@nodegx/preview 0.2.2 → 0.2.3

package/dist/noodl-preview.cjs

@@ -28738,6 +28738,198 @@ var init_resolveBackend = __esm({
   }
 });
 
+// ../noodl-runtime/src/api/backends/SessionStore.ts
+function ambientStorage() {
+  if (typeof localStorage === "undefined") return void 0;
+  return localStorage;
+}
+function ambientBroadcaster() {
+  if (typeof window === "undefined" || !window || typeof window.addEventListener !== "function") return void 0;
+  return window;
+}
+function parseSessionKey(appId) {
+  return "Parse/" + appId + "/currentUser";
+}
+function parseInstallationIdKey(appId) {
+  return "Parse/" + appId + "/installationId";
+}
+function parseSessionStore(appId) {
+  const cacheKey = String(appId);
+  let store = _parseStores.get(cacheKey);
+  if (store === void 0) {
+    store = new SessionStore({ key: parseSessionKey(appId) });
+    _parseStores.set(cacheKey, store);
+  }
+  return store;
+}
+var _tabCounter, SessionStore, _parseStores;
+var init_SessionStore = __esm({
+  "../noodl-runtime/src/api/backends/SessionStore.ts"() {
+    _tabCounter = 0;
+    SessionStore = class {
+      constructor(options) {
+        this.key = options.key;
+        this.lockKey = options.key + ".refresh-lock";
+        this.injectedStorage = options.storage;
+        this.injectedBroadcaster = options.broadcaster;
+        this.lockTtlMs = options.lockTtlMs !== void 0 ? options.lockTtlMs : 1e4;
+        this.now = options.now || Date.now;
+        this.tabId = options.tabId || "tab-" + ++_tabCounter + "-" + Math.random().toString(36).slice(2);
+      }
+      /**
+       * Resolved per access, not captured at construction.
+       *
+       * The code this replaced was a bare `localStorage[key]` evaluated on every
+       * request, so a page (or a suite) that swapped the global took effect
+       * immediately. Capturing it once would look identical until something did —
+       * and something does: `parse-wire-adapter.test.ts` replaces
+       * `globalThis.localStorage` between cases, and caching broke it. Found by
+       * running the suite that was not this task's.
+       */
+      get storage() {
+        if (this.injectedStorage !== void 0) return this.injectedStorage || void 0;
+        return ambientStorage();
+      }
+      get broadcaster() {
+        if (this.injectedBroadcaster !== void 0) return this.injectedBroadcaster || void 0;
+        return ambientBroadcaster();
+      }
+      /** False under SSR and in the cloud runtime. Nothing here throws when it is. */
+      get available() {
+        return this.storage !== void 0;
+      }
+      // ── The session ──────────────────────────────────────────────────────────
+      /** The stored text, or `undefined`. */
+      readRaw() {
+        const storage = this.storage;
+        if (!storage) return void 0;
+        const value2 = storage[this.key];
+        return value2 === void 0 || value2 === null ? void 0 : String(value2);
+      }
+      /**
+       * The stored session, or `undefined` when there is none *or it will not
+       * parse*.
+       *
+       * Unparseable is treated as absent rather than raised, which is what all four
+       * of the replaced call sites did — a corrupt entry must not stop an app from
+       * loading, and the user can always sign in again.
+       */
+      read() {
+        const raw = this.readRaw();
+        if (raw === void 0) return void 0;
+        try {
+          return JSON.parse(raw);
+        } catch (e) {
+          return void 0;
+        }
+      }
+      write(session) {
+        const storage = this.storage;
+        if (!storage) return;
+        storage[this.key] = JSON.stringify(session);
+      }
+      clear() {
+        const storage = this.storage;
+        if (!storage) return;
+        delete storage[this.key];
+      }
+      /**
+       * Read and write any key in the same storage, with the same absent-storage
+       * tolerance.
+       *
+       * Here for Parse's installation id, which lives beside the session under
+       * `Parse/<appId>/installationId` and is the only other thing `userservice.ts`
+       * kept in local storage. It is not session state, so it gets no method of its
+       * own — but it does need the SSR guard, and duplicating that guard is how the
+       * four copies above happened in the first place.
