {
+      text = await response.body.text();
+    } catch (err) {
+      throw noted(
+        new K8sTransportError(
+          `response body could not be read: ${err instanceof Error ? err.message : String(err)}`,
+          opts.target ?? `${method} ${path}`,
+          { cause: err }
+        )
+      );
+    }
+    return { status: response.httpStatusCode, body: text };
+  }
+  async function sendJson(path, method, opts = {}) {
+    const { status, body } = await send(path, method, opts);
+    if (status < 200 || status > 299) {
+      throw noted(K8sApiError.fromResponse(status, body, opts.target));
+    }
+    try {
+      return JSON.parse(body);
+    } catch (err) {
+      throw noted(
+        new K8sTransportError(
+          `the API server returned HTTP ${status} with a body that is not JSON`,
+          opts.target ?? `${method} ${path}`,
+          { cause: err }
+        )
+      );
+    }
+  }
+  async function apiResourceList(apiVersion, signal) {
+    const cached = discoveryCache.get(apiVersion);
+    if (cached) return cached;
+    const pending = (async () => {
+      try {
+        return await sendJson(apiVersionPath(apiVersion), "GET", {
+          signal,
+          target: `discovery ${apiVersion}`
+        });
+      } catch (err) {
+        if (err instanceof K8sApiError && err.notFound) return null;
+        discoveryCache.delete(apiVersion);
+        throw err;
+      }
+    })();
+    discoveryCache.set(apiVersion, pending);
+    return pending;
+  }
+  async function rootDiscovery(signal) {
+    if (rootDiscoveryCache) return rootDiscoveryCache;
+    rootDiscoveryCache = (async () => {
+      const core = await sendJson("/api", "GET", {
+        signal,
+        target: "discovery /api"
+      });
+      const groups = await sendJson("/apis", "GET", { signal, target: "discovery /apis" });
+      return {
+        coreVersions: core.versions ?? ["v1"],
+        groups: (groups.groups ?? []).map((group) => ({
+          preferred: group.preferredVersion?.groupVersion,
+          versions: (group.versions ?? []).map((v) => v.groupVersion).filter((gv) => typeof gv === "string" && gv.length > 0)
+        }))
+      };
+    })().catch((err) => {
+      rootDiscoveryCache = void 0;
+      throw err;
+    });
+    return rootDiscoveryCache;
+  }
+  async function servedGroupVersions(signal) {
+    const root = await rootDiscovery(signal);
+    const out = [...root.coreVersions];
+    for (const group of root.groups) {
+      if (group.preferred) out.push(group.preferred);
+      for (const gv of group.versions) {
+        if (gv !== group.preferred) out.push(gv);
+      }
+    }
+    return [...new Set(out)];
+  }
+  async function preferredGroupVersions(signal) {
+    const root = await rootDiscovery(signal);
+    const core = root.coreVersions.includes("v1") ? "v1" : root.coreVersions[0];
+    const out = core ? [core] : [];
+    for (const group of root.groups) {
+      const gv = group.preferred ?? group.versions[0];
+      if (gv) out.push(gv);
+    }
+    return [...new Set(out)];
+  }
+  function toInfo(apiVersion, entry) {
+    const [group, version] = splitApiVersion(apiVersion);
+    return {
+      name: entry.name ?? "",
+      singularName: entry.singularName || void 0,
+      kind: entry.kind ?? "",
+      namespaced: entry.namespaced === true,
+      verbs: entry.verbs ?? [],
+      shortNames: entry.shortNames,
+      group,
+      version,
+      apiVersion
+    };
+  }
+  async function resolveByGvk(apiVersion, kind, signal) {
+    const list4 = await apiResourceList(apiVersion, signal);
+    if (!list4) return void 0;
+    const entry = (list4.resources ?? []).find((r) => r.kind === kind && !(r.name ?? "").includes("/"));
+    return entry ? toInfo(apiVersion, entry) : void 0;
+  }
+  async function resolveByResourceString(resource, group, signal) {
+    const dot = resource.indexOf(".");
+    const bare = dot === -1 ? resource : resource.slice(0, dot);
+    const fromString = dot === -1 ? void 0 : resource.slice(dot + 1);
+    const wantedGroup = fromString ?? group;
+    const needle = bare.toLowerCase();
+    const all = await servedGroupVersions(signal);
+    const candidates = wantedGroup === void 0 ? all : all.filter((gv) => splitApiVersion(gv)[0] === (wantedGroup === "" ? "" : wantedGroup));
+    const lists = await mapConcurrent(
+      candidates,
+      async (gv) => ({ gv, list: await apiResourceList(gv, signal).catch(() => null) }),
+      concurrency
+    );
+    const matchers = [
+      (r) => (r.name ?? "").toLowerCase() === needle,
+      (r) => (r.singularName ?? "").toLowerCase() === needle,
+      (r) => (r.kind ?? "").toLowerCase() === needle,
+      (r) => (r.shortNames ?? []).some((s) => s.toLowerCase() === needle)
+    ];
+    for (const matches of matchers) {
+      for (const { gv, list: list4 } of lists) {
+        const entry = (list4?.resources ?? []).find((r) => !(r.name ?? "").includes("/") && matches(r));
+        if (entry) return toInfo(gv, entry);
+      }
+    }
+    return void 0;
+  }
+  async function resolve8(selector, signal) {
+    return "apiVersion" in selector ? resolveByGvk(selector.apiVersion, selector.kind, signal) : resolveByResourceString(selector.resource, selector.group, signal);
+  }
+  async function resolveOrThrow(selector, signal) {
+    const info = await resolve8(selector, signal);
+    if (!info) throw new UnknownResourceError(selectorText(selector));
+    return info;
+  }
+  function objectPath(info, name, namespace) {
+    const parts = [apiVersionPath(info.apiVersion)];
+    if (info.namespaced) parts.push("namespaces", encodeURIComponent(namespace || defaultNamespace));
+    parts.push(info.name);
+    if (name) parts.push(encodeURIComponent(name));
+    return parts.join("/");
+  }
+  async function pathFor(ref, signal) {
+    const info = await resolve8({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
+    if (!info) return void 0;
+    return objectPath(info, ref.name, ref.namespace);
+  }
+  async function read(ref, opts = {}) {
+    const info = await resolveOrThrow({ apiVersion: ref.apiVersion, kind: ref.kind }, opts.signal);
+    return sendJson(objectPath(info, ref.name, ref.namespace), "GET", {
+      signal: opts.signal,
+      target: refText(ref)
+    });
+  }
+  async function readIfPresent(ref, opts = {}) {
+    try {
+      return await read(ref, opts);
+    } catch (err) {
+      if (err instanceof K8sApiError && err.notFound) return void 0;
+      throw err;
+    }
+  }
+  async function list3(selector, opts = {}) {
+    const info = await resolveOrThrow(selector, opts.signal);
+    const items = [];
+    let cont;
+    do {
+      const query = {};
+      if (cont) query.continue = cont;
+      if (opts.labelSelector) query.labelSelector = opts.labelSelector;
+      const page = await sendJson(
+        // Omitting the namespace segment lists across all namespaces, which is
+        // what `kubectl get <kind> -A` does and what the import path wants.
+        opts.namespace ? objectPath(info, void 0, opts.namespace) : `${apiVersionPath(info.apiVersion)}/${info.name}`,
+        "GET",
+        {
+          signal: opts.signal,
+          query: Object.keys(query).length > 0 ? query : void 0,
+          target: `list ${selectorText(selector)}`
+        }
+      );
+      items.push(...page.items ?? []);
+      cont = page.metadata?.continue || void 0;
+    } while (cont);
+    return items;
+  }
+  async function apply(object, opts = {}) {
+    const apiVersion = object.apiVersion;
+    const kind = object.kind;
+    if (!apiVersion || !kind) {
+      throw new KubeConfigError(
+        `cannot apply an object without both apiVersion and kind (got apiVersion=${String(apiVersion)}, kind=${String(kind)})`
+      );
+    }
+    const name = object.metadata?.name;
+    if (!name) {
+      throw new KubeConfigError(`cannot apply a ${apiVersion} ${kind} without metadata.name`);
+    }
+    const fieldManager = opts.fieldManager ?? CHANT_FIELD_MANAGER;
+    assertValidFieldManager(fieldManager);
+    const info = await resolveOrThrow({ apiVersion, kind }, opts.signal);
+    const query = {
+      fieldManager,
+      force: String(opts.force ?? false)
+    };
+    if (opts.dryRun) query.dryRun = "All";
+    try {
+      return await sendJson(objectPath(info, name, object.metadata?.namespace), "PATCH", {
+        // Server-side apply. JSON is valid YAML, so the JSON body is accepted
+        // under the apply-patch content type without a YAML round trip.
+        contentType: "application/apply-patch+yaml",
+        body: JSON.stringify(object),
+        query,
+        signal: opts.signal,
+        target: refText({ apiVersion, kind, name, namespace: object.metadata?.namespace })
+      });
+    } catch (err) {
+      throw asFieldManagerConflict(err, fieldManager);
+    }
+  }
+  async function readLog(ref, opts = {}) {
+    const info = await resolveOrThrow({ apiVersion: ref.apiVersion, kind: ref.kind }, opts.signal);
+    const query = {};
+    if (opts.container) query.container = opts.container;
+    if (opts.previous) query.previous = "true";
+    if (opts.tailLines !== void 0) query.tailLines = String(opts.tailLines);
+    if (opts.sinceSeconds !== void 0) query.sinceSeconds = String(opts.sinceSeconds);
+    if (opts.timestamps) query.timestamps = "true";
+    const target = `${refText(ref)} logs`;
+    const { status, body } = await send(`${objectPath(info, ref.name, ref.namespace)}/log`, "GET", {
+      query: Object.keys(query).length > 0 ? query : void 0,
+      signal: opts.signal,
+      target
+    });
+    if (status < 200 || status > 299) {
+      throw noted(K8sApiError.fromResponse(status, body, target));
+    }
+    return body;
+  }
+  async function remove(ref, opts = {}) {
+    const info = await resolveOrThrow({ apiVersion: ref.apiVersion, kind: ref.kind }, opts.signal);
+    const query = {};
+    if (opts.propagationPolicy) query.propagationPolicy = opts.propagationPolicy;
+    if (opts.dryRun) query.dryRun = "All";
+    await sendJson(objectPath(info, ref.name, ref.namespace), "DELETE", {
+      signal: opts.signal,
+      query: Object.keys(query).length > 0 ? query : void 0,
+      target: refText(ref)
+    });
+  }
+  async function resourcesOf(apiVersion, signal) {
+    const list4 = await apiResourceList(apiVersion, signal);
+    if (!list4) return [];
+    return (list4.resources ?? []).filter((r) => !(r.name ?? "").includes("/")).map((entry) => toInfo(apiVersion, entry));
+  }
+  return {
+    provenance,
+    defaultNamespace,
+    resolve: resolve8,
+    read,
+    pathFor,
+    readIfPresent,
+    list: list3,
+    readLog,
+    apply,
+    delete: remove,
+    concurrently: (items, fn) => mapConcurrent(items, fn, concurrency),
+    resources: resourcesOf,
+    preferredGroupVersions,
+    discoveryCacheKeys: () => [...discoveryCache.keys()].sort()
+  };
+}
+function apiVersionPath(apiVersion) {
+  return apiVersion.includes("/") ? `/apis/${apiVersion}` : `/api/${apiVersion}`;
+}
+function splitApiVersion(apiVersion) {
+  const slash = apiVersion.indexOf("/");
+  return slash === -1 ? ["", apiVersion] : [apiVersion.slice(0, slash), apiVersion.slice(slash + 1)];
+}
+function selectorText(selector) {
+  return "apiVersion" in selector ? `${selector.apiVersion} ${selector.kind}` : selector.group ? `${selector.resource}.${selector.group}` : selector.resource;
+}
+function refText(ref) {
+  return `${ref.apiVersion} ${ref.kind} ${ref.namespace ? `${ref.namespace}/` : ""}${ref.name}`;
+}
+var clientNodeModule;
+var init_client = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/client.ts"() {
+    init_errors();
+    init_credentials();
+    init_conflict();
+    init_field_manager();
+    init_concurrency();
+    init_kubeconfig();
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/managed-fields.ts
+function managedFieldsOf(object) {
+  const entries = object?.metadata?.managedFields;
+  if (!Array.isArray(entries)) return [];
+  return entries.filter((e) => e !== null && typeof e === "object").map((e) => e);
+}
+function fieldSetsOf(object) {
+  return managedFieldsOf(object).filter((entry) => typeof entry.manager === "string" && entry.manager.length > 0).map((entry) => ({
+    manager: entry.manager,
+    operation: entry.operation ?? "Update",
+    ...entry.apiVersion !== void 0 ? { apiVersion: entry.apiVersion } : {},
+    ...entry.subresource !== void 0 ? { subresource: entry.subresource } : {},
+    ...entry.time !== void 0 ? { time: entry.time } : {},
+    fields: fieldPathsOf(entry.fieldsV1)
+  }));
+}
+function managersOf(object) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of managedFieldsOf(object)) {
+    if (typeof entry.manager === "string" && entry.manager.length > 0) seen.add(entry.manager);
+  }
+  return [...seen];
+}
+function fieldsOwnedBy(object, manager, options = {}) {
+  const matches = typeof manager === "function" ? manager : (m) => m === manager;
+  const paths = /* @__PURE__ */ new Set();
+  for (const set of fieldSetsOf(object)) {
+    if (!matches(set.manager)) continue;
+    if (set.subresource !== void 0 && options.includeSubresources !== true) continue;
+    for (const path of set.fields) paths.add(path);
+  }
+  return [...paths].sort();
+}
+function chantOwnedFields(object, options = {}) {
+  return fieldsOwnedBy(object, isChantFieldManager, options);
+}
+function fieldOwners(object, options = {}) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const set of fieldSetsOf(object)) {
+    if (set.subresource !== void 0 && options.includeSubresources !== true) continue;
+    for (const path of set.fields) {
+      const list3 = owners.get(path) ?? [];
+      if (!list3.includes(set.manager)) list3.push(set.manager);
+      owners.set(path, list3);
+    }
+  }
+  return owners;
+}
+function fieldPathsOf(fieldsV1, prefix = "") {
+  return [...collect(fieldsV1, prefix, /* @__PURE__ */ new Set())].sort();
+}
+function collect(node, prefix, into) {
+  if (node === null || typeof node !== "object" || Array.isArray(node)) return into;
+  for (const [key, child] of Object.entries(node)) {
+    if (key === ".") {
+      if (prefix !== "") into.add(prefix);
+      continue;
+    }
+    const segment = renderSegment(key);
+    if (segment === void 0) continue;
+    const path = `${prefix}${segment}`;
+    into.add(path);
+    collect(child, path, into);
+  }
+  return into;
+}
+function renderSegment(key) {
+  if (key.startsWith("f:")) return `.${key.slice(2)}`;
+  if (key.startsWith("i:")) return `[${key.slice(2)}]`;
+  if (key.startsWith("v:")) return `[=${key.slice(2)}]`;
+  if (key.startsWith("k:")) return renderKeySegment(key.slice(2));
+  return void 0;
+}
+function renderKeySegment(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return `[${json}]`;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return `[${json}]`;
+  const parts = Object.entries(parsed).map(
+    ([name, value]) => `${name}=${JSON.stringify(value)}`
+  );
+  return `[${parts.join(",")}]`;
+}
+var init_managed_fields = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/managed-fields.ts"() {
+    init_field_manager();
+  }
+});
+
+// node_modules/@intentius/chant-k8s-client/src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  CHANT_FIELD_MANAGER: () => CHANT_FIELD_MANAGER,
+  DEFAULT_CONCURRENCY: () => DEFAULT_CONCURRENCY,
+  DEFAULT_EXEC_ALLOWLIST: () => DEFAULT_EXEC_ALLOWLIST,
+  ExecCredentialNotAllowedError: () => ExecCredentialNotAllowedError,
+  FIELD_MANAGER_MAX_LENGTH: () => FIELD_MANAGER_MAX_LENGTH,
+  FIELD_MANAGER_SEPARATOR: () => FIELD_MANAGER_SEPARATOR,
+  FieldManagerConflictError: () => FieldManagerConflictError,
+  FieldManagerError: () => FieldManagerError,
+  K8sApiError: () => K8sApiError,
+  K8sClientUnavailableError: () => K8sClientUnavailableError,
+  K8sTransportError: () => K8sTransportError,
+  KubeConfigError: () => KubeConfigError,
+  UnknownResourceError: () => UnknownResourceError,
+  apiVersionPath: () => apiVersionPath,
+  asFieldManagerConflict: () => asFieldManagerConflict,
+  assertExecCredentialAllowed: () => assertExecCredentialAllowed,
+  assertValidFieldManager: () => assertValidFieldManager,
+  chantOwnedFields: () => chantOwnedFields,
+  chantStackOf: () => chantStackOf,
+  createK8sClient: () => createK8sClient,
+  credentialPathOf: () => credentialPathOf,
+  execCommandName: () => execCommandName,
+  execConfigOf: () => execConfigOf,
+  fieldManagerFor: () => fieldManagerFor,
+  fieldOwners: () => fieldOwners,
+  fieldPathsOf: () => fieldPathsOf,
+  fieldSetsOf: () => fieldSetsOf,
+  fieldsOwnedBy: () => fieldsOwnedBy,
+  isChantFieldManager: () => isChantFieldManager,
+  isK8sClientAvailable: () => isK8sClientAvailable,
+  loadClientNode: () => loadClientNode,
+  managedFieldsOf: () => managedFieldsOf,
+  managersOf: () => managersOf,
+  mapConcurrent: () => mapConcurrent,
+  parseConflictMessage: () => parseConflictMessage,
+  parseFieldConflicts: () => parseFieldConflicts,
+  readAmbientContext: () => readAmbientContext,
+  readKubeconfigView: () => readKubeconfigView,
+  refText: () => refText,
+  renderConflictReport: () => renderConflictReport,
+  renderSegment: () => renderSegment,
+  selectorText: () => selectorText,
+  splitApiVersion: () => splitApiVersion
+});
+var init_src = __esm({
+  "node_modules/@intentius/chant-k8s-client/src/index.ts"() {
+    init_client();
+    init_errors();
+    init_field_manager();
+    init_conflict();
+    init_managed_fields();
+    init_credentials();
+    init_concurrency();
+  }
+});
+
 // src/cli.ts
-import { resolve as resolve4, dirname as dirname6, join as join14, relative as relative3, sep } from "node:path";
-import { realpathSync, existsSync as existsSync10, cpSync } from "node:fs";
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { resolve as resolve7, dirname as dirname6, join as join17 } from "node:path";
+import { realpathSync, existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { spawn as spawn5 } from "node:child_process";
 
