@aaqu/fromcubes-portal-react 0.1.0-alpha.3 → 0.1.0-alpha.30

package/nodes/portal-react.html

@@ -3,7 +3,7 @@
      ============================================================ -->
 <script type="text/javascript">
   (function () {
-    var PREFIX = "[FC-Monaco]";
+    const PREFIX = "[FC-Monaco]";
 
     // Shared editor options — used by both component and portal-react editors
     window.__fcEditorOpts = {
@@ -20,32 +20,51 @@
     };
 
     window.__fcTwClasses = null;
-    var jsxSetupDone = false;
-
-    // One-time Monaco setup: compiler opts, diagnostics, extra libs, completion provider.
-    // Idempotent — safe to call multiple times, only runs setup once.
+    let jsxSetupDone = false;
+
+    /**
+     * One-time Monaco setup: compiler opts, diagnostics, extra libs,
+     * completion providers (Tailwind class, JSX tag, utility symbol).
+     * Idempotent — safe to call multiple times, only the first call wires
+     * up listeners; subsequent calls just re-apply the compiler/diagnostics
+     * blocks because Node-RED resets them whenever the editor reloads.
+     *
+     * @returns {void}
+     * @private
+     */
     function ensureJsxSetup() {
       if (jsxSetupDone) {
-        console.log(PREFIX, "ensureJsxSetup: already done, re-applying compiler+diag only");
+        console.log(
+          PREFIX,
+          "ensureJsxSetup: already done, re-applying compiler+diag only",
+        );
         // Always re-apply compiler/diag in case Node-RED reset them
         applyCompilerAndDiag();
         return;
       }
       jsxSetupDone = true;
 
-      var jsDef = monaco.typescript.javascriptDefaults;
+      const jsDef = monaco.typescript.javascriptDefaults;
 
       // Log initial state
-      console.log(PREFIX, "INITIAL compilerOptions:", JSON.stringify(jsDef.getCompilerOptions()));
-      console.log(PREFIX, "INITIAL diagnosticsOptions:", JSON.stringify(jsDef.getDiagnosticsOptions()));
+      console.log(
+        PREFIX,
+        "INITIAL compilerOptions:",
+        JSON.stringify(jsDef.getCompilerOptions()),
+      );
+      console.log(
+        PREFIX,
+        "INITIAL diagnosticsOptions:",
+        JSON.stringify(jsDef.getDiagnosticsOptions()),
+      );
 
       applyCompilerAndDiag();
 
       // Global type stubs
-      var libContent = [
-        "declare var React: any;",
-        "declare var ReactDOM: any;",
-        "declare function useNodeRed(): { data: any; send: (payload: any, topic?: string) => void };",
+      const libContent = [
+        "declare const React: any;",
+        "declare const ReactDOM: any;",
+        "declare function useNodeRed(opts?: { ignoreRecovery?: boolean }): { data: any; send: (payload: any, topic?: string) => void; user: { userId?: string; userName?: string; username?: string; email?: string; role?: string; groups?: any[] } | null; portalClient: string | null };",
       ].join("\n");
       console.log(PREFIX, "addExtraLib globals.d.ts");
       jsDef.addExtraLib(libContent, "file:///globals.d.ts");
@@ -57,44 +76,44 @@
       monaco.languages.registerCompletionItemProvider("javascript", {
         triggerCharacters: ['"', "'", "`", " "],
         provideCompletionItems: function (model, position) {
-          var line = model.getLineContent(position.lineNumber);
-          var before = line.substring(0, position.column - 1);
+          const line = model.getLineContent(position.lineNumber);
+          const before = line.substring(0, position.column - 1);
 
           // 1) className="..." or className={`...`}
-          var isClassName =
+          const isClassName =
             before.match(/className\s*=\s*["'][^"']*$/) ||
             before.match(/className\s*=\s*\{`[^`]*$/);
 
           // 2) Any open string literal: "..., '..., or `...
-          var inString = !isClassName && before.match(/["'`][^"'`]*$/);
+          const inString = !isClassName && before.match(/["'`][^"'`]*$/);
 
           if (!isClassName && !inString) return { suggestions: [] };
 
           // Extract text inside the string
-          var raw = (isClassName || inString)[0];
-          var inside;
+          const raw = (isClassName || inString)[0];
+          let inside;
           if (isClassName) {
             inside = raw.replace(/^className\s*=\s*(?:\{`|["'])/, "");
           } else {
             inside = raw.substring(1); // skip opening quote
           }
           inside = inside.replace(/\$\{[^}]*\}/g, " ");
-          var parts = inside.split(/\s+/);
-          var word = parts[parts.length - 1] || "";
+          const parts = inside.split(/\s+/);
+          const word = parts[parts.length - 1] || "";
 
           // For non-className strings, only activate if at least one existing
           // token in the string looks like a TW class (avoid noise in random strings)
           if (!isClassName && parts.length > 0) {
-            var classes = window.__fcTwClasses || [];
-            var twSet = window.__fcTwSet;
+            const classes = window.__fcTwClasses || [];
+            let twSet = window.__fcTwSet;
             if (!twSet && classes.length) {
               twSet = new Set(classes);
               window.__fcTwSet = twSet;
               console.log(PREFIX, "TW: built lookup Set, size=" + twSet.size);
             }
             if (twSet) {
-              var hasTwToken = false;
-              for (var p = 0; p < parts.length; p++) {
+              let hasTwToken = false;
+              for (let p = 0; p < parts.length; p++) {
                 if (parts[p] && twSet.has(parts[p])) {
                   hasTwToken = true;
                   break;
@@ -102,7 +121,7 @@
               }
               // If typing the very first word, accept if it looks like a prefix
               if (!hasTwToken && parts.length === 1 && word.length >= 2) {
-                for (var j = 0; j < classes.length; j++) {
+                for (let j = 0; j < classes.length; j++) {
                   if (classes[j].indexOf(word) === 0) {
                     hasTwToken = true;
                     break;
@@ -113,17 +132,17 @@
             }
           }
 
-          var range = {
+          const range = {
             startLineNumber: position.lineNumber,
             endLineNumber: position.lineNumber,
             startColumn: position.column - word.length,
             endColumn: position.column,
           };
 
-          var classes = window.__fcTwClasses || [];
-          var suggestions = [];
-          for (var i = 0; i < classes.length; i++) {
-            var cls = classes[i];
+          const classes = window.__fcTwClasses || [];
+          const suggestions = [];
+          for (let i = 0; i < classes.length; i++) {
+            const cls = classes[i];
             if (!word.length || cls.indexOf(word) === 0) {
               suggestions.push({
                 label: cls,
@@ -134,57 +153,133 @@
               });
             }
           }
-          console.log(PREFIX, "TW completion: ctx=" + (isClassName ? "className" : "string") + " word='" + word + "', matched=" + suggestions.length + "/" + classes.length);
+          console.log(
+            PREFIX,
+            "TW completion: ctx=" +
+              (isClassName ? "className" : "string") +
+              " word='" +
+              word +
+              "', matched=" +
+              suggestions.length +
+              "/" +
+              classes.length,
+          );
           return { suggestions: suggestions };
         },
       });
 
       // JSX/HTML tag completion — type tag name, Tab → <tag>|</tag>
       console.log(PREFIX, "registering JSX tag completion provider");
-      var HTML_TAGS = [
-        "div","span","p","a","button","input","img","form","label",
-        "h1","h2","h3","h4","h5","h6",
-        "ul","ol","li","dl","dt","dd",
-        "table","thead","tbody","tfoot","tr","th","td",
-        "section","article","aside","header","footer","nav","main",
-        "strong","em","b","i","u","s","small","mark","code","pre","blockquote",
-        "br","hr","wbr",
-        "select","option","optgroup","textarea",
-        "fieldset","legend","details","summary","dialog",
-        "canvas","video","audio","source","picture","figure","figcaption",
-        "svg","path","circle","rect","line","g","defs","use","text",
+      const HTML_TAGS = [
+        "div",
+        "span",
+        "p",
+        "a",
+        "button",
+        "input",
+        "img",
+        "form",
+        "label",
+        "h1",
+        "h2",
+        "h3",
+        "h4",
+        "h5",
+        "h6",
+        "ul",
+        "ol",
+        "li",
+        "dl",
+        "dt",
+        "dd",
+        "table",
+        "thead",
+        "tbody",
+        "tfoot",
+        "tr",
+        "th",
+        "td",
+        "section",
+        "article",
+        "aside",
+        "header",
+        "footer",
+        "nav",
+        "main",
+        "strong",
+        "em",
+        "b",
+        "i",
+        "u",
+        "s",
+        "small",
+        "mark",
+        "code",
+        "pre",
+        "blockquote",
+        "br",
+        "hr",
+        "wbr",
+        "select",
+        "option",
+        "optgroup",
+        "textarea",
+        "fieldset",
+        "legend",
+        "details",
+        "summary",
+        "dialog",
+        "canvas",
+        "video",
+        "audio",
+        "source",
+        "picture",
+        "figure",
+        "figcaption",
+        "svg",
+        "path",
+        "circle",
+        "rect",
+        "line",
+        "g",
+        "defs",
+        "use",
+        "text",
       ];
-      var VOID_TAGS = new Set(["br","hr","img","input","wbr","source"]);
+      const VOID_TAGS = new Set(["br", "hr", "img", "input", "wbr", "source"]);
 
       monaco.languages.registerCompletionItemProvider("javascript", {
         triggerCharacters: ["<"],
         provideCompletionItems: function (model, position) {
-          var line = model.getLineContent(position.lineNumber);
-          var before = line.substring(0, position.column - 1);
+          const line = model.getLineContent(position.lineNumber);
+          const before = line.substring(0, position.column - 1);
 
           // After "<" — suggest tags
-          var afterBracket = before.match(/<([a-zA-Z]*)$/);
+          const afterBracket = before.match(/<([a-zA-Z]*)$/);
           // Bare word at line start or after whitespace/{ — Emmet-like (lower or upper)
-          var bareWord = !afterBracket && before.match(/(?:^|[\s{(,])([a-zA-Z][a-zA-Z0-9]*)$/);
+          const bareWord =
+            !afterBracket &&
+            before.match(/(?:^|[\s{(,])([a-zA-Z][a-zA-Z0-9]*)$/);
 
           if (!afterBracket && !bareWord) return { suggestions: [] };
 
-          var typed = (afterBracket ? afterBracket[1] : bareWord[1]) || "";
-          var replaceStart = position.column - typed.length - (afterBracket ? 1 : 0);
+          const typed = (afterBracket ? afterBracket[1] : bareWord[1]) || "";
+          const replaceStart =
+            position.column - typed.length - (afterBracket ? 1 : 0);
 
-          var range = {
+          const range = {
             startLineNumber: position.lineNumber,
             endLineNumber: position.lineNumber,
             startColumn: replaceStart,
             endColumn: position.column,
           };
 
-          var suggestions = [];
-          var seen = new Set();
+          const suggestions = [];
+          const seen = new Set();
 
           // HTML tags
-          for (var i = 0; i < HTML_TAGS.length; i++) {
-            var tag = HTML_TAGS[i];
+          for (let i = 0; i < HTML_TAGS.length; i++) {
+            const tag = HTML_TAGS[i];
             if (typed && tag.indexOf(typed) !== 0) continue;
             seen.add(tag);
             if (VOID_TAGS.has(tag)) {
@@ -192,7 +287,8 @@
                 label: tag,
                 kind: monaco.languages.CompletionItemKind.Property,
                 insertText: "<" + tag + " $0/>",
-                insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
+                insertTextRules:
+                  monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
                 range: range,
                 detail: "<" + tag + " />",
                 sortText: "0" + tag,
@@ -202,7 +298,8 @@
                 label: tag,
                 kind: monaco.languages.CompletionItemKind.Property,
                 insertText: "<" + tag + ">$0</" + tag + ">",
-                insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
+                insertTextRules:
+                  monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
                 range: range,
                 detail: "<" + tag + ">…</" + tag + ">",
                 sortText: "0" + tag + "a",
@@ -211,7 +308,8 @@
                 label: tag,
                 kind: monaco.languages.CompletionItemKind.Property,
                 insertText: "<" + tag + " $0/>",
-                insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
+                insertTextRules:
+                  monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
                 range: range,
                 detail: "<" + tag + " />",
                 sortText: "0" + tag + "b",
@@ -220,24 +318,36 @@
           }
 