+       */
+      readKey(key) {
+        const storage = this.storage;
+        if (!storage) return void 0;
+        const value2 = storage[key];
+        return value2 === void 0 || value2 === null ? void 0 : String(value2);
+      }
+      writeKey(key, value2) {
+        const storage = this.storage;
+        if (!storage) return;
+        storage[key] = value2;
+      }
+      // ── Cross-tab ────────────────────────────────────────────────────────────
+      /**
+       * Hear about session changes made by **other** tabs.
+       *
+       * The `storage` event fires only in tabs that did not make the change, which
+       * is exactly the semantics wanted and is why this is preferred to
+       * `BroadcastChannel`: no echo to filter out, no availability question, and it
+       * comes free with the storage already in use.
+       *
+       * Returns an unsubscribe function. Returns a no-op one when there is no
+       * broadcaster, so callers never branch.
+       */
+      onExternalChange(handler) {
+        const broadcaster = this.broadcaster;
+        if (!broadcaster) return () => {
+        };
+        const listener = (event) => {
+          if (event && event.key !== null && event.key !== this.key) return;
+          handler(this.read());
+        };
+        broadcaster.addEventListener("storage", listener);
+        return () => broadcaster.removeEventListener("storage", listener);
+      }
+      /**
+       * Try to become the tab that refreshes.
+       *
+       * Read, write, **read back**. `localStorage` writes are serialised per origin,
+       * so in the racing case both tabs write and both read back and exactly one
+       * sees its own id — and the loser discovers that *before issuing any request*,
+       * because the whole sequence is synchronous with no `await` in it. That is
+       * what keeps the cost of a lost race at one tab doing nothing rather than two
+       * tabs spending the same rotating refresh token.
+       *
+       * It is not a mutex and BCN-006-LIFECYCLE-DESIGN §5 does not claim it is. The
+       * residual risk is a same-millisecond interleaving across processes on an
+       * implementation that does not serialise writes; the cost if it happens is one
+       * wasted refresh, and the follower's wait-then-adopt behaviour means the user
+       * still ends up with the session the winner wrote.
+       *
+       * **The lock expires.** A tab closed mid-refresh must not hold it forever —
+       * that would be worse than having no lock at all.
+       */
+      tryAcquireRefreshLock() {
+        const storage = this.storage;
+        if (!storage) return false;
+        const now = this.now();
+        const existing = this.readLock();
+        if (existing && existing.owner !== this.tabId && existing.expiresAt > now) return false;
+        storage[this.lockKey] = JSON.stringify({ owner: this.tabId, expiresAt: now + this.lockTtlMs });
+        const confirmed = this.readLock();
+        return confirmed !== void 0 && confirmed.owner === this.tabId;
+      }
+      /** Release only our own lock — never one another tab has since taken. */
+      releaseRefreshLock() {
+        const storage = this.storage;
+        if (!storage) return;
+        const existing = this.readLock();
+        if (existing && existing.owner !== this.tabId) return;
+        delete storage[this.lockKey];
+      }
+      readLock() {
+        const raw = this.readKey(this.lockKey);
+        if (raw === void 0) return void 0;
+        try {
+          const parsed = JSON.parse(raw);
+          if (!parsed || typeof parsed.owner !== "string" || typeof parsed.expiresAt !== "number") return void 0;
+          return parsed;
+        } catch (e) {
+          return void 0;
+        }
+      }
+    };
+    _parseStores = /* @__PURE__ */ new Map();
+  }
+});
+
 // ../nodegx-backend-contract/src/realtime.ts
 function nextReconnectDelay(attempt, timing = REALTIME_TIMING) {
   const n = Number.isFinite(attempt) && attempt > 0 ? Math.floor(attempt) : 0;
@@ -28898,6 +29090,7 @@ var DEFAULT_TIMING, DEFAULT_HOST, RealtimeSubscription;
 var init_RealtimeSubscription = __esm({
   "../noodl-runtime/src/api/backends/realtime/RealtimeSubscription.ts"() {
     init_resolveBackend_pure();
+    init_SessionStore();
     init_realtime2();
     DEFAULT_TIMING = REALTIME_TIMING;
     DEFAULT_HOST = {};
@@ -29138,9 +29331,20 @@ var init_RealtimeSubscription = __esm({
        * fallback.
