diff --git a/deployment/cloud/README.md b/deployment/cloud/README.md
index a6f9db18b..002eec2d5 100644
--- a/deployment/cloud/README.md
+++ b/deployment/cloud/README.md
@@ -60,6 +60,30 @@ with the redirect URL `https://<your-host>/oauth2/callback`; PKCE (S256) is used
 
 Secrets reach oauth2-proxy through its environment, never its command line.
 
+## Public Studio (`ACCESS=public`)
+
+For a team whose Plugin Studio should be open to everyone: no sign-in provider. The Studio, every map and the
+backend's public API are open. The admin parts ask for a username and password, set when you deploy.
+
+| Variable | Meaning |
+|---|---|
+| `ACCESS` | `public` turns this mode on. OIDC settings are then ignored; unset `ACCESS` to use the sign-in |
+| `ADMIN_USER`, `ADMIN_PASSWORD` | guard `/admin/` (publishing), PocketBase's dashboard `/pb/_/` and its `_superusers`. `ADMIN_PASSWORD` is required (the container refuses to start without it); use a long random one. `ADMIN_USER` defaults to `admin` |
+
+| Route | Who |
+|---|---|
+| `/` | anyone: the Plugin Studio, with hot reload |
+| `/cdn/dx-maps/`, `/api-prod/api/` | anyone, as in the signed-in mode |
+| `/pb/api/` | anyone, as PocketBase's own record rules allow. People sign in with PocketBase's own accounts |
+| `/pb/_/`, `/pb/api/collections/_…`, `/admin/*` | `ADMIN_USER` / `ADMIN_PASSWORD` (the browser asks) |
+
+Also in this mode:
+- Rudder's voice engine stays off.
+- Gated bundles (`gatedProfiles`) are refused even by URL.
+- Vite's `/__open-in-editor` is refused.
+
+In both modes, the Studio's own `/api/pb` goes through the same gates as `/pb/`.
+
 ## Backend and production (v1, experimental)
 
 With the sign-in on, the container also runs PocketBase and can publish a production build:
diff --git a/deployment/cloud/admin.mjs b/deployment/cloud/admin.mjs
index d16a48251..1f5064b7a 100644
--- a/deployment/cloud/admin.mjs
+++ b/deployment/cloud/admin.mjs
@@ -9,6 +9,7 @@
 //   /admin/pb-signin-check  a page that signs in to the team PocketBase and shows who it thinks you are
 // Groups come from oauth2-proxy's X-Forwarded-Groups, which it sets on signed-in routes only.
 import { spawn } from 'node:child_process'
+import { createHash, timingSafeEqual } from 'node:crypto'
 import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { basename, join, normalize } from 'node:path'
 import { serveTreeFile } from './cdn-cache.mjs'
@@ -19,8 +20,25 @@ const CDN = '/data/cdn/current'
 let last = { state: 'idle' }
 
 const groupsOf = (req) => (req.headers.get('x-forwarded-groups') || '').split(',').map((g) => g.trim())
-const isAdmin = (req) => ADMIN.length > 0 && groupsOf(req).some((g) => ADMIN.includes(g))
+// ACCESS=public (entry.sh): the Plugin Studio is open and nobody signs in, so X-Forwarded-Groups is whatever a
+// visitor sends and is never read. The admin parts (/admin/, PocketBase's dashboard, _superusers) ask for
+// ADMIN_USER / ADMIN_PASSWORD over HTTP Basic instead, compared in constant time.
+const PUBLIC = env.ACCESS === 'public'
+const ADMIN_USER = env.ADMIN_USER || 'admin'
+const same = (a, b) => timingSafeEqual(createHash('sha256').update(a).digest(), createHash('sha256').update(b).digest())
+function passwordOk(req) {
+  const h = req.headers.get('authorization') || ''
+  if (!env.ADMIN_PASSWORD || !h.startsWith('Basic ')) return false
+  const [user, ...rest] = Buffer.from(h.slice(6), 'base64').toString('utf8').split(':')
+  const userOk = same(user, ADMIN_USER), passOk = same(rest.join(':'), env.ADMIN_PASSWORD)
+  return userOk && passOk
+}
+const isAdmin = (req) => (PUBLIC ? passwordOk(req) : ADMIN.length > 0 && groupsOf(req).some((g) => ADMIN.includes(g)))
 const text = (s, status = 200) => new Response(s + '\n', { status, headers: { 'content-type': 'text/plain; charset=utf-8' } })
+// Refusing an admin part: in public mode a 401 that makes the browser ask for the password; with the sign-in, 403.
+const refuse = (msg) => (PUBLIC
+  ? new Response(msg + '\n', { status: 401, headers: { 'content-type': 'text/plain; charset=utf-8', 'www-authenticate': 'Basic realm="dx-maps admin", charset="UTF-8"' } })
+  : text(msg, 403))
 