           // Custom components from registry (PascalCase)
-          var upperMatch = afterBracket && before.match(/<([A-Z][a-zA-Z0-9]*)$/);
-          var bareUpper = !afterBracket && before.match(/(?:^|[\s{(,])([A-Z][a-zA-Z0-9]*)$/);
-          var compTyped = upperMatch ? upperMatch[1] : (bareUpper ? bareUpper[1] : "");
+          const upperMatch =
+            afterBracket && before.match(/<([A-Z][a-zA-Z0-9]*)$/);
+          const bareUpper =
+            !afterBracket && before.match(/(?:^|[\s{(,])([A-Z][a-zA-Z0-9]*)$/);
+          const compTyped = upperMatch
+            ? upperMatch[1]
+            : bareUpper
+              ? bareUpper[1]
+              : "";
 
           if (compTyped || (!typed && afterBracket)) {
             // Fetch component names from registry (cached on window)
-            var reg = window.__fcComponentNames || [];
-            for (var c = 0; c < reg.length; c++) {
-              var name = reg[c];
+            const reg = window.__fcComponentNames || [];
+            for (let c = 0; c < reg.length; c++) {
+              const name = reg[c];
               if (seen.has(name)) continue;
               if (compTyped && name.indexOf(compTyped) !== 0) continue;
-              if (!compTyped && typed && name.toLowerCase().indexOf(typed) !== 0) continue;
+              if (
+                !compTyped &&
+                typed &&
+                name.toLowerCase().indexOf(typed) !== 0
+              )
+                continue;
               seen.add(name);
               suggestions.push({
                 label: name,
                 kind: monaco.languages.CompletionItemKind.Class,
                 insertText: "<" + name + ">$0</" + name + ">",
-                insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
+                insertTextRules:
+                  monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
                 range: range,
                 detail: "<" + name + ">…</" + name + ">",
                 sortText: "0" + name + "a",
@@ -246,7 +356,8 @@
                 label: name,
                 kind: monaco.languages.CompletionItemKind.Class,
                 insertText: "<" + name + " $0/>",
-                insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
+                insertTextRules:
+                  monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
                 range: range,
                 detail: "<" + name + " />",
                 sortText: "0" + name + "b",
@@ -258,7 +369,8 @@
                 label: compTyped,
                 kind: monaco.languages.CompletionItemKind.Class,
                 insertText: "<" + compTyped + ">$0</" + compTyped + ">",
-                insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
+                insertTextRules:
+                  monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
                 range: range,
                 detail: "<" + compTyped + ">…</" + compTyped + ">",
                 sortText: "0" + compTyped + "a",
@@ -267,7 +379,8 @@
                 label: compTyped,
                 kind: monaco.languages.CompletionItemKind.Class,
                 insertText: "<" + compTyped + " $0/>",
-                insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
+                insertTextRules:
+                  monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
                 range: range,
                 detail: "<" + compTyped + " />",
                 sortText: "0" + compTyped + "b",
@@ -275,7 +388,13 @@
             }
           }
 
-          console.log(PREFIX, "JSX tag completion: typed='" + typed + "', suggestions=" + suggestions.length);
+          console.log(
+            PREFIX,
+            "JSX tag completion: typed='" +
+              typed +
+              "', suggestions=" +
+              suggestions.length,
+          );
           return { suggestions: suggestions };
         },
       });
@@ -285,69 +404,155 @@
       window.__fcAttachSelfClose = function (editor) {
         editor.onDidChangeModelContent(function (e) {
           if (e.changes.length !== 1) return;
-          var ch = e.changes[0];
+          const ch = e.changes[0];
           if (ch.text !== "/") return;
-          var model = editor.getModel();
+          const model = editor.getModel();
           if (!model) return;
-          var lineNum = ch.range.startLineNumber;
-          var line = model.getLineContent(lineNum);
+          const lineNum = ch.range.startLineNumber;
+          const line = model.getLineContent(lineNum);
           // Pattern 1: <tag>/</tag>  (cursor was between > and </)
           // Pattern 2: <tag/></tag>  (cursor was before > in opening tag)
-          var m = line.match(/^(.*)<([a-zA-Z][a-zA-Z0-9]*)>\/<\/\2>(.*)$/);
-          var matchStr, tag, prefix;
+          let m = line.match(/^(.*)<([a-zA-Z][a-zA-Z0-9]*)>\/<\/\2>(.*)$/);
+          let matchStr, tag, prefix;
           if (m) {
-            prefix = m[1]; tag = m[2];
+            prefix = m[1];
+            tag = m[2];
             matchStr = "<" + tag + ">/</" + tag + ">";
           } else {
             m = line.match(/^(.*)<([a-zA-Z][a-zA-Z0-9]*)\/><\/\2>(.*)$/);
             if (!m) return;
-            prefix = m[1]; tag = m[2];
+            prefix = m[1];
+            tag = m[2];
             matchStr = "<" + tag + "/></" + tag + ">";
           }
-          var startCol = prefix.length + 1;
-          var endCol = startCol + matchStr.length;
-          var replacement = "<" + tag + " />";
-          var cursorCol = startCol + replacement.length - 2;
+          const startCol = prefix.length + 1;
+          const endCol = startCol + matchStr.length;
+          const replacement = "<" + tag + " />";
+          const cursorCol = startCol + replacement.length - 2;
           setTimeout(function () {
-            editor.executeEdits("self-close-collapse", [{
-              range: {
-                startLineNumber: lineNum,
-                endLineNumber: lineNum,
-                startColumn: startCol,
-                endColumn: endCol,
+            editor.executeEdits("self-close-collapse", [
+              {
+                range: {
+                  startLineNumber: lineNum,
+                  endLineNumber: lineNum,
+                  startColumn: startCol,
+                  endColumn: endCol,
+                },
+                text: replacement,
               },
-              text: replacement,
-            }]);
+            ]);
             editor.setPosition({ lineNumber: lineNum, column: cursorCol });
           }, 0);
         });
         console.log(PREFIX, "self-close collapse attached to editor");
       };
 
-      // Fetch component names for tag completion
+      /**
+       * Fetch the current component registry from `/portal-react/registry`
+       * and stash the names on `window.__fcComponentNames` so the JSX-tag
+       * completion provider can offer `<Button` etc. Re-fetched on every
+       * editor open so newly-added components show up without an editor
+       * restart.
+       * @returns {void}
+       * @private
+       */
       function refreshComponentNames() {
         $.getJSON("portal-react/registry", function (reg) {
           window.__fcComponentNames = Object.keys(reg);
-          console.log(PREFIX, "component names loaded:", window.__fcComponentNames);
+          console.log(
+            PREFIX,
+            "component names loaded:",
+            window.__fcComponentNames,
+          );
         }).fail(function () {
           window.__fcComponentNames = [];
         });
       }
       refreshComponentNames();
 
+      // Fetch utility nodes + their parsed top-level symbols.
+      // Window cache shape: { byNode: { utilName: [symbol, ...] }, allSymbols: [..] }
+      window.__fcRefreshUtilities = function () {
+        $.getJSON("portal-react/utilities", function (reg) {
+          const byNode = {};
+          const all = new Set();
+          Object.keys(reg).forEach(function (n) {
+            const syms = reg[n].symbols || [];
+            byNode[n] = syms;
+            syms.forEach(function (s) { all.add(s); });
+          });
+          window.__fcUtilities = { byNode: byNode, allSymbols: [...all] };
+          console.log(
+            PREFIX,
+            "utilities loaded: " + Object.keys(byNode).length + " nodes, " + all.size + " symbols",
+          );
+        }).fail(function () {
+          window.__fcUtilities = { byNode: {}, allSymbols: [] };
+        });
+      };
+      window.__fcRefreshUtilities();
+
+      // Utility-symbol completion: suggests bare identifiers anywhere in JS
+      // context EXCEPT after "<" (that's JSX tag completion, handled below).
+      monaco.languages.registerCompletionItemProvider("javascript", {
+        triggerCharacters: ["."], // jQuery-ish — but we mostly fire from word context
+        provideCompletionItems: function (model, position) {
+          const line = model.getLineContent(position.lineNumber);
+          const before = line.substring(0, position.column - 1);
+          // Skip JSX tag context — covered by other providers
+          if (/<[a-zA-Z]*$/.test(before)) return { suggestions: [] };
+          // Skip property access — let Monaco's language service handle it
+          if (/\.\s*\w*$/.test(before)) return { suggestions: [] };
+          // Skip inside strings
+          if (/["'`][^"'`]*$/.test(before)) return { suggestions: [] };
+          const wordMatch = before.match(/([A-Za-z_$][\w$]*)$/);
+          const word = wordMatch ? wordMatch[1] : "";
+          const all = (window.__fcUtilities && window.__fcUtilities.allSymbols) || [];
+          if (!all.length) return { suggestions: [] };
+          const range = {
+            startLineNumber: position.lineNumber,
+            endLineNumber: position.lineNumber,
+            startColumn: position.column - word.length,
+            endColumn: position.column,
+          };
+          const suggestions = [];
+          for (let i = 0; i < all.length; i++) {
+            const sym = all[i];
+            if (word && sym.indexOf(word) !== 0) continue;
+            suggestions.push({
+              label: sym,
+              kind: monaco.languages.CompletionItemKind.Function,
+              insertText: sym,
+              range: range,
+              detail: "fc-portal-utility",
+              sortText: "1" + sym,
+            });
+          }
+          return { suggestions: suggestions };
+        },
+      });
+
       // Marker listener for debugging
       monaco.editor.onDidChangeMarkers(function (uris) {
         uris.forEach(function (uri) {
-          var markers = monaco.editor.getModelMarkers({ resource: uri });
+          const markers = monaco.editor.getModelMarkers({ resource: uri });
           if (markers.length > 0) {
             console.group(PREFIX + " MARKERS on " + uri.toString());
             markers.forEach(function (m) {
               console.log(
-                "  code=" + (m.code || "?") +
-                " severity=" + m.severity +
-                " source=" + (m.source || "?") +
-                " msg=" + m.message +
-                " [L" + m.startLineNumber + ":" + m.startColumn + "]"
+                "  code=" +
+                  (m.code || "?") +
+                  " severity=" +
+                  m.severity +
+                  " source=" +
+                  (m.source || "?") +
+                  " msg=" +
+                  m.message +
+                  " [L" +
+                  m.startLineNumber +
+                  ":" +
+                  m.startColumn +
+                  "]",
               );
             });
             console.groupEnd();
@@ -358,9 +563,20 @@
       console.log(PREFIX, "one-time setup complete");
     }
 
+    /**
+     * Push compilerOptions + diagnosticsOptions into Monaco's TS defaults.
+     * Called by `ensureJsxSetup` once and re-applied on every editor open
+     * because Node-RED's outer Monaco initialiser can reset these between
+     * editor sessions. We disable Monaco's TS-side squiggles entirely —
+     * the authoritative syntax check is the server-side esbuild pass at
+     * deploy time, and Monaco's TS parser produces noisy false positives
+     * (1109/1005/1128) on raw JSX.
+     * @returns {void}
+     * @private
+     */
     function applyCompilerAndDiag() {
-      var jsDef = monaco.typescript.javascriptDefaults;
-      var compilerOpts = {
+      const jsDef = monaco.typescript.javascriptDefaults;
+      const compilerOpts = {
         jsx: monaco.typescript.JsxEmit.React,
         target: monaco.typescript.ScriptTarget.ESNext,
         module: monaco.typescript.ModuleKind.ESNext,
@@ -370,33 +586,64 @@
       console.log(PREFIX, "setCompilerOptions:", JSON.stringify(compilerOpts));
       jsDef.setCompilerOptions(compilerOpts);
 
-      var diagOpts = {
+      const diagOpts = {
         noSemanticValidation: true,
-        noSyntaxValidation: false,
+        // Server-side esbuild does the real syntax check at deploy time;
+        // Monaco's TS parser produces noisy false positives on raw JSX
+        // (1109, 1005, 1128 etc.), so we silence its squiggles entirely.
+        noSyntaxValidation: true,
         noSuggestionDiagnostics: true,
         diagnosticCodesToIgnore: [17004],
       };
       console.log(PREFIX, "setDiagnosticsOptions:", JSON.stringify(diagOpts));
       jsDef.setDiagnosticsOptions(diagOpts);
 
-      console.log(PREFIX, "readback compilerOptions:", JSON.stringify(jsDef.getCompilerOptions()));
-      console.log(PREFIX, "readback diagnosticsOptions:", JSON.stringify(jsDef.getDiagnosticsOptions()));
+      console.log(
+        PREFIX,
+        "readback compilerOptions:",
+        JSON.stringify(jsDef.getCompilerOptions()),
+      );
+      console.log(
+        PREFIX,
+        "readback diagnosticsOptions:",
+        JSON.stringify(jsDef.getDiagnosticsOptions()),
+      );
     }
 
-    // Exported for oneditprepare to call before model creation
+    /**
+     * Re-apply JSX defaults before Monaco model creation. Exported for
+     * `oneditprepare` to call. Idempotent — wraps `ensureJsxSetup`.
+     * @returns {void}
+     */
     window.__fcApplyJsxDefaults = function () {
       ensureJsxSetup();
     };
 
+    /**
+     * Lazy-load Monaco from the admin endpoint `/portal-react/vs/` the
+     * first time an editor opens. If Monaco is already on `window`
+     * (Node-RED bundled its own copy, or another node loaded it first),
+     * skip the loader script and run our setup inline.
+     *
+     * The callback signature is `cb(failed)` — `failed === true` when the
+     * loader script threw at load time; editors should fall back to a
+     * plain textarea in that case.
+     *
+     * @param {(failed?: boolean) => void} cb
+     * @returns {void}
+     */
     window.__fcLoadMonaco = function (cb) {
       console.log(PREFIX, "loadMonaco called, monaco exists:", !!window.monaco);
       if (window.monaco) {
-        console.log(PREFIX, "Monaco already loaded (by Node-RED?), running setup inline");
+        console.log(
+          PREFIX,
+          "Monaco already loaded (by Node-RED?), running setup inline",
+        );
         ensureJsxSetup();
         cb();
         return;
       }
-      var s = document.createElement("script");
+      const s = document.createElement("script");
       s.src = "portal-react/vs/loader.js";
       s.onload = function () {
         console.log(PREFIX, "loader.js loaded, configuring require paths");
@@ -429,26 +676,6 @@
     <label for="node-input-compName"><i class="fa fa-cube"></i> JSX Tag</label>
     <input type="text" id="node-input-compName" placeholder="MyComponent" />
   </div>
-  <div class="form-row" style="display:flex;gap:8px;">
-    <div style="flex:1">
-      <label><i class="fa fa-sign-in"></i> Input fields</label>
-      <input
-        type="text"
-        id="node-input-compInputs"
-        placeholder="payload,topic"
-        style="width:100%"
-      />
-    </div>
-    <div style="flex:1">
-      <label><i class="fa fa-sign-out"></i> Output fields</label>
-      <input
-        type="text"
-        id="node-input-compOutputs"
-        placeholder="payload,topic"
-        style="width:100%"
-      />
-    </div>
-  </div>
   <div class="form-row" style="margin-bottom:4px;">
     <label><i class="fa fa-code"></i> JSX Code</label>
   </div>
@@ -469,9 +696,9 @@
 