        */
       get token() {
-        if (isParseWireType(this.handle.type)) return this.handle.sessionToken || "";
+        if (isParseWireType(this.handle.type)) return this.handle.sessionToken || this.storedSession() || "";
         return this.handle.sessionToken || this.handle.publicToken || "";
       }
+      /**
+       * 🔴 P121-TWO005-LIVEANON. The signed-in user's session, where a Parse-wire app keeps it: the session store, keyed by
+       * the app id in `publicToken` — the same place `ParseWireAdapter` reads it from for every request
+       * (`readStoredCurrentUser`). Nothing sets `handle.sessionToken` on this wire, so reading the handle alone made every
+       * subscription anonymous for a signed-in member, and a collection only members may read refused it ("denies find
+       * to anonymous") on every retry. SBR-011's arm passed a session ON THE HANDLE, which a real app never has.
+       */
+      storedSession() {
+        const stored = parseSessionStore(this.handle.publicToken).read();
+        return stored && typeof stored.sessionToken === "string" ? stored.sessionToken : "";
+      }
       _armDeadline(generation2) {
         this._clearTimer("_deadlineTimer");
         this._deadlineTimer = this._setTimeout(() => {
@@ -29684,12 +29888,11 @@ var init_SseTransport = __esm({
       helloEvent: "connected",
       changeEvents: () => ["change"],
       resyncEvent: "resync",
-      subscribeRequest(base, token, clientId, subscriptions) {
+      subscribeRequest(base, _token, clientId, subscriptions) {
         const body = subscriptions.map(
           (subscription) => subscription.where === void 0 ? { collection: subscription.collection } : { collection: subscription.collection, filter: subscription.where }
         );
         const headers = { "content-type": "application/json" };
-        if (token) headers["authorization"] = "Bearer " + token;
         return {
           url: base + "/realtime/subscriptions",
           init: {
@@ -31472,8 +31675,8 @@ var init_nodegx = __esm({
         // The header works. What it cannot do is make a file private on behalf of
         // nobody, and an author reading "supported" would not expect that.
         "files.private": degraded(
-          "A private upload is locked to the person who made it, so a file uploaded by anything other than a signed-in user \u2014 an admin tool, a cloud function \u2014 ends up private with no owner, and stays readable by everyone.",
-          "BCN-007 live, security enforced: uploaded as a signed-in user, the plain URL is 403 for anonymous AND for a second signed-in user. Uploaded with the master key, the identical request with X-NodeGX-File-Private: true serves 200 to anonymous \u2014 files.ts::upload sets owner=null for a non-user principal"
+          "A private upload is locked to the person who made it, so a file uploaded by anything other than a signed-in user \u2014 an admin tool, a cloud function \u2014 ends up private with no owner, and stays readable by everyone. Upload File's Readers names roles that may read it too, such as role:member; a file with Readers is never readable by everyone.",
+          "BCN-007 live, security enforced: uploaded as a signed-in user, the plain URL is 403 for anonymous AND for a second signed-in user. Uploaded with the master key, the identical request with X-NodeGX-File-Private: true serves 200 to anonymous \u2014 files.ts::upload sets owner=null for a non-user principal. P121-TWO001-MEMBERSPHOTO: X-NodeGX-File-Readers adds read-only role entries to the file's ACL; uploaded with the master key and role:crew, anonymous and a user without the role are 403 (files-http.test.ts)"
         ),
         "files.progress": supported("XHR upload path reports progress"),
         "auth.password": supported("nodegx-backend/src/server/users.ts"),
@@ -33207,198 +33410,6 @@ var init_AdapterEvents = __esm({
   }
 });
 
-// ../noodl-runtime/src/api/backends/SessionStore.ts
-function ambientStorage() {
-  if (typeof localStorage === "undefined") return void 0;
-  return localStorage;
-}
-function ambientBroadcaster() {
-  if (typeof window === "undefined" || !window || typeof window.addEventListener !== "function") return void 0;
-  return window;
-}
-function parseSessionKey(appId) {
-  return "Parse/" + appId + "/currentUser";
-}
-function parseInstallationIdKey(appId) {
-  return "Parse/" + appId + "/installationId";
-}
-function parseSessionStore(appId) {
-  const cacheKey = String(appId);
-  let store = _parseStores.get(cacheKey);
-  if (store === void 0) {
-    store = new SessionStore({ key: parseSessionKey(appId) });
-    _parseStores.set(cacheKey, store);
-  }
-  return store;
-}
-var _tabCounter, SessionStore, _parseStores;
-var init_SessionStore = __esm({
-  "../noodl-runtime/src/api/backends/SessionStore.ts"() {
-    _tabCounter = 0;
-    SessionStore = class {
-      constructor(options) {
-        this.key = options.key;
-        this.lockKey = options.key + ".refresh-lock";
-        this.injectedStorage = options.storage;
-        this.injectedBroadcaster = options.broadcaster;
-        this.lockTtlMs = options.lockTtlMs !== void 0 ? options.lockTtlMs : 1e4;
-        this.now = options.now || Date.now;
-        this.tabId = options.tabId || "tab-" + ++_tabCounter + "-" + Math.random().toString(36).slice(2);
-      }
-      /**
-       * Resolved per access, not captured at construction.