 // src/server.ts
 import { Hono } from "hono";
@@ -33,41 +1072,32 @@ function targetEnvOverrides(targets, chosen) {
 }
 
 // src/k8s-target.ts
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-var run = promisify(execFile);
 var EMPTY = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
-function str(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function readKubeconfigJson(json) {
+function kubeconfigFromView(view) {
   const contexts = /* @__PURE__ */ new Map();
-  for (const entry of json.contexts ?? []) {
-    const name = str(entry?.name);
-    const cluster = str(entry?.context?.cluster);
-    if (name && cluster) contexts.set(name, cluster);
-  }
   const servers = /* @__PURE__ */ new Map();
-  for (const entry of json.clusters ?? []) {
-    const name = str(entry?.name);
-    const server = str(entry?.cluster?.server);
-    if (name && server) servers.set(name, server);
+  for (const entry of view.contexts) {
+    if (entry.name && entry.cluster) contexts.set(entry.name, entry.cluster);
+    if (entry.cluster && entry.server) servers.set(entry.cluster, entry.server);
   }
-  const current = str(json["current-context"]);
-  return { contexts, servers, ...current ? { currentContext: current } : {} };
+  return { contexts, servers, ...view.currentContext ? { currentContext: view.currentContext } : {} };
+}
+async function loadKubeconfig(options = {}) {
+  const client = await k8sClient();
+  if (!client) return EMPTY;
+  return kubeconfigFromView(await client.readKubeconfigView(options));
+}
+async function ambientContext(options = {}) {
+  const client = await k8sClient();
+  return client ? await client.readAmbientContext(options) : void 0;
 }
-async function loadKubeconfig(exec = defaultExec) {
+async function k8sClient() {
   try {
-    const stdout = await exec("kubectl", ["config", "view", "--raw", "-o", "json"]);
-    return readKubeconfigJson(JSON.parse(stdout));
+    return await Promise.resolve().then(() => (init_src(), src_exports));
   } catch {
-    return EMPTY;
+    return void 0;
   }
 }
-async function defaultExec(cmd, args) {
-  const { stdout } = await run(cmd, args, { encoding: "utf8", timeout: 1e4 });
-  return stdout;
-}
 function resolveK8sTarget(profiles, env, kubeconfig) {
   const declared = env ? profiles?.[env]?.context : void 0;
   const context = declared ?? kubeconfig.currentContext;
@@ -88,10 +1118,10 @@ import { streamSSE } from "hono/streaming";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { serve } from "@hono/node-server";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { execFile as execFile4 } from "node:child_process";
-import { promisify as promisify4 } from "node:util";
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname4, join as join11, relative, resolve as resolve2 } from "node:path";
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
+import { dirname as dirname4, join as join15, relative as relative3, resolve as resolve5, sep as sep4 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -563,6 +1593,7 @@ function graphFlags(opts) {
   if (opts.env) flags.push("--env", opts.env);
   if (opts.live) flags.push("--live");
   if (opts.overlay) flags.push("--overlay");
+  if (opts.namespace) flags.push("--namespace", opts.namespace);
   return flags;
 }
 function packageManifestFrom(req, name) {
@@ -803,10 +1834,10 @@ function applyArgs(target, env) {
 }
 
 // src/cluster-root.ts
-import { execFile as execFile2 } from "node:child_process";
-import { promisify as promisify2 } from "node:util";
-var run2 = promisify2(execFile2);
-async function runningK3dClusters(exec = defaultExec2) {
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var run = promisify(execFile);
+async function runningK3dClusters(exec = defaultExec) {
   try {
     const out = await exec("k3d", ["cluster", "list", "--no-headers"]);
     const clusters = /* @__PURE__ */ new Map();
@@ -822,8 +1853,8 @@ async function runningK3dClusters(exec = defaultExec2) {
     return void 0;
   }
 }
-async function defaultExec2(cmd, args) {
-  const { stdout } = await run2(cmd, args, { encoding: "utf8", timeout: 1e4 });
+async function defaultExec(cmd, args) {
+  const { stdout } = await run(cmd, args, { encoding: "utf8", timeout: 1e4 });
   return stdout;
 }
 function k3dClusterName(node) {
@@ -1004,19 +2035,19 @@ function finishPipelineProgress(state, exitCode) {
 }
 
 // src/gh-run.ts
-var defaultGhExec = (args) => new Promise((resolve5) => {
+var defaultGhExec = (args) => new Promise((resolve8) => {
   let out = "";
   let proc;
   try {
     proc = spawn2("gh", args, { stdio: ["ignore", "pipe", "pipe"] });
   } catch {
-    resolve5({ code: 127, out: "" });
+    resolve8({ code: 127, out: "" });
     return;
   }
   proc.stdout.on("data", (d) => out += d);
   proc.stderr.on("data", (d) => out += d);
-  proc.on("error", () => resolve5({ code: 127, out }));
-  proc.on("close", (code) => resolve5({ code: code ?? 1, out }));
+  proc.on("error", () => resolve8({ code: 127, out }));
+  proc.on("close", (code) => resolve8({ code: code ?? 1, out }));
 });
 async function ghReady(exec = defaultGhExec) {
   const { code, out } = await exec(["auth", "status"]);
@@ -1160,11 +2191,11 @@ function joinCiProgress(ir, state) {
   }
   for (const n of ir.nodes) {
     if (n.kind !== "Component") continue;
-    const run4 = byComponent.get(n.id);
-    if (!run4) continue;
+    const run3 = byComponent.get(n.id);
+    if (!run3) continue;
     const attrs = n.attrs ??= {};
-    attrs.ci = run4.status;
-    attrs._ciJob = run4.job;
+    attrs.ci = run3.status;
+    attrs._ciJob = run3.job;
   }
   return ir;
 }
@@ -1329,14 +2360,14 @@ var WORKLOAD_KINDS = /* @__PURE__ */ new Set([
 function rec(v) {
   return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 }
-function str2(v) {
+function str(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function namespaceOf(n) {
-  return str2(rec(n.attrs?.metadata)?.namespace) ?? "default";
+  return str(rec(n.attrs?.metadata)?.namespace) ?? "default";
 }
 function nameOf(n) {
-  return str2(rec(n.attrs?.metadata)?.name);
+  return str(rec(n.attrs?.metadata)?.name);
 }
 function labelRecord(v) {
   const r = rec(v);
@@ -1368,16 +2399,16 @@ var FLUX_SOURCE_KINDS = /* @__PURE__ */ new Set([
 ]);
 function sourceRefOf(refObj, referrer, defaultKind) {
   const ref = rec(refObj);
-  const kind = str2(ref?.kind) ?? defaultKind;
-  const name = str2(ref?.name);
+  const kind = str(ref?.kind) ?? defaultKind;
+  const name = str(ref?.name);
   if (!kind || !name) return void 0;
-  return { kind, name, namespace: str2(ref?.namespace) ?? namespaceOf(referrer) };
+  return { kind, name, namespace: str(ref?.namespace) ?? namespaceOf(referrer) };
 }
 function namedRefOf(refObj, referrer) {
   const ref = rec(refObj);
-  const name = str2(ref?.name);
+  const name = str(ref?.name);
   if (!name) return void 0;
-  return { name, namespace: str2(ref?.namespace) ?? namespaceOf(referrer) };
+  return { name, namespace: str(ref?.namespace) ?? namespaceOf(referrer) };
 }
 function list(v) {
   return Array.isArray(v) ? v : [];
@@ -1388,7 +2419,7 @@ function helmReleaseSourceRef(n) {
 function ingressBackendServices(n) {
   const spec = rec(n.attrs?.spec);
   const out = [];
-  const backendName = (b) => str2(rec(rec(b)?.service)?.name);
+  const backendName = (b) => str(rec(rec(b)?.service)?.name);
   const fromDefault = backendName(spec?.defaultBackend);
   if (fromDefault) out.push(fromDefault);
   const rules = Array.isArray(spec?.rules) ? spec.rules : [];
@@ -1462,8 +2493,8 @@ function deriveK8sEdges(nodes) {
     }
     if (n.kind === "K8s::Autoscaling::HorizontalPodAutoscaler") {
       const ref = rec(rec(n.attrs?.spec)?.scaleTargetRef);
-      const refKind = str2(ref?.kind);
-      const refName = str2(ref?.name);
+      const refKind = str(ref?.kind);
+      const refName = str(ref?.name);
       if (!refKind || !refName) continue;
       for (const w of workloads) {
         if (namespaceOf(w) !== namespaceOf(n)) continue;
@@ -1498,11 +2529,11 @@ function deriveK8sEdges(nodes) {
       continue;
     }
     if (n.kind === "K8s::Argo::Application") {
-      addProject(n, str2(rec(n.attrs?.spec)?.project), "project");
+      addProject(n, str(rec(n.attrs?.spec)?.project), "project");
       continue;
     }
     if (n.kind === "K8s::Argo::ApplicationSet") {
-      addProject(n, str2(rec(rec(rec(n.attrs?.spec)?.template)?.spec)?.project), "template project");
+      addProject(n, str(rec(rec(rec(n.attrs?.spec)?.template)?.spec)?.project), "template project");
     }
   }
   return out;
@@ -2706,9 +3737,12 @@ function logicalKept(before, after) {
   if (after > 0 && after * 3 >= before) return void 0;
   return after === 0 ? `logical projected nothing from ${before} resources \u2014 it is a cloud-topology lens, and this estate declares none of the kinds it nests (behold#74)` : `logical kept ${after} of ${before} resources \u2014 it is a cloud-topology lens, and the rest are kinds it does not nest (behold#74)`;
 }
-function edgelessNote(zoom, ir) {
+function edgelessNote(zoom, ir, detail) {
   if (zoom === "components" || zoom === "logical") return void 0;
   if (ir.nodes.length === 0 || ir.edges.length > 0) return void 0;
+  if (detail !== void 0 && detail < 3) {
+    return "no edges at this detail \u2014 sourceRef/dependsOn and other attrs-derived references only appear at detail 3 (\u2318K \u2192 attributes, or add &detail=3)";
+  }
   return "no edges \u2014 nothing in this estate references anything else";
 }
 var CLUSTER_SCOPED = /* @__PURE__ */ new Set([
@@ -2727,9 +3761,14 @@ function namespaceMismatchNote(nodes) {
   if (!k8s.some((n) => n.attrs?._status === "good")) return void 0;
   return `${pending.length} pending k8s objects declare no metadata.namespace \u2014 if a controller stamps it at apply time (e.g. Flux's targetNamespace), the live read looked in "default", not where they run`;
 }
-function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore) {
+function namespaceJoinNote(joined) {
+  if (joined.length === 0) return void 0;
+  const each = joined.map((j) => `${j.name} in "${j.namespace}"`).join(", ");
+  return `read ${each} \u2014 the namespace the estate's own Kustomization targetNamespace binds, not the app project's own declaration`;
+}
+function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore, detail) {
   const primary = zoom === "logical" && logicalBefore !== void 0 ? logicalKept(logicalBefore, ir.nodes.length) : zoomNote(zoom, ir, compositeEdgesAttached);
-  const notes = [primary, edgelessNote(zoom, ir)].filter((n) => n !== void 0);
+  const notes = [primary, edgelessNote(zoom, ir, detail)].filter((n) => n !== void 0);
   return notes.length ? notes.join(" \xB7 ") : void 0;
 }
 function tierMismatchNote(ir, tiers, currentTier) {
@@ -2844,6 +3883,20 @@ var cache = /* @__PURE__ */ new Map();
 function unprefix(body) {
   return body.replace(/\s(?:inkscape|sodipodi):[\w-]+\s*=\s*(["'])[\s\S]*?\1/g, "").replace(/\sxlink:href\s*=/g, " href=");
 }
+var PLATE_FILL = "#ffffff";
+var PLATE_INSET = 0.1;
+var PLATED = /* @__PURE__ */ new Set(["cncf/helm"]);
+function plate(glyph) {
+  const [minX, minY, w, h] = glyph.viewBox.trim().split(/[\s,]+/).map(Number);
+  const side = Math.max(w, h);
+  const cx = minX + w / 2;
+  const cy = minY + h / 2;
+  const k = 1 - 2 * PLATE_INSET;
+  const round = (n) => Math.round(n * 1e4) / 1e4;
+  const ground = `<rect x="${round(cx - side / 2)}" y="${round(cy - side / 2)}" width="${round(side)}" height="${round(side)}" rx="${round(side * 0.18)}" fill="${PLATE_FILL}"/>`;
+  const inset = `translate(${round(cx * (1 - k))} ${round(cy * (1 - k))}) scale(${k})`;
+  return { ...glyph, body: `${ground}<g transform="${inset}">${glyph.body}</g>` };
+}
 function loadIcon(rel) {
   const hit = cache.get(rel);
   if (hit) return hit;
@@ -2854,7 +3907,8 @@ function loadIcon(rel) {
   if (open < 0 || openEnd < 0 || close < 0) throw new Error(`malformed vendored icon: ${rel}.svg`);
   const viewBox = /\bviewBox\s*=\s*(["'])(.*?)\1/.exec(raw.slice(open, openEnd))?.[2];
   if (!viewBox) throw new Error(`vendored icon has no viewBox: ${rel}.svg`);
-  const glyph = { body: unprefix(raw.slice(openEnd + 1, close).trim()), colored: true, viewBox };
+  const bare = { body: unprefix(raw.slice(openEnd + 1, close).trim()), colored: true, viewBox };
+  const glyph = PLATED.has(rel) ? plate(bare) : bare;
   cache.set(rel, glyph);
   return glyph;
 }
@@ -2907,9 +3961,203 @@ function helmIconFor(kind) {
   return HELM_MARK_KINDS.has(kind) ? loadIcon("cncf/helm") : void 0;
 }
 