 <script type="text/javascript">
   (function () {
-    var compEditorInstance = null;
+    let compEditorInstance = null;
 
-    var COMP_STARTER = [
+    const COMP_STARTER = [
       "function StatusCard({ label, value, unit }) {",
       "  return (",
       '    <div className="rounded-2xl bg-zinc-900 border border-zinc-800 p-6">',
@@ -484,59 +711,119 @@
       "}",
     ].join("\n");
 
+    // FC_NAME_RE / FC_NAME_MAX / FC_NAME_BLACKLIST mirror lib/helpers.js
+    // isSafeName so the editor flags invalid names before deploy.
+    const FC_NAME_RE = /^[A-Za-z_$][\w$]*$/;
+    const FC_NAME_MAX = 64;
+    const FC_NAME_BLACKLIST = [
+      "__proto__", "constructor", "prototype", "hasOwnProperty",
+      "isPrototypeOf", "propertyIsEnumerable", "toString", "valueOf",
+      "toLocaleString",
+    ];
+    function fcValidateName(v) {
+      return (
+        typeof v === "string" &&
+        v.length > 0 &&
+        v.length <= FC_NAME_MAX &&
+        FC_NAME_RE.test(v) &&
+        FC_NAME_BLACKLIST.indexOf(v) === -1
+      );
+    }
+
     RED.nodes.registerType("fc-portal-component", {
       category: "fromcubes",
       color: "#a8d8ea",
       defaults: {
         name: { value: "" },
-        compName: { value: "StatusCard", required: true },
-        compCode: { value: COMP_STARTER },
-        compInputs: { value: "label,value,unit" },
-        compOutputs: { value: "" },
+        compName: {
+          value: "StatusCard",
+          required: true,
+          validate: fcValidateName,
+        },
+        compCode: {
+          value: COMP_STARTER,
+          validate: function (v) {
+            return typeof v === "string" && v.trim().length > 0;
+          },
+        },
       },
       inputs: 0,
       outputs: 0,
       icon: "font-awesome/fa-cube",
-      paletteLabel: "component",
+      paletteLabel: "React Component",
+      inputLabels: [],
+      outputLabels: [],
+      /**
+       * Canvas label resolver — falls back through `name → compName →
+       * "component"` so a freshly-dropped node shows something readable
+       * before the user opens the edit dialog.
+       * @returns {string}
+       */
       label: function () {
         return this.name || this.compName || "component";
       },
 
+      /**
+       * Node-RED editor lifecycle: called every time the user opens the
+       * edit dialog for this node. Loads Monaco lazily, creates a JSX
+       * model with a stable URI (`file:///fc-comp-<nodeId>.jsx`) and
+       * attaches it to the `#fcc-monaco` container. Falls back to a
+       * `<textarea>` if Monaco fails to load.
+       * @returns {void}
+       */
       oneditprepare: function () {
-        var node = this;
-        var code = node.compCode || COMP_STARTER;
+        const node = this;
+        const code =
+          typeof node.compCode === "string" ? node.compCode : COMP_STARTER;
         console.log("[FC-Monaco] COMP oneditprepare, node.id=" + node.id);
 
         if (!window.__fcTwClasses) {
           console.log("[FC-Monaco] loading tw-classes...");
           $.getJSON("portal-react/tw-classes", function (classes) {
-            console.log("[FC-Monaco] tw-classes loaded, count=" + classes.length);
+            console.log(
+              "[FC-Monaco] tw-classes loaded, count=" + classes.length,
+            );
             window.__fcTwClasses = classes;
           }).fail(function (xhr) {
-            console.error("[FC-Monaco] tw-classes FAILED:", xhr.status, xhr.statusText);
+            console.error(
+              "[FC-Monaco] tw-classes FAILED:",
+              xhr.status,
+              xhr.statusText,
+            );
           });
         }
 
         window.__fcLoadMonaco(function (failed) {
           if (failed) {
-            console.error("[FC-Monaco] COMP: Monaco load failed, using fallback textarea");
+            console.error(
+              "[FC-Monaco] COMP: Monaco load failed, using fallback textarea",
+            );
             $("#fcc-monaco").hide();
             $("#fcc-fallback").show().val(code);
             return;
           }
 
-          console.log("[FC-Monaco] COMP: applying JSX defaults before model creation");
+          console.log(
+            "[FC-Monaco] COMP: applying JSX defaults before model creation",
+          );
           window.__fcApplyJsxDefaults();
 
-          var compUri = monaco.Uri.parse("file:///fc-comp-" + node.id + ".jsx");
+          const compUri = monaco.Uri.parse("file:///fc-comp-" + node.id + ".jsx");
           console.log("[FC-Monaco] COMP: model URI=" + compUri.toString());
-          var existingModel = monaco.editor.getModel(compUri);
+          const existingModel = monaco.editor.getModel(compUri);
           if (existingModel) {
             console.log("[FC-Monaco] COMP: disposing existing model");
             existingModel.dispose();
           }
-          var compModel = monaco.editor.createModel(code, "javascript", compUri);
-          console.log("[FC-Monaco] COMP: model created, language=" + compModel.getLanguageId());
+          const compModel = monaco.editor.createModel(
+            code,
+            "javascript",
+            compUri,
+          );
+          console.log(
+            "[FC-Monaco] COMP: model created, language=" +
+              compModel.getLanguageId(),
+          );
 
           compEditorInstance = monaco.editor.create(
             document.getElementById("fcc-monaco"),
@@ -546,21 +833,41 @@
 
           // Log markers after a short delay (diagnostics are async)
           setTimeout(function () {
-            var markers = monaco.editor.getModelMarkers({ resource: compUri });
-            console.log("[FC-Monaco] COMP: markers after 500ms, count=" + markers.length);
+            const markers = monaco.editor.getModelMarkers({ resource: compUri });
+            console.log(
+              "[FC-Monaco] COMP: markers after 500ms, count=" + markers.length,
+            );
             markers.forEach(function (m) {
-              console.log("[FC-Monaco] COMP marker: code=" + m.code + " msg=" + m.message);
+              console.log(
+                "[FC-Monaco] COMP marker: code=" + m.code + " msg=" + m.message,
+              );
             });
             // Also log current compiler options state
-            console.log("[FC-Monaco] COMP: current compilerOptions:", JSON.stringify(monaco.typescript.javascriptDefaults.getCompilerOptions()));
-            console.log("[FC-Monaco] COMP: current diagnosticsOptions:", JSON.stringify(monaco.typescript.javascriptDefaults.getDiagnosticsOptions()));
+            console.log(
+              "[FC-Monaco] COMP: current compilerOptions:",
+              JSON.stringify(
+                monaco.typescript.javascriptDefaults.getCompilerOptions(),
+              ),
+            );
+            console.log(
+              "[FC-Monaco] COMP: current diagnosticsOptions:",
+              JSON.stringify(
+                monaco.typescript.javascriptDefaults.getDiagnosticsOptions(),
+              ),
+            );
           }, 500);
         });
       },
 
+      /**
+       * Editor → flow: copy Monaco editor contents into the hidden
+       * `#node-input-compCode` input and the node's `compCode` property,
+       * then dispose Monaco's model + editor to free GPU/CPU resources.
+       * @returns {void}
+       */
       oneditsave: function () {
         console.log("[FC-Monaco] COMP oneditsave");
-        var code = compEditorInstance
+        const code = compEditorInstance
           ? compEditorInstance.getValue()
           : $("#fcc-fallback").val();
         $("#node-input-compCode").val(code);
@@ -573,6 +880,12 @@
         }
       },
 
+      /**
+       * User cancelled the dialog — discard Monaco state without writing
+       * back to the node. Same dispose pattern as oneditsave to avoid
+       * leaking model graphs.
+       * @returns {void}
+       */
       oneditcancel: function () {
         console.log("[FC-Monaco] COMP oneditcancel");
         if (compEditorInstance) {
@@ -583,8 +896,15 @@
         }
       },
 
+      /**
+       * Resize handler — Monaco doesn't react to container size changes
+       * unless we call `editor.layout()` explicitly. Subtracts ~180 px of
+       * chrome (label, buttons, padding) from the dialog height.
+       * @param {{height: number, width: number}} size
+       * @returns {void}
+       */
       oneditresize: function (size) {
-        var h = size.height - 180;
+        let h = size.height - 180;
         if (h < 150) h = 150;
         $("#fcc-editor-wrap").css("height", h + "px");
         if (compEditorInstance) compEditorInstance.layout();
@@ -622,6 +942,264 @@
   </p>
 </script>
 