-       *
-       * The code this replaced was a bare `localStorage[key]` evaluated on every
-       * request, so a page (or a suite) that swapped the global took effect
-       * immediately. Capturing it once would look identical until something did —
-       * and something does: `parse-wire-adapter.test.ts` replaces
-       * `globalThis.localStorage` between cases, and caching broke it. Found by
-       * running the suite that was not this task's.
-       */
-      get storage() {
-        if (this.injectedStorage !== void 0) return this.injectedStorage || void 0;
-        return ambientStorage();
-      }
-      get broadcaster() {
-        if (this.injectedBroadcaster !== void 0) return this.injectedBroadcaster || void 0;
-        return ambientBroadcaster();
-      }
-      /** False under SSR and in the cloud runtime. Nothing here throws when it is. */
-      get available() {
-        return this.storage !== void 0;
-      }
-      // ── The session ──────────────────────────────────────────────────────────
-      /** The stored text, or `undefined`. */
-      readRaw() {
-        const storage = this.storage;
-        if (!storage) return void 0;
-        const value2 = storage[this.key];
-        return value2 === void 0 || value2 === null ? void 0 : String(value2);
-      }
-      /**
-       * The stored session, or `undefined` when there is none *or it will not
-       * parse*.
-       *
-       * Unparseable is treated as absent rather than raised, which is what all four
-       * of the replaced call sites did — a corrupt entry must not stop an app from
-       * loading, and the user can always sign in again.
-       */
-      read() {
-        const raw = this.readRaw();
-        if (raw === void 0) return void 0;
-        try {
-          return JSON.parse(raw);
-        } catch (e) {
-          return void 0;
-        }
-      }
-      write(session) {
-        const storage = this.storage;
-        if (!storage) return;
-        storage[this.key] = JSON.stringify(session);
-      }
-      clear() {
-        const storage = this.storage;
-        if (!storage) return;
-        delete storage[this.key];
-      }
-      /**
-       * Read and write any key in the same storage, with the same absent-storage
-       * tolerance.
-       *
-       * Here for Parse's installation id, which lives beside the session under
-       * `Parse/<appId>/installationId` and is the only other thing `userservice.ts`
-       * kept in local storage. It is not session state, so it gets no method of its
-       * own — but it does need the SSR guard, and duplicating that guard is how the
-       * four copies above happened in the first place.
-       */
-      readKey(key) {
-        const storage = this.storage;
-        if (!storage) return void 0;
-        const value2 = storage[key];
-        return value2 === void 0 || value2 === null ? void 0 : String(value2);
-      }
-      writeKey(key, value2) {
-        const storage = this.storage;
-        if (!storage) return;
-        storage[key] = value2;
-      }
-      // ── Cross-tab ────────────────────────────────────────────────────────────
-      /**
-       * Hear about session changes made by **other** tabs.
-       *
-       * The `storage` event fires only in tabs that did not make the change, which
-       * is exactly the semantics wanted and is why this is preferred to
-       * `BroadcastChannel`: no echo to filter out, no availability question, and it
-       * comes free with the storage already in use.
-       *
-       * Returns an unsubscribe function. Returns a no-op one when there is no
-       * broadcaster, so callers never branch.
-       */
-      onExternalChange(handler) {
-        const broadcaster = this.broadcaster;
-        if (!broadcaster) return () => {
-        };
-        const listener = (event) => {
-          if (event && event.key !== null && event.key !== this.key) return;
-          handler(this.read());
-        };
-        broadcaster.addEventListener("storage", listener);
-        return () => broadcaster.removeEventListener("storage", listener);
-      }
-      /**
-       * Try to become the tab that refreshes.