 // fetch() hands back the body DECOMPRESSED, so the upstream Content-Encoding and Content-Length no longer describe
 // what is sent on: forwarding them made browsers try to gunzip plain HTML, and PocketBase's dashboard never rendered
@@ -165,18 +183,20 @@ Bun.serve({
     if (p.startsWith('/pb/')) {
       const bp = backendPath(p)
       if (bp === null) return text('bad path', 400)
-      if ((bp === '/pb/_' || bp.startsWith('/pb/_/')) && !isAdmin(req)) return text('the PocketBase dashboard is for admins', 403)
+      if ((bp === '/pb/_' || bp.startsWith('/pb/_/')) && !isAdmin(req)) return refuse('the PocketBase dashboard is for admins')
       // The superuser (and every _system collection) is for admins only. oauth2-proxy never opens these
       // paths to the public (its skip routes exclude names starting with _), so the groups header is its own.
-      if (bp.startsWith('/pb/api/collections/_') && !isAdmin(req)) return text('for admins only', 403)
+      if (bp.startsWith('/pb/api/collections/_') && !isAdmin(req)) return refuse('for admins only')
       return proxy(req, url, '/pb/', 8090)
     }
+    // With the sign-in, oauth2-proxy guards every /admin/ path; in public mode the admin password does.
+    if (PUBLIC && p.startsWith('/admin/') && !isAdmin(req)) return refuse('the admin pages ask for the admin password')
     // A one-click check of the team PocketBase sign-in (behind the site sign-in like every /admin/ path).
     if (p === '/admin/pb-signin-check') return new Response(Bun.file('/app/repo/deployment/cloud/pb-signin-check.html'), { headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' } })
     if (p === '/admin/status') return Response.json({ ...last, production: { branch: PROD, autoBuildMinutes: AUTO_MIN, head: watch.seen, published: publishedCommit(), prodSchema: prodSchema(), error: watch.error } })
     if (p === '/admin/build') {
       if (req.method !== 'POST') return text('POST only', 405)
-      if (!isAdmin(req)) return text('builds are for team admins', 403)
+      if (!isAdmin(req)) return refuse('builds are for team admins')
       if (last.state === 'building') return text('a build is already running', 409)
       startBuild('admin')
       return text('build started', 202)
diff --git a/deployment/cloud/entry.sh b/deployment/cloud/entry.sh
index 6b04d65ff..4debc036c 100755
--- a/deployment/cloud/entry.sh
+++ b/deployment/cloud/entry.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 # dx-maps cloud dev server, run by the image's /boot.sh from the cloned repo (see Dockerfile).
 #   1. install, 2. pull BRANCH every PULL_INTERVAL s (Vite hot-reloads what changed; 0 = never pull),
-#   3. serve: Vite alone, or behind an OIDC sign-in when OIDC_ISSUER is set.
+#   3. serve: Vite alone; behind an OIDC sign-in when OIDC_ISSUER is set; or, with ACCESS=public, the Studio
+#      open to everyone and the admin parts behind ADMIN_USER/ADMIN_PASSWORD.
 set -u
 cd /app/repo
 BRANCH="${BRANCH:-main}"; PORT="${PORT:-5173}"
@@ -47,6 +48,18 @@ fi
 
