@nodegx/preview 0.2.5 → 0.2.6

package/dist/nodegx-deploy.cjs

@@ -18277,6 +18277,27 @@ var init_run_on_value_change = __esm({
   }
 });
 
+// ../noodl-runtime/src/tracecause.ts
+function currentTraceCause(context) {
+  const c = context;
+  return c && c.traceEnabled ? c._currentCause || 0 : 0;
+}
+function withTraceCause(context, cause, fn) {
+  const c = context;
+  if (!cause || !c || !c.traceEnabled) return fn();
+  const previous = c._currentCause;
+  c._currentCause = cause;
+  try {
+    return fn();
+  } finally {
+    c._currentCause = previous;
+  }
+}
+var init_tracecause = __esm({
+  "../noodl-runtime/src/tracecause.ts"() {
+  }
+});
+
 // ../noodl-runtime/src/outputproperty.ts
 var require_outputproperty = __commonJS({
   "../noodl-runtime/src/outputproperty.ts"(exports2, module2) {
@@ -18452,6 +18473,7 @@ var require_node2 = __commonJS({
     init_diagnostics();
     init_outcome();
     init_run_on_value_change();
+    init_tracecause();
     var OutputProperty = require_outputproperty();
     var NAN_INPUT_KEY = "node/nan-input/";
     var SIGNAL_PULSE = Object.freeze({ __noodlSignalPulse: true });
@@ -18964,6 +18986,8 @@ var require_node2 = __commonJS({
     });
     Node17.prototype.beginOutcome = function(inputData) {
       const token = { reported: void 0 };
+      const cause = currentTraceCause(this.context);
+      if (cause) token.cause = cause;
       const scope = this.nodeScope;
       const runContext = scope && scope.runContext;
       if (runContext && runContext.beginStep) {
@@ -18999,6 +19023,10 @@ var require_node2 = __commonJS({
         return;
       }
       token.reported = outcome;
+      const traceContext = this.context;
+      const tokenCause = token.cause;
+      const causeBefore = traceContext ? traceContext._currentCause : 0;
+      if (tokenCause && traceContext && traceContext.traceEnabled) traceContext._currentCause = tokenCause;
       this._raisingForOutcome = true;
       try {
         if (outcome === "failure" && !(options && options.raise === false)) {
@@ -19028,6 +19056,7 @@ var require_node2 = __commonJS({
         }
       } finally {
         this._raisingForOutcome = false;
+        if (tokenCause && traceContext && traceContext.traceEnabled) traceContext._currentCause = causeBefore;
       }
       const step = token.step;
       if (step !== void 0 && step !== null) {
@@ -19123,7 +19152,12 @@ var require_node2 = __commonJS({
       this.flagDirty();
     };
     Node17.prototype.scheduleAfterInputsHaveUpdated = function(callback) {
-      this._afterInputsHaveUpdatedCallbacks.push(callback);
+      const cause = currentTraceCause(this.context);
+      this._afterInputsHaveUpdatedCallbacks.push(
+        cause ? function() {
+          return withTraceCause(this.context, cause, () => callback.call(this));
+        } : callback
+      );
       this.flagDirty();
     };
     Node17.prototype.setNodeModel = function(nodeModel) {
@@ -19226,6 +19260,60 @@ var require_node2 = __commonJS({
   }
 });
 
+// ../nodegx-project-contract/renamed-ports.ts
+function renamedOutput(typeName4, port5) {
+  const renames = own.call(RENAMED_OUTPUTS, typeName4) ? RENAMED_OUTPUTS[typeName4] : void 0;
+  return renames && own.call(renames, port5) ? renames[port5] : void 0;
+}
+var RENAMED_OUTPUTS, own;
+var init_renamed_ports = __esm({
+  "../nodegx-project-contract/renamed-ports.ts"() {
+    "use strict";
+    RENAMED_OUTPUTS = {
+      AddDbModelRelation: { relationAdded: "done" },
+      Boolean: { stored: "completed" },
+      CloudFunction2: { success: "done" },
+      CollectionClear: { modified: "done" },
+      CollectionInsert: { modified: "done" },
+      CollectionNew: { created: "done" },
+      CollectionRemove: { modified: "done" },
+      Color: { stored: "completed" },
+      DeleteDbModelProperties: { deleted: "done" },
+      "Event Sender": { sent: "done" },
+      NavigationClosePopup: { success: "done" },
+      NewDbModelProperties: { created: "done" },
+      NewModel: { created: "done" },
+      Number: { stored: "completed" },