-       *
-       * Read, write, **read back**. `localStorage` writes are serialised per origin,
-       * so in the racing case both tabs write and both read back and exactly one
-       * sees its own id — and the loser discovers that *before issuing any request*,
-       * because the whole sequence is synchronous with no `await` in it. That is
-       * what keeps the cost of a lost race at one tab doing nothing rather than two
-       * tabs spending the same rotating refresh token.
-       *
-       * It is not a mutex and BCN-006-LIFECYCLE-DESIGN §5 does not claim it is. The
-       * residual risk is a same-millisecond interleaving across processes on an
-       * implementation that does not serialise writes; the cost if it happens is one
-       * wasted refresh, and the follower's wait-then-adopt behaviour means the user
-       * still ends up with the session the winner wrote.
-       *
-       * **The lock expires.** A tab closed mid-refresh must not hold it forever —
-       * that would be worse than having no lock at all.
-       */
-      tryAcquireRefreshLock() {
-        const storage = this.storage;
-        if (!storage) return false;
-        const now = this.now();
-        const existing = this.readLock();
-        if (existing && existing.owner !== this.tabId && existing.expiresAt > now) return false;
-        storage[this.lockKey] = JSON.stringify({ owner: this.tabId, expiresAt: now + this.lockTtlMs });
-        const confirmed = this.readLock();
-        return confirmed !== void 0 && confirmed.owner === this.tabId;
-      }
-      /** Release only our own lock — never one another tab has since taken. */
-      releaseRefreshLock() {
-        const storage = this.storage;
-        if (!storage) return;
-        const existing = this.readLock();
-        if (existing && existing.owner !== this.tabId) return;
-        delete storage[this.lockKey];
-      }
-      readLock() {
-        const raw = this.readKey(this.lockKey);
-        if (raw === void 0) return void 0;
-        try {
-          const parsed = JSON.parse(raw);
-          if (!parsed || typeof parsed.owner !== "string" || typeof parsed.expiresAt !== "number") return void 0;
-          return parsed;
-        } catch (e) {
-          return void 0;
-        }
-      }
-    };
-    _parseStores = /* @__PURE__ */ new Map();
-  }
-});
-
 // ../noodl-runtime/src/api/backends/fileRef.ts
 function jwtExpiry(token) {
   if (typeof token !== "string") return void 0;
@@ -33532,6 +33543,13 @@ function withStatus(err, status) {
   if (status !== void 0 && status > 0) envelope.status = status;
   return envelope;
 }
+function uploadHeaders(options) {
+  const headers = {};
+  if (options.private) headers["X-NodeGX-File-Private"] = "true";
+  const readers = typeof options.readers === "string" ? options.readers.trim() : "";
+  if (readers) headers["X-NodeGX-File-Readers"] = readers;
+  return Object.keys(headers).length ? headers : void 0;
+}
 function _removeProtectedFields(data, className) {
   const _data = Object.assign({}, data);
   _protectedFields._common.forEach((f) => delete _data[f]);
@@ -33949,10 +33967,10 @@ var init_ParseWireAdapter = __esm({
           content: options.file,
           // Dead — `_makeRequest` never reads `contentType`. See the module note.
           contentType: options.file.type,
-          // BAK-006 follow-up: the Upload File node's Private input. The backend
-          // reads this exact header (files.ts, case-insensitively) to ACL the
-          // upload to its owner instead of leaving it public.
-          headers: options.private ? { "X-NodeGX-File-Private": "true" } : void 0,
+          // BAK-006 follow-up: the Upload File node's Private input, and (P121
+          // MEMBERSPHOTO) its Readers. The backend reads these headers to ACL the
+          // upload to its owner, and to those roles, instead of leaving it public.