+// src/carve-lens.ts
+var SUPPORTED_MAJOR = 1;
+var refuse = (error, remedy) => ({ ok: false, refusal: { error, code: "carve-report", remedy } });
+var HOW_TO_GET_ONE = "Generate one with `chant carve advise --from <terraform-dir> --report report.json` (chant's read-only Terraform peelability advisor), then `behold carve report.json`.";
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parseCarveReport(value) {
+  if (!isRecord(value)) {
+    return refuse("That file isn't a carve report \u2014 its top level isn't a JSON object.", HOW_TO_GET_ONE);
+  }
+  if (!Array.isArray(value.resources)) {
+    return refuse(
+      "That JSON doesn't look like a carve report \u2014 it has no `resources` array.",
+      HOW_TO_GET_ONE
+    );
+  }
+  const bad = value.resources.findIndex(
+    (r) => !isRecord(r) || typeof r.address !== "string" || typeof r.score !== "number" || typeof r.band !== "string"
+  );
+  if (bad >= 0) {
+    return refuse(
+      `That JSON has a \`resources\` array, but entry ${bad} isn't a scored resource (needs a string \`address\`, a numeric \`score\` and a string \`band\`).`,
+      HOW_TO_GET_ONE
+    );
+  }
+  const version = value.version ?? value.schemaVersion;
+  if (version !== void 0) {
+    const major = Number(String(version).split(".")[0]);
+    if (!Number.isFinite(major) || major !== SUPPORTED_MAJOR) {
+      return refuse(
+        `This carve report declares schema version ${String(version)}; behold reads version ${SUPPORTED_MAJOR}.`,
+        "Upgrade behold, or render the report with a behold that speaks its version."
+      );
+    }
+  }
+  return { ok: true, report: value };
+}
+function readCarveReport(path, readFile) {
+  let text;
+  try {
+    text = readFile(path);
+  } catch (err) {
+    return refuse(
+      `Couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`,
+      HOW_TO_GET_ONE
+    );
+  }
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch (err) {
+    return refuse(
+      `${path} isn't valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+      HOW_TO_GET_ONE
+    );
+  }
+  return parseCarveReport(json);
+}
+function statusForBand(band, score) {
+  switch (band) {
+    case "clean leaf":
+      return "good";
+    case "carvable w/ edits":
+      return "warn";
+    case "leave in Terraform":
+      return "neutral";
+    default:
+      return score >= 80 ? "good" : score >= 50 ? "warn" : "neutral";
+  }
+}
+function verdictForStatus(status) {
+  return status === "good" ? "carve now" : status === "warn" ? "boundary work" : "leave in Terraform";
+}
+function tfTypeOf(address, kind) {
+  if (kind === "module" || address.startsWith("module.")) return "module";
+  const dot = address.indexOf(".");
+  return dot > 0 ? address.slice(0, dot) : address;
+}
+var directionOf = (e) => e.direction ?? "inbound";
+function boundaryEdgesOf(r) {
+  const b = r.boundary;
+  if (!b) return [];
+  const list3 = Array.isArray(b) ? b : [...b.inbound ?? [], ...b.outbound ?? []];
+  return list3.filter((e) => isRecord(e) && typeof e.survivor === "string" && typeof e.carved === "string");
+}
+function scoreArithmetic(r) {
+  const b = r.breakdown;
+  if (!b || b.tier === null) return `${r.score} (no known native mapping \u2014 nothing to carve into)`;
+  const p = b.penalties ?? {};
+  const terms = [];
+  if (p.inbound) terms.push(`- 12x${b.inbound ?? 0} inbound`);
+  if (p.outbound) terms.push(`- 4x${b.outbound ?? 0} outbound`);
+  if (p.outputs) terms.push(`- 4x${b.outputs ?? 0} output`);
+  if (p.tier) terms.push(`- 15x${(b.tier ?? 1) - 1} tier${b.tier}`);
+  if (p.dynamic) terms.push(`- 10 dynamic`);
+  if (p.instances) terms.push(`- 3x${(b.instances ?? 1) - 1} instances`);
+  if (!terms.length) return `100 (no penalties) = ${r.score}`;
+  const raw = 100 + Object.values(p).reduce((s, n) => s + (n ?? 0), 0);
+  const clamped = raw !== r.score ? ` (clamped from ${raw})` : "";
+  return `100 ${terms.join(" ")} = ${r.score}${clamped}`;
+}
+function boundaryWorkOf(r) {
+  const b = r.breakdown;
+  if (!b || b.tier === null) return "no known native mapping (unsupported provider/type)";
+  const parts = [];
+  if (b.inbound) parts.push(`${b.inbound} inbound (a data-source patch each)`);
+  if (b.outbound) parts.push(`${b.outbound} outbound (a deferred input each)`);
+  if (b.outputs) parts.push(`${b.outputs} output block(s) reading it (a one-line rewrite each)`);
+  if ((b.tier ?? 1) > 1) parts.push(`tier ${b.tier} map`);
+  if (b.hasDynamic) parts.push("count/for_each/data present");
+  if ((b.instances ?? 1) > 1) parts.push(`${b.instances} instances`);
+  return parts.length ? parts.join(", ") : "clean 1:1 native map, no boundary edges";
+}
+function carveCardFields(node) {
+  const score = node.attrs.score;
+  const carve = node.attrs.carve;
+  if (typeof score !== "number") return void 0;
+  return [
+    { label: "score", value: String(score) },
+    ...typeof carve === "string" ? [{ label: "carve", value: carve }] : []
+  ];
+}
+function carveReportToIr(report) {
+  const resources = report.resources ?? [];
+  const known = new Set(resources.map((r) => r.address));
+  const nodes = resources.map((r) => {
+    const status = statusForBand(r.band, r.score);
+    const b = r.breakdown ?? {};
+    const edges2 = boundaryEdgesOf(r);
+    const patches = edges2.filter((e) => e.carved === r.address && directionOf(e) === "inbound").map((e) => e.survivor);
+    const inputs = edges2.filter((e) => e.carved === r.address && directionOf(e) === "outbound").map((e) => e.survivor);
+    return {
+      id: r.address,
+      kind: tfTypeOf(r.address, r.kind),
+      lexicon: "terraform",
+      attrs: {
+        // The drift palette's channel — `_`-prefixed, so it paints the card and
+        // stays out of both the card's fields and the inspect pane's list.
+        _status: status,
+        score: r.score,
+        carve: verdictForStatus(status),
+        band: r.band,
+        arithmetic: scoreArithmetic(r),
+        boundaryWork: boundaryWorkOf(r),
+        ...r.mapsTo ? { mapsTo: r.mapsTo } : {},
+        tier: b.tier === null || b.tier === void 0 ? "none" : b.tier,
+        inbound: b.inbound ?? 0,
+        outbound: b.outbound ?? 0,
+        outputs: b.outputs ?? 0,
+        instances: b.instances ?? 1,
+        dynamic: b.hasDynamic ?? false,
+        // The predicted diff, when the report carries the edge lists: who needs
+        // a `data` source the moment this is carved, and what becomes a
+        // deploy-time input. Absent (not empty) when the report has no lists —
+        // "none" and "not reported" are different claims.
+        ...patches.length ? { patchOnCarve: patches.join(", ") } : {},
+        ...inputs.length ? { deferredInputs: inputs.join(", ") } : {}
+      }
+    };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const edges = [];
+  for (const r of resources) {
+    for (const e of boundaryEdgesOf(r)) {
+      const direction = directionOf(e);
+      const from = direction === "inbound" ? e.survivor : e.carved;
+      const to = direction === "inbound" ? e.carved : e.survivor;
+      if (!known.has(from) || !known.has(to)) continue;
+      const key = `${from}|${to}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      edges.push({
+        from,
+        to,
+        kind: "ref",
+        viaAttr: direction,
+        ...e.attrs?.length ? { toAttr: e.attrs.join(", ") } : {}
+      });
+    }
+  }
+  const byStack = {};
+  for (const order of ["good", "warn", "neutral"]) {
+    const members = resources.filter((r) => statusForBand(r.band, r.score) === order).map((r) => r.address);
+    if (members.length) byStack[verdictForStatus(order)] = members;
+  }
+  return { nodes, edges, groups: { byStack } };
+}
+function carveNote(report, ir) {
+  const counts = Object.entries(report.bands ?? {}).filter(([, n]) => n > 0).map(([band, n]) => `${n} ${band}`).join(" \xB7 ");
+  const head = `chant carve advisory${report.from ? ` for ${report.from}` : ""}${counts ? ` \u2014 ${counts}` : ""}`;
+  if (ir.edges.length) return `${head}. Read-only: nothing is emitted, patched, or applied.`;
+  return `${head}. This report carries per-resource boundary COUNTS but no edge lists, so no boundary edges are drawn (chant#1636). Read-only: nothing is emitted, patched, or applied.`;
+}
+
 // src/render.ts
 registerPack({ lexicon: "k8s", iconFor: k8sIconFor });
 registerPack({ lexicon: "helm", iconFor: helmIconFor });
+registerPack({ lexicon: "terraform", iconFor: () => void 0, fields: carveCardFields });
 function renderArchitecture(ir, byContainer, opts = {}) {
   const spread = Math.min(1.5, ir.edges.length / Math.max(ir.nodes.length, 1));
   const layout = layoutArchitecture(ir, byContainer, {
@@ -2940,6 +4188,59 @@ function renderGraph(ir, opts = {}) {
   });
   return { svg };
 }
+function renderBanded(ir, opts = {}) {
+  const bands = ir.groups.byStack ?? {};
+  const size = footprints(ir);
+  const dims = (id) => size.get(id) ?? { w: NODE_W, h: NODE_H };
+  const ids = ir.nodes.map((n) => n.id);
+  const cellW = Math.max(NODE_W, ...ids.map((id) => dims(id).w));
+  const cellH = Math.max(NODE_H, ...ids.map((id) => dims(id).h));
+  const GAP = 28;
+  const PAD = 24;
+  const TITLE = 34;
+  const BAND_GAP = 26;
+  const cols = Math.max(1, Math.round(Math.sqrt(ids.length * (cellH + GAP) * 2 / (cellW + GAP))));
+  const contentW = cols * cellW + (cols - 1) * GAP;
+  const panelW = contentW + PAD * 2;
+  const claimed = new Set(Object.values(bands).flat());
+  const orphans = ids.filter((id) => !claimed.has(id));
+  const panels = [
+    ...Object.entries(bands).map(([title, members]) => [title, members.filter((id) => size.has(id))]),
+    ...orphans.length ? [["unbanded", orphans]] : []
+  ].filter(([, members]) => members.length > 0);
+  const statusOf = new Map(ir.nodes.map((n) => [n.id, n.attrs?._status]));
+  const placed = [];
+  const boxes = [];
+  let top = 0;
+  for (const [title, members] of panels) {
+    const rows = Math.ceil(members.length / cols);
+    const panelH = TITLE + PAD + rows * cellH + (rows - 1) * GAP + PAD;
+    members.forEach((id, i) => {
+      placed.push({
+        id,
+        x: PAD + i % cols * (cellW + GAP) + cellW / 2,
+        y: top + TITLE + PAD + Math.floor(i / cols) * (cellH + GAP) + cellH / 2
+      });
+    });
+    const statuses = new Set(members.map((id) => statusOf.get(id)));
+    const status = statuses.size === 1 ? [...statuses][0] : void 0;
+    boxes.push({ title, x: panelW / 2, y: top + panelH / 2, w: panelW, h: panelH, ...status ? { status } : {} });
+    top += panelH + BAND_GAP;
+  }
+  const height = Math.max(1, top - BAND_GAP);
+  const layout = {
+    width: panelW,
+    height,
+    nodes: placed.map((p) => ({ id: p.id, x: p.x, y: height - p.y }))
+  };
+  const svg = renderSvg(ir, layout, {
+    fit: true,
+    hideTitle: true,
+    groups: boxes.map((b) => ({ ...b, y: height - b.y })),
+    ...opts.theme ? { theme: opts.theme } : {}
+  });
+  return { svg };
+}
 var NODE_W = 175;
 var NODE_H = 104;
 function footprints(ir) {
@@ -3104,9 +4405,374 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
   layout.height = Math.max(...nodes.map((n) => n.y + hOf(n) / 2)) + pad;
 }
 