 CONFIG=/app/repo/deployment/cloud/vite.cloud.config.mjs
 
+# ACCESS=public: the Plugin Studio (and every map, and the backend's public API) is open to everyone, with no
+# sign-in. /admin/ (publishing), PocketBase's dashboard and _superusers ask for ADMIN_USER / ADMIN_PASSWORD
+# instead (admin.mjs). OIDC stays the other mode: unset ACCESS and set OIDC_ISSUER.
+if [ "${ACCESS:-}" = public ]; then
+  : "${ADMIN_PASSWORD:?ACCESS=public needs ADMIN_PASSWORD (and ADMIN_USER, default admin): it guards publishing, /admin/ and the PocketBase dashboard}"
+  if [ "${RUDDER_ENGINE:-0}" = 1 ]; then
+    echo "[access] public: Rudder's voice engine stays off (a public one would take anyone's microphone traffic)" >&2
+    RUDDER_ENGINE=0
+  fi
+  [ -z "${OIDC_ISSUER:-}" ] || echo "[access] public: OIDC_ISSUER is ignored; unset ACCESS to use the sign-in" >&2
+fi
+
 # Rudder (optional, RUDDER_ENGINE=1): its voice-to-text engine runs here, fed by the BROWSER's
 # microphone (no server mic). The image carries the runtime and the pinned model (/opt/rudder); a copy on
 # the persistent volume (/data/rudder) wins when it exists. Setup (checksums + building the engine) runs
@@ -79,25 +92,27 @@ if [ "${RUDDER_ENGINE:-0}" = 1 ]; then
   disown
 fi
 
-if [ -z "${OIDC_ISSUER:-}" ]; then
-  # Open, like a laptop: no sign-in.
+if [ -z "${OIDC_ISSUER:-}" ] && [ "${ACCESS:-}" != public ]; then
+  # Open, like a laptop: no sign-in, no backend.
   export VITE_HOST=0.0.0.0 VITE_PORT="$PORT"
   exec bun x vite --config "$CONFIG"
 fi
 
-# OIDC gate: oauth2-proxy owns the public port; Vite listens on localhost behind it, so the Plugin
-# Studio, every map and the hot-reload websocket are all behind the same sign-in.
-: "${OIDC_CLIENT_ID:?}" "${OIDC_CLIENT_SECRET:?}" "${OIDC_REDIRECT_URL:?}"
-if [ -z "${OIDC_ALLOWED_GROUPS:-}" ]; then
-  echo "refusing to start: set OIDC_ALLOWED_GROUPS (comma-separated). With open sign-up, anyone could log in." >&2
-  exit 1
-fi
-ALLOW=(); IFS=',' read -ra G <<< "$OIDC_ALLOWED_GROUPS"
-for g in "${G[@]}"; do g="${g// /}"; [ -n "$g" ] && ALLOW+=(--allowed-group="$g"); done
+if [ "${ACCESS:-}" != public ]; then
+  # OIDC gate: oauth2-proxy owns the public port; Vite listens on localhost behind it, so the Plugin
+  # Studio, every map and the hot-reload websocket are all behind the same sign-in.
+  : "${OIDC_CLIENT_ID:?}" "${OIDC_CLIENT_SECRET:?}" "${OIDC_REDIRECT_URL:?}"
+  if [ -z "${OIDC_ALLOWED_GROUPS:-}" ]; then
+    echo "refusing to start: set OIDC_ALLOWED_GROUPS (comma-separated). With open sign-up, anyone could log in." >&2
+    exit 1
+  fi
+  ALLOW=(); IFS=',' read -ra G <<< "$OIDC_ALLOWED_GROUPS"
+  for g in "${G[@]}"; do g="${g// /}"; [ -n "$g" ] && ALLOW+=(--allowed-group="$g"); done
 
-# Secrets reach oauth2-proxy through its environment, never its command line.
-export OAUTH2_PROXY_CLIENT_SECRET="$OIDC_CLIENT_SECRET"
-export OAUTH2_PROXY_COOKIE_SECRET="${OIDC_COOKIE_SECRET:-$(head -c 32 /dev/urandom | base64 | tr -d '=+/' | head -c 32)}"
+  # Secrets reach oauth2-proxy through its environment, never its command line.
+  export OAUTH2_PROXY_CLIENT_SECRET="$OIDC_CLIENT_SECRET"
+  export OAUTH2_PROXY_COOKIE_SECRET="${OIDC_COOKIE_SECRET:-$(head -c 32 /dev/urandom | base64 | tr -d '=+/' | head -c 32)}"
+fi
 