+          headers: uploadHeaders(options),
           // BCN-007 step 1. This used to be
           // `Object.assign({}, options.data, response)` cast to `{name, url}` —
           // whatever the backend sent, spread over a caller-supplied object no
@@ -95294,6 +95312,76 @@ var init_openfilepicker = __esm({
   }
 });
 
+// ../noodl-viewer-react/src/nodes/std-library/shrinkphoto.ts
+function shrunkSize(width, height, largestSide) {
+  const longer = Math.max(width, height);
+  if (!(largestSide > 0) || !(longer > largestSide)) return void 0;
+  const scale = largestSide / longer;
+  return {
+    width: Math.max(1, Math.round(width * scale)),
+    height: Math.max(1, Math.round(height * scale))
+  };
+}
+function shrunkType(type) {
+  return KEEPS_ITS_TYPE.has(type) ? type : "image/jpeg";
+}
+function isShrinkable(type) {
+  return typeof type === "string" && type.startsWith("image/") && !LEFT_ALONE.has(type);
+}
+function shrunkName(name2, fromType, toType) {
+  if (fromType === toType) return name2;
+  const ext = toType === "image/jpeg" ? "jpg" : toType.slice("image/".length);
+  const dot = name2.lastIndexOf(".");
+  return `${dot > 0 ? name2.slice(0, dot) : name2 || "photo"}.${ext}`;
+}
+function qualityOf(quality) {
+  const q = typeof quality === "number" && quality > 0 && quality <= 100 ? quality : DEFAULT_PHOTO_QUALITY;
+  return q / 100;
+}
+async function shrinkPhoto(file, options, ops = browserPhotoOps) {
+  if (!(options.largestSide > 0) || !isShrinkable(file.type)) return file;
+  let photo;
+  try {
+    photo = await ops.decode(file);
+    const size2 = shrunkSize(photo.width, photo.height, options.largestSide);
+    if (!size2) return file;
+    const type = shrunkType(file.type);
+    const blob = await ops.encode(photo, size2.width, size2.height, type, qualityOf(options.quality));
+    if (!blob || blob.size === 0 || blob.size >= file.size) return file;
+    return new File([blob], shrunkName(file.name, file.type, type), {
+      type,
+      lastModified: file.lastModified
+    });
+  } catch (_e) {
+    return file;
+  } finally {
+    if (photo && photo.close) photo.close();
+  }
+}
+var DEFAULT_PHOTO_QUALITY, KEEPS_ITS_TYPE, LEFT_ALONE, browserPhotoOps;
+var init_shrinkphoto = __esm({
+  "../noodl-viewer-react/src/nodes/std-library/shrinkphoto.ts"() {
+    DEFAULT_PHOTO_QUALITY = 80;
+    KEEPS_ITS_TYPE = /* @__PURE__ */ new Set(["image/png", "image/webp", "image/jpeg"]);
+    LEFT_ALONE = /* @__PURE__ */ new Set(["image/gif", "image/svg+xml"]);
+    browserPhotoOps = {
+      async decode(file) {
+        return createImageBitmap(file, { imageOrientation: "from-image" });
+      },
+      encode(photo, width, height, type, quality) {
+        const canvas = document.createElement("canvas");
+        canvas.width = width;
+        canvas.height = height;
+        const ctx = canvas.getContext("2d");
+        if (!ctx) return Promise.resolve(null);
+        ctx.imageSmoothingQuality = "high";
+        ctx.drawImage(photo, 0, 0, width, height);
+        return new Promise((resolve5) => canvas.toBlob(resolve5, type, quality));
+      }
+    };
+  }
+});
+
 // ../noodl-viewer-react/src/nodes/std-library/uploadfile.ts
 var uploadfile_exports = {};
 __export(uploadfile_exports, {
@@ -95314,6 +95402,7 @@ var init_uploadfile = __esm({
     init_schema_ports();
     init_fileRef();
     init_outcome();
+    init_shrinkphoto();
     UPLOAD_ERROR_CODE = "upload-file/upload-failed";
     UploadFile = {
       name: "Upload File",
@@ -95352,6 +95441,42 @@ var init_uploadfile = __esm({
             this._internal.private = value2;
           }
         },
+        // P121-TWO001-MEMBERSPHOTO: Private alone is the uploader's alone, and a feed shows every
+        // member's photos to every other member. `X-NodeGX-File-Readers` shares a private file with
+        // roles; the backend refuses a malformed list, or a role the uploader does not hold, in words.
+        readers: {
+          group: "General",
+          displayName: "Readers",
+          type: "string",
+          description: "Roles that may read the file as well as whoever uploaded it, such as role:member, separated by commas; setting it makes the file private. NodeGX backends only",
+          set(value2) {
+            this._internal.readers = value2;
+          }
+        },
+        // ── P121-TWO008-UPLOADSHRINK: Shrink Photos ──────────────────────────
+        //
+        // A phone photo is 3 to 8 MB, and the backend's thumbnails shrink what is served, not what
+        // is sent. Off unless set, so every existing graph sends exactly what it sent before.