-// src/ops.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync7, existsSync as existsSync6 } from "node:fs";
+// src/carve-actions.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { isAbsolute, join as join9, relative, resolve as resolve2, sep } from "node:path";
+
+// src/layout.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync7, renameSync, rmSync, writeFileSync as writeFileSync2, accessSync, constants } from "node:fs";
 import { join as join8 } from "node:path";
+var LAYOUT_DIR = ".behold";
+var LAYOUT_FILE = "layout.json";
+var MAX_BODY_BYTES = 64 * 1024;
+var MAX_FILE_BYTES = 256 * 1024;
+var MAX_IDS_PER_LENS = 2e3;
+var MAX_LENSES = 64;
+var MAX_ID_LENGTH = 512;
+var MAX_LENS_LENGTH = 128;
+var NUM = ["dx", "dy", "dw", "dh"];
+function slug(s) {
+  return String(s ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
+}
+function normalizeLens(raw) {
+  if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_LENS_LENGTH) return null;
+  const parts = raw.split("+").map((p) => slug(p)).filter((p) => p && p !== "unknown");
+  if (!parts.length) return null;
+  const key = parts.join("+");
+  return key === "__proto__" || key === "constructor" || key === "prototype" ? null : key;
+}
+function normalizeDeltas(raw) {
+  const out = {};
+  if (!raw || typeof raw !== "object") return out;
+  for (const [id, d] of Object.entries(raw)) {
+    if (!id || id.length > MAX_ID_LENGTH || id === "__proto__" || !d || typeof d !== "object") continue;
+    const clean = {};
+    for (const k of NUM) {
+      const v = Number(d[k]);
+      if (Number.isFinite(v) && v !== 0) clean[k] = v;
+    }
+    if (Object.keys(clean).length) out[id] = clean;
+    if (Object.keys(out).length >= MAX_IDS_PER_LENS) break;
+  }
+  return out;
+}
+function lensFromQuery(params) {
+  const zoom = params.get("components") === "1" ? "components" : params.get("logical") === "1" ? "logical" : params.get("runtime") === "1" ? "runtime" : { 1: "composites", 2: "resources", 3: "attributes" }[Number(params.get("detail") ?? 2)] ?? "resources";
+  const stack = params.get("stack");
+  return [slug(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug(`stack-${stack}`) : null].filter(Boolean).join("+");
+}
+function layoutPath(projectDir) {
+  return join8(projectDir, LAYOUT_DIR, LAYOUT_FILE);
+}
+function unwritableReason(projectDir) {
+  if (!projectDir || !existsSync6(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
+  try {
+    accessSync(projectDir, constants.W_OK);
+  } catch {
+    return "the served project directory is read-only";
+  }
+  return null;
+}
+function readLayoutFile(projectDir) {
+  const empty = { version: 1, lenses: {} };
+  const file = layoutPath(projectDir);
+  try {
+    if (!existsSync6(file)) return empty;
+    const raw = readFileSync7(file, "utf8");
+    if (raw.length > MAX_FILE_BYTES) return empty;
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || !parsed.lenses || typeof parsed.lenses !== "object") return empty;
+    const lenses = {};
+    for (const [lens, deltas] of Object.entries(parsed.lenses)) {
+      const key = normalizeLens(lens);
+      if (!key) continue;
+      const clean = normalizeDeltas(deltas);
+      if (Object.keys(clean).length) lenses[key] = clean;
+      if (Object.keys(lenses).length >= MAX_LENSES) break;
+    }
+    return { version: 1, lenses };
+  } catch {
+    return empty;
+  }
+}
+function readLens(projectDir, lens) {
+  const key = normalizeLens(lens);
+  if (!key) return {};
+  return readLayoutFile(projectDir).lenses[key] ?? {};
+}
+var LayoutTooLarge = class extends Error {
+};
+function writeLens(projectDir, lens, deltas) {
+  const key = normalizeLens(lens);
+  if (!key) throw new Error(`not a lens key: ${String(lens)}`);
+  const clean = normalizeDeltas(deltas);
+  const current = readLayoutFile(projectDir);
+  const lenses = { ...current.lenses };
+  if (Object.keys(clean).length) lenses[key] = clean;
+  else delete lenses[key];
+  if (Object.keys(lenses).length > MAX_LENSES) throw new LayoutTooLarge(`a layout sidecar holds at most ${MAX_LENSES} lenses`);
+  const file = layoutPath(projectDir);
+  if (!Object.keys(lenses).length) {
+    rmSync(file, { force: true });
+    return { lens: key, deltas: clean, bytes: 0 };
+  }
+  const body = JSON.stringify({ version: 1, lenses }, null, 2) + "\n";
+  if (body.length > MAX_FILE_BYTES) throw new LayoutTooLarge(`a layout sidecar is capped at ${MAX_FILE_BYTES} bytes`);
+  mkdirSync2(join8(projectDir, LAYOUT_DIR), { recursive: true });
+  const tmp = `${file}.tmp`;
+  writeFileSync2(tmp, body, "utf8");
+  renameSync(tmp, file);
+  return { lens: key, deltas: clean, bytes: body.length };
+}
+function nodeTransform(base, d) {
+  const dx = d.dx || 0;
+  const dy = d.dy || 0;
+  if (!dx && !dy) return base;
+  return `translate(${dx}, ${dy}) ${base}`.trim();
+}
+function pathAnchors(d) {
+  const n = String(d || "").match(/-?\d*\.?\d+(?:e[-+]?\d+)?/gi);
+  if (!n || n.length < 4) return null;
+  return { sx: +n[0], sy: +n[1], ex: +n[n.length - 2], ey: +n[n.length - 1] };
+}
+function straightEdge(anchors, from, to) {
+  const { sx, sy, ex, ey } = anchors;
+  return `M ${sx + (from && from.dx || 0)} ${sy + (from && from.dy || 0)} L ${ex + (to && to.dx || 0)} ${ey + (to && to.dy || 0)}`;
+}
+function unescapeAttr(v) {
+  return v.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function attrOf(tag, name) {
+  const m = new RegExp(`\\b${name}="([^"]*)"`).exec(tag);
+  return m ? unescapeAttr(m[1]) : null;
+}
+function groupEnd(svg, from) {
+  const tok = /<g\b|<\/g\s*>/g;
+  tok.lastIndex = from;
+  let depth = 1;
+  let m;
+  while (m = tok.exec(svg)) {
+    if (m[0][1] === "/") {
+      depth--;
+      if (!depth) return m.index;
+    } else depth++;
+  }
+  return svg.length;
+}
+function applyLayoutToSvg(svg, deltas) {
+  const moved = {};
+  for (const [id, d] of Object.entries(normalizeDeltas(deltas))) if (d.dx || d.dy) moved[id] = d;
+  if (!Object.keys(moved).length || typeof svg !== "string" || !svg) return { svg, applied: 0 };
+  const placed = /* @__PURE__ */ new Set();
+  let out = svg.replace(/<g\b([^>]*?)(\/?)>/g, (tag, attrs, selfClose) => {
+    const id = attrOf(attrs, "data-node-id");
+    const d = id ? moved[id] : void 0;
+    if (!id || !d) return tag;
+    placed.add(id);
+    const base = /\btransform="([^"]*)"/.exec(attrs);
+    const next = nodeTransform(base ? base[1] : "", d);
+    if (base) return `<g${attrs.replace(base[0], () => `transform="${next}"`)}${selfClose}>`;
+    return `<g${attrs}${/\s$/.test(attrs) ? "" : " "}transform="${next}"${selfClose}>`;
+  });
+  out = reanchorEdges(out, moved);
+  return { svg: out, applied: placed.size };
+}
+function reanchorEdges(svg, moved) {
+  const open = /<g\b([^>]*\bdata-edge-from="[^"]*"[^>]*?)(\/?)>/g;
+  let out = "";
+  let cursor = 0;
+  let m;
+  while (m = open.exec(svg)) {
+    const bodyStart = m.index + m[0].length;
+    if (m[2] === "/") continue;
+    const bodyEnd = groupEnd(svg, bodyStart);
+    open.lastIndex = bodyEnd;
+    const from = moved[attrOf(m[1], "data-edge-from") ?? ""];
+    const to = moved[attrOf(m[1], "data-edge-to") ?? ""];
+    if (!from && !to) continue;
+    const body = svg.slice(bodyStart, bodyEnd);
+    const first = /<path\b[^>]*\bd="([^"]*)"/.exec(body);
+    const anchors = first ? pathAnchors(first[1]) : null;
+    if (!anchors) continue;
+    const d = straightEdge(anchors, from, to);
+    out += svg.slice(cursor, bodyStart) + body.replace(/(<path\b[^>]*\bd=")([^"]*)(")/g, (_t, a, _d, z) => a + d + z);
+    cursor = bodyEnd;
+  }
+  return out + svg.slice(cursor);
+}
+
+// src/carve-actions.ts
+var MAX_ARTIFACT_BYTES = 64 * 1024;
+var MAX_ARTIFACTS = 24;
+var MAX_OUTPUT_BYTES = 32 * 1024;
+var refuse2 = (code, error, remedy) => ({
+  ok: false,
+  refusal: { error, code, remedy }
+});
+var BUILD_CAVEAT = "The gate shown is `chant lint`, not `chant build`. chant#1637's fold is applied now: the bucket's versioning and public-access-block sub-resources come out as native props, not just folded-in mentions. `chant build` still fails, but on one rule only \u2014 WAW042, a TLS-deny bucket policy the source Terraform never declared. That's real drift the estate inherited, not a gap in the carve. example-carve/README.md, \"Why build still fails\", has the full statement.";
+function insideDemo(root, p) {
+  const rel = relative(resolve2(root), resolve2(p));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function selectFromReport(report, raw) {
+  if (typeof raw !== "string" || !raw || raw.length > 512) return null;
+  return (report?.resources ?? []).some((r) => r.address === raw) ? raw : null;
+}
+function carveWriteBlock(demo) {
+  if (!demo) {
+    return "this server isn't running a carve demo \u2014 the carve actions only exist inside a `behold demo carve` copy";
+  }
+  if (!existsSync7(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
+  if (!insideDemo(demo.root, demo.out)) return "the carve output directory is outside the demo copy";
+  return unwritableReason(demo.root);
+}
+function readArtifacts(demo, dir, filter) {
+  const out = [];
+  const walk = (d, depth) => {
+    if (out.length >= MAX_ARTIFACTS || depth > 2) return;
+    let entries;
+    try {
+      entries = readdirSync3(d).sort();
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (out.length >= MAX_ARTIFACTS) return;
+      if (name === "node_modules" || name.startsWith(".")) continue;
+      const full = join9(d, name);
+      let st;
+      try {
+        st = statSync2(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(full, depth + 1);
+        continue;
+      }
+      const rel = relative(demo.root, full).split(sep).join("/");
+      if (!filter(rel)) continue;
+      let text = "";
+      try {
+        text = readFileSync8(full, "utf8");
+      } catch {
+        continue;
+      }
+      const truncated = text.length > MAX_ARTIFACT_BYTES;
+      out.push({
+        path: rel,
+        kind: (name.split(".").pop() ?? "").toLowerCase(),
+        bytes: st.size,
+        text: truncated ? text.slice(0, MAX_ARTIFACT_BYTES) : text,
+        truncated
+      });
+    }
+  };
+  walk(dir, 0);
+  return out;
+}
+function carveSlug(select) {
+  return select.replace(/[^A-Za-z0-9_]+/g, "-");
+}
+var clip = (s) => s.length > MAX_OUTPUT_BYTES ? s.slice(0, MAX_OUTPUT_BYTES) + "\n\u2026 (truncated)" : s;
+function shortenIn(arg, root) {
+  return arg.startsWith(root + sep) ? arg.slice(root.length + 1) : arg === root ? "." : arg;
+}
+function merge(r, root) {
+  const joined = stripAnsi([r.stdout, r.stderr].filter((s) => s.trim()).join("\n").trim());
+  return clip(joined.split(root + sep).join("").split(root).join("."));
+}
+async function runCarveEmit(demo, select) {
+  const block = carveWriteBlock(demo);
+  if (block) return refuse2("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  mkdirSync3(demo.out, { recursive: true });
+  const reportFile = join9(demo.out, `${carveSlug(select)}-boundary.json`);
+  const args = [
+    "carve",
+    "emit",
+    "--from",
+    demo.from,
+    ...demo.state ? ["--state", demo.state] : [],
+    "--select",
+    select,
+    "--output",
+    demo.out,
+    "--report",
+    reportFile
+  ];
+  const run3 = await runChantRaw(args, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  const output = merge(run3, demo.root);
+  if (run3.code !== 0) {
+    return refuse2(
+      "carve-action",
+      `chant carve emit exited ${run3.code}: ${output || "(no output)"}`,
+      "The offline emit needs `@cdktf/hcl2json` in the demo copy and the demo's own chant install \u2014 `npm install` in the copy's `app/` and re-run `behold demo carve`."
+    );
+  }
+  let boundary = null;
+  try {
+    boundary = JSON.parse(readFileSync8(reportFile, "utf8"));
+  } catch {
+  }
+  const lintPath = relative(demo.project, join9(demo.out, "src")).split(sep).join("/");
+  const lintArgs = ["lint", lintPath];
+  const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  return {
+    ok: true,
+    select,
+    command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
+    output,
+    // Emitted source first, scaffolding after: `src/assets.ts` is the thing the
+    // step is about, and a package.json sorting above it buries the answer.
+    artifacts: readArtifacts(demo, demo.out, (rel) => /\.(ts|json)$/.test(rel) && !rel.endsWith("tsconfig.json")).sort(
+      (a, b) => Number(!/\/src\//.test(a.path)) - Number(!/\/src\//.test(b.path))
+    ),
+    boundary,
+    lint: { ok: lint.code === 0, code: lint.code, command: `chant ${lintArgs.join(" ")}`, output: merge(lint, demo.root) },
+    buildCaveat: BUILD_CAVEAT
+  };
+}
+async function runCarveBridge(demo, select) {
+  const block = carveWriteBlock(demo);
+  if (block) return refuse2("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  mkdirSync3(demo.out, { recursive: true });
+  const args = [
+    "carve",
+    "bridge",
+    "--from",
+    demo.from,
+    ...demo.state ? ["--state", demo.state] : [],
+    "--select",
+    select,
+    "--output",
+    demo.out
+  ];
+  const run3 = await runChantRaw(args, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  const output = merge(run3, demo.root);
+  if (run3.code !== 0) {
+    return refuse2(
+      "carve-action",
+      `chant carve bridge exited ${run3.code}: ${output || "(no output)"}`,
+      "Run the Emit step first \u2014 bridge reads the carve manifest emit leaves in the output directory."
+    );
+  }
+  const slug3 = carveSlug(select);
+  const all = readArtifacts(demo, demo.out, (rel) => /\.(tf|md|patch)$/.test(rel));
+  return {
+    ok: true,
+    select,
+    command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
+    output,
+    runbook: all.find((a) => a.path.endsWith(`${slug3}-runbook.md`)) ?? null,
+    proposals: all.filter((a) => !a.path.endsWith(`${slug3}-runbook.md`))
+  };
+}
+
+// src/ops.ts
+import { readdirSync as readdirSync4, readFileSync as readFileSync9, existsSync as existsSync8 } from "node:fs";
+import { join as join10 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -3128,11 +4794,11 @@ function discoverOps(projectDir) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const sub of ["ops", "src", "."]) {
-    const dir = join8(projectDir, sub);
-    if (!existsSync6(dir)) continue;
-    for (const f of readdirSync3(dir)) {
+    const dir = join10(projectDir, sub);
+    if (!existsSync8(dir)) continue;
+    for (const f of readdirSync4(dir)) {
       if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync7(join8(dir, f), "utf8");
+      const content = readFileSync9(join10(dir, f), "utf8");
       const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
       if (!name || seen.has(name)) continue;
       seen.add(name);
@@ -3248,7 +4914,7 @@ function classifyHealth(status) {
 function rec2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
 }
-function str3(v) {
+function str2(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function statusTree(o) {
@@ -3269,24 +4935,40 @@ var ARGO_SYNC = {
   OutOfSync: "progressing",
   Unknown: "unknown"
 };
+var ARGO_ERROR_CONDITION = /Error$/;
+function argoErrorMessage(tree) {
+  const conditions = tree?.conditions;
+  if (!Array.isArray(conditions)) return void 0;
+  for (const c of conditions) {
+    const type = str2(rec2(c)?.type);
+    if (!type || !ARGO_ERROR_CONDITION.test(type)) continue;
+    const message = str2(rec2(c)?.message);
+    if (message) return message;
+  }
+  return void 0;
+}
 function argoVerdict(o) {
   if (o.type !== "K8s::Argo::Application") return void 0;
   const tree = statusTree(o);
-  let health = str3(rec2(tree?.health)?.status);
-  let sync = str3(rec2(tree?.sync)?.status);
+  let health = str2(rec2(tree?.health)?.status);
+  let sync = str2(rec2(tree?.sync)?.status);
   if (!health && !sync) {
-    const word = str3(o.status);
+    const word = str2(o.status);
     if (word === "READY") {
       health = "Healthy";
       sync = "Synced";
+    } else if (word && word in ARGO_SYNC) {
+      sync = word;
+      health = "Healthy";
     } else if (word && word in ARGO_HEALTH) health = word;
-    else if (word && word in ARGO_SYNC) sync = word;
   }
   const verdicts = [health ? ARGO_HEALTH[health] : void 0, sync ? ARGO_SYNC[sync] : void 0].filter(
     (v) => v !== void 0
   );
   if (verdicts.length === 0) return void 0;
-  const detail = [health ? `health=${health}` : void 0, sync ? `sync=${sync}` : void 0].filter(Boolean).join(", ");
+  const pair = [health ? `health=${health}` : void 0, sync ? `sync=${sync}` : void 0].filter(Boolean).join(", ");
+  const message = argoErrorMessage(tree);
+  const detail = message ? `${pair}: ${message}` : pair;
   for (const rung of ["degraded", "progressing", "unknown"]) {
     if (verdicts.includes(rung)) return { health: rung, detail };
   }
@@ -3299,9 +4981,9 @@ function readyFromConditions(tree) {
   for (const c of conditions) {
     const cond = rec2(c);
     if (!cond || cond.type !== "Ready") continue;
-    const status = str3(cond.status);
+    const status = str2(cond.status);
     if (status !== "True" && status !== "False" && status !== "Unknown") continue;
-    return { status, reason: str3(cond.reason) };
+    return { status, reason: str2(cond.reason) };
   }
   return void 0;
 }
@@ -3318,7 +5000,7 @@ function readyFromChantConditions(o) {
   return void 0;
 }
 function readyFromStatusWord(o) {
-  const word = str3(o.status);
+  const word = str2(o.status);
   if (!word || word === "PRESENT") return void 0;
   if (word === "READY") return { status: "True" };
   if (word === "NOT-READY") return { status: "False" };
@@ -3328,8 +5010,8 @@ function describeReady(ready) {
   return `Ready=${ready.status}${ready.reason ? ` (${ready.reason})` : ""}`;
 }
 function revisionVerdict(tree) {
-  const applied = str3(tree?.lastAppliedRevision);
-  const attempted = str3(tree?.lastAttemptedRevision);
+  const applied = str2(tree?.lastAppliedRevision);
+  const attempted = str2(tree?.lastAttemptedRevision);
   if (!applied || !attempted || applied === attempted) return void 0;
   return { health: "progressing", detail: `applied ${applied}, attempted ${attempted}` };
 }
@@ -3347,7 +5029,7 @@ function fluxVerdict(o) {
     return cond?.type === "Reconciling" && cond.status === "True";
   });
   if (reconciling) return { health: "progressing", detail: "Reconciling=True" };
-  if (!str3(o.status) || o.status === "PRESENT") {
+  if (!str2(o.status) || o.status === "PRESENT") {
     return { health: "progressing", detail: "no Ready condition yet" };
   }
   return void 0;
@@ -3642,40 +5324,41 @@ var OpRunner = class {
 