+      "Open File Picker": { success: "done", cancelled: "unchanged" },
+      PageStackNavigate: { navigated: "done" },
+      PageStackNavigateBack: { success: "done" },
+      PageStackNavigateToPath: { success: "done" },
+      RemoveDbModelRelation: { relationRemoved: "done" },
+      RouterNavigate: { navigated: "done" },
+      RunTasks: { success: "done" },
+      SetDbModelProperties: { stored: "done" },
+      SetModelProperties: { stored: "done" },
+      "Sign File URL": { success: "done" },
+      String: { stored: "completed" },
+      "Unique Id": { generated: "done" },
+      "Upload File": { success: "done" },
+      "net.noodl.HTTP": { success: "done" },
+      "net.noodl.SetComponentObjectProperties": { stored: "done" },
+      "net.noodl.SetParentComponentObjectProperties": { stored: "done" },
+      "net.noodl.externallink": { success: "done" },
+      "net.noodl.user.LogIn": { success: "done" },
+      "net.noodl.user.LogOut": { success: "done" },
+      "net.noodl.user.RequestMagicLink": { success: "done" },
+      "net.noodl.user.SetUserProperties": { success: "done" },
+      "net.noodl.user.SignInWith": { success: "done" },
+      "net.noodl.user.SignUp": { success: "done" },
+      "noodl.cloud.response": { sent: "done" },
+      "noodl.cloud.sendemail": { sent: "done", failed: "failure" }
+    };
+    own = Object.prototype.hasOwnProperty;
+  }
+});
+
 // ../noodl-runtime/src/guid.ts
 var require_guid = __commonJS({
   "../noodl-runtime/src/guid.ts"(exports2, module2) {
@@ -19243,6 +19331,7 @@ var require_guid = __commonJS({
 var require_nodescope = __commonJS({
   "../noodl-runtime/src/nodescope.ts"(exports2, module2) {
     "use strict";
+    init_renamed_ports();
     var guid5 = require_guid();
     function hasNode(map2, id) {
       return Object.prototype.hasOwnProperty.call(map2, id);
@@ -19275,11 +19364,15 @@ var require_nodescope = __commonJS({
         var sourceNode = this.getNodeWithId(connectionData.sourceId), targetNode = this.getNodeWithId(connectionData.targetId);
         targetNode.registerInputIfNeeded(connectionData.targetPort);
         sourceNode.registerOutputIfNeeded(connectionData.sourcePort);
-        targetNode.connectInput(connectionData.targetPort, sourceNode, connectionData.sourcePort);
+        targetNode.connectInput(connectionData.targetPort, sourceNode, sourcePortOf(sourceNode, connectionData.sourcePort));
       } catch (e) {
         console.error(e.message);
       }
     };
+    function sourcePortOf(sourceNode, port5) {
+      if (sourceNode.hasOutput(port5)) return port5;
+      return renamedOutput(sourceNode.name, port5) ?? port5;
+    }
     NodeScope.prototype.setNodeParameters = function(node, nodeModel) {
       const variant = this.context.variants.getVariant(nodeModel.type, nodeModel.variant);
       if (variant) {
@@ -19287,10 +19380,10 @@ var require_nodescope = __commonJS({
       } else {
         const parameters = nodeModel.parameters;
         var inputNames = Object.keys(parameters);
-        const RUN_ON_CHANGE_PREFIX3 = "runOnChange-";
+        const RUN_ON_CHANGE_PREFIX4 = "runOnChange-";
         const metadata = this.context.nodeRegister.hasNode(node.name) ? this.context.nodeRegister.getNodeMetadata(node.name) : void 0;
         const priorityOf = function(name2) {
-          if (name2.indexOf(RUN_ON_CHANGE_PREFIX3) === 0) return Number.MAX_SAFE_INTEGER;
+          if (name2.indexOf(RUN_ON_CHANGE_PREFIX4) === 0) return Number.MAX_SAFE_INTEGER;
           const input2 = metadata ? metadata.inputs[name2] : void 0;
           return input2 ? input2.inputPriority : 0;
         };
@@ -19464,7 +19557,9 @@ var require_nodescope = __commonJS({
     };
     NodeScope.prototype.removeConnection = function(connectionModel) {
       var targetNode = this.getNodeWithId(connectionModel.targetId);
-      targetNode.removeInputConnection(connectionModel.targetPort, connectionModel.sourceId, connectionModel.sourcePort);
+      const sourceNode = this.hasNodeWithId(connectionModel.sourceId) ? this.getNodeWithId(connectionModel.sourceId) : void 0;