+        shrinkTo: {
+          group: "Shrink Photos",
+          displayName: "Shrink To",
+          type: "number",
+          default: 0,
+          description: "Makes a photo smaller in the browser before sending it, so its longer side is at most this many pixels; 0 sends every file as picked",
+          set(value2) {
+            this._internal.shrinkTo = value2;
+          }
+        },
+        photoQuality: {
+          group: "Shrink Photos",
+          displayName: "Photo Quality",
+          type: "number",
+          default: 80,
+          description: "How much detail a shrunk JPEG or WebP keeps, from 1 to 100; PNG keeps every pixel and its transparency, GIF and SVG are never shrunk",
+          set(value2) {
+            this._internal.photoQuality = value2;
+          }
+        },
         // ── BCN-007 step 3: File Location ────────────────────────────────────
         //
         // ⚠️ **Two of the five backends cannot store a file without being told
@@ -95429,10 +95554,11 @@ var init_uploadfile = __esm({
               }
               const store = this.cloudStore([outcome]);
               if (!store) return;
-              store.uploadFile({
-                file,
+              const send = (sent) => store.uploadFile({
+                file: sent,
                 private: this._internal.private,
-                target: this.fileTarget(),
+                readers: this._internal.readers,
+                target: this.fileTarget(sent),
                 onUploadProgress: (p) => {
                   this._internal.progressTotal = p.total;
                   this._internal.progressLoaded = p.loaded;
@@ -95448,14 +95574,20 @@ var init_uploadfile = __esm({
                 // structurally rather than imported, because `cloudstore.js` is still
                 // JavaScript and declares this callback `unknown` (PLAT-006 residual).
                 success: (response) => {
-                  const sent = file && typeof file.name === "string" ? file.name : void 0;
-                  const filename = response.filename !== void 0 ? response.filename : sent;
+                  const sentName = sent && typeof sent.name === "string" ? sent.name : void 0;
+                  const filename = response.filename !== void 0 ? response.filename : sentName;
                   this._internal.cloudFile = new import_cloudfile.default(filename !== void 0 ? Object.assign({}, response, { filename }) : response);
                   this.flagOutputDirty("cloudFile");
                   this.reportOutcome(outcome, "done");
                 },
                 error: (e) => this.setError(e, [outcome])
               });
+              const shrinkTo = this._internal.shrinkTo;
+              if (typeof shrinkTo === "number" && shrinkTo > 0 && isShrinkable(file.type)) {
+                shrinkPhoto(file, { largestSide: shrinkTo, quality: this._internal.photoQuality }).then(send);
+              } else {
+                send(file);
+              }
             });
           }
         }
@@ -95603,8 +95735,9 @@ var init_uploadfile = __esm({
          * meaningful: a project has one backend selected, and only one of the two
          * backends reads either group.