 // src/substrates.ts
 import { spawn as spawn3 } from "node:child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
+import { join as join11 } from "node:path";
 import { platform } from "node:os";
+var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve8) => {
     let out = "";
     let proc;
     try {
       proc = spawn3(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve5({ code: 127, out: "" });
+      resolve8({ code: 127, out: "" });
       return;
     }
     proc.stdout.on("data", (d) => out += d);
     proc.stderr.on("data", (d) => out += d);
-    proc.on("error", () => resolve5({ code: 127, out }));
-    proc.on("close", (code) => resolve5({ code: code ?? 1, out }));
+    proc.on("error", () => resolve8({ code: 127, out }));
+    proc.on("close", (code) => resolve8({ code: code ?? 1, out }));
   });
 }
-async function dockerAvailable() {
-  const { code } = await probe("docker", ["info", "--format", "{{.ServerVersion}}"]);
+async function dockerAvailable(run3) {
+  const { code } = await run3("docker", ["info", "--format", "{{.ServerVersion}}"]);
   return code === 0;
 }
-async function dockerRunning(nameFilter) {
-  const { code, out } = await probe("docker", ["ps", "--filter", `name=${nameFilter}`, "--format", "{{.Names}}"]);
+async function dockerRunning(run3, nameFilter) {
+  const { code, out } = await run3("docker", ["ps", "--filter", `name=${nameFilter}`, "--format", "{{.Names}}"]);
   if (code !== 0) return [];
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync7(join9(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync9(join11(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync8(join9(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync10(join11(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -3683,10 +5366,11 @@ function projectLexicons(projectDir) {
     return [];
   }
 }
-async function detectSubstrates(projectDir, preview = false, boundContext) {
+async function detectSubstrates(projectDir, preview = false, boundContext, probes = {}) {
+  const run3 = probes.probe ?? probe;
   const subs = [];
   const lexicons = projectLexicons(projectDir);
-  const docker = await dockerAvailable();
+  const docker = await dockerAvailable(run3);
   subs.push({
     name: "docker",
     label: "Docker",
@@ -3694,9 +5378,10 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     detail: docker ? "daemon running" : "daemon not running",
     bringUp: docker || platform() !== "darwin" ? void 0 : { label: "open -a Docker", cmd: "open", args: ["-a", "Docker"] }
   });
-  const dep = (up, upDetail, offDetail) => !docker ? { status: "blocked", detail: "waiting on Docker" } : { status: up ? "up" : offDetail === "on-demand (pipeline run)" ? "on-demand" : "down", detail: up ? upDetail : offDetail };
+  const DOCKER_BLOCKED = { status: "blocked", detail: DOCKER_DOWN_DETAIL };
+  const dep = (up, upDetail, offDetail) => !docker ? DOCKER_BLOCKED : { status: up ? "up" : offDetail === "on-demand (pipeline run)" ? "on-demand" : "down", detail: up ? upDetail : offDetail };
   if (lexicons.includes("aws")) {
-    const floci = docker ? await dockerRunning("^floci$|^chant-floci$") : [];
+    const floci = docker ? await dockerRunning(run3, "^floci$|^chant-floci$") : [];
     const d = dep(floci.length > 0, "container up on :4566", "not running");
     subs.push({
       name: "floci",
@@ -3711,7 +5396,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
   ];
   for (const [lexicon, name, label, pattern, port] of emulators) {
     if (!lexicons.includes(lexicon)) continue;
-    const running = docker ? await dockerRunning(pattern) : [];
+    const running = docker ? await dockerRunning(run3, pattern) : [];
     subs.push({
       name,
       label,
@@ -3725,8 +5410,8 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync7(join9(projectDir, marker))) continue;
-    const c = docker ? await dockerRunning(name) : [];
+    if (!existsSync9(join11(projectDir, marker))) continue;
+    const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
       name,
@@ -3736,15 +5421,19 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     });
   }
   if (lexicons.includes("k8s")) {
-    const k3d = await probe("k3d", ["cluster", "list", "--no-headers"]);
-    const clusters = k3d.code === 0 ? k3d.out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean) : [];
-    subs.push({
-      name: "k3d",
-      label: "k3d",
-      status: k3d.code === 127 ? "unknown" : clusters.length ? "up" : "down",
-      detail: k3d.code === 127 ? "k3d not installed" : clusters.length ? `${clusters.length} cluster(s)` : "no clusters",
-      bringUp: docker && k3d.code !== 127 && !clusters.length ? scriptBringUp(projectDir, "scripts/local/local-up.sh", "local-up") : void 0
-    });
+    if (!docker) {
+      subs.push({ name: "k3d", label: "k3d", ...DOCKER_BLOCKED });
+    } else {
+      const k3d = await run3("k3d", ["cluster", "list", "--no-headers"]);
+      const clusters = k3d.code === 0 ? k3d.out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean) : [];
+      subs.push({
+        name: "k3d",
+        label: "k3d",
+        status: k3d.code === 127 ? "unknown" : clusters.length ? "up" : "down",
+        detail: k3d.code === 127 ? "k3d not installed" : clusters.length ? `${clusters.length} cluster(s)` : "no clusters",
+        bringUp: k3d.code !== 127 && !clusters.length ? scriptBringUp(projectDir, "scripts/local/local-up.sh", "local-up") : void 0
+      });
+    }
   }
   if (lexicons.includes("fly")) {
     const endpoint = process.env.FLY_FLAPS_BASE_URL;
@@ -3755,8 +5444,8 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync7(join9(projectDir, ".github", "workflows"))) {
-    const gh = await probe("gh", ["auth", "status"]);
+  if (existsSync9(join11(projectDir, ".github", "workflows"))) {
+    const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
       name: "github",
@@ -3768,7 +5457,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync8(join9(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync10(join11(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -3779,9 +5468,9 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     });
   }
   if (lexicons.includes("helm")) {
-    const helm = await probe("helm", ["version", "--short"]);
-    const ambient = helm.code === 0 && !boundContext ? await probe("kubectl", ["config", "current-context"]) : { code: 127, out: "" };
-    const ctx = boundContext ?? (ambient.code === 0 ? ambient.out.trim() : "");
+    const helm = await run3("helm", ["version", "--short"]);
+    const ambient = helm.code === 0 && !boundContext ? await ambientContext() : void 0;
+    const ctx = boundContext ?? ambient ?? "";
     subs.push({
       name: "helm",
       label: "Helm",
@@ -3831,9 +5520,9 @@ function pickAutoSyncOps(mode, ops, running, movedLexicons, suspended = /* @__PU
 }
 
 // src/history.ts
-import { execFile as execFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
-var execFileAsync = promisify3(execFile3);
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync = promisify2(execFile2);
 var SEP = "";
 function parseGitLog(stdout) {
   return stdout.split("\n").map((l) => l.trim()).filter(Boolean).map((line) => {
@@ -3872,6 +5561,8 @@ async function openRollbackBranches(projectDir, env) {
 }
 
 // src/estate.ts
+import { statSync as statSync3 } from "node:fs";
+import { join as join12, resolve as resolve3, sep as sep2 } from "node:path";
 import { composeStacks, shortStackNames } from "@intentius/pinhole";
 async function composeEstate(projectDirs, opts = {}) {
   const names = shortStackNames(projectDirs);
@@ -3880,7 +5571,7 @@ async function composeEstate(projectDirs, opts = {}) {
   );
   return composeStacks(stacks);
 }
-var firstLine = (e) => {
+var firstLine2 = (e) => {
   const msg = e instanceof Error ? e.message : String(e);
   const m = msg.match(/exited \d+:\s*([\s\S]*)/);
   return (m ? m[1] : msg).split("\n")[0].trim().slice(0, 160);
@@ -3890,20 +5581,116 @@ function namespaceRuntimeOwners(name, ir) {
   for (const n of ir.nodes) {
     if (n.runtimeOwner && own.has(n.runtimeOwner)) n.runtimeOwner = `${name}/${n.runtimeOwner}`;
   }
-  return ir;
+  return ir;
+}
+var NAMESPACE_JOIN_FLOOR = "0.44.5";
+var rec3 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+var str3 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
+var realIsDir = (p) => {
+  try {
+    return statSync3(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+function declaredNamespaceBindings(ir) {
+  const out = [];
+  for (const n of ir.nodes) {
+    if (n.kind !== "K8s::Flux::Kustomization") continue;
+    const spec = rec3(n.attrs?.spec);
+    const namespace = str3(spec?.targetNamespace);
+    const path = str3(spec?.path);
+    if (namespace && path) out.push({ path, namespace });
+  }
+  return out;
+}
+function awaitsNamespaceBinding(ir) {
+  const namespaced = ir.nodes.filter((n) => n.lexicon === "k8s" && !CLUSTER_SCOPED.has(n.kind ?? ""));
+  if (namespaced.length === 0) return false;
+  return namespaced.every((n) => !str3(rec3(n.attrs?.metadata)?.namespace));
+}
+function declaredSegments(path) {
+  if (path.startsWith("/")) return void 0;
+  const segs = path.split("/").filter((s) => s !== "" && s !== ".");
+  if (segs.length === 0 || segs.includes("..")) return void 0;
+  return segs;
+}
+function pathAlignment(declared, dir, isDir = realIsDir) {
+  const want = declaredSegments(declared);
+  if (!want) return 0;
+  const root = resolve3(dir);
+  const have = root.split(sep2).filter(Boolean);
+  for (let k = Math.min(want.length, have.length); k >= 1; k--) {
+    if (!have.slice(-k).every((s, i) => s === want[i])) continue;
+    if (!isDir(join12(root, ...want.slice(k)))) continue;
+    return k;
+  }
+  return 0;
+}
+function joinNamespaceBindings(members, isDir = realIsDir) {
+  const bindings = members.flatMap(
+    (m) => m.ir ? declaredNamespaceBindings(m.ir).map((b) => ({ ...b, declaredBy: m.dir })) : []
+  );
+  if (bindings.length === 0) return [];
+  const awaiting = members.filter((m) => m.ir && awaitsNamespaceBinding(m.ir));
+  if (awaiting.length === 0) return [];
+  const best = /* @__PURE__ */ new Map();
+  for (const b of bindings) {
+    let winner;
+    let tied = false;
+    for (const m of awaiting) {
+      if (m.dir === b.declaredBy) continue;
+      const score = pathAlignment(b.path, m.dir, isDir);
+      if (score === 0) continue;
+      if (!winner || score > winner.score) {
+        winner = { dir: m.dir, score };
+        tied = false;
+      } else if (score === winner.score) {
+        tied = true;
+      }
+    }
+    if (!winner || tied) continue;
+    const prev = best.get(winner.dir);
+    if (prev === "ambiguous") continue;
+    const join18 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join18 });
+    else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join18 });
+  }
+  return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
+}
+async function estateNamespaceScopes(projectDirs, opts, isDir = realIsDir) {
+  if (projectDirs.length < 2) return /* @__PURE__ */ new Map();
+  const { live: _live, overlay: _overlay, namespace: _namespace, ...src } = opts;
+  const irs = await Promise.all(projectDirs.map((dir) => graphIr(dir, { ...src, detail: 3 }).catch(() => void 0)));
+  const scopes = /* @__PURE__ */ new Map();
+  for (const j of joinNamespaceBindings(projectDirs.map((dir, i) => ({ dir, ir: irs[i] })), isDir)) {
+    if (!meetsFloor(resolveChant(j.dir).version, NAMESPACE_JOIN_FLOOR)) continue;
+    scopes.set(j.dir, j.namespace);
+  }
+  return scopes;
+}
+function withoutJoinedMembers(nodes, joined) {
+  if (joined.length === 0) return [...nodes];
+  return nodes.filter((n) => !joined.some((j) => n.id.startsWith(`${j.name}/`)));
 }
 async function composeEstateOverlay(projectDirs, opts, classify) {
   const names = shortStackNames(projectDirs);
   const unobserved = [];
   const dropped = [];
+  const joined = [];
   const stacks = new Array(projectDirs.length);
+  const scopes = await estateNamespaceScopes(projectDirs, opts);
   await Promise.all(
     projectDirs.map(async (dir, i) => {
       const name = names[i];
+      const namespace = scopes.get(dir);
       try {
-        stacks[i] = { name, ir: namespaceRuntimeOwners(name, classify(await graphIr(dir, { ...opts, live: true, overlay: true }))) };
+        const live = { ...opts, live: true, overlay: true, ...namespace ? { namespace } : {} };
+        stacks[i] = { name, ir: namespaceRuntimeOwners(name, classify(await graphIr(dir, live))) };
+        if (namespace) joined.push({ name, namespace });
       } catch (err) {
-        const reason = firstLine(err);
+        const reason = firstLine2(err);
         try {
           const { env: _env, live: _live, overlay: _overlay, ...srcOpts } = opts;
           const src = await graphIr(dir, srcOpts);
@@ -3911,7 +5698,7 @@ async function composeEstateOverlay(projectDirs, opts, classify) {
           stacks[i] = { name, ir: src };
           unobserved.push({ name, reason });
         } catch (err2) {
-          dropped.push({ name, reason: firstLine(err2) });
+          dropped.push({ name, reason: firstLine2(err2) });
         }
       }
     })
@@ -3922,13 +5709,16 @@ async function composeEstateOverlay(projectDirs, opts, classify) {
     observed: present.length - unobserved.length,
     total: projectDirs.length,
     unobserved,
-    dropped
+    dropped,
+    // Concurrent reads finish in whatever order the clusters answer; the note
+    // this feeds should read the same twice.
+    joined: joined.sort((a, b) => a.name.localeCompare(b.name))
   };
 }
 
 // src/events.ts
-import { watch, existsSync as existsSync8 } from "node:fs";
-import { join as join10 } from "node:path";
+import { watch, existsSync as existsSync10 } from "node:fs";
+import { join as join13 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -3946,7 +5736,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync8(join10(projectDir, "src")) ? join10(projectDir, "src") : projectDir;
+  const dir = existsSync10(join13(projectDir, "src")) ? join13(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -4223,9 +6013,108 @@ async function emulatorDown(projectDir) {
   await runChantRaw(["emulator", "down"], projectDir);
 }
 