+      const sourcePort = sourceNode ? sourcePortOf(sourceNode, connectionModel.sourcePort) : connectionModel.sourcePort;
+      targetNode.removeInputConnection(connectionModel.targetPort, connectionModel.sourceId, sourcePort);
     };
     NodeScope.prototype.setComponentModel = async function(componentModel) {
       this.componentModel = componentModel;
@@ -27078,7 +27173,9 @@ var init_function_ports = __esm({
     INPUT_PATTERNS = [/Inputs\.([A-Za-z0-9_]+)/g, /Inputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]/g];
     SIGNAL_PATTERNS = [
       /Outputs\.([A-Za-z0-9_]+)\s*\(\s*\)/g,
-      /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\(\s*\)/g
+      /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\(\s*\)/g,
+      /Outputs\.([A-Za-z0-9_]+)\.send\s*\(\s*\)/g,
+      /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\.send\s*\(\s*\)/g
     ];
     OUTPUT_PATTERNS = [/Outputs\.([A-Za-z0-9_]+)/g, /Outputs\s*\[\s*"([^"]*)"\s*\]/g];
     REGEX_AFTER = /* @__PURE__ */ new Set(["(", ",", "=", ":", "[", "!", "&", "|", "?", "{", "}", ";", "+", "-", "*", "%", "<", ">", "~", "^"]);
@@ -27095,6 +27192,7 @@ var require_simplejavascript = __commonJS({
     init_functionDiagnostics();
     init_scriptfiles();
     init_function_ports();
+    init_tracecause();
     var Node17 = require_node2();
     var JavascriptNodeParser4 = require_javascriptnodeparser();
     var { logJavaScriptNodeError: logJavaScriptNodeError2, thrownMessage: thrownMessage3 } = (init_utils(), __toCommonJS(utils_exports));
@@ -27464,11 +27562,12 @@ var require_simplejavascript = __commonJS({
           }
           const inputs = this._internal.inputValues;
           const outputs2 = this._internal.outputValuesProxy;
+          const runCause = currentTraceCause(this.context);
           placingSignalPorts(this).forEach((key) => {
             const _sendSignal = () => {
               this._internal.outputWrites.add(key.substring("out-".length));
               publishHeldWrites(this);
-              if (this.hasOutput(key)) this.sendSignalOnOutput(key);
+              if (this.hasOutput(key)) withTraceCause(this.context, runCause, () => this.sendSignalOnOutput(key));
             };
             const signalValue = _sendSignal;
             signalValue.send = _sendSignal;
@@ -27493,7 +27592,7 @@ var require_simplejavascript = __commonJS({
                 this._internal.lastError = "";
                 this.flagOutputDirty("error");
               }
-              this.sendSignalOnOutput("success");
+              withTraceCause(this.context, runCause, () => this.sendSignalOnOutput("success"));
               reportOutcomes(this, tokens, "done");
             }
           } catch (e) {
@@ -35613,6 +35712,466 @@ var init_TokenLifecycle = __esm({
   }
 });
 
+// ../noodl-runtime/src/api/backends/ParseAuthAdapter.ts
+function pageSays(response, phrase) {
+  return typeof response === "string" && response.indexOf(phrase) !== -1;
+}
+function htmlPageError(error, invalidPhrase, invalidMessage, fallback) {
+  if (typeof error !== "string" || error.indexOf("<") === -1) return error || fallback;
+  return error.indexOf(invalidPhrase) !== -1 ? invalidMessage : fallback;
+}
+function sessionTokenOf(session) {
+  return session ? session.sessionToken : void 0;
+}
+var guid, HANDOFF_PARAM, AUTH_ERROR_PARAM, SESSION_MOVED_MESSAGE, ParseAuthAdapter;
+var init_ParseAuthAdapter = __esm({
+  "../noodl-runtime/src/api/backends/ParseAuthAdapter.ts"() {
+    init_AuthEvents();
+    init_SessionStore();
+    init_TokenLifecycle();
+    guid = require_guid();
+    HANDOFF_PARAM = "nodegx_auth";
+    AUTH_ERROR_PARAM = "nodegx_auth_error";
+    SESSION_MOVED_MESSAGE = "Someone signed in or out while this was being checked, so its answer was not used. Check again.";
+    ParseAuthAdapter = class extends AuthEvents {
+      constructor(options) {
+        super();
+        /** BAK-004: the state of a sign-in returning from a provider or a magic link. */
+        this.oauthReturn = { inProgress: false };
+        /**
+         * One store and one controller per backend, keyed by application id.