 # Backend: PocketBase DEV (/pb/, signed-in) and PROD (/api-prod/, public API only); data = the /data volume.
 # The superuser comes from env, never printed. SCHEMA: dev runs the migrations in this checkout (BRANCH, the
@@ -130,6 +145,18 @@ pocketbase serve --http 127.0.0.1:8090 --dir /data/pb-dev --migrationsDir "$MIG"
     echo "$(date -u +%FT%TZ) [pb-prod] exited ($?); starting again on $(basename "$(readlink "$PROD_MIG")")"; sleep 1
   done ) &
 bun /app/repo/deployment/cloud/admin.mjs &
+# The Studio's own /api/pb (the repo's dev backend plugin) goes through admin.mjs's /pb, so the same gates apply
+# (the dashboard and _superusers for admins only), and plugins that use PocketBase reach it here too. Without
+# this the plugin answered 503 (it found the port taken and started nothing).
+export DX_PB_URL="${DX_PB_URL:-http://127.0.0.1:5175/pb}"
+if [ "${ACCESS:-}" = public ]; then
+  # Vite owns the public port; vite.cloud.config.mjs forwards /cdn/, /api-prod/, /pb/ and /admin/ to admin.mjs.
+  export DX_PUBLIC_STUDIO=1
+  echo "[access] public: the Plugin Studio is open on :$PORT; /admin/, publishing and PocketBase's dashboard ask for ADMIN_USER/ADMIN_PASSWORD"
+  VITE_HOST=0.0.0.0 VITE_PORT="$PORT" bun x vite --config "$CONFIG" &
+  wait -n
+  exit $?
+fi
 
 # TEAM PB: laptops reach pb-dev's API WITHOUT the site sign-in (DX_PB_URL=https://<host>/pb), and PocketBase
 # itself signs people in through the same OIDC provider, members of OIDC_ALLOWED_GROUPS only (the baked
diff --git a/deployment/cloud/vite.cloud.config.mjs b/deployment/cloud/vite.cloud.config.mjs
index 76a501db7..34138a879 100644
--- a/deployment/cloud/vite.cloud.config.mjs
+++ b/deployment/cloud/vite.cloud.config.mjs
@@ -3,6 +3,7 @@
 import base from '/app/repo/vite.config.js'
 import { mergeConfig } from 'vite'
 import { readFileSync } from 'node:fs'
+import { GATED_PROFILES } from '/app/repo/internal/_tree-name.mjs'
 
 const env = process.env
 const SETUP_STATE = '/tmp/rudder-setup.state'   // written by entry.sh: running -> done | failed
@@ -40,13 +41,38 @@ const rudderStarting = {
   },
 }
 
+// ACCESS=public (entry.sh sets DX_PUBLIC_STUDIO=1): Vite owns the public port with no sign-in in front of it.
+// - The backend's paths go to admin.mjs, whose gates decide: /cdn/ and /api-prod/api/ public, /pb/ records
+//   by PocketBase's own rules, and /pb/_/, _superusers and /admin/ for the admin password.
+// - GATED bundles (gatedProfiles, e.g. key-cities) must never reach a public surface. The Studio already leaves
+//   them out of its list; here their source and dev pages are refused too, so a typed URL can't load them.
+// - /__open-in-editor (Vite's own) would start an editor process on this server for a visitor: refused.
+const PUBLIC = env.DX_PUBLIC_STUDIO === '1'
+const publicGuard = {
+  name: 'cloud-public-guard',
+  enforce: 'pre',
+  apply: 'serve',
+  configureServer(server) {
+    if (!PUBLIC) return
+    server.middlewares.use((req, res, next) => {
+      let p = (req.url || '').split('?')[0]
+      try { p = decodeURIComponent(p) } catch { /* keep it raw */ }
+      const gated = GATED_PROFILES.some((g) => p.includes(`/plugin-designs/${g}/`) || p === `/__leaf/${g}` || p.startsWith(`/__leaf/${g}/`))
+      if (!gated && !p.startsWith('/__open-in-editor')) return next()
+      res.statusCode = 404
+      res.setHeader('content-type', 'text/plain; charset=utf-8')
+      res.end('not found\n')
+    })
+  },
+}
+
 export default async (e) => {
   const b = typeof base === 'function' ? await base(e) : base
   const hmr = env.HMR_CLIENT_PORT
     ? { clientPort: Number(env.HMR_CLIENT_PORT), protocol: env.HMR_PROTOCOL || 'wss' }
     : undefined
   return mergeConfig(b, {
-    plugins: [rudderStarting],
+    plugins: [publicGuard, rudderStarting],
     cacheDir: '/tmp/vite-cache',
     server: {
       host: env.VITE_HOST || '0.0.0.0',
@@ -54,6 +80,7 @@ export default async (e) => {
       strictPort: true,
       allowedHosts: true,
       ...(hmr ? { hmr } : {}),
+      ...(PUBLIC ? { proxy: { '^/(cdn|api-prod|pb|admin)/': { target: 'http://127.0.0.1:5175', ws: true } } } : {}),
     },
   })
 }