+<!-- ============================================================
+     fc-portal-utility – canvas node (helpers / hooks / constants)
+     ============================================================ -->
+<script type="text/html" data-template-name="fc-portal-utility">
+  <div class="form-row">
+    <label for="node-input-name"><i class="fa fa-tag"></i> Name</label>
+    <input type="text" id="node-input-name" placeholder="Label on canvas" />
+  </div>
+  <div class="form-row">
+    <label for="node-input-utilName"><i class="fa fa-wrench"></i> Module name</label>
+    <input type="text" id="node-input-utilName" placeholder="mathHelpers" />
+  </div>
+  <div class="form-row" style="margin-bottom:4px;">
+    <label><i class="fa fa-code"></i> Code</label>
+    <div style="font-size:11px;opacity:.5;margin-top:2px;">
+      Top-level helpers, custom hooks and constants. Available globally to portals
+      that reference any of the symbols declared here.
+    </div>
+  </div>
+  <div class="form-row node-text-editor-row">
+    <div
+      id="fcu-editor-wrap"
+      style="width:100%;height:350px;border:1px solid var(--red-ui-form-input-border-color,#555);border-radius:4px;overflow:hidden;position:relative;"
+    >
+      <div id="fcu-monaco" style="width:100%;height:100%;"></div>
+      <textarea
+        id="fcu-fallback"
+        style="display:none;width:100%;height:100%;font-family:'Cascadia Code',Consolas,monospace;font-size:13px;background:#1e1e1e;color:#d4d4d4;border:none;padding:12px;resize:none;"
+      ></textarea>
+    </div>
+  </div>
+  <input type="hidden" id="node-input-utilCode" />
+</script>
+
+<script type="text/javascript">
+  (function () {
+    let utilEditorInstance = null;
+
+    // Local copy of the identifier validator — each editor <script> block is
+    // wrapped in its own IIFE, so the helper defined in the fc-portal-component
+    // block above is out of scope here. Mirrors lib/helpers.js isSafeName.
+    const FC_NAME_RE = /^[A-Za-z_$][\w$]*$/;
+    const FC_NAME_MAX = 64;
+    const FC_NAME_BLACKLIST = [
+      "__proto__", "constructor", "prototype", "hasOwnProperty",
+      "isPrototypeOf", "propertyIsEnumerable", "toString", "valueOf",
+      "toLocaleString",
+    ];
+    /**
+     * Mirror of `lib/helpers.js#isSafeName` — used as `defaults.utilName.validate`
+     * so the editor flags invalid identifiers in red before the user can
+     * deploy a node that the server would later reject. Rules: non-empty
+     * string, ≤ 64 chars, JS identifier syntax, not on the prototype-key
+     * blacklist.
+     * @param {unknown} v
+     * @returns {boolean}
+     */
+    function fcValidateName(v) {
+      return (
+        typeof v === "string" &&
+        v.length > 0 &&
+        v.length <= FC_NAME_MAX &&
+        FC_NAME_RE.test(v) &&
+        FC_NAME_BLACKLIST.indexOf(v) === -1
+      );
+    }
+
+    const UTIL_STARTER = [
+      "// Helpers / custom hooks / constants — top-level, no React component.",
+      "// Each symbol declared here is available globally in any portal that",
+      "// references it (selective inclusion: unused utility nodes are skipped).",
+      "",
+      "const PI2 = Math.PI * 2;",
+      "",
+      "function clamp(n, min, max) {",
+      "  return Math.max(min, Math.min(max, n));",
+      "}",
+      "",
+      "// Custom React hook — call from inside App() or library components",
+      "function useDebounce(value, ms = 300) {",
+      "  const [v, setV] = React.useState(value);",
+      "  React.useEffect(() => {",
+      "    const t = setTimeout(() => setV(value), ms);",
+      "    return () => clearTimeout(t);",
+      "  }, [value, ms]);",
+      "  return v;",
+      "}",
+    ].join("\n");
+
+    RED.nodes.registerType("fc-portal-utility", {
+      category: "fromcubes",
+      color: "#fbbf24",
+      defaults: {
+        name: { value: "" },
+        utilName: {
+          value: "myHelpers",
+          required: true,
+          validate: fcValidateName,
+        },
+        utilCode: {
+          value: UTIL_STARTER,
+          validate: function (v) {
+            return typeof v === "string" && v.trim().length > 0;
+          },
+        },
+      },
+      inputs: 0,
+      outputs: 0,
+      icon: "font-awesome/fa-wrench",
+      paletteLabel: "React Utility",
+      inputLabels: [],
+      outputLabels: [],
+      /**
+       * Canvas label — `name → utilName → "utility"`.
+       * @returns {string}
+       */
+      label: function () {
+        return this.name || this.utilName || "utility";
+      },
+
+      /**
+       * Editor lifecycle for `fc-portal-utility`: lazy-load Monaco,
+       * create a JS model with URI `file:///fc-util-<nodeId>.js` (note
+       * `.js` not `.jsx` — utility code is plain JS).
+       * @returns {void}
+       */
+      oneditprepare: function () {
+        const node = this;
+        const code =
+          typeof node.utilCode === "string" ? node.utilCode : UTIL_STARTER;
+        console.log("[FC-Monaco] UTIL oneditprepare, node.id=" + node.id);
+
+        if (!window.__fcTwClasses) {
+          $.getJSON("portal-react/tw-classes", function (classes) {
+            window.__fcTwClasses = classes;
+          });
+        }
+
+        window.__fcLoadMonaco(function (failed) {
+          if (failed) {
+            $("#fcu-monaco").hide();
+            $("#fcu-fallback").show().val(code);
+            return;
+          }
+          window.__fcApplyJsxDefaults();
+
+          const utilUri = monaco.Uri.parse("file:///fc-util-" + node.id + ".js");
+          const existingModel = monaco.editor.getModel(utilUri);
+          if (existingModel) existingModel.dispose();
+          const utilModel = monaco.editor.createModel(code, "javascript", utilUri);
+
+          utilEditorInstance = monaco.editor.create(
+            document.getElementById("fcu-monaco"),
+            Object.assign({ model: utilModel }, window.__fcEditorOpts),
+          );
+        });
+      },
+
+      /**
+       * Editor → flow: write Monaco contents back to `utilCode`, dispose
+       * model+editor.
+       * @returns {void}
+       */
+      oneditsave: function () {
+        const code = utilEditorInstance
+          ? utilEditorInstance.getValue()
+          : $("#fcu-fallback").val();
+        $("#node-input-utilCode").val(code);
+        this.utilCode = code;
+        if (utilEditorInstance) {
+          utilEditorInstance.getModel().dispose();
+          utilEditorInstance.dispose();
+          utilEditorInstance = null;
+        }
+      },
+
+      /**
+       * Discard Monaco state without writing back.
+       * @returns {void}
+       */
+      oneditcancel: function () {
+        if (utilEditorInstance) {
+          utilEditorInstance.getModel().dispose();
+          utilEditorInstance.dispose();
+          utilEditorInstance = null;
+        }
+      },
+
+      /**
+       * Layout Monaco on dialog resize. -200 px chrome for the utility
+       * dialog (taller because of the symbol-list panel).
+       * @param {{height: number, width: number}} size
+       * @returns {void}
+       */
+      oneditresize: function (size) {
+        let h = size.height - 200;
+        if (h < 150) h = 150;
+        $("#fcu-editor-wrap").css("height", h + "px");
+        if (utilEditorInstance) utilEditorInstance.layout();
+      },
+    });
+  })();
+</script>
+
+<script type="text/html" data-help-name="fc-portal-utility">
+  <p>
+    Defines shared <strong>helpers</strong>, <strong>custom hooks</strong> and
+    <strong>constants</strong> available to all <strong>portal-react</strong>
+    nodes. Unlike <code>fc-portal-component</code>, the code is injected raw at
+    top level (no IIFE wrapper) — a single utility node may declare many symbols.
+  </p>
+  <h3>Properties</h3>
+  <dl>
+    <dt>Module name</dt>
+    <dd>
+      Identifier for this utility node. Shares a namespace with
+      <code>fc-portal-component</code> names — must be unique across all
+      components and utilities.
+    </dd>
+    <dt>Code</dt>
+    <dd>
+      Top-level JavaScript: <code>const</code>, <code>let</code>,
+      <code>function</code>, <code>class</code> declarations. <code>import</code>
+      statements at the top are auto-hoisted into the bundle.
+    </dd>
+  </dl>
+  <h3>Selective inclusion</h3>
+  <p>
+    A utility node is bundled into a portal only when the portal's JSX (or any
+    of its referenced library components) mentions at least one of the symbols
+    declared in the utility. Unused utility nodes are skipped.
+  </p>
+  <p>
+    Group related symbols in one node — referencing any one symbol pulls in the
+    whole node's code. Split unrelated helpers across multiple nodes for finer
+    granularity.
+  </p>
+  <h3>Example</h3>
+  <pre>function clamp(n, min, max) { return Math.max(min, Math.min(max, n)); }
+
+function useDebounce(value, ms = 300) {
+  const [v, setV] = React.useState(value);
+  React.useEffect(() => {
+    const t = setTimeout(() => setV(value), ms);
+    return () => clearTimeout(t);
+  }, [value, ms]);
+  return v;
+}</pre>
+  <p>
+    Then in any <strong>portal-react</strong> node:
+  </p>
+  <pre>function App() {
+  const { data } = useNodeRed();
+  const slow = useDebounce(data?.value);
+  return &lt;div&gt;{clamp(slow ?? 0, 0, 100)}&lt;/div&gt;;
+}</pre>
+</script>
+
 <!-- ============================================================
      portal-react – main node
      ============================================================ -->
@@ -631,6 +1209,37 @@
     <ul id="fc-tabs" style="min-width:600px;margin-bottom:0;"></ul>
   </div>
   <div id="fc-tabs-content">
+    <!-- ── Tab: JSX ── -->
+    <div id="fc-tab-jsx" class="fc-tab-pane">
+      <div class="form-row node-text-editor-row">
+        <div
+          id="fc-editor-wrap"
+          style="width:100%;height:420px;border:1px solid var(--red-ui-form-input-border-color,#555);border-radius:4px;overflow:hidden;position:relative;"
+        >
+          <div id="fc-monaco" style="width:100%;height:100%;"></div>
+          <textarea
+            id="fc-fallback"
+            style="display:none;width:100%;height:100%;font-family:'Cascadia Code',Consolas,monospace;font-size:13px;background:#1e1e1e;color:#d4d4d4;border:none;padding:12px;resize:none;"
+          ></textarea>
+        </div>
+      </div>
+      <div class="form-row" style="display:flex;gap:8px;margin-top:4px;flex-wrap:wrap;">
+        <button type="button" class="red-ui-button" id="fc-btn-starter">
+          <i class="fa fa-magic"></i> Default
+        </button>
+        <button type="button" class="red-ui-button" id="fc-btn-components">
+          <i class="fa fa-cube"></i> Components
+        </button>
+        <button type="button" class="red-ui-button" id="fc-btn-utilities">
+          <i class="fa fa-wrench"></i> Utilities
+        </button>
+        <span style="flex:1"></span>
+        <button type="button" class="red-ui-button" id="fc-btn-preview">
+          <i class="fa fa-eye"></i> Preview
+        </button>
+      </div>
+    </div>
+
     <!-- ── Tab: Properties ── -->
     <div id="fc-tab-props" class="fc-tab-pane" style="display:none;">
       <div class="form-row">
@@ -638,10 +1247,22 @@
         <input type="text" id="node-input-name" placeholder="My Portal" />
       </div>
       <div class="form-row">
-        <label for="node-input-endpoint"
-          ><i class="fa fa-globe"></i> Endpoint</label
+        <label for="node-input-subPath"
+          ><i class="fa fa-globe"></i> Sub-path</label
         >
-        <input type="text" id="node-input-endpoint" placeholder="/portal" />
+        <div style="display:inline-flex;align-items:stretch;width:70%;">
+          <span
+            style="display:inline-flex;align-items:center;padding:0 8px;background:var(--red-ui-secondary-background,#f3f3f3);border:1px solid var(--red-ui-form-input-border-color,#ccc);border-right:none;border-radius:4px 0 0 4px;color:var(--red-ui-secondary-text-color,#888);font-family:monospace;user-select:none;"
+            >/fromcubes/</span
+          >
+          <input
+            type="text"
+            id="node-input-subPath"
+            placeholder="sensors"
+            style="flex:1;border-radius:0 4px 4px 0;"
+          />
+        </div>
+        <input type="hidden" id="node-input-endpoint" />
         <div
           style="font-size:11px;opacity:.5;margin-top:2px;margin-left:105px;"
           id="fc-url-hint"
@@ -653,41 +1274,41 @@
         >
         <input type="text" id="node-input-pageTitle" placeholder="Portal" />
       </div>
-    </div>
-
-    <!-- ── Tab: JSX ── -->
-    <div id="fc-tab-jsx" class="fc-tab-pane">
-      <div class="form-row" style="margin-bottom:0;">
-        <div style="font-size:11px;opacity:.6;margin-bottom:4px;">
-          <code>useNodeRed()</code> &rarr;
-          <code>{ data, send }</code> &nbsp;|&nbsp; Components from
-          <code>fc-portal-component</code> nodes auto-imported &nbsp;|&nbsp;
-          Must export <code>&lt;App /&gt;</code> &nbsp;|&nbsp;
-          <strong>Transpiled server-side at deploy</strong>
-        </div>
-      </div>
-      <div class="form-row node-text-editor-row">
+      <div class="form-row node-input-libs-container-row">
+        <label style="width:auto;"><i class="fa fa-archive"></i> Modules</label>
+        <ol id="node-input-libs-container"></ol>
         <div
-          id="fc-editor-wrap"
-          style="width:100%;height:420px;border:1px solid var(--red-ui-form-input-border-color,#555);border-radius:4px;overflow:hidden;position:relative;"
+          style="font-size:11px;opacity:.5;margin-top:4px;margin-left:4px;"
         >
-          <div id="fc-monaco" style="width:100%;height:100%;"></div>
-          <textarea
-            id="fc-fallback"
-            style="display:none;width:100%;height:100%;font-family:'Cascadia Code',Consolas,monospace;font-size:13px;background:#1e1e1e;color:#d4d4d4;border:none;padding:12px;resize:none;"
-          ></textarea>
+          npm packages to bundle. Node-RED auto-installs them at deploy time.
         </div>
       </div>
-      <div class="form-row" style="display:flex;gap:8px;margin-top:4px;">
-        <button type="button" class="red-ui-button" id="fc-btn-preview">
-          <i class="fa fa-eye"></i> Preview
-        </button>
-        <button type="button" class="red-ui-button" id="fc-btn-components">
-          <i class="fa fa-cube"></i> Components
-        </button>
-        <button type="button" class="red-ui-button" id="fc-btn-starter">
-          <i class="fa fa-magic"></i> Starter
-        </button>
+      <div class="form-row" style="margin-top:12px;">
+        <label style="width:auto;">
+          <input
+            type="checkbox"
+            id="node-input-portalAuth"
+            style="width:auto;margin:0 8px 0 0;vertical-align:middle;"
+          />
+          Enable Portal Auth headers
+        </label>
+        <div style="font-size:11px;opacity:.5;margin-top:4px;margin-left:4px;">
+          Read <code>X-Portal-*</code> headers from reverse proxy.
+        </div>
+      </div>
+      <div class="form-row" style="margin-top:12px;">
+        <label style="width:auto;">
+          <input
+            type="checkbox"
+            id="node-input-showWsStatus"
+            style="width:auto;margin:0 8px 0 0;vertical-align:middle;"
+          />
+          Show WebSocket status indicator
+        </label>
+        <div style="font-size:11px;opacity:.5;margin-top:4px;margin-left:4px;">
+          Displays a small <em>fromcubes</em> badge in the bottom-right corner
+          showing connection state.
+        </div>
       </div>
     </div>
 
@@ -696,7 +1317,8 @@
       <div class="form-row">
         <div style="font-size:11px;opacity:.6;margin-bottom:6px;">
           Extra tags injected into <code>&lt;head&gt;</code>. CDN links, fonts,
-          stylesheets, meta tags.
+          stylesheets, meta tags. Trusted authors only: scripts and event
+          handlers run in the public portal page.
         </div>
         <div
           id="fc-head-wrap"
@@ -719,11 +1341,11 @@
 
 <script type="text/javascript">
   (function () {
-    var editorInstance = null;
-    var headEditorInstance = null;
+    let editorInstance = null;
+    let headEditorInstance = null;
 
-    var STARTER = [
-      "// useNodeRed() \u2192 { data, send }",
+    const STARTER = [
+      "// useNodeRed() \u2192 { data, send, portalClient }",
       "//   data  = last msg.payload from input wire",
       "//   send(payload, topic?) = push msg to output wire",
       "// Components from fc-portal-component nodes are available by name.",
@@ -734,7 +1356,7 @@
       "",
       "  return (",
       '    <div className="min-h-screen bg-zinc-950 p-8">',
-      '      <h1 className="text-2xl font-light text-cyan-400 mb-6">Portal</h1>',
+      '      <h1 className="text-2xl font-light text-cyan-400 mb-6">fromcubes</h1>',
       '      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">',
       '        <StatusCard label="Value" value={d.value ?? "—"} unit="" />',
       "      </div>",
@@ -754,37 +1376,94 @@
       color: "#61dafb",
       defaults: {
         name: { value: "" },
-        endpoint: { value: "/portal", required: true },
-        pageTitle: { value: "Portal" },
-        componentCode: { value: STARTER },
+        subPath: {
+          value: "",
+          required: true,
+          validate: function (v) {
+            if (typeof v !== "string") return false;
+            const t = v.trim();
+            if (t.length === 0) return false;
+            if (/\s/.test(t)) return false;
+            if (t.charAt(0) === "/" || t.charAt(t.length - 1) === "/") return false;
+            const segs = t.split("/");
+            for (let i = 0; i < segs.length; i++) {
+              const s = segs[i];
+              if (!s || s === "." || s === "..") return false;
+              const lower = s.toLowerCase();
+              if (lower === "public" || lower === "_ws") return false;
+              if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(s)) return false;
+            }
+            return true;
+          },
+        },
+        endpoint: { value: "" },
+        pageTitle: { value: "fromcubes" },
+        componentCode: {
+          value: STARTER,
+          validate: function (v) {
+            return typeof v === "string" && v.trim().length > 0;
+          },
+        },
         customHead: { value: "" },
+        portalAuth: { value: false },
+        showWsStatus: { value: false },
+        libs: { value: [] },
       },
       inputs: 1,
       outputs: 1,
       icon: "font-awesome/fa-desktop",
-      paletteLabel: "portal react",
+      paletteLabel: "React Portal",
+      // Source AND sink — we keep the default left-aligned input even though
+      // Node-RED appearance docs suggest align: 'right' for nodes that sit at
+      // the end of a flow. This portal is hybrid: the input wire pushes msgs
+      // into the browser, while the output wire forwards UI events out. Left
+      // alignment matches the dominant "msg → render" direction.
+      inputLabels: ["broadcast / unicast msg → page"],
+      outputLabels: ["UI event from page"],
+      /**
+       * Canvas label — shows `name` or the deployed URL (`/fromcubes/<subPath>`).
+       * @returns {string}
+       */
       label: function () {
-        return this.name || this.endpoint || "portal react";
+        return this.name || ("/fromcubes/" + (this.subPath || "?"));
       },
 