+         *
+         * Per handle rather than per adapter because the contract's whole point is
+         * that a project may have more than one backend, and two backends have two
+         * sessions — the phase decided explicitly that they are never shared.
+         */
+        this.stores = /* @__PURE__ */ new Map();
+        this.controllers = /* @__PURE__ */ new Map();
+        this.serializeObject = options.serializeObject;
+        this.createStore = options.createStore || parseSessionStore;
+        this.lifecycle = options.lifecycle || { kind: "eternal" };
+      }
+      // ── Session storage ──────────────────────────────────────────────────────
+      sessionStore(handle) {
+        const appId = handle.publicToken;
+        const cacheKey = String(appId);
+        let store2 = this.stores.get(cacheKey);
+        if (store2 === void 0) {
+          store2 = this.createStore(appId);
+          this.stores.set(cacheKey, store2);
+        }
+        return store2;
+      }
+      /**
+       * The lifecycle controller for this backend.
+       *
+       * On Parse this is an `eternal` controller: it arms no timer, subscribes to no
+       * storage events, and its gate is a synchronous pass-through. It is on the
+       * request path anyway, so that BCN-004 adds a `performRefresh` rather than a
+       * call site.
+       */
+      lifecycleController(handle) {
+        const cacheKey = String(handle.publicToken);
+        let controller = this.controllers.get(cacheKey);
+        if (controller === void 0) {
+          controller = new TokenLifecycleController({
+            lifecycle: this.lifecycle,
+            store: this.sessionStore(handle),
+            onSessionLost: (reason) => {
+              this.emitAuthEvent("sessionChanged", void 0);
+              this.emitAuthEvent("sessionLost", reason);
+            },
+            onSessionClearedElsewhere: () => {
+              this.emitAuthEvent("sessionChanged", void 0);
+              this.emitAuthEvent("loggedOut");
+            }
+          });
+          controller.start();
+          this.controllers.set(cacheKey, controller);
+        }
+        return controller;
+      }
+      /** The stored session, or `undefined`. Not a contract method. */
+      getCurrentUser(handle) {
+        return this.sessionStore(handle).read();
+      }
+      setSession(handle, session) {
+        this.sessionStore(handle).write(session);
+        this.lifecycleController(handle).sessionChanged();
+        this.emitAuthEvent("sessionChanged", session);
+      }
+      clearSession(handle) {
+        this.sessionStore(handle).clear();
+        this.lifecycleController(handle).sessionChanged();
+        this.emitAuthEvent("sessionChanged", void 0);
+      }
+      // ── The wire ─────────────────────────────────────────────────────────────
+      /**
+       * The Parse auth seam. Moved from `userservice.ts:198` with one substitution:
+       * `this.endpoint`/`this.appId` became `handle.url`/`handle.publicToken`.
+       *
+       * It is deliberately *not* `ParseWireAdapter._makeRequest`. The two differ in
+       * three ways that all matter: this one sends `X-Parse-Installation-Id`, never
+       * sends a master key, and hands its error callback Parse's `code` (the `209`
+       * the session check turns on). Merging them would be a rewrite in a task
+       * whose value is that nothing was rewritten.