+// src/demos.ts
+import { readFileSync as readFileSync11, existsSync as existsSync11, cpSync } from "node:fs";
+import { join as join14, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
+import { spawn as spawn4, spawnSync } from "node:child_process";
+function loadDemoRegistry(pkgRoot2) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync11(join14(pkgRoot2, "demos.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  const list3 = raw?.demos;
+  if (!Array.isArray(list3)) return [];
+  return list3.filter((e) => {
+    const d = e;
+    if (!d || typeof d.name !== "string" || !d.name || typeof d.description !== "string") return false;
+    if (d.source === "bundled") {
+      if (typeof d.dir !== "string" || !d.dir) return false;
+    } else if (d.source === "git") {
+      if (typeof d.repo !== "string" || !d.repo) return false;
+    } else {
+      return false;
+    }
+    if (!Array.isArray(d.requires) || d.requires.some((r) => typeof r !== "string")) return false;
+    if (!d.serve || typeof d.serve !== "object") return false;
+    if (d.serve.dirs !== void 0 && (!Array.isArray(d.serve.dirs) || d.serve.dirs.some((x) => typeof x !== "string") || !d.serve.dirs.length))
+      return false;
+    if (d.serve.carve !== void 0) {
+      const c = d.serve.carve;
+      const rel = (v) => typeof v === "string" && !!v && !v.startsWith("/") && !v.split("/").includes("..");
+      if (!c || typeof c !== "object") return false;
+      if (!rel(c.report) || !rel(c.from) || !rel(c.project) || !rel(c.out)) return false;
+      if (c.state !== void 0 && !rel(c.state)) return false;
+      if (!`${c.out}/`.startsWith(`${c.project}/`)) return false;
+    }
+    return true;
+  });
+}
+function missingRequirements(entry) {
+  const bins = entry.source === "git" && !entry.requires.includes("git") ? [...entry.requires, "git"] : entry.requires;
+  const finder = process.platform === "win32" ? "where" : "which";
+  return bins.filter((bin) => spawnSync(finder, [bin], { stdio: "ignore" }).status !== 0);
+}
+function fetchesFromNetwork(entry) {
+  return entry.source === "git";
+}
+function demoTargetDir(entry, cwd = process.cwd()) {
+  const legacy = resolve4(cwd, "behold-demo");
+  if (entry.name === "writes" && existsSync11(legacy)) return legacy;
+  return resolve4(cwd, "behold-demos", entry.name);
+}
+async function loadDemo(entry, opts) {
+  const { pkgRoot: pkgRoot2, target } = opts;
+  const say = (line) => opts.log?.(`behold demo ${entry.name} \u2192 ${line}`);
+  if (!existsSync11(target)) {
+    if (entry.source === "bundled") {
+      const bundled = join14(pkgRoot2, entry.dir);
+      if (!existsSync11(bundled)) return { ok: false, error: `this install has no bundled ${entry.dir}` };
+      say(`copying to ${target} (it's yours \u2014 edit it)`);
+      try {
+        cpSync(bundled, target, {
+          recursive: true,
+          filter: (src) => !relative2(bundled, src).split(sep3).includes("node_modules")
+        });
+      } catch (err) {
+        return { ok: false, error: `copy failed: ${err instanceof Error ? err.message : String(err)}` };
+      }
+    } else {
+      say(`cloning ${entry.repo} to ${target}`);
+      if (await runStep("git", ["clone", "--depth", "1", entry.repo, target]) !== 0) {
+        return { ok: false, error: `clone of ${entry.repo} failed` };
+      }
+    }
+  } else {
+    say(`reusing ${target}`);
+  }
+  if (existsSync11(join14(target, "package.json")) && !existsSync11(join14(target, "node_modules"))) {
+    say("npm install\u2026");
+    if (await runStep("npm", ["install"], { cwd: target, shell: process.platform === "win32" }) !== 0) {
+      return { ok: false, error: `npm install failed in ${target}` };
+    }
+  }
+  if (entry.setup) {
+    say(entry.setup);
+    if (await runStep(entry.setup, [], { cwd: target, shell: true }) !== 0) {
+      return { ok: false, error: `setup failed (${entry.setup})` };
+    }
+  }
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join14(target, d)) : [target] };
+}
+function runStep(cmd, args, opts = {}) {
+  return new Promise((res) => {
+    const child = spawn4(cmd, args, { stdio: "inherit", cwd: opts.cwd, shell: opts.shell ?? false });
+    child.on("error", () => res(-1));
+    child.on("close", (code) => res(code ?? 1));
+  });
+}
+
 // src/server.ts
-var webRoot = join11(dirname4(fileURLToPath3(import.meta.url)), "..", "web");
-var execFileP = async (cmd, args) => (await promisify4(execFile4)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
+var pkgRoot = join15(dirname4(fileURLToPath3(import.meta.url)), "..");
+var webRoot = join15(pkgRoot, "web");
+var execFileP = async (cmd, args) => (await promisify3(execFile3)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
   const opts = {};
@@ -4274,7 +6163,7 @@ function tierFailure(tier, message) {
 function beholdVersion() {
   try {
     const here = dirname4(fileURLToPath3(import.meta.url));
-    return JSON.parse(readFileSync9(join11(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync12(join15(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -4318,12 +6207,125 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
     return null;
   }
 }
+function carveRoutes(app, reportPath, demo) {
+  const load = () => readCarveReport(reportPath, (p) => readFileSync12(p, "utf8"));
+  const demoBlock = () => carveWriteBlock(demo);
+  const demoInfo = () => {
+    if (!demo) return null;
+    const block = demoBlock();
+    return {
+      root: demo.root,
+      from: demo.from,
+      state: demo.state ?? null,
+      project: demo.project,
+      out: demo.out,
+      // Paths the UI can print without leaking the operator's whole home dir.
+      outLabel: relative3(demo.root, demo.out).split(sep4).join("/"),
+      fromLabel: relative3(demo.root, demo.from).split(sep4).join("/"),
+      runnable: !block,
+      ...block ? { reason: block } : {},
+      ...demo.degraded ? { degraded: demo.degraded } : {},
+      buildCaveat: BUILD_CAVEAT
+    };
+  };
+  app.get("/api/carve", (c) => {
+    const parsed = load();
+    return parsed.ok ? c.json(parsed.report) : c.json(parsed.refusal, 422);
+  });
+  app.get("/api/graph", (c) => {
+    const parsed = load();
+    if (!parsed.ok) return c.json(parsed.refusal, 422);
+    const ir = carveReportToIr(parsed.report);
+    const { svg } = renderBanded(ir);
+    return c.json({
+      ir,
+      svg,
+      meta: {
+        projectDir: reportPath,
+        env: null,
+        tier: null,
+        target: null,
+        carve: true,
+        // A demo whose own advisor run failed says so on the statusbar, not
+        // only in the terminal the viewer isn't looking at.
+        note: carveNote(parsed.report, ir) + (demo?.degraded ? ` Degraded: ${demo.degraded}` : "")
+      }
+    });
+  });
+  app.get("/api/project", (c) => {
+    const parsed = load();
+    return c.json({
+      projectDir: reportPath,
+      recents: [],
+      // No envs, tiers, stacks or targets: a peelability report is a static
+      // analysis of foreign Terraform, so every picker that would imply a live
+      // axis stays empty and the SPA renders none of them.
+      environments: [],
+      lexicons: ["terraform"],
+      currentEnv: null,
+      targets: [],
+      carve: parsed.ok ? {
+        report: reportPath,
+        from: parsed.report.from ?? null,
+        count: parsed.report.count ?? parsed.report.resources.length,
+        bands: parsed.report.bands ?? {},
+        advisory: parsed.report.advisory ?? null,
+        demo: demoInfo()
+      } : { report: reportPath, demo: demoInfo() }
+    });
+  });
+  const runStep2 = async (c, run3) => {
+    const block = demoBlock();
+    if (block) {
+      return c.json(
+        {
+          error: block,
+          code: "read-only",
+          remedy: "The carve steps run inside a demo copy \u2014 start the walkthrough with `behold demo carve`."
+        },
+        403
+      );
+    }
+    if (!(c.req.header("content-type") ?? "").includes("application/json")) {
+      return c.json({ error: "send application/json", code: "carve-select", remedy: 'POST {"select": "<terraform address>"}' }, 415);
+    }
+    const text = await c.req.text().catch(() => "");
+    if (text.length > 4096) return c.json({ error: "a carve step body is capped at 4096 bytes", code: "carve-select", remedy: 'POST {"select": "\u2026"}' }, 413);
+    let body;
+    try {
+      body = JSON.parse(text || "null");
+    } catch {
+      return c.json({ error: "body must be JSON", code: "carve-select", remedy: 'POST {"select": "<terraform address>"}' }, 400);
+    }
+    const parsed = load();
+    const select = selectFromReport(parsed.ok ? parsed.report : void 0, body?.select);
+    if (!select) {
+      return c.json(
+        {
+          error: `\`select\` must name a resource this report ranks \u2014 ${JSON.stringify(body?.select ?? null)} isn't one of them.`,
+          code: "carve-select",
+          remedy: "Pick a card in the graph, or read the addresses off GET /api/carve."
+        },
+        400
+      );
+    }
+    const result = await run3(demo, select);
+    return result.ok ? c.json(result) : c.json(result.refusal, 422);
+  };
+  app.post("/api/carve/emit", (c) => runStep2(c, runCarveEmit));
+  app.post("/api/carve/bridge", (c) => runStep2(c, runCarveBridge));
+  app.get("/api/substrates", (c) => c.json({ substrates: [] }));
+  app.get("/api/history", (c) => c.json({ commits: [] }));
+  app.get("/api/resources", (c) => c.json({ byComponent: {} }));
+  app.get("/api/ci", (c) => c.json({ stages: [], jobs: [], forge: null }));
+}
 function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffer(), runner = new OpRunner({
   projectDir: cfg.projectDir,
   broadcaster,
   onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
 })) {
   const app = new Hono();
+  if (cfg.carveReport) carveRoutes(app, cfg.carveReport, cfg.carveDemo);
   let beholdConfig = loadBeholdConfig(cfg.projectDir);
   let tierEnvVar = beholdConfig.tiers?.envVar;
   const boundK8sContext = async (env) => {
@@ -4408,9 +6410,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join11(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join11(cfg.projectDir, "scripts/local/local-up.sh");
-    if (!existsSync9(down) || !existsSync9(up)) {
+    const down = join15(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join15(cfg.projectDir, "scripts/local/local-up.sh");
+    if (!existsSync12(down) || !existsSync12(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
     if (!runner.bringUp("reset local emulator", "bash", ["-c", "bash scripts/local/local-down.sh && bash scripts/local/local-up.sh"], cfg.projectDir)) {
@@ -4487,26 +6489,29 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   app.post("/api/project/open", async (c) => {
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve2(body.dir.trim()) : "";
-    if (!dir || !existsSync9(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync9(join11(dir, "chant.config.ts"))) {
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve5(body.dir.trim()) : "";
+    if (!dir || !existsSync12(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
+    if (!existsSync12(join15(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
+    switchServedProject([dir]);
+    return c.json({ ok: true, projectDir: dir });
+  });
+  const switchServedProject = (dirs, env) => {
     addRecent(cfg.projectDir);
-    cfg.projectDir = dir;
-    cfg.projectDirs = void 0;
-    cfg.env = void 0;
-    beholdConfig = loadBeholdConfig(dir);
+    cfg.projectDir = dirs[0];
+    cfg.projectDirs = dirs.length > 1 ? dirs : void 0;
+    cfg.env = env;
+    beholdConfig = loadBeholdConfig(dirs[0]);
     tierEnvVar = beholdConfig.tiers?.envVar;
-    runner.retarget(dir);
-    addRecent(dir);
-    cfg.onProjectSwitch?.(dir);
+    runner.retarget(dirs[0]);
+    for (const d of dirs) addRecent(d);
+    cfg.onProjectSwitch?.(dirs[0]);
     broadcaster.emit("changed");
-    return c.json({ ok: true, projectDir: dir });
-  });
+  };
   app.post("/api/project/reveal", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve2(body.dir.trim()) : cfg.projectDir;
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve5(body.dir.trim()) : cfg.projectDir;
     const known = /* @__PURE__ */ new Set([cfg.projectDir, ...cfg.projectDirs ?? [], ...listRecents().map((r) => r.dir)]);
     if (!known.has(dir)) return c.json({ error: "not a served or recent project directory" }, 400);
     const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
@@ -4517,6 +6522,144 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
     }
   });
+  const demoRow = (e) => {
+    const missing = missingRequirements(e);
+    const target = demoTargetDir(e);
+    return {
+      name: e.name,
+      description: e.description,
+      requires: e.requires,
+      source: e.source,
+      // #268's consent half: a git entry is cloned from a public repo, so the
+      // button says so (and names the repo) BEFORE anything is fetched.
+      fetches: fetchesFromNetwork(e),
+      ...e.repo ? { repo: e.repo } : {},
+      target,
+      loaded: existsSync12(target),
+      satisfiable: missing.length === 0,
+      // #254: the carve walkthrough runs fine here — it just isn't a project
+      // to switch INTO. Carve mode claims `/api/graph` and `/api/project` at
+      // app creation (see carveRoutes), so a running server cannot become one;
+      // the row stays in the catalog, disabled, saying what to run instead.
+      ...e.serve.carve ? { switchable: false } : {},
+      ...missing.length ? { reason: `needs ${missing.join(", ")} on PATH` } : e.serve.carve ? { reason: `serves a carve report, not a project \u2014 run \`behold demo ${e.name}\`` } : {}
+    };
+  };
+  app.get(
+    "/api/demos",
+    (c) => c.json({
+      demos: loadDemoRegistry(pkgRoot).map(demoRow),
+      ...cfg.previewMode ? { locked: "loading a demo is locked in preview mode" } : {}
+    })
+  );
+  let loadingDemo = null;
+  app.post("/api/demos/open", async (c) => {
+    if (cfg.previewMode) return c.json({ error: "loading a demo is locked in preview mode" }, 403);
+    const body = await c.req.json().catch(() => ({}));
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    const entry = loadDemoRegistry(pkgRoot).find((e) => e.name === name);
+    if (!entry) {
+      return c.json({ error: `no "${name || "(no name given)"}" in this install's demo catalog` }, 400);
+    }
+    const missing = missingRequirements(entry);
+    if (missing.length) return c.json({ error: `${entry.name} needs ${missing.join(", ")} on PATH` }, 400);
+    if (entry.serve.carve) {
+      return c.json(
+        {
+          error: `${entry.name} serves a carve report, not a chant project \u2014 a running server can't switch into carve mode.`,
+          remedy: `Run \`behold demo ${entry.name}\` in a terminal.`
+        },
+        400
+      );
+    }
+    if (loadingDemo) return c.json({ error: `${loadingDemo} is still loading` }, 409);
+    loadingDemo = entry.name;
+    try {
+      const target = demoTargetDir(entry);
+      const loaded = await loadDemo(entry, { pkgRoot, target, log: (line) => process.stdout.write(line + "\n") });
+      if (!loaded.ok) return c.json({ error: loaded.error }, 500);
+      const dirs = loaded.serveDirs;
+      if (!existsSync12(join15(dirs[0], "chant.config.ts"))) {
+        return c.json({ error: `${entry.name} loaded to ${target} but ${dirs[0]} has no chant.config.ts` }, 500);
+      }
+      if (entry.serve.local) {
+        if (cfg.emulators?.length) await emulatorDown(cfg.projectDir).catch(() => {
+        });
+        cfg.local = true;
+        cfg.emulators = await bootLocalEmulators(dirs[0], `behold demo ${entry.name} --local`);
+      }
+      switchServedProject(dirs, entry.serve.env);
+      return c.json({ ok: true, demo: entry.name, projectDir: dirs[0], projectDirs: dirs, env: entry.serve.env ?? null });
+    } finally {
+      loadingDemo = null;
+    }
+  });
+  const layoutWriteBlock = () => {
+    if (cfg.previewMode) return "the layout sidecar is read-only in preview mode";
+    if (cfg.carveReport) return "a carve report isn't a project \u2014 there's nowhere to keep a hand layout";
+    if (cfg.layoutWrites === false) return "a static export captures a snapshot \u2014 it doesn't write to the project";
+    return unwritableReason(cfg.projectDir);
+  };
+  app.get("/api/layout", (c) => {
+    const block = layoutWriteBlock();
+    const shared = { path: layoutPath(cfg.projectDir), writable: !block, ...block ? { reason: block } : {} };
+    const raw = new URL(c.req.url).searchParams.get("lens");
+    if (raw === null) return c.json({ ...shared, lenses: readLayoutFile(cfg.projectDir).lenses });
+    const lens = normalizeLens(raw);
+    if (!lens) return c.json({ error: `not a lens key: ${raw}`, code: "bad-layout" }, 400);
+    return c.json({ ...shared, lens, deltas: readLens(cfg.projectDir, lens) });
+  });
+  app.post("/api/layout", async (c) => {
+    const block = layoutWriteBlock();
+    if (block) return c.json({ error: block, code: "read-only" }, 403);
+    if (!(c.req.header("content-type") ?? "").includes("application/json")) {
+      return c.json({ error: "send application/json", code: "bad-layout" }, 415);
+    }
+    const declared = Number(c.req.header("content-length") ?? 0);
+    if (declared > MAX_BODY_BYTES) return c.json({ error: `a layout body is capped at ${MAX_BODY_BYTES} bytes`, code: "too-large" }, 413);
+    const text = await c.req.text().catch(() => "");
+    if (text.length > MAX_BODY_BYTES) return c.json({ error: `a layout body is capped at ${MAX_BODY_BYTES} bytes`, code: "too-large" }, 413);
+    let body;
+    try {
+      body = JSON.parse(text || "null");
+    } catch {
+      return c.json({ error: "body must be JSON", code: "bad-layout" }, 400);
+    }
+    const lens = normalizeLens(body?.lens);
+    if (!lens) return c.json({ error: "body needs a `lens` key (the zoom stop, plus +radial / +stack-<name>)", code: "bad-layout" }, 400);
+    if (!body?.deltas || typeof body.deltas !== "object" || Array.isArray(body.deltas)) {
+      return c.json({ error: "body needs `deltas`: {<node id>: {dx,dy,dw,dh}}", code: "bad-layout" }, 400);
+    }
+    try {
+      const stored = writeLens(cfg.projectDir, lens, body.deltas);
+      return c.json({ ok: true, lens: stored.lens, deltas: stored.deltas, count: Object.keys(stored.deltas).length, path: layoutPath(cfg.projectDir) });
+    } catch (err) {
+      if (err instanceof LayoutTooLarge) return c.json({ error: err.message, code: "too-large" }, 413);
+      return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+    }
+  });
+  const bakeHandLayout = async (c, next) => {
+    await next();
+    const url = new URL(c.req.url);
+    if (url.searchParams.get("layout") !== "1") return;
+    const res = c.res;
+    if (!res || res.status !== 200 || !(res.headers.get("content-type") ?? "").includes("json")) return;
+    const lens = lensFromQuery(url.searchParams);
+    const deltas = readLens(cfg.projectDir, lens);
+    if (!Object.keys(deltas).length) return;
+    let body;
+    try {
+      body = await res.clone().json();
+    } catch {
+      return;
+    }
+    if (typeof body.svg !== "string") return;
+    const { svg, applied } = applyLayoutToSvg(body.svg, deltas);
+    if (!applied) return;
+    c.res = c.json({ ...body, svg, meta: { ...body.meta ?? {}, layout: { lens, applied } } });
+  };
+  app.use("/api/graph", bakeHandLayout);
+  app.use("/api/overlay", bakeHandLayout);
   app.get(
     "/api",
     (c) => c.json({
@@ -4528,8 +6671,29 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         { method: "GET", path: "/api/project", desc: "project info: dir, recents, environments, tiers, targets, stacks, preview lock" },
         { method: "POST", path: "/api/project/open", desc: "switch the served project: JSON body {dir} (validated; preview-locked)" },
         { method: "POST", path: "/api/project/reveal", desc: "open the OS file manager at a served/recent project dir: JSON body {dir?}" },
-        { method: "GET", path: "/api/graph", desc: "the graph {ir, svg, meta} \u2014 params: detail=0..3, components=1, logical=1, env, stack, tier, target, lens, up=1, down=1, radial=1" },
+        { method: "GET", path: "/api/demos", desc: "the bundled demo catalog: [{name, description, requires, satisfiable, reason?, fetches, repo?, target, loaded}]" },
+        {
+          method: "POST",
+          path: "/api/demos/open",
+          desc: "load a demo and serve it: JSON body {name} (a catalog name, never a path) \u2014 copies/clones, installs, runs its setup, then switches (preview-locked)"
+        },
+        { method: "GET", path: "/api/graph", desc: "the graph {ir, svg, meta} \u2014 params: detail=0..3, components=1, logical=1, env, stack, tier, target, lens, up=1, down=1, radial=1, layout=1" },
+        ...cfg.carveReport ? [
+          { method: "GET", path: "/api/carve", desc: "carve mode: the raw `chant carve advise --json` peelability report this server is rendering" },
+          {
+            method: "POST",
+            path: "/api/carve/emit",
+            desc: "carve demo only (#254): run `chant carve emit --state --select <addr>` into the demo copy \u2014 JSON body {select}; answers {artifacts, boundary, lint}"
+          },
+          {
+            method: "POST",
+            path: "/api/carve/bridge",
+            desc: "carve demo only (#254): run `chant carve bridge` (never --apply-rewrites) \u2014 JSON body {select}; answers {runbook, proposals}"
+          }
+        ] : [],
         { method: "GET", path: "/api/overlay", desc: "live drift overlay for ?env= \u2014 same shape/params as /api/graph, plus runtime=1" },
+        { method: "GET", path: "/api/layout", desc: "hand-layout sidecar (.behold/layout.json): ?lens=<key> \u2192 {lens, deltas, writable}; no lens \u2192 every lens" },
+        { method: "POST", path: "/api/layout", desc: "store one lens's deltas: JSON body {lens, deltas: {<node id>: {dx,dy,dw,dh}}} (the only file behold writes in your project)" },
         { method: "GET", path: "/api/diff", desc: "per-node live diff for ?env= \u2014 {env, nodes: {<id>: {observed, diff, health, fieldDrift}}}" },
         { method: "GET", path: "/api/reconcile", desc: "pending-change summary for ?env=" },
         { method: "GET", path: "/api/resources", desc: "component \u2192 declared resources" },
@@ -4621,7 +6785,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync9(join11(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync12(join15(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -4726,10 +6890,10 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       return c.json({ error: "overlay needs an environment \u2014 pick one, or start behold with --env <name>" }, 400);
     }
     const logical = new URL(c.req.url).searchParams.get("logical") === "1";
+    const runtime = new URL(c.req.url).searchParams.get("runtime") === "1";
     try {
       if (cfg.projectDirs && cfg.projectDirs.length > 1) {
-        const runtime = new URL(c.req.url).searchParams.get("runtime") === "1";
-        const detail = logical ? 3 : query.detail;
+        const detail = logical || runtime ? 3 : query.detail;
         const est = await composeEstateOverlay(cfg.projectDirs, { ...tierTargetOpts(query), detail, env }, reclassifyOverlay);
         if (est.dropped.length === est.total) {
           return c.json({ error: `no project in the estate could be graphed \u2014 ${est.dropped.map((d) => `${d.name}: ${d.reason}`).join("; ")}` }, 500);
@@ -4749,7 +6913,12 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           const logicalBefore = ir2.nodes.length;
           const { ir: projected, byContainer } = projectTopology(ir2, env, boundContext2, await estateSourceRoots(query));
           const { svg: svg3 } = renderArchitecture(projected, byContainer);
-          const note3 = [notesFor("logical", projected, void 0, logicalBefore), coverNote, namespaceMismatchNote(projected.nodes)].filter(Boolean).join(" \xB7 ");
+          const note3 = [
+            notesFor("logical", projected, void 0, logicalBefore),
+            coverNote,
+            namespaceJoinNote(est.joined),
+            namespaceMismatchNote(withoutJoinedMembers(projected.nodes, est.joined))
+          ].filter(Boolean).join(" \xB7 ");
           return c.json({
             ir: projected,
             svg: svg3,
@@ -4758,14 +6927,19 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           });
         }
         const { svg: svg2 } = renderGraph(ir2, { boxes: runtime ? "byContainer" : "byStack" });
-        const note2 = [coverNote, namespaceMismatchNote(ir2.nodes), runtime ? notesFor("runtime", ir2) : void 0].filter(Boolean).join(" \xB7 ");
+        const note2 = [
+          coverNote,
+          namespaceJoinNote(est.joined),
+          namespaceMismatchNote(withoutJoinedMembers(ir2.nodes, est.joined)),
+          runtime ? notesFor("runtime", ir2, void 0, void 0, detail) : void 0
+        ].filter(Boolean).join(" \xB7 ");
         return c.json({
           ir: ir2,
           svg: svg2,
           meta: { projectDir: cfg.projectDir, env, mode: "overlay", estate: est.total, ...note2 ? { note: note2 } : {} }
         });
       }
-      const opts = { ...query, live: true, overlay: true, env, ...logical ? { detail: 3 } : {} };
+      const opts = { ...query, live: true, overlay: true, env, ...logical || runtime ? { detail: 3 } : {} };
       let ir = reclassifyOverlay(await graphIr(cfg.projectDir, opts));
       const boundContext = await boundK8sContext(env);
       ir = mergeClusterRoot(ir, await clusterRootGraphIr(cfg.projectDir, query), await runningK3dClusters());
@@ -4775,7 +6949,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         applyHelmArtifacts(ir, observed);
         synthesizeHelmReleases(ir, observed, discoverReleaseUnits(cfg.projectDir));
       }
-      ir = new URL(c.req.url).searchParams.get("runtime") === "1" ? attachRuntimeContainment(ir) : pruneRuntimeChildren(ir);
+      ir = runtime ? attachRuntimeContainment(ir) : pruneRuntimeChildren(ir);
       if (logical) {
         const logicalBefore = ir.nodes.length;
         const { ir: projected, byContainer } = projectTopology(addK8sDeclaredEdges(addValueMatchEdges(ir)), env, boundContext, [await graphPath(cfg.projectDir, opts), cfg.projectDir]);
@@ -4800,10 +6974,10 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
       }
       const { svg } = renderGraph(ir, { boxes: "byContainer", radial: new URL(c.req.url).searchParams.get("radial") === "1" });
-      const zoom = new URL(c.req.url).searchParams.get("runtime") === "1" ? "runtime" : query.detail === 1 ? "composites" : query.detail === 3 ? "attributes" : "resources";
+      const zoom = runtime ? "runtime" : query.detail === 1 ? "composites" : query.detail === 3 ? "attributes" : "resources";
       const tierNote = tierMismatchNote(ir, beholdConfig.tiers, query.tier);
       const nsNote = namespaceMismatchNote(ir.nodes);
-      const zoomNotes = notesFor(zoom, ir, compositeEdgesAttached);
+      const zoomNotes = notesFor(zoom, ir, compositeEdgesAttached, void 0, opts.detail ?? 2);
       const note = [tierNote, nsNote, zoomNotes].filter(Boolean).join(" \xB7 ");
       return c.json({ ir, svg, meta: { projectDir: cfg.projectDir, env, mode: "overlay", ...note ? { note } : {} } });
     } catch (err) {
@@ -4949,38 +7123,38 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
     return c.json({ started: true, component, env });
   });
-  const rel = relative(process.cwd(), webRoot) || ".";
+  const rel = relative3(process.cwd(), webRoot) || ".";
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join11(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join15(rel, "index.html") }));
   return app;
 }
-async function startServer(cfg) {
-  if (cfg.local) {
-    try {
-      const emulators = await emulatorUp(cfg.projectDir);
-      cfg.emulators = emulators;
-      if (emulators.length === 0) {
-        process.stderr.write(
-          "behold serve --local: no configured lexicon has a local emulator \u2014 serving without one.\n"
-        );
-      } else {
-        Object.assign(process.env, mergedEnv(emulators));
-        for (const e of emulators) {
-          process.stdout.write(`  local: ${e.lexicon} ${e.name} up on ${e.endpoint}
+async function bootLocalEmulators(dir, who) {
+  try {
+    const emulators = await emulatorUp(dir);
+    if (emulators.length === 0) {
+      process.stderr.write(`${who}: no configured lexicon has a local emulator \u2014 serving without one.
 `);
-        }
-      }
-    } catch (err) {
-      cfg.emulators = [];
-      process.stderr.write(
-        `behold serve --local: ${err instanceof Error ? err.message : String(err)}
+      return [];
+    }
+    Object.assign(process.env, mergedEnv(emulators));
+    for (const e of emulators) {
+      process.stdout.write(`  local: ${e.lexicon} ${e.name} up on ${e.endpoint}
+`);
+    }
+    return emulators;
+  } catch (err) {
+    process.stderr.write(
+      `${who}: ${err instanceof Error ? err.message : String(err)}
   Serving the source graph without the emulator \u2014 start Docker and restart to enable local deploys.
 `
-      );
-    }
+    );
+    return [];
   }
+}
+async function startServer(cfg) {
+  if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync9(join11(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync12(join15(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -5022,8 +7196,10 @@ async function startServer(cfg) {
       }
     }
   };
-  let stopWatch = watchSource(cfg.projectDir, onEstateChange);
-  let stopPoll = cfg.env && cfg.pollSecs ? startDriftPoll({
+  const carve = !!cfg.carveReport;
+  let stopWatch = carve ? () => {
+  } : watchSource(cfg.projectDir, onEstateChange);
+  let stopPoll = !carve && cfg.env && cfg.pollSecs ? startDriftPoll({
     intervalMs: cfg.pollSecs * 1e3,
     query: () => graphIr(cfg.projectDir, { live: true, overlay: true, env: cfg.env }),
     onChange: onPollDrift,
@@ -5041,7 +7217,7 @@ async function startServer(cfg) {
 `);
     void capture();
   };
-  void capture();
+  if (!carve) void capture();
   let shuttingDown = false;
   const shutdown = () => {
     if (shuttingDown) return;
@@ -5055,6 +7231,19 @@ async function startServer(cfg) {
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
   const server = serve({ fetch: app.fetch, port: cfg.port }, (info) => {
+    if (carve) {
+      process.stdout.write(
+        `behold \u2192 http://localhost:${info.port}
+  carve report: ${cfg.carveReport}
+  green = carve now, amber = boundary work, grey = leave in Terraform.
+` + (cfg.carveDemo ? `  walkthrough: the panel's Carve tab \u2014 advise \u2192 pick \u2192 emit \u2192 bridge \u2192 handoff \u2192 done.
+  Emit and bridge write only into ${cfg.carveDemo.out}; your Terraform is never edited.
+` + (cfg.carveDemo.degraded ? `  degraded: ${cfg.carveDemo.degraded}
+` : "") : `  Read-only advisory: behold emits nothing and touches no Terraform. Ctrl-C to stop.
+`)
+      );
+      return;
+    }
     const poll = cfg.env && cfg.pollSecs ? `, polling drift every ${cfg.pollSecs}s` : "";
     const auto = autoSync !== "off" ? `  auto-sync: ${autoSync}` : "";
     const localTag = cfg.emulators && cfg.emulators.length ? `  local: ${cfg.emulators.map((e) => e.name).join(", ")} up (creds-free \u2014 deploys hit the emulator)` : "";
@@ -5085,45 +7274,9 @@ async function startServer(cfg) {
   });
 }
 