          */
-        fileTarget() {
-          const { bucket, path: path8, collection, recordId, field, file } = this._internal;
+        fileTarget(sent) {
+          const { bucket, path: path8, collection, recordId, field } = this._internal;
+          const file = sent || this._internal.file;
           if (bucket) {
             return { kind: "bucket", bucket, path: path8 || file?.name || "" };
           }
@@ -111891,7 +112024,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@nodegx/preview",
-      version: "0.2.2",
+      version: "0.2.3",
       description: "Standalone live-preview harness: renders a NodeGX (OpenNoodl) v2 project in a browser with no editor process, and reloads it when the files on disk change.",
       license: "GPL-3.0-only",
       homepage: "https://nodegx.io",
@@ -111903,7 +112036,8 @@ var require_package = __commonJS({
       main: "src/index.ts",
       bin: {
         "noodl-preview": "./bin/noodl-preview.js",
-        "nodegx-deploy": "./bin/nodegx-deploy.js"
+        "nodegx-deploy": "./bin/nodegx-deploy.js",
+        preview: "./bin/noodl-preview.js"
       },
       files: [
         "bin",
@@ -149452,6 +149586,18 @@ var node_catalog_default = {
           isSignal: false,
           description: "Object path inside the bucket, such as avatars/me.png. Supabase only. Leave blank to use the file's own name"
         },
+        {
+          name: "photoQuality",
+          displayName: "Photo Quality",
+          group: "Shrink Photos",
+          plug: "input",
+          type: {
+            name: "number"
+          },
+          isSignal: false,
+          default: 80,
+          description: "How much detail a shrunk JPEG or WebP keeps, from 1 to 100; PNG keeps every pixel and its transparency, GIF and SVG are never shrunk"
+        },
         {
           name: "private",
           displayName: "Private",
@@ -149464,6 +149610,17 @@ var node_catalog_default = {
           default: false,
           description: "Restricts the stored file to whoever uploaded it, so reading it later needs a Sign File URL node"
         },
+        {
+          name: "readers",
+          displayName: "Readers",
+          group: "General",
+          plug: "input",
+          type: {
+            name: "string"
+          },
+          isSignal: false,
+          description: "Roles that may read the file as well as whoever uploaded it, such as role:member, separated by commas; setting it makes the file private. NodeGX backends only"
+        },
         {
           name: "recordId",
           displayName: "Record ID (PocketBase)",
@@ -149475,6 +149632,18 @@ var node_catalog_default = {
           isSignal: false,
           description: "Existing record to attach the file to. PocketBase only. Leave blank to create a new record as part of the upload"
         },
+        {
+          name: "shrinkTo",
+          displayName: "Shrink To",
+          group: "Shrink Photos",
+          plug: "input",
+          type: {
+            name: "number"
+          },
+          isSignal: false,
+          default: 0,
+          description: "Makes a photo smaller in the browser before sending it, so its longer side is at most this many pixels; 0 sends every file as picked"
+        },
         {
           name: "upload",
           displayName: "Upload",
@@ -149617,6 +149786,15 @@ var node_catalog_default = {
         private: [
           "always: held as handed; read when the next Upload goes"
         ],
+        readers: [
+          "always: held as handed; read when the next Upload goes \u2014 set, those roles may read the file as well as whoever uploaded it, and the file is private"
+        ],
+        shrinkTo: [
+          "always: held as handed; read when the next Upload goes \u2014 above 0, a photo (not a GIF or an SVG) is drawn smaller in the browser first, its longer side at most this many pixels, and the smaller file is what goes; it goes as picked when it is already that small, when the smaller one would weigh more, or when the browser cannot read it"
+        ],
+        photoQuality: [
+          "always: held as handed; read when the next Upload goes, and only when a photo is shrunk \u2014 1 to 100 for a JPEG or WebP, anything else is 80; a PNG keeps every pixel"
+        ],
         bucket: [
           "always: held as handed; read when the next Upload goes \u2014 set, the file goes to this bucket at Path (or under the file's own name)"
         ],
@@ -149633,7 +149811,7 @@ var node_catalog_default = {
           "always: held as handed; read when the next Upload goes, and only with Collection \u2014 a half-filled group is no location at all"
         ],
         upload: [
-          "always: its own upload at the frame's end \u2014 two presses are two uploads \u2014 with File, Private and the File Location held then: no File, or a Backend the project does not have, is Error, Error Status Code 0 and Failure at once; otherwise the backend answers with Cloud File then Done, or Error, Error Status Code and Failure"
+          "always: its own upload at the frame's end \u2014 two presses are two uploads \u2014 with File, Private, Readers and the File Location held then: no File, or a Backend the project does not have, is Error, Error Status Code 0 and Failure at once; otherwise the backend answers with Cloud File then Done, or Error, Error Status Code and Failure"
         ]
       }
     },
@@ -189893,7 +190071,10 @@ function exportNode(node) {
     id: node.id,
     type: node.type.name,
     version: node.version,
-    variant: node.variant ? node.variant.name : void 0,
+    // P123-S2-VARIANTLOST: `node.variant` is a lookup through the node library's registered modules, and a project
+    // that is not `ProjectModel.instance` (the kit's in-page preview, the headless render) is not one — the name the
+    // node wears is on the node itself, and the runtime looks the variant up by name.
+    variant: node.variant ? node.variant.name : node.variantName || void 0,
     parameters: clone(node.parameters),
     stateParameters: node.stateParameters ? clone(node.stateParameters) : void 0,
     stateTransitions: node.stateTransitions ? clone(node.stateTransitions) : void 0,