+       */
+      _makeRequest(handle, path10, options) {
+        if (!handle.url) {
+          if (options.error) {
+            options.error({ error: "No active cloud service", status: 0 });
+          }
+          return;
+        }
+        const store2 = this.sessionStore(handle);
+        this.lifecycleController(handle).withSession((session) => {
+          const xhr = new XMLHttpRequest();
+          xhr.onreadystatechange = function() {
+            if (xhr.readyState === 4) {
+              let json2;
+              try {
+                json2 = JSON.parse(xhr.response);
+              } catch (e) {
+              }
+              if (xhr.status === 200 || xhr.status === 201) {
+                options.success(json2 || xhr.response);
+              } else options.error(json2 || { error: xhr.responseText, status: xhr.status });
+            }
+          };
+          xhr.open(options.method || "GET", handle.url + path10, true);
+          xhr.setRequestHeader("X-Parse-Application-Id", handle.publicToken);
+          const iidKey = parseInstallationIdKey(handle.publicToken);
+          let _iid = store2.readKey(iidKey);
+          if (_iid === void 0) {
+            _iid = guid();
+            store2.writeKey(iidKey, _iid);
+          }
+          xhr.setRequestHeader("X-Parse-Installation-Id", _iid);
+          if (options.sessionToken) xhr.setRequestHeader("X-Parse-Session-Token", options.sessionToken);
+          else if (session !== void 0) {
+            xhr.setRequestHeader("X-Parse-Session-Token", session.sessionToken);
+          }
+          xhr.setRequestHeader("Content-Type", "application/json");
+          xhr.send(JSON.stringify(options.content));
+        });
+      }
+      // ── The ten ──────────────────────────────────────────────────────────────
+      logIn(handle, options) {
+        this._makeRequest(handle, "/login", {
+          method: "POST",
+          content: {
+            username: options.username,
+            password: options.password,
+            _method: "GET"
+          },
+          success: (response) => {
+            this.setSession(handle, response);
+            options.success(response);
+            this.emitAuthEvent("loggedIn", response);
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      logOut(handle, options) {
+        this._makeRequest(handle, "/logout", {
+          method: "POST",
+          content: {},
+          success: () => {
+            this.clearSession(handle);
+            options.success();
+            this.emitAuthEvent("loggedOut");
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      signUp(handle, options) {
+        const additionalUserProps = options.properties ? this.serializeObject({ ...options.properties }, "_User") : {};
+        this._makeRequest(handle, "/users", {
+          method: "POST",
+          content: Object.assign({}, additionalUserProps, {
+            username: options.username,
+            password: options.password,
+            email: options.email
+          }),
+          success: (response) => {
+            const identity2 = { username: options.username };
+            if (options.email !== void 0) identity2.email = options.email;
+            const _cu = Object.assign(response, identity2, options.properties);
+            if (_cu.emailVerified === void 0) _cu.emailVerified = false;
+            this.setSession(handle, _cu);
+            options.success(response);
+            this.emitAuthEvent("loggedIn", _cu);
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      fetchCurrentUser(handle, options) {
+        const asked = sessionTokenOf(this.getCurrentUser(handle));
+        this._makeRequest(handle, "/users/me", {
+          method: "GET",
+          sessionToken: options.sessionToken,
+          success: (response) => {
+            if (sessionTokenOf(this.getCurrentUser(handle)) !== asked) {
+              options.error(SESSION_MOVED_MESSAGE);
+              return;
+            }
+            this.setSession(handle, response);
+            this.emitAuthEvent("sessionGained", response);
+            options.success(response);
+          },
+          error: (e) => {
+            if (sessionTokenOf(this.getCurrentUser(handle)) !== asked) {
+              options.error(SESSION_MOVED_MESSAGE);
+              return;
+            }
+            if (e.code === 209) {
+              this.sessionStore(handle).clear();
+              this.emitAuthEvent("sessionLost");
+            }
+            options.error(e.error);
+          }
+        });
+      }
+      verifyEmail(handle, options) {
+        this._makeRequest(
+          handle,
+          "/apps/" + handle.publicToken + "/verify_email?username=" + options.username + "&token=" + options.token,
+          {
+            method: "GET",
+            // This endpoint answers with an HTML page rather than JSON, so the outcome has to be
+            // read out of the page's text.