-// src/demos.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-import { join as join12 } from "node:path";
-import { spawnSync } from "node:child_process";
-function loadDemoRegistry(pkgRoot) {
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync10(join12(pkgRoot, "demos.json"), "utf8"));
-  } catch {
-    return [];
-  }
-  const list3 = raw?.demos;
-  if (!Array.isArray(list3)) return [];
-  return list3.filter((e) => {
-    const d = e;
-    if (!d || typeof d.name !== "string" || !d.name || typeof d.description !== "string") return false;
-    if (d.source === "bundled") {
-      if (typeof d.dir !== "string" || !d.dir) return false;
-    } else if (d.source === "git") {
-      if (typeof d.repo !== "string" || !d.repo) return false;
-    } else {
-      return false;
-    }
-    if (!Array.isArray(d.requires) || d.requires.some((r) => typeof r !== "string")) return false;
-    if (!d.serve || typeof d.serve !== "object") return false;
-    if (d.serve.dirs !== void 0 && (!Array.isArray(d.serve.dirs) || d.serve.dirs.some((x) => typeof x !== "string") || !d.serve.dirs.length))
-      return false;
-    return true;
-  });
-}
-function missingRequirements(entry) {
-  const bins = entry.source === "git" && !entry.requires.includes("git") ? [...entry.requires, "git"] : entry.requires;
-  const finder = process.platform === "win32" ? "where" : "which";
-  return bins.filter((bin) => spawnSync(finder, [bin], { stdio: "ignore" }).status !== 0);
-}
-
 // src/export.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, copyFileSync, readFileSync as readFileSync11, readdirSync as readdirSync4 } from "node:fs";
-import { join as join13, dirname as dirname5, basename } from "node:path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, copyFileSync, readFileSync as readFileSync13, readdirSync as readdirSync5 } from "node:fs";
+import { join as join16, dirname as dirname5, basename } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var LENS_PARAMS = ["components", "detail", "env", "logical", "radial", "tier"];
 function canonicalKey(path, params) {
@@ -5131,7 +7284,7 @@ function canonicalKey(path, params) {
   const q = LENS_PARAMS.filter((k) => params.has(k) && !(flat && (k === "detail" || k === "radial"))).map((k) => `${k}=${params.get(k)}`).join("&");
   return q ? `${path}?${q}` : path;
 }
-function slug(key) {
+function slug2(key) {
   const base = key.replace(/^\//, "").replace(/[^a-zA-Z0-9=_.-]+/g, "_").slice(0, 120);
   return `${base}.json`;
 }
@@ -5171,7 +7324,7 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join13(dirname5(fileURLToPath4(import.meta.url)), "..", "web");
+  return join16(dirname5(fileURLToPath4(import.meta.url)), "..", "web");
 }
 function workerName(project, override) {
   const raw = override ?? `behold-${basename(project)}`;
@@ -5179,19 +7332,19 @@ function workerName(project, override) {
   return name || "behold-export";
 }
 async function runExport(cfg, outDir, opts = {}) {
-  const app = createApp(cfg);
+  const app = createApp({ ...cfg, layoutWrites: false });
   const proj = await (await app.request("/api/project")).json();
   const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [] };
-  const snapDir = join13(outDir, "snapshots");
-  mkdirSync2(snapDir, { recursive: true });
+  const snapDir = join16(outDir, "snapshots");
+  mkdirSync4(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
   let failed = 0;
   for (const key of captureKeys(axes)) {
-    const res = await app.request(key);
+    const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = await res.text();
-    const file = slug(key);
-    writeFileSync2(join13(snapDir, file), body);
+    const file = slug2(key);
+    writeFileSync3(join16(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -5203,21 +7356,21 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync2(join13(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync11(join13(webDir(), "index.html"), "utf8").replace(
+  writeFileSync3(join16(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync13(join16(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync2(join13(outDir, "index.html"), html);
-  for (const f of readdirSync4(webDir())) {
+  writeFileSync3(join16(outDir, "index.html"), html);
+  for (const f of readdirSync5(webDir())) {
     if (f === "index.html") continue;
-    copyFileSync(join13(webDir(), f), join13(outDir, f));
+    copyFileSync(join16(webDir(), f), join16(outDir, f));
   }
-  writeFileSync2(join13(outDir, "README.md"), BUNDLE_README);
+  writeFileSync3(join16(outDir, "README.md"), BUNDLE_README);
   const name = workerName(cfg.projectDir, opts.name);
-  writeFileSync2(
-    join13(outDir, "wrangler.jsonc"),
+  writeFileSync3(
+    join16(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
@@ -5265,7 +7418,7 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 `;
 