+      /**
+       * Editor lifecycle for the portal node. Heaviest of the three —
+       * creates two Monaco editors (JSX + Head HTML), wires up:
+       *   - URL hint that previews `/fromcubes/<subPath>`
+       *   - Legacy `endpoint` field migration warning
+       *   - `RED.tabs` for JSX / Properties / Head HTML panels
+       *   - Component picker dialog (`#fc-btn-components`)
+       *   - Utility picker dialog (`#fc-btn-utilities`)
+       *   - Portal Assets sidebar tab via `RED.sidebar.addTab` (once)
+       * @returns {void}
+       */
       oneditprepare: function () {
-        var node = this;
-        var code = node.componentCode || STARTER;
-        var headCode = node.customHead || "";
+        const node = this;
+        const code =
+          typeof node.componentCode === "string" ? node.componentCode : STARTER;
+        const headCode = node.customHead || "";
         console.log("[FC-Monaco] PORTAL oneditprepare, node.id=" + node.id);
 
         if (!window.__fcTwClasses) {
           console.log("[FC-Monaco] loading tw-classes...");
           $.getJSON("portal-react/tw-classes", function (classes) {
-            console.log("[FC-Monaco] tw-classes loaded, count=" + classes.length);
+            console.log(
+              "[FC-Monaco] tw-classes loaded, count=" + classes.length,
+            );
             window.__fcTwClasses = classes;
           }).fail(function (xhr) {
-            console.error("[FC-Monaco] tw-classes FAILED:", xhr.status, xhr.statusText);
+            console.error(
+              "[FC-Monaco] tw-classes FAILED:",
+              xhr.status,
+              xhr.statusText,
+            );
           });
         }
 
         // Tabs
-        var fcTabs = RED.tabs.create({
+        const fcTabs = RED.tabs.create({
           id: "fc-tabs",
           onchange: function (tab) {
             $(".fc-tab-pane").hide();
@@ -800,18 +1479,73 @@
         fcTabs.addTab({ id: "fc-tab-head", label: "Head HTML" });
         fcTabs.activateTab("fc-tab-jsx");
 
+        // Legacy endpoint detection + convenience pre-fill
+        if (node.endpoint && typeof node.endpoint === "string") {
+          const legacy = node.endpoint;
+          const prefix = "/fromcubes/";
+          if (legacy.indexOf(prefix) === 0) {
+            if (!node.subPath) {
+              $("#node-input-subPath").val(legacy.slice(prefix.length));
+            }
+          } else if (legacy !== "" && legacy !== "/fromcubes") {
+            $("#fc-url-hint")
+              .css("color", "#c00")
+              .text(
+                "Legacy endpoint detected: '" +
+                  legacy +
+                  "'. Set a Sub-path and redeploy.",
+              );
+          }
+        }
+
         // URL hint
         function updateHint() {
-          var ep = $("#node-input-endpoint").val() || "/portal";
-          $("#fc-url-hint").text("Page served at: http://<host>:1880" + ep);
+          const sp = ($("#node-input-subPath").val() || "").trim();
+          const root = (RED.settings.httpNodeRoot || "/").replace(/\/$/, "");
+          if (sp) {
+            $("#fc-url-hint")
+              .css("color", "")
+              .text(
+                "Page served at: http://<host>:1880" +
+                  root +
+                  "/fromcubes/" +
+                  sp,
+              );
+          } else if (!node.endpoint || node.endpoint.indexOf("/fromcubes/") === 0) {
+            $("#fc-url-hint")
+              .css("color", "")
+              .text("Sub-path required (will be served under /fromcubes/<sub-path>)");
+          }
         }
-        $("#node-input-endpoint").on("input", updateHint);
+        $("#node-input-subPath").on("input", updateHint);
         updateHint();
 
+        // Modules editableList (like function node's libs)
+        const libsList = node.libs || [];
+        $("#node-input-libs-container").css("min-height","68px").editableList({
+          addItem: function(container, i, opt) {
+            const lib = opt || {};
+            const row = $('<div/>',{style:"display:flex;gap:8px;align-items:center;"}).appendTo(container);
+            const modInput = $('<input/>',{type:"text",placeholder:"e.g. chart.js/auto@^4.4.0",style:"flex:1;"}).appendTo(row);
+            const varInput = $('<input/>',{type:"text",placeholder:"Import as (e.g. Chart)",style:"width:140px;"}).appendTo(row);
+            modInput.val(lib.module || "");
+            varInput.val(lib.const || "");
+            container.data("mod", modInput);
+            container.data("var", varInput);
+          },
+          removable: true,
+          sortable: true
+        });
+        libsList.forEach(function(lib) {
+          $("#node-input-libs-container").editableList("addItem", lib);
+        });
+
         // Monaco
         window.__fcLoadMonaco(function (failed) {
           if (failed) {
-            console.error("[FC-Monaco] PORTAL: Monaco load failed, using fallback textarea");
+            console.error(
+              "[FC-Monaco] PORTAL: Monaco load failed, using fallback textarea",
+            );
             $("#fc-monaco").hide();
             $("#fc-fallback").show().val(code);
             $("#fc-head-monaco").hide();
@@ -819,30 +1553,40 @@
             return;
           }
 
-          console.log("[FC-Monaco] PORTAL: applying JSX defaults before model creation");
+          console.log(
+            "[FC-Monaco] PORTAL: applying JSX defaults before model creation",
+          );
           window.__fcApplyJsxDefaults();
-          var opts = window.__fcEditorOpts;
+          const opts = window.__fcEditorOpts;
 
-          var jsxUri = monaco.Uri.parse("file:///fc-portal-" + node.id + ".jsx");
+          const jsxUri = monaco.Uri.parse(
+            "file:///fc-portal-" + node.id + ".jsx",
+          );
           console.log("[FC-Monaco] PORTAL: JSX model URI=" + jsxUri.toString());
-          var existingJsx = monaco.editor.getModel(jsxUri);
+          const existingJsx = monaco.editor.getModel(jsxUri);
           if (existingJsx) {
             console.log("[FC-Monaco] PORTAL: disposing existing JSX model");
             existingJsx.dispose();
           }
-          var jsxModel = monaco.editor.createModel(code, "javascript", jsxUri);
-          console.log("[FC-Monaco] PORTAL: JSX model created, language=" + jsxModel.getLanguageId());
+          const jsxModel = monaco.editor.createModel(code, "javascript", jsxUri);
+          console.log(
+            "[FC-Monaco] PORTAL: JSX model created, language=" +
+              jsxModel.getLanguageId(),
+          );
           editorInstance = monaco.editor.create(
             document.getElementById("fc-monaco"),
             Object.assign({ model: jsxModel }, opts),
           );
           console.log("[FC-Monaco] PORTAL: JSX editor created");
-          if (window.__fcAttachSelfClose) window.__fcAttachSelfClose(editorInstance);
+          if (window.__fcAttachSelfClose)
+            window.__fcAttachSelfClose(editorInstance);
 
-          var headUri = monaco.Uri.parse("file:///fc-head-" + node.id + ".html");
-          var existingHead = monaco.editor.getModel(headUri);
+          const headUri = monaco.Uri.parse(
+            "file:///fc-head-" + node.id + ".html",
+          );
+          const existingHead = monaco.editor.getModel(headUri);
           if (existingHead) existingHead.dispose();
-          var headModel = monaco.editor.createModel(headCode, "html", headUri);
+          const headModel = monaco.editor.createModel(headCode, "html", headUri);
           headEditorInstance = monaco.editor.create(
             document.getElementById("fc-head-monaco"),
             Object.assign({ model: headModel }, opts),
@@ -851,93 +1595,320 @@
 
           // Log markers after a short delay (diagnostics are async)
           setTimeout(function () {
-            var markers = monaco.editor.getModelMarkers({ resource: jsxUri });
-            console.log("[FC-Monaco] PORTAL: markers after 500ms, count=" + markers.length);
+            const markers = monaco.editor.getModelMarkers({ resource: jsxUri });
+            console.log(
+              "[FC-Monaco] PORTAL: markers after 500ms, count=" +
+                markers.length,
+            );
             markers.forEach(function (m) {
-              console.log("[FC-Monaco] PORTAL marker: code=" + m.code + " severity=" + m.severity + " msg=" + m.message);
+              console.log(
+                "[FC-Monaco] PORTAL marker: code=" +
+                  m.code +
+                  " severity=" +
+                  m.severity +
+                  " msg=" +
+                  m.message,
+              );
             });
-            console.log("[FC-Monaco] PORTAL: current compilerOptions:", JSON.stringify(monaco.typescript.javascriptDefaults.getCompilerOptions()));
-            console.log("[FC-Monaco] PORTAL: current diagnosticsOptions:", JSON.stringify(monaco.typescript.javascriptDefaults.getDiagnosticsOptions()));
+            console.log(
+              "[FC-Monaco] PORTAL: current compilerOptions:",
+              JSON.stringify(
+                monaco.typescript.javascriptDefaults.getCompilerOptions(),
+              ),
+            );
+            console.log(
+              "[FC-Monaco] PORTAL: current diagnosticsOptions:",
+              JSON.stringify(
+                monaco.typescript.javascriptDefaults.getDiagnosticsOptions(),
+              ),
+            );
           }, 500);
         });
 
         // Buttons
         $("#fc-btn-starter").on("click", function () {
-          if (editorInstance) editorInstance.setValue(STARTER);
-          else $("#fc-fallback").val(STARTER);
+          $("<div>Replace current JSX with default starter code?</div>").dialog({
+            title: "Load Default",
+            modal: true,
+            width: 360,
+            buttons: [
+              { text: "Cancel", click: function () { $(this).dialog("close"); } },
+              { text: "Replace", class: "primary", click: function () {
+                if (editorInstance) editorInstance.setValue(STARTER);
+                else $("#fc-fallback").val(STARTER);
+                $(this).dialog("close");
+              }},
+            ],
+            close: function () { $(this).remove(); },
+          });
         });
 
         $("#fc-btn-preview").on("click", function () {
-          var ep = $("#node-input-endpoint").val();
-          if (ep) window.open(ep, "_blank");
+          const sp = ($("#node-input-subPath").val() || "").trim();
+          const root = (RED.settings.httpNodeRoot || "/").replace(/\/$/, "");
+          if (sp) window.open(root + "/fromcubes/" + sp, "_blank");
         });
 