+            success: (response) => {
+              if (pageSays(response, "Successfully verified your email")) {
+                options.success();
+              } else if (pageSays(response, "Invalid Verification Link")) {
+                options.error("Invalid verification token");
+              } else {
+                options.error("Failed to verify email");
+              }
+            },
+            error: (e) => {
+              options.error(htmlPageError(e.error, "Invalid Verification Link", "Invalid verification token", "Failed to verify email"));
+            }
+          }
+        );
+      }
+      sendEmailVerification(handle, options) {
+        this._makeRequest(handle, "/verificationEmailRequest", {
+          method: "POST",
+          content: { email: options.email },
+          success: () => {
+            options.success();
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      resetPassword(handle, options) {
+        this._makeRequest(handle, "/apps/" + handle.publicToken + "/request_password_reset", {
+          method: "POST",
+          content: {
+            username: options.username,
+            token: options.token,
+            new_password: options.newPassword
+          },
+          success: (response) => {
+            if (pageSays(response, "Password successfully reset") || pageSays(response, "Successfully updated your password")) {
+              options.success();
+            } else if (pageSays(response, "Invalid Link")) {
+              options.error("Invalid or expired reset link");
+            } else {
+              options.error("Failed to reset password");
+            }
+          },
+          error: (e) => {
+            options.error(htmlPageError(e.error, "Invalid Link", "Invalid or expired reset link", "Failed to reset password"));
+          }
+        });
+      }
+      requestPasswordReset(handle, options) {
+        this._makeRequest(handle, "/requestPasswordReset", {
+          method: "POST",
+          content: { email: options.email },
+          success: () => {
+            options.success();
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      /**
+       * Send the browser to a provider. This NAVIGATES AWAY: nothing after it runs,
+       * and the result arrives on a later page load through {@link consumeAuthReturn}.
+       *
+       * `redirect` defaults to the current page (minus any leftover sign-in
+       * parameters), so the user comes back where they were. The backend refuses
+       * any target that is neither same-origin nor on its `redirectAllowList` — if
+       * sign-in dead-ends with "origin not allowed", that list is the fix.
+       */
+      signInWithProvider(handle, options) {
+        if (!handle.url) {
+          if (options.error) options.error("No active cloud service");
+          return;
+        }
+        if (!options.provider) {
+          if (options.error) options.error("Sign In With: no provider was set.");
+          return;
+        }
+        const redirect = options.redirect || this._currentUrlWithoutAuthParams();
+        const url = `${handle.url}/oauth/${encodeURIComponent(options.provider)}/start?redirect=${encodeURIComponent(redirect)}`;
+        window.location.href = url;
+      }
+      /**
+       * Ask the backend to email a one-click sign-in link.
+       *
+       * Succeeds identically for a known and an unknown address — the endpoint is
+       * anonymous and anti-enumerating by design, so "success" here means "the
+       * request was accepted", never "an account exists". The node's help text says
+       * so, because a UI that claims "check your inbox" only for real accounts
+       * re-creates the oracle the endpoint removed.
+       */
+      requestMagicLink(handle, options) {
+        this._makeRequest(handle, "/auth/magic-link", {
+          method: "POST",
+          content: { email: options.email, redirect: options.redirect || this._currentUrlWithoutAuthParams() },
+          success: () => options.success(),
+          error: (e) => options.error(e.error)
+        });
+      }
+      // ── Not contract, and deliberately so ────────────────────────────────────
+      /**
+       * Write user-profile fields onto the signed-in user.
+       *
+       * Not one of the ten. It is the `Set User Properties` node's whole
+       * implementation, and BCN-006's Desired State §3 makes it schema-driven across
+       * five backends — which is step 6, not this pass. It moves with the wire
+       * because leaving it behind would have left a second `_makeRequest` in
+       * `userservice.ts`, and the entire claim of this move is that there is one.