 // src/doctor.ts
-import { relative as relative2, resolve as resolve3 } from "node:path";
+import { relative as relative4, resolve as resolve6 } from "node:path";
 var list2 = (xs) => xs.join(", ");
 var EMPTY_KUBECONFIG = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
 function summarize(xs, max = 4) {
@@ -5273,7 +7426,7 @@ function summarize(xs, max = 4) {
 }
 function labelFor(root, target, estate) {
   if (!estate) return "";
-  const rel = relative2(root, target);
+  const rel = relative4(root, target);
   return `${rel || "."}: `;
 }
 function chantCheck(root, targets, estate) {
@@ -5286,7 +7439,7 @@ function chantCheck(root, targets, estate) {
       name: "chant",
       status: "fail",
       detail: `${list2(resolutions.map(describe))} \u2014 behold shells the project's own chant`,
-      fix: `Run \`npm install\` in ${list2(missing.map(({ target }) => relative2(root, target) || target))}`
+      fix: `Run \`npm install\` in ${list2(missing.map(({ target }) => relative4(root, target) || target))}`
     };
   }
   const stale = resolutions.filter(({ res }) => !meetsFloor(res.version, floor));
@@ -5343,8 +7496,8 @@ function kubeCheck(lexicons, profiles, envs, kubeconfig) {
     return {
       name: "kube",
       status: "warn",
-      detail: "no kubeconfig readable (kubectl absent, or it has no contexts) \u2014 the declared graph still serves",
-      fix: "Install kubectl and point KUBECONFIG at your cluster, or run `behold demo k8s` for a throwaway k3d one."
+      detail: "no kubeconfig readable (none on this machine, or it has no contexts) \u2014 the declared graph still serves",
+      fix: "Point KUBECONFIG at your cluster's kubeconfig (or put one at ~/.kube/config), or run `behold demo k8s` for a throwaway k3d one."
     };
   }
   const bound = envs.filter((e) => profiles[e]?.context);
@@ -5414,7 +7567,7 @@ function opsCheck(root, ops, chantSource, estate) {
   return { name: "ops", status: "pass", detail: `${ops.length} committed: ${list2(names)}; ${mcp}` };
 }
 async function diagnose(dir, probes = {}) {
-  const root = resolve3(dir);
+  const root = resolve6(dir);
   const shape = detectProjectShape(root);
   const behold = beholdVersion();
   if (shape.kind === "none") {
@@ -5434,16 +7587,16 @@ async function diagnose(dir, probes = {}) {
     };
   }
   const estate = shape.kind === "estate";
-  const members = (shape.members ?? []).map((m) => resolve3(root, m));
+  const members = (shape.members ?? []).map((m) => resolve6(root, m));
   const targets = estate ? members : [root];
   const primary = targets[0];
   const projectCheck = estate ? {
     name: "project",
     status: "pass",
     detail: `estate of ${members.length} projects (${shape.membersFrom === "behold-config" ? ".behold.json members" : "npm workspaces"}): ${list2(
-      members.map((m) => relative2(root, m))
+      members.map((m) => relative4(root, m))
     )}`
-  } : { name: "project", status: "pass", detail: `chant project (${relative2(root, shape.configFile)})` };
+  } : { name: "project", status: "pass", detail: `chant project (${relative4(root, shape.configFile)})` };
   const infos = await Promise.all(targets.map(async (t) => ({ target: t, info: await detectProject(t) })));
   const declared = new Map(infos.map(({ target, info }) => [target, info.lexicons]));
   const lexicons = [...new Set(infos.flatMap(({ info }) => info.lexicons))];
@@ -5488,6 +7641,16 @@ Usage:
   behold preview [project-dir] [--port <n>] [--emulator]
   behold export [project-dir] [--out <dir>] [--env <name>] [--name <worker>] [--emulator]
   behold serve <project-dir\u2026> [--port <n>] [--env <name>] [--poll <secs>] [--local]
+  behold carve <report.json> [--port <n>]
+
+  carve   Render a chant Terraform peelability report \u2014 the JSON from
+          \`chant carve advise --from <tf-dir> --json\` \u2014 as a graph. One card
+          per ranked resource, coloured by band: green = carve now, amber =
+          has boundary work, grey = leave in Terraform. Click a card for the
+          score arithmetic behind its rank. Read-only twice over: chant's
+          advisor emits nothing, and behold only draws what it says.
+          \`GET /api/carve\` serves the raw report to agents. behold parses no
+          Terraform and needs no Terraform tooling \u2014 the report is the contract.
 
   doctor  Why won't this project serve well? A read-only diagnosis of
           everything behold needs \u2014 the project's kind, its own chant install
@@ -5503,9 +7666,13 @@ Usage:
           clone a public estate. Bare \`behold demo\` is the AWS example \u2014 an
           S3 bucket + policy on a local emulator: blue = declared, click
           Deploy, watch it turn green. \`behold demo k8s\` stands a workload
-          up on a throwaway k3d cluster instead. Needs Docker (and per-demo
-          tools --list names). Loaded demos land in the panel's recents, so
-          switching between them is the Scope tab.
+          up on a throwaway k3d cluster instead. \`behold demo carve\` is the
+          odd one out: no cluster, no Docker, no cloud \u2014 a half-migrated
+          Terraform/chant estate plus the six-step carve walkthrough on the
+          panel's Carve tab. Needs Docker (and per-demo tools --list names).
+          Loaded demos land in the panel's recents, so switching between them
+          is the Scope tab \u2014 which lists this whole catalog too (#268), one
+          click from any served project.
 
   export  Capture the live estate into a self-contained, interactive STATIC
           bundle (default ./behold-export) \u2014 every env/tier \xD7 zoom \xD7 radial,
@@ -5526,7 +7693,7 @@ Usage:
           overlay, and rollback act on it).
 
 Options:
-  --port <n>          Port (default 4600). preview/serve.
+  --port <n>          Port (default 4600). preview/serve/carve.
   --env <name>        Environment name \u2014 turns on the live drift overlay.
                       export/serve.
   --poll <secs>       Re-query live drift every <secs> and push updates (needs --env).
@@ -5565,7 +7732,7 @@ Options:
   -h, --help          This text.
   -v, --version       Print the behold version.
 `;
-async function run3(argv) {
+async function run2(argv) {
   const [cmd, ...rest] = argv;
   if (!cmd || cmd === "-h" || cmd === "--help") {
     process.stdout.write(USAGE);
@@ -5591,6 +7758,10 @@ async function run3(argv) {
     await runExportCmd(rest);
     return;
   }
+  if (cmd === "carve") {
+    await runCarve(rest);
+    return;
+  }
   if (cmd !== "serve") {
     process.stderr.write(`behold: unknown command '${cmd}'
 
@@ -5646,7 +7817,7 @@ ${USAGE}`);
     process.stderr.write("behold serve: --auto-sync needs --env and --poll (it acts on polled drift)\n");
     process.exit(2);
   }
-  const dirs = projectDirs.map((d) => resolve4(d));
+  const dirs = projectDirs.map((d) => resolve7(d));
   for (const d of dirs) warnIfNotChantProject(d);
   await startServer({
     projectDir: dirs[0],
@@ -5665,7 +7836,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join14(dir, m)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join17(dir, m)).join(" ")}
 `
     );
     return;
@@ -5676,6 +7847,44 @@ function warnIfNotChantProject(dir) {
 `
   );
 }
+async function runCarve(rest) {
+  let port = 4600;
+  let fileArg;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--port") port = Number(rest[++i]);
+    else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
+    else if (!a.startsWith("-")) fileArg = a;
+    else {
+      process.stderr.write(`behold carve: unexpected argument '${a}'
+`);
+      process.exit(2);
+    }
+  }
+  if (!Number.isFinite(port)) {
+    process.stderr.write("behold carve: --port must be a number\n");
+    process.exit(2);
+  }
+  if (!fileArg) {
+    process.stderr.write(
+      "behold carve: missing <report.json>\n  Generate one: chant carve advise --from <terraform-dir> --report report.json\n"
+    );
+    process.exit(2);
+  }
+  const reportPath = resolve7(fileArg);
+  const parsed = readCarveReport(reportPath, (p) => readFileSync14(p, "utf8"));
+  if (!parsed.ok) {
+    process.stderr.write(`behold carve: ${parsed.refusal.error}
+  ${parsed.refusal.remedy}
+`);
+    process.exit(2);
+  }
+  process.stdout.write(
+    `behold carve \u2014 ${parsed.report.resources.length} resource(s)/module(s) ranked${parsed.report.from ? ` from ${parsed.report.from}` : ""}
+`
+  );
+  await startServer({ projectDir: dirname6(reportPath), carveReport: reportPath, port });
+}
 async function runDoctor(rest) {
   let json = false;
   let dirArg;
@@ -5690,8 +7899,8 @@ async function runDoctor(rest) {
     }
   }
   const dir = dirArg ?? ".";
-  if (!existsSync10(resolve4(dir))) {
-    process.stderr.write(`behold doctor: no such directory: ${resolve4(dir)}
+  if (!existsSync13(resolve7(dir))) {
+    process.stderr.write(`behold doctor: no such directory: ${resolve7(dir)}
 `);
     process.exit(2);
   }
@@ -5700,8 +7909,8 @@ async function runDoctor(rest) {
   if (!report.ok) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot = join14(dirname6(fileURLToPath5(import.meta.url)), "..");
-  const registry = loadDemoRegistry(pkgRoot);
+  const pkgRoot2 = join17(dirname6(fileURLToPath5(import.meta.url)), "..");
+  const registry = loadDemoRegistry(pkgRoot2);
   let port = 4600;
   let name;
   let dirArg;
@@ -5752,64 +7961,93 @@ async function runDemo(rest) {
 `);
     process.exit(2);
   }
-  const target = resolve4(
-    dirArg ?? (entry.name === "writes" && existsSync10("behold-demo") ? "behold-demo" : join14("behold-demos", entry.name))
-  );
-  if (!existsSync10(target)) {
-    if (entry.source === "bundled") {
-      const bundled = join14(pkgRoot, entry.dir);
-      if (!existsSync10(bundled)) {
-        process.stderr.write(`behold demo ${entry.name}: this install has no bundled ${entry.dir}
+  const target = dirArg ? resolve7(dirArg) : demoTargetDir(entry);
+  const loaded = await loadDemo(entry, { pkgRoot: pkgRoot2, target, log: (line) => process.stdout.write(line + "\n") });
+  if (!loaded.ok) {
+    process.stderr.write(`behold demo ${entry.name}: ${loaded.error}
 `);
-        process.exit(2);
-      }
-      process.stdout.write(`behold demo ${entry.name} \u2192 copying to ${target} (it's yours \u2014 edit it)
+    process.exit(1);
+  }
+  if (entry.serve.carve) {
+    await serveCarveDemo(target, entry.serve.carve, port);
+    return;
+  }
+  process.stdout.write(`behold demo ${entry.name} \u2192 serving. Blue = declared; Deploy turns it green.
 `);
-      cpSync(bundled, target, {
-        recursive: true,
-        filter: (src) => !relative3(bundled, src).split(sep).includes("node_modules")
-      });
-    } else {
-      process.stdout.write(`behold demo ${entry.name} \u2192 cloning ${entry.repo} to ${target}
+  const serveArgs = ["serve", ...loaded.serveDirs, "--port", String(port)];
+  if (entry.serve.local) serveArgs.push("--local");
+  if (entry.serve.env) serveArgs.push("--env", entry.serve.env);
+  await run2(serveArgs);
+}
+function spawnStep(cmd, args, cwd) {
+  return new Promise((res) => {
+    const child = spawn5(cmd, args, { stdio: "inherit", cwd, shell: process.platform === "win32" });
+    child.on("error", () => res(-1));
+    child.on("close", (code) => res(code ?? 1));
+  });
+}
+async function serveCarveDemo(target, carve, port) {
+  const at = (rel) => resolve7(target, rel);
+  const project = at(carve.project);
+  const from = at(carve.from);
+  const state = carve.state ? at(carve.state) : void 0;
+  const committed = at(carve.report);
+  if (existsSync13(join17(project, "package.json")) && !existsSync13(join17(project, "node_modules"))) {
+    process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
-      const r = spawnSync2("git", ["clone", "--depth", "1", entry.repo, target], { stdio: "inherit" });
-      if (r.status !== 0) {
-        process.stderr.write(`behold demo ${entry.name}: clone failed
+    const code = await spawnStep("npm", ["install"], project);
+    if (code !== 0) {
+      process.stderr.write(`behold demo carve: npm install failed in ${project}
 `);
-        process.exit(r.status ?? 1);
-      }
+      process.exit(code || 1);
     }
-  } else {
-    process.stdout.write(`behold demo ${entry.name} \u2192 reusing ${target}
-`);
   }
-  if (existsSync10(join14(target, "package.json")) && !existsSync10(join14(target, "node_modules"))) {
-    process.stdout.write(`behold demo ${entry.name} \u2192 npm install\u2026
-`);
-    const r = spawnSync2("npm", ["install"], { cwd: target, stdio: "inherit", shell: process.platform === "win32" });
-    if (r.status !== 0) {
-      process.stderr.write(`behold demo: npm install failed in ${target}${r.error ? ` (${r.error.message})` : ""}
-`);
-      process.exit(r.status ?? 1);
-    }
+  let degraded;
+  if (!existsSync13(join17(target, "node_modules", "@cdktf", "hcl2json"))) {
+    process.stdout.write("behold demo carve \u2192 npm install @cdktf/hcl2json (chant's HCL parser, ~2MB, once)\u2026\n");
+    const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", "@cdktf/hcl2json"], target);
+    if (code !== 0) degraded = "couldn't install @cdktf/hcl2json (chant's HCL parser) \u2014 no network?";
+  }
+  const report = at("carve-report.json");
+  if (!degraded) {
+    const bin = resolveChant(project).bin;
+    process.stdout.write("behold demo carve \u2192 chant carve advise (read-only; emits nothing)\u2026\n");
+    const code = await spawnStep(
+      bin,
+      ["carve", "advise", "--from", carve.from, ...carve.state ? ["--state", carve.state] : [], "--report", report],
+      target
+    );
+    if (code !== 0) degraded = `chant carve advise exited ${code}`;
   }
-  if (entry.setup) {
-    process.stdout.write(`behold demo ${entry.name} \u2192 ${entry.setup}
-`);
-    const r = spawnSync2(entry.setup, { cwd: target, stdio: "inherit", shell: true });
-    if (r.status !== 0) {
-      process.stderr.write(`behold demo ${entry.name}: setup failed (${entry.setup})
-`);
-      process.exit(r.status ?? 1);
-    }
+  const serving = !degraded && existsSync13(report) ? report : committed;
+  if (degraded) {
+    process.stderr.write(
+      `behold demo carve: ${degraded}
+        Serving the committed report (${carve.report}) instead \u2014 the bands are real, just not regenerated here.
+`
+    );
   }
-  process.stdout.write(`behold demo ${entry.name} \u2192 serving. Blue = declared; Deploy turns it green.
+  if (!existsSync13(serving)) {
+    process.stderr.write(`behold demo carve: no carve report at ${serving}
 `);
-  const serveDirs = entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join14(target, d)) : [target];
-  const serveArgs = ["serve", ...serveDirs, "--port", String(port)];
-  if (entry.serve.local) serveArgs.push("--local");
-  if (entry.serve.env) serveArgs.push("--env", entry.serve.env);
-  await run3(serveArgs);
+    process.exit(2);
+  }
+  process.stdout.write(
+    "behold demo carve \u2192 serving the walkthrough. Green = carve now; the Carve tab walks the six steps.\n"
+  );
+  await startServer({
+    projectDir: target,
+    carveReport: serving,
+    carveDemo: {
+      root: target,
+      from,
+      ...state ? { state } : {},
+      project,
+      out: at(carve.out),
+      ...degraded ? { degraded: `${degraded} \u2014 showing the committed report shipped with the demo.` } : {}
+    },
+    port
+  });
 }
 function injectEmulatorEnv(env) {
   process.env.LOOM_ENV ??= env ?? "local";
@@ -5833,8 +8071,8 @@ async function runPreview(rest) {
     process.stderr.write("behold preview: --port must be a number\n");
     process.exit(2);
   }
-  const projectDir = resolve4(dirArg ?? process.cwd());
-  if (!existsSync10(projectDir)) {
+  const projectDir = resolve7(dirArg ?? process.cwd());
+  if (!existsSync13(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -5854,26 +8092,26 @@ async function runPreview(rest) {
   await startServer({ projectDir, port, env: "local", previewMode: true });
 }
 async function runExportCmd(rest) {
-  let outDir = resolve4("behold-export");
+  let outDir = resolve7("behold-export");
   let env;
   let name;
   let dirArg;
   let emulator = false;
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--out") outDir = resolve4(rest[++i]);
+    if (a === "--out") outDir = resolve7(rest[++i]);
     else if (a === "--env") env = rest[++i];
     else if (a === "--name") name = rest[++i];
     else if (a === "--emulator") emulator = true;
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
   }
-  const projectDir = resolve4(dirArg ?? process.cwd());
+  const projectDir = resolve7(dirArg ?? process.cwd());
   if (emulator) {
     injectEmulatorEnv(env);
     env ??= "local";
   }
-  if (!existsSync10(projectDir)) {
+  if (!existsSync13(projectDir)) {
     process.stderr.write(`behold export: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -5890,12 +8128,12 @@ function isMainModule() {
   }
 }
 if (isMainModule()) {
-  run3(process.argv.slice(2)).catch((err) => {
+  run2(process.argv.slice(2)).catch((err) => {
     process.stderr.write(`behold: fatal: ${err?.message ?? err}
 `);
     process.exit(3);
   });
 }
 export {
-  run3 as run
+  run2 as run
 };