         $("#fc-btn-components").on("click", function () {
           $.getJSON("portal-react/registry", function (reg) {
-            var names = Object.keys(reg);
+            const names = Object.keys(reg).sort();
             if (!names.length) {
               RED.notify("No component nodes on canvas.", "warning");
               return;
             }
-            var html = "<p>Click to insert:</p>";
+
+            function extractProps(code) {
+              if (!code) return [];
+              const m = code.match(/function\s+\w+\s*\(\s*\{([^}]*)\}/);
+              if (!m) return [];
+              return m[1].split(",").map(function (s) { return s.trim().split(/\s*=\s*/)[0]; }).filter(Boolean);
+            }
+
+            let html =
+              '<div style="display:flex;flex-direction:column;height:100%;overflow:hidden;">' +
+              '<input type="text" id="fc-comp-search" placeholder="Search..." ' +
+              'style="width:100%;box-sizing:border-box;margin-bottom:6px;padding:5px 8px;border:1px solid rgba(128,128,128,.4);border-radius:3px;' +
+              'background:var(--red-ui-form-input-background-color,#fff);color:var(--red-ui-form-text-color,#333);font-size:12px;flex-shrink:0;" />' +
+              '<div id="fc-comp-list" style="flex:1;overflow-y:auto;">';
+
             names.forEach(function (n) {
-              var c = reg[n];
+              const c = reg[n];
+              const props = extractProps(c.code);
+              const detailParts = [];
+              if (props.length) {
+                detailParts.push('<div style="margin:4px 0 0 0;font-size:11px;opacity:.6;">' +
+                  props.map(function (p) {
+                    return '<code style="background:rgba(128,128,128,.15);padding:0 4px;border-radius:2px;margin-right:3px;">' + p + '</code>';
+                  }).join("") + '</div>');
+              }
+              const hasDetail = detailParts.length > 0;
+
               html +=
-                '<div style="padding:4px 0;border-bottom:1px solid rgba(128,128,128,.2)">' +
-                '<button class="red-ui-button fc-lib-ins" data-name="' +
-                n +
-                '">' +
-                n +
-                "</button>" +
-                ' <span style="opacity:.5;font-size:11px">in:[' +
-                (c.inputs || []).join(",") +
-                "] out:[" +
-                (c.outputs || []).join(",") +
-                "]</span></div>";
+                '<div class="fc-comp-item" data-name="' + n + '" data-search="' + n.toLowerCase() + '" ' +
+                'style="border-bottom:1px solid rgba(128,128,128,.1);">' +
+                '<div style="display:flex;align-items:center;padding:4px 6px;cursor:pointer;" class="fc-comp-row">' +
+                (hasDetail ? '<i class="fa fa-caret-right fc-comp-arrow" style="width:14px;opacity:.4;font-size:12px;transition:transform .15s;"></i>' : '<span style="width:14px;"></span>') +
+                '<span class="fc-comp-name" data-name="' + n + '" style="font-weight:600;font-size:12px;flex:1;">' + n + '</span>' +
+                '</div>' +
+                (hasDetail ? '<div class="fc-comp-detail" style="display:none;padding:0 6px 4px 20px;">' + detailParts.join("") + '</div>' : '') +
+                '</div>';
             });
-            $("<div></div>")
-              .html(html)
-              .dialog({
-                title: "Available Components",
-                modal: true,
-                width: 400,
-                buttons: [
-                  {
-                    text: "Close",
-                    click: function () {
-                      $(this).dialog("close");
-                    },
-                  },
-                ],
-                close: function () {
-                  $(this).remove();
-                },
+            html += '</div></div>';
+
+            const $dlg = $("<div></div>").html(html).dialog({
+              title: "Components",
+              modal: true,
+              width: 380,
+              buttons: [
+                { text: "Close", click: function () { $(this).dialog("close"); } },
+              ],
+              close: function () { $(this).remove(); },
+            });
+
+            // Search
+            $dlg.find("#fc-comp-search").on("input", function () {
+              const q = $(this).val().toLowerCase();
+              $dlg.find(".fc-comp-item").each(function () {
+                $(this).toggle($(this).data("search").indexOf(q) !== -1);
+              });
+            }).focus();
+
+            // Hover
+            $dlg.on("mouseenter", ".fc-comp-row", function () {
+              $(this).css("background", "rgba(128,128,128,.1)");
+            }).on("mouseleave", ".fc-comp-row", function () {
+              $(this).css("background", "");
+            });
+
+            // Arrow toggle detail
+            $dlg.on("click", ".fc-comp-arrow", function (e) {
+              e.stopPropagation();
+              const $item = $(this).closest(".fc-comp-item");
+              const $detail = $item.find(".fc-comp-detail");
+              const open = $detail.is(":visible");
+              $detail.slideToggle(100);
+              $(this).css("transform", open ? "" : "rotate(90deg)");
+            });
+
+            // Click name: delete selection, insert <Tag></Tag> in one line, cursor between tags
+            $dlg.on("click", ".fc-comp-name", function () {
+              const name = $(this).data("name");
+              const openTag = "<" + name + ">";
+              const closeTag = "</" + name + ">";
+              const text = openTag + closeTag;
+              $dlg.dialog("close");
+              if (editorInstance) {
+                const sel = editorInstance.getSelection();
+                const startLine = sel.startLineNumber;
+                const startCol = sel.startColumn;
+                editorInstance.executeEdits("fc-components", [{
+                  range: sel,
+                  text: text,
+                }]);
+                setTimeout(function () {
+                  editorInstance.setPosition({ lineNumber: startLine, column: startCol + openTag.length });
+                  editorInstance.focus();
+                }, 50);
+              } else {
+                const ta = $("#fc-fallback")[0];
+                const s = ta.selectionStart, e = ta.selectionEnd, v = ta.value;
+                ta.value = v.slice(0, s) + text + v.slice(e);
+                setTimeout(function () {
+                  ta.selectionStart = ta.selectionEnd = s + openTag.length;
+                  ta.focus();
+                }, 50);
+              }
+            });
+          });
+        });
+
+        $("#fc-btn-utilities").on("click", function () {
+          $.getJSON("portal-react/utilities", function (reg) {
+            // Refresh global cache too so completion provider picks up changes
+            if (window.__fcRefreshUtilities) window.__fcRefreshUtilities();
+            const names = Object.keys(reg).sort();
+            if (!names.length) {
+              RED.notify("No utility nodes on canvas.", "warning");
+              return;
+            }
+
+            let html =
+              '<div style="display:flex;flex-direction:column;height:100%;overflow:hidden;">' +
+              '<input type="text" id="fc-util-search" placeholder="Search..." ' +
+              'style="width:100%;box-sizing:border-box;margin-bottom:6px;padding:5px 8px;border:1px solid rgba(128,128,128,.4);border-radius:3px;' +
+              'background:var(--red-ui-form-input-background-color,#fff);color:var(--red-ui-form-text-color,#333);font-size:12px;flex-shrink:0;" />' +
+              '<div id="fc-util-list" style="flex:1;overflow-y:auto;">';
+
+            names.forEach(function (n) {
+              const u = reg[n];
+              const syms = u.symbols || [];
+              const errBadge = u.error
+                ? '<span style="margin-left:6px;font-size:10px;color:#ef4444;" title="' +
+                  String(u.error).replace(/"/g, "&quot;") + '">syntax error</span>'
+                : "";
+              const symBadges = syms.map(function (s) {
+                return '<span class="fc-util-sym" data-sym="' + s +
+                  '" style="display:inline-block;background:rgba(251,191,36,.15);border:1px solid rgba(251,191,36,.35);' +
+                  'padding:1px 6px;border-radius:3px;margin:2px 4px 2px 0;font-size:11px;font-family:monospace;cursor:pointer;">' +
+                  s + '</span>';
+              }).join("");
+              const detail = syms.length
+                ? '<div style="margin:4px 0 0 0;">' + symBadges + '</div>'
+                : '<div style="margin:4px 0 0 0;font-size:11px;opacity:.5;">(no top-level symbols detected)</div>';
+              const searchKey = (n + " " + syms.join(" ")).toLowerCase();
+
+              html +=
+                '<div class="fc-util-item" data-name="' + n + '" data-search="' + searchKey + '" ' +
+                'style="border-bottom:1px solid rgba(128,128,128,.1);">' +
+                '<div style="display:flex;align-items:center;padding:4px 6px;cursor:pointer;" class="fc-util-row">' +
+                '<i class="fa fa-caret-right fc-util-arrow" style="width:14px;opacity:.4;font-size:12px;transition:transform .15s;"></i>' +
+                '<i class="fa fa-wrench" style="width:14px;color:#fbbf24;font-size:11px;"></i>' +
+                '<span style="font-weight:600;font-size:12px;flex:1;margin-left:4px;">' + n + '</span>' +
+                errBadge +
+                '</div>' +
+                '<div class="fc-util-detail" style="display:none;padding:0 6px 6px 32px;">' + detail + '</div>' +
+                '</div>';
+            });
+            html += '</div></div>';
+
+            const $dlg = $("<div></div>").html(html).dialog({
+              title: "Utilities",
+              modal: true,
+              width: 420,
+              buttons: [
+                { text: "Close", click: function () { $(this).dialog("close"); } },
+              ],
+              close: function () { $(this).remove(); },
+            });
+
+            $dlg.find("#fc-util-search").on("input", function () {
+              const q = $(this).val().toLowerCase();
+              $dlg.find(".fc-util-item").each(function () {
+                $(this).toggle($(this).data("search").indexOf(q) !== -1);
               });
-            $(document).on("click", ".fc-lib-ins", function () {
-              var tag = "<" + $(this).data("name") + " />";
+            }).focus();
+
+            $dlg.on("mouseenter", ".fc-util-row", function () {
+              $(this).css("background", "rgba(251,191,36,.08)");
+            }).on("mouseleave", ".fc-util-row", function () {
+              $(this).css("background", "");
+            });
+
+            $dlg.on("click", ".fc-util-row", function (e) {
+              if ($(e.target).closest(".fc-util-sym").length) return;
+              const $item = $(this).closest(".fc-util-item");
+              const $detail = $item.find(".fc-util-detail");
+              const $arrow = $item.find(".fc-util-arrow");
+              const open = $detail.is(":visible");
+              $detail.slideToggle(100);
+              $arrow.css("transform", open ? "" : "rotate(90deg)");
+            });
+
+            // Click symbol → insert bare identifier at cursor
+            $dlg.on("click", ".fc-util-sym", function (e) {
+              e.stopPropagation();
+              const sym = $(this).data("sym");
+              $dlg.dialog("close");
               if (editorInstance) {
-                editorInstance.trigger("keyboard", "type", { text: tag });
-                editorInstance.focus();
+                const sel = editorInstance.getSelection();
+                const startLine = sel.startLineNumber;
+                const startCol = sel.startColumn;
+                editorInstance.executeEdits("fc-utilities", [{
+                  range: sel,
+                  text: sym,
+                }]);
+                setTimeout(function () {
+                  editorInstance.setPosition({ lineNumber: startLine, column: startCol + sym.length });
+                  editorInstance.focus();
+                }, 50);
               } else {
-                var ta = $("#fc-fallback")[0];
-                var p = ta.selectionStart,
-                  v = ta.value;
-                ta.value = v.slice(0, p) + tag + v.slice(p);
+                const ta = $("#fc-fallback")[0];
+                const s = ta.selectionStart, en = ta.selectionEnd, v = ta.value;
+                ta.value = v.slice(0, s) + sym + v.slice(en);
+                setTimeout(function () {
+                  ta.selectionStart = ta.selectionEnd = s + sym.length;
+                  ta.focus();
+                }, 50);
               }
             });
           });
         });
       },
 
+      /**
+       * Editor → flow. Normalises `subPath` (trim), clears the legacy
+       * `endpoint` field, collects `libs` from the editableList widget,
+       * writes both Monaco editors back to hidden inputs + node props,
+       * then disposes both editors.
+       * @returns {void}
+       */
       oneditsave: function () {
         console.log("[FC-Monaco] PORTAL oneditsave");
-        var code = editorInstance
+
+        // Clear legacy endpoint field + normalize subPath
+        $("#node-input-endpoint").val("");
+        this.endpoint = "";
+        this.subPath = ($("#node-input-subPath").val() || "").trim();
+
+        // Collect libs from editableList
+        const libs = [];
+        const items = $("#node-input-libs-container").editableList("items");
+        items.each(function() {
+          const mod = $(this).data("mod").val().trim();
+          const v = $(this).data("var").val().trim();
+          if (mod) {
+            libs.push({ module: mod, var: v });
+          }
+        });
+        this.libs = libs;
+
+        const code = editorInstance
           ? editorInstance.getValue()
           : $("#fc-fallback").val();
         $("#node-input-componentCode").val(code);
         this.componentCode = code;
 
-        var head = headEditorInstance
+        const head = headEditorInstance
           ? headEditorInstance.getValue()
           : $("#fc-head-fallback").val();
         $("#node-input-customHead").val(head);
@@ -957,6 +1928,12 @@
         }
       },
 
+      /**
+       * Discard both Monaco editors without writing back to the node.
+       * Identical dispose pattern to oneditsave so we never leak Monaco
+       * graphs even if the user spams Edit / Cancel rapidly.
+       * @returns {void}
+       */
       oneditcancel: function () {
         console.log("[FC-Monaco] PORTAL oneditcancel");
         if (editorInstance) {
@@ -973,12 +1950,19 @@
         }
       },
 
+      /**
+       * Dialog resize → compute available editor height by subtracting
+       * the heights of non-tab form rows + tab strip + 30 px padding,
+       * then re-layout both Monaco editors. Falls back to 200 px minimum.
+       * @param {{height: number, width: number}} size
+       * @returns {void}
+       */
       oneditresize: function (size) {
-        var tabsH = $("#fc-tabs").outerHeight(true) || 0;
-        var rows = $(
+        const tabsH = $("#fc-tabs").outerHeight(true) || 0;
+        const rows = $(
           "#dialog-form>div:not(#fc-tabs-content):not(:has(#fc-tabs))",
         );
-        var h = size.height;
+        let h = size.height;
         rows.each(function () {
           h -= $(this).outerHeight(true);
         });
@@ -997,37 +1981,59 @@
      Help
      ============================================================ -->
 <script type="text/html" data-help-name="portal-react">
+  <h3>Quick Reference</h3>
+  <ul>
+    <li><code>useNodeRed()</code> &rarr; <code>{ data, send, user, portalClient }</code></li>
+    <li>Components from <code>fc-portal-component</code> nodes are auto-imported</li>
+    <li>Must export <code>&lt;App /&gt;</code></li>
+    <li>JSX is transpiled server-side at deploy</li>
+  </ul>
+
   <p>
-    Renders a React application on a configurable HTTP endpoint with live
-    WebSocket data binding.
-  </p>
-  <h3>Key difference from Dashboard 2.0</h3>
-  <p>
-    JSX is transpiled <strong>server-side at deploy time</strong> using Sucrase.
-    The browser receives plain JS — no Babel, no runtime compilation. Page
-    weight: ~45 KB (React production).
+    Renders a React 19 application on a configurable HTTP endpoint with live
+    WebSocket data binding. JSX is transpiled <strong>server-side at deploy
+    time</strong> using esbuild — browsers receive pre-compiled JS with zero
+    runtime compilation. Tailwind CSS 4 utility classes are generated
+    server-side and served as static CSS.
   </p>
 
   <h3>Inputs</h3>
   <p>
-    <code>msg.payload</code> is pushed to all connected clients via WebSocket.
+    <code>msg.payload</code> is pushed via WebSocket. Set <code>msg._client</code>
+    to target specific clients, or omit it to broadcast to all.
   </p>
   <pre>
-const { data, send } = useNodeRed();
-// data = last msg.payload</pre
+const { data, send, user, portalClient } = useNodeRed();
+// data         = last msg.payload (reactive)
+// send(payload, topic?) — emit msg on output wire
+// user         = portal auth data or null
+// portalClient = unique session/tab ID (assigned by server)</pre
   >
 
   <h3>Outputs</h3>
   <p>
     <code>send(payload, topic?)</code> emits a <code>msg</code> on the node's
-    output wire.
+    output wire via WebSocket.
+  </p>
+
+  <h3>npm Packages</h3>
+  <p>
+    Add npm packages in the <strong>Modules</strong> list (e.g.
+    <code>chart.js/auto@^4.4.0</code>, <code>d3</code>, <code>three</code>).
+    Node-RED auto-installs them at deploy time. All packages are bundled with
+    React into a single vendor IIFE via esbuild, cached by hash of installed
+    versions. Use them in JSX via standard imports.
   </p>
 
   <h3>Deploy behavior</h3>
   <ul>
     <li>
-      Each deploy re-transpiles JSX (cached by content hash — unchanged code is
-      instant)
+      Each deploy re-transpiles JSX via esbuild and rebuilds Tailwind CSS
+      (both cached by content hash — unchanged code is instant)
+    </li>
+    <li>
+      Vendor bundle (React + npm packages) rebuilt only when package versions
+      change
     </li>
     <li>
       Active WebSocket clients receive close code 1001 and auto-reconnect
@@ -1045,15 +2051,584 @@ const { data, send } = useNodeRed();
   <p>
     Components defined in <strong>fc-portal-component</strong> nodes on the
     canvas are auto-injected into every portal-react page. Use them as JSX tags
-    by their component name.
+    by their component name — no imports needed.
   </p>
 
+  <h3>Portal Auth</h3>
+  <p>
+    When enabled in the Auth tab, reads <code>X-Portal-*</code> headers set by
+    a reverse proxy (e.g. Nginx) and exposes user data:
+  </p>
+  <ul>
+    <li><code>useNodeRed()</code> returns <code>{ data, send, user, portalClient }</code></li>
+    <li>
+      All WebSocket messages include <code>msg._client</code> with
+      <code>{ portalClient, ...userFields }</code>
+    </li>
+    <li>
+      To target a specific tab: keep <code>msg._client</code> (or set
+      <code>msg._client = { portalClient: "..." }</code>)
+    </li>
+    <li>
+      To target all tabs of a user: set
+      <code>msg._client = { userId: "..." }</code> (no portalClient)
+    </li>
+    <li>
+      To broadcast to all: remove <code>msg._client</code>
+    </li>
+  </ul>
+
   <h3>Custom Head HTML</h3>
   <p>
     Inject CDN links, fonts, or extra stylesheets into
-    <code>&lt;head&gt;</code>. Example:
+    <code>&lt;head&gt;</code>. This is raw trusted-author HTML; scripts and
+    event handlers run in the public portal page. Example:
   </p>
   <pre>
-&lt;link href="https://fonts.googleapis.com/css2?family=Inter&display=swap" rel="stylesheet"&gt;</pre
+&lt;link href="https://fonts.googleapis.com/css2?family=Inter&amp;display=swap" rel="stylesheet"&gt;</pre
   >
+
+  <h3>WebSocket Status</h3>
+  <p>
+    Optional <em>fromcubes</em> badge in the bottom-right corner showing
+    connection state. Enable via the <strong>Show WebSocket status
+    indicator</strong> checkbox (off by default).
+  </p>
+</script>
+
+<!-- ── Assets sidebar tab ──────────────────────────────────────── -->
+<script type="text/javascript">
+(function () {
+  // Resolve httpNodeRoot for public URL prefix
+  const nodeRoot = (RED.settings.httpNodeRoot || "/").replace(/\/$/, "");
+  const publicBase = nodeRoot + "/fromcubes/public/";
+
+  /**
+   * Human-readable byte formatter for the assets sidebar.
+   * @param {number} bytes
+   * @returns {string}  e.g. `"42 B"`, `"3.2 KB"`, `"1.4 MB"`.
+   */
+  function formatSize(bytes) {
+    if (bytes < 1024) return bytes + " B";
+    if (bytes < 1024 * 1024) return (bytes / 1024).toFixed(1) + " KB";
+    return (bytes / (1024 * 1024)).toFixed(1) + " MB";
+  }
+
+  let allEntries = [];
+  const collapsed = {};
+
+  const content = $('<div class="red-ui-sidebar-info" style="height:100%;overflow:auto;padding:0;"></div>');
+  const fileList = $('<div style="padding:0;"></div>').appendTo(content);
+
+  // ── Toolbar ──
+  const toolbar = $('<div style="display:flex;align-items:center;gap:6px;margin:0 6px;padding:2px 0 0;"></div>');
+  const fileInput = $('<input type="file" multiple style="display:none;">').appendTo(toolbar);
+  $('<button class="red-ui-button red-ui-button-small" style="flex-shrink:0;"><i class="fa fa-upload"></i> Upload</button>')
+    .on("click", function (e) { e.preventDefault(); fileInput.trigger("click"); })
+    .appendTo(toolbar);
+  $('<button class="red-ui-button red-ui-button-small" style="flex-shrink:0;"><i class="fa fa-folder-open"></i> New folder</button>')
+    .on("click", function (e) { e.preventDefault(); showNewFolderInput(""); })
+    .appendTo(toolbar);
+
+  // ── Helpers ──
+  /**
+   * Linear scan over the most-recently-fetched asset list.
+   * @param {string} p   Relative path inside the assets root.
+   * @returns {boolean}
+   */
+  function pathExists(p) {
+    for (let i = 0; i < allEntries.length; i++) {
+      if (allEntries[i].name === p) return true;
+    }
+    return false;
+  }
+
+  /**
+   * POST one or more files to the upload endpoint. Prompts before
+   * overwriting existing paths. Each request is sent independently so
+   * an upstream failure of one file does not block the rest; the sidebar
+   * is refreshed once all responses have arrived.
+   * @param {FileList|Array<File>} files
+   * @param {string} targetDir   Relative directory inside the assets root
+   *                             (empty string for root).
+   * @returns {void}
+   */
+  function uploadFiles(files, targetDir) {
+    if (!files || files.length === 0) return;
+    let toUpload = [];
+    const duplicates = [];
+    for (let i = 0; i < files.length; i++) {
+      const uploadPath = targetDir ? targetDir + "/" + files[i].name : files[i].name;
+      if (pathExists(uploadPath)) {
+        duplicates.push({ file: files[i], path: uploadPath });
+      } else {
+        toUpload.push({ file: files[i], path: uploadPath });
+      }
+    }
+    if (duplicates.length > 0) {
+      const names = duplicates.map(function (d) { return d.file.name; }).join(", ");
+      if (confirm("These files already exist: " + names + "\nOverwrite?")) {
+        toUpload = toUpload.concat(duplicates);
+      }
+    }
+    if (toUpload.length === 0) return;
+    let pending = toUpload.length;
+    toUpload.forEach(function (item) {
+      const reader = new FileReader();
+      reader.onload = function () {
+        $.ajax({
+          type: "POST",
+          url: "portal-react/assets/upload/" + item.path.split("/").map(encodeURIComponent).join("/"),
+          data: new Uint8Array(reader.result),
+          contentType: "application/octet-stream",
+          processData: false,
+          success: function () { if (--pending === 0) refreshList(); },
+          error: function () {
+            RED.notify("Upload failed: " + item.file.name, "error");
+            if (--pending === 0) refreshList();
+          },
+        });
+      };
+      reader.readAsArrayBuffer(item.file);
+    });
+  }
+
+  fileInput.on("change", function () {
+    uploadFiles(this.files, "");
+    fileInput.val("");
+  });
+
+  // External file drag & drop on content area (root upload)
+  content.on("dragover", function (e) {
+    if (e.originalEvent.dataTransfer.types.indexOf("Files") >= 0) {
+      e.preventDefault();
+      e.stopPropagation();
+      content.css("background", "rgba(34,211,238,0.05)");
+    }
+  });
+  content.on("dragleave", function (e) {
+    e.preventDefault();
+    content.css("background", "");
+  });
+  content.on("drop", function (e) {
+    e.preventDefault();
+    e.stopPropagation();
+    content.css("background", "");
+    const dt = e.originalEvent.dataTransfer;
+    if (dt.files && dt.files.length > 0) {
+      uploadFiles(dt.files, "");
+    }
+  });
+
+  /**
+   * Move or rename an asset. Computes the new path from `fromPath`'s basename
+   * + `toDir`. No-ops when source and destination are equal. Prompts before
+   * overwriting an existing destination. Posts to the `move` admin endpoint
+   * (auth- and CSRF-gated server-side); the sidebar refreshes on success.
+   * @param {string} fromPath  Current relative path of the item.
+   * @param {string} toDir     Destination directory (empty string for root).
+   * @returns {void}
+   */
+  function moveItem(fromPath, toDir) {
+    const filename = fromPath.split("/").pop();
+    const newPath = toDir ? toDir + "/" + filename : filename;
+    if (fromPath === newPath) return;
+    if (pathExists(newPath)) {
+      if (!confirm("'" + filename + "' already exists in this folder. Overwrite?")) return;
+    }
+    $.ajax({
+      type: "POST", url: "portal-react/assets/move",
+      contentType: "application/json",
+      data: JSON.stringify({ from: fromPath, to: newPath }),
+      success: function () { refreshList(); },
+      error: function (xhr) {
+        const msg = xhr.responseJSON ? xhr.responseJSON.error : "move failed";
+        RED.notify("Move failed: " + msg, "error");
+      },
+    });
+  }
+
+  // ── Inline new-folder input ──
+  function showNewFolderInput(parentDir) {
+    const existingInput = fileList.find(".fc-new-folder-row");
+    if (existingInput.length) existingInput.remove();
+
+    const depth = parentDir ? parentDir.split("/").length : 0;
+    const indent = 8 + depth * 18;
+    const row = $('<div class="fc-new-folder-row" style="display:flex;align-items:center;gap:6px;padding:8px;border-bottom:1px solid var(--red-ui-secondary-border-color);background:var(--red-ui-tertiary-background);"></div>');
+    row.css("padding-left", indent + "px");
+    $('<i class="fa fa-folder" style="color:#fbbf24;font-size:13px;width:16px;text-align:center;"></i>').appendTo(row);
+    const inp = $('<input type="text" placeholder="folder name" class="red-ui-searchBox-input" style="flex:1;padding:3px 6px;font-size:12px;">');
+    inp.appendTo(row);
+    const okBtn = $('<button class="red-ui-button red-ui-button-small" style="color:var(--red-ui-text-color-success);" title="Create"><i class="fa fa-check"></i></button>');
+    const cancelBtn = $('<button class="red-ui-button red-ui-button-small" title="Cancel"><i class="fa fa-times"></i></button>');
+    function submit() {
+      const name = inp.val().trim();
+      if (!name) { row.remove(); return; }
+      const p = parentDir ? parentDir + "/" + name : name;
+      if (pathExists(p)) {
+        RED.notify("Folder '" + name + "' already exists", "warning");
+        return;
+      }
+      $.ajax({ type: "POST", url: "portal-react/assets/mkdir", contentType: "application/json", data: JSON.stringify({ path: p }),
+        success: function () { row.remove(); refreshList(); },
+        error: function () { RED.notify("Failed to create folder", "error"); },
+      });
+    }
+    okBtn.on("click", function (e) { e.preventDefault(); submit(); });
+    cancelBtn.on("click", function (e) { e.preventDefault(); row.remove(); });
+    inp.on("keydown", function (e) {
+      if (e.key === "Enter") submit();
+      if (e.key === "Escape") row.remove();
+    });
+    okBtn.appendTo(row);
+    cancelBtn.appendTo(row);
+
+    // Insert after the parent folder row, or at top
+    if (parentDir) {
+      const parentRow = fileList.find('[data-path="' + parentDir + '"]');
+      if (parentRow.length) { row.insertAfter(parentRow); } else { fileList.prepend(row); }
+    } else {
+      fileList.prepend(row);
+    }
+    inp.focus();
+  }
+
+  // ── Context menu (native Node-RED style) ──
+  let activeMenu = null;
+  function closeMenu() {
+    if (activeMenu) { activeMenu.remove(); activeMenu = null; }
+  }
+  $(document).on("click", closeMenu);
+
+  function showMenu(anchor, items) {
+    closeMenu();
+    const menu = $('<ul class="red-ui-menu red-ui-menu-dropdown" style="position:absolute;z-index:10000;display:block;"></ul>');
+    items.forEach(function (item) {
+      if (item.divider) {
+        menu.append('<li class="red-ui-menu-divider"></li>');
+        return;
+      }
+      const li = $('<li></li>');
+      const a = $('<a href="#"></a>');
+      if (item.danger) a.css("color", "var(--red-ui-text-color-error)");
+      a.append('<i class="fa ' + item.icon + '" style="width:18px;text-align:center;"></i> ');
+      a.append($('<span class="red-ui-menu-label"></span>').text(item.label));
+      a.on("click", function (e) {
+        e.preventDefault();
+        e.stopPropagation();
+        closeMenu();
+        item.action();
+      });
+      li.append(a);
+      menu.append(li);
+    });
+
+    $("body").append(menu);
+    activeMenu = menu;
+
+    // Position near the anchor
+    const off = anchor.offset();
+    let top = off.top + anchor.outerHeight() + 2;
+    let left = off.left - menu.outerWidth() + anchor.outerWidth();
+    if (left < 0) left = off.left;
+    if (top + menu.outerHeight() > $(window).height()) top = off.top - menu.outerHeight() - 2;
+    menu.css({ top: top, left: left });
+  }
+
+  const adminRoot = (RED.settings.httpAdminRoot || "/").replace(/\/$/, "");
+
+  function showRenameInput(rowEl, fullPath, currentName) {
+    const nameSpan = rowEl.find("span").filter(function () { return $(this).text() === currentName; }).first();
+    if (!nameSpan.length) return;
+    const origText = nameSpan.text();
+    const inp = $('<input type="text" class="red-ui-searchBox-input" style="flex:1;padding:3px 6px;font-size:12px;">').val(origText);
+    const okBtn = $('<button class="red-ui-button red-ui-button-small" style="color:var(--red-ui-text-color-success);" title="Save"><i class="fa fa-check"></i></button>');
+    const cancelBtn = $('<button class="red-ui-button red-ui-button-small" title="Cancel"><i class="fa fa-times"></i></button>');
+    const dotIdx = origText.lastIndexOf(".");
+    const hasExt = dotIdx > 0; // has extension (not hidden file)
+    const origExt = hasExt ? origText.slice(dotIdx) : "";
+
+    nameSpan.replaceWith(inp);
+    inp.after(cancelBtn).after(okBtn);
+    inp.focus();
+    // Select only the name part before extension
+    const el = inp[0];
+    if (hasExt && el.setSelectionRange) {
+      el.setSelectionRange(0, dotIdx);
+    } else {
+      inp.select();
+    }
+
+    function restore() {
+      okBtn.remove();
+      cancelBtn.remove();
+      inp.replaceWith($('<span style="flex:1;font-size:12px;word-break:break-all;"></span>').text(origText));
+    }
+    function submit() {
+      const newName = inp.val().trim();
+      if (!newName) {
+        RED.notify("Name cannot be empty", "warning");
+        return;
+      }
+      // Warn if extension changed or removed
+      if (hasExt) {
+        const newDot = newName.lastIndexOf(".");
+        const newExt = newDot > 0 ? newName.slice(newDot) : "";
+        if (newExt.toLowerCase() !== origExt.toLowerCase()) {
+          if (!confirm("Extension changed from '" + origExt + "' to '" + (newExt || "none") + "'. Continue?")) return;
+        }
+      }
+      if (newName === origText) { restore(); return; }
+      const parentDir = fullPath.indexOf("/") >= 0 ? fullPath.slice(0, fullPath.lastIndexOf("/")) : "";
+      const newPath = parentDir ? parentDir + "/" + newName : newName;
+      if (pathExists(newPath)) {
+        RED.notify("'" + newName + "' already exists", "warning");
+        return;
+      }
+      $.ajax({
+        type: "POST", url: "portal-react/assets/move",
+        contentType: "application/json",
+        data: JSON.stringify({ from: fullPath, to: newPath }),
+        success: function () { refreshList(); },
+        error: function (xhr) {
+          const msg = xhr.responseJSON ? xhr.responseJSON.error : "rename failed";
+          RED.notify("Rename failed: " + msg, "error");
+          restore();
+        },
+      });
+    }
+    okBtn.on("click", function (e) { e.preventDefault(); e.stopPropagation(); submit(); });
+    cancelBtn.on("click", function (e) { e.preventDefault(); e.stopPropagation(); restore(); });
+    inp.on("keydown", function (e) {
+      if (e.key === "Enter") submit();
+      if (e.key === "Escape") restore();
+    });
+  }
+
+  // ── Tree rendering ──
+  function buildTree(entries) {
+    // Build nested structure: { children: { name: { type, children, entry } } }
+    const root = { children: {} };
+    entries.forEach(function (e) {
+      const parts = e.name.split("/");
+      let node = root;
+      for (let i = 0; i < parts.length; i++) {
+        if (!node.children[parts[i]]) {
+          node.children[parts[i]] = { children: {} };
+        }
+        node = node.children[parts[i]];
+      }
+      node.entry = e;
+    });
+    return root;
+  }
+
+  const ROOT_KEY = "__root__";
+
+  function renderTree() {
+    fileList.empty();
+    const isOpen = !collapsed[ROOT_KEY];
+
+    // Root folder row — always visible
+    const rootRow = $('<div style="display:flex;align-items:center;gap:5px;padding:4px 8px;border-bottom:1px solid var(--red-ui-secondary-border-color);"></div>');
+    const rootArrow = $('<i class="fa ' + (isOpen ? 'fa-caret-down' : 'fa-caret-right') + '" style="color:var(--red-ui-secondary-text-color);font-size:11px;width:10px;text-align:center;cursor:pointer;"></i>');
+    rootArrow.on("click", function () { collapsed[ROOT_KEY] = isOpen; renderTree(); });
+    rootRow.append(rootArrow);
+    $('<i class="fa ' + (isOpen ? 'fa-folder-open' : 'fa-folder') + '" style="color:#fbbf24;font-size:12px;width:16px;text-align:center;"></i>').appendTo(rootRow);
+    $('<span style="flex:1;font-size:12px;cursor:pointer;opacity:0.8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;"></span>').text(publicBase.replace(/\/$/, ""))
+      .on("click", function () { collapsed[ROOT_KEY] = isOpen; renderTree(); })
+      .appendTo(rootRow);
+    fileList.append(rootRow);
+
+    if (!isOpen) return;
+
+    if (allEntries.length === 0) {
+      fileList.append($('<div style="padding:16px;color:var(--red-ui-secondary-text-color);text-align:center;">No files uploaded.<br><span style="font-size:11px;">Drop files here or click Upload.</span></div>'));
+      return;
+    }
+    const tree = buildTree(allEntries);
+    renderNode(tree, "", 1);
+  }
+
+  function renderNode(node, parentPath, depth) {
+    // Collect and sort: dirs first, then files
+    const names = Object.keys(node.children).sort(function (a, b) {
+      const aIsDir = node.children[a].entry && node.children[a].entry.type === "dir";
+      const bIsDir = node.children[b].entry && node.children[b].entry.type === "dir";
+      if (aIsDir && !bIsDir) return -1;
+      if (!aIsDir && bIsDir) return 1;
+      return a.localeCompare(b);
+    });
+
+    names.forEach(function (name) {
+      const child = node.children[name];
+      const e = child.entry;
+      if (!e) return;
+      const fullPath = e.name;
+      const indent = 8 + depth * 18;
+      const isDir = e.type === "dir";
+      const isOpen = !collapsed[fullPath];
+
+      const row = $('<div data-path="' + fullPath + '" style="display:flex;align-items:center;gap:5px;padding:4px 8px;border-bottom:1px solid var(--red-ui-secondary-border-color);"></div>');
+      row.css("padding-left", indent + "px");
+
+      if (isDir) {
+        // Expand/collapse arrow
+        const arrow = $('<i class="fa ' + (isOpen ? 'fa-caret-down' : 'fa-caret-right') + '" style="color:var(--red-ui-secondary-text-color);font-size:11px;width:10px;text-align:center;cursor:pointer;"></i>');
+        arrow.on("click", function (e) {
+          e.stopPropagation();
+          collapsed[fullPath] = isOpen;
+          renderTree();
+        });
+        row.append(arrow);
+        $('<i class="fa ' + (isOpen ? 'fa-folder-open' : 'fa-folder') + '" style="color:#fbbf24;font-size:12px;width:16px;text-align:center;"></i>').appendTo(row);
+        $('<span style="flex:1;font-size:12px;cursor:pointer;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;" title="' + fullPath + '"></span>').text(name)
+          .on("click", function () { collapsed[fullPath] = isOpen; renderTree(); })
+          .appendTo(row);
+
+        // Context menu trigger
+        const dirMenuBtn = $('<button class="red-ui-button red-ui-button-small" style="padding:1px 5px;"><i class="fa fa-ellipsis-v"></i></button>');
+        (function (fp, nm) {
+          dirMenuBtn.on("click", function (ev) {
+            ev.preventDefault();
+            ev.stopPropagation();
+            showMenu(dirMenuBtn, [
+              { icon: "fa-pencil", label: "Rename", action: function () {
+                showRenameInput(row, fp, nm);
+              }},
+              { icon: "fa-plus", label: "New subfolder", action: function () {
+                if (collapsed[fp]) { collapsed[fp] = false; renderTree(); }
+                setTimeout(function () { showNewFolderInput(fp); }, 50);
+              }},
+              { divider: true },
+              { icon: "fa-trash", label: "Delete folder", danger: true, action: function () {
+                if (!confirm("Delete folder '" + nm + "' and all contents?")) return;
+                $.ajax({
+                  type: "DELETE",
+                  url: "portal-react/assets/" + fp.split("/").map(encodeURIComponent).join("/"),
+                  success: function () { refreshList(); },
+                  error: function () { RED.notify("Delete failed", "error"); },
+                });
+              }},
+            ]);
+          });
+        })(fullPath, name);
+        dirMenuBtn.appendTo(row);
+
+        // Drop target
+        row.on("dragover", function (ev) {
+          ev.preventDefault();
+          ev.stopPropagation();
+          row.css("background", "rgba(251,191,36,0.08)");
+        });
+        row.on("dragleave", function () { row.css("background", ""); });
+        row.on("drop", function (ev) {
+          ev.preventDefault();
+          ev.stopPropagation();
+          row.css("background", "");
+          const srcPath = ev.originalEvent.dataTransfer.getData("text/x-asset-path");
+          if (srcPath) {
+            moveItem(srcPath, fullPath);
+          } else if (ev.originalEvent.dataTransfer.files && ev.originalEvent.dataTransfer.files.length > 0) {
+            uploadFiles(ev.originalEvent.dataTransfer.files, fullPath);
+          }
+        });
+        fileList.append(row);
+
+        // Render children if open
+        if (isOpen) {
+          renderNode(child, fullPath, depth + 1);
+        }
+      } else {
+        // File
+        row.attr("draggable", "true").css("cursor", "grab");
+        $('<span style="width:10px;"></span>').appendTo(row); // spacer for arrow alignment
+        $('<i class="fa fa-file-o" style="color:var(--red-ui-secondary-text-color);font-size:11px;width:16px;text-align:center;"></i>').appendTo(row);
+        $('<span style="flex:1;font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;" title="' + fullPath + '"></span>').text(name).appendTo(row);
+        $('<span style="font-size:10px;color:var(--red-ui-tertiary-text-color);white-space:nowrap;"></span>').text(formatSize(e.size)).appendTo(row);
+
+        row.on("dragstart", function (ev) {
+          ev.originalEvent.dataTransfer.setData("text/x-asset-path", fullPath);
+          ev.originalEvent.dataTransfer.effectAllowed = "move";
+          row.css("opacity", "0.4");
+        });
+        row.on("dragend", function () { row.css("opacity", "1"); });
+
+        const copyBtn = $('<button class="red-ui-button red-ui-button-small" style="padding:1px 5px;" title="Copy public path"><i class="fa fa-clipboard"></i></button>');
+        const fileMenuBtn = $('<button class="red-ui-button red-ui-button-small" style="padding:1px 5px;"><i class="fa fa-ellipsis-v"></i></button>');
+        (function (fp, nm) {
+          copyBtn.on("click", function (ev) {
+            ev.preventDefault();
+            ev.stopPropagation();
+            const url = publicBase + fp;
+            navigator.clipboard.writeText(url).then(function () {
+              RED.notify("Copied: " + url, { type: "success", timeout: 2000 });
+            });
+          });
+          fileMenuBtn.on("click", function (ev) {
+            ev.preventDefault();
+            ev.stopPropagation();
+            showMenu(fileMenuBtn, [
+              { icon: "fa-pencil", label: "Rename", action: function () {
+                showRenameInput(row, fp, nm);
+              }},
+              { icon: "fa-download", label: "Download", action: function () {
+                const a = document.createElement("a");
+                a.href = adminRoot + "/portal-react/assets/download/" + fp.split("/").map(encodeURIComponent).join("/");
+                a.download = nm;
+                document.body.appendChild(a);
+                a.click();
+                document.body.removeChild(a);
+              }},
+              { divider: true },
+              { icon: "fa-trash", label: "Delete", danger: true, action: function () {
+                $.ajax({
+                  type: "DELETE",
+                  url: "portal-react/assets/" + fp.split("/").map(encodeURIComponent).join("/"),
+                  success: function () { refreshList(); },
+                  error: function () { RED.notify("Delete failed: " + nm, "error"); },
+                });
+              }},
+            ]);
+          });
+        })(fullPath, name);
+        copyBtn.appendTo(row);
+        fileMenuBtn.appendTo(row);
+        fileList.append(row);
+      }
+    });
+  }
+
+  /**
+   * Re-fetch the assets listing from the admin API and re-render the tree.
+   * Called after every mutation (upload/move/delete/mkdir) and on the
+   * Node-RED `sidebar:resize` event.
+   * @returns {void}
+   */
+  function refreshList() {
+    $.getJSON("portal-react/assets", function (entries) {
+      allEntries = entries || [];
+      renderTree();
+    });
+  }
+
+  RED.sidebar.addTab({
+    id: "fromcubes-public",
+    label: "Portal Assets",
+    name: "fromcubes portal assets",
+    iconClass: "fa fa-desktop",
+    content: content[0],
+    toolbar: toolbar[0],
+    pinned: false,
+    enableOnEdit: true,
+  });
+
+  RED.actions.add("fromcubes:show-assets", function () {
+    RED.sidebar.show("fromcubes-public");
+  });
+
+  RED.events.on("sidebar:resize", function () { refreshList(); });
+  setTimeout(refreshList, 1000);
+})();
 </script>