+       */
+      setUserProperties(handle, options) {
+        const _cu = this.getCurrentUser(handle);
+        if (_cu === void 0) {
+          options.error("Nobody is signed in.");
+          return;
+        }
+        {
+          const propsToSave = this.serializeObject({ ...options.properties }, "_User");
+          const _content = Object.assign(
+            {},
+            { email: options.email, username: options.username },
+            propsToSave
+          );
+          delete _content.emailVerified;
+          delete _content.createdAt;
+          delete _content.updatedAt;
+          this._makeRequest(handle, "/users/" + _cu.objectId, {
+            method: "PUT",
+            content: _content,
+            success: (response) => {
+              Object.assign(_cu, _content);
+              this.setSession(handle, _cu);
+              options.success(response);
+            },
+            error: (e) => {
+              options.error(e.error);
+            }
+          });
+        }
+      }
+      /** The sign-in methods this backend offers — for rendering a set of buttons. */
+      listAuthProviders(handle, options) {
+        this._makeRequest(handle, "/auth/providers", {
+          method: "GET",
+          success: (response) => options.success(response),
+          error: (e) => options.error(e.error)
+        });
+      }
+      // ── BAK-004 — the provider return leg ────────────────────────────────────
+      /**
+       * Look for a sign-in result in the current URL and act on it.
+       *
+       * Returns true when this page load IS a sign-in return, so the caller can skip
+       * its ordinary stale-session validation.
+       *
+       * **Per backend, not contract.** BCN-006 step 5 is four different redirect
+       * shapes — Parse `authData`, Directus SSO, Supabase, PocketBase
+       * `auth-with-oauth2` — and this is the first of the four. What they have in
+       * common is only the *outcome*: a session, established. That is where the
+       * contract's surface is, and it is `signInWithProvider` plus a `loggedIn`.
+       */
+      consumeAuthReturn(handle) {
+        if (typeof window === "undefined" || !window.location) return false;
+        let params;
+        try {
+          params = new URLSearchParams(window.location.search);
+        } catch (e) {
+          return false;
+        }
+        const code = params.get(HANDOFF_PARAM);
+        const error = params.get(AUTH_ERROR_PARAM);
+        if (!code && !error) return false;
+        params.delete(HANDOFF_PARAM);
+        params.delete(AUTH_ERROR_PARAM);
+        this._stripAuthParamsFromUrl(params);
+        if (error) {
+          this.oauthReturn = { inProgress: false, succeeded: false, error };
+          setTimeout(() => this.emitAuthEvent("oauthReturn", this.oauthReturn), 0);
+          return true;
+        }
+        this.oauthReturn = { inProgress: true };
+        this._makeRequest(handle, "/oauth/exchange", {
+          method: "POST",
+          content: { code },
+          success: (response) => {
+            this.setSession(handle, response);
+            this.oauthReturn = {
+              inProgress: false,
+              succeeded: true,
+              outcome: response.authOutcome,
+              notice: response.authNotice || void 0
+            };
+            this.emitAuthEvent("oauthReturn", this.oauthReturn);
+            this.emitAuthEvent("loggedIn", response);
+          },
+          error: (e) => {
+            this.oauthReturn = {
+              inProgress: false,
+              succeeded: false,
+              error: e && e.error || "Sign-in could not be completed."
+            };
+            this.emitAuthEvent("oauthReturn", this.oauthReturn);
+          }
+        });
+        return true;
+      }
+      /** Rewrite the address bar without the sign-in parameters, keeping everything else. */
+      _stripAuthParamsFromUrl(remaining) {
+        if (!window.history || typeof window.history.replaceState !== "function") return;
+        const query2 = remaining.toString();
+        const cleaned = window.location.pathname + (query2 ? `?${query2}` : "") + window.location.hash;
+        try {
+          window.history.replaceState(window.history.state, "", cleaned);
+        } catch (e) {
+        }
+      }
+      _currentUrlWithoutAuthParams() {
+        const url = new URL(window.location.href);
+        url.searchParams.delete(HANDOFF_PARAM);
+        url.searchParams.delete(AUTH_ERROR_PARAM);
+        return url.toString();
+      }
+    };
+  }
+});
+
 // ../noodl-runtime/src/api/backends/RestAuthAdapter.ts
 function restAuthProfileFor(type) {
   return PROFILES[type];
@@ -35704,6 +36263,7 @@ var init_RestAuthAdapter = __esm({
   "../noodl-runtime/src/api/backends/RestAuthAdapter.ts"() {
     init_src();
     init_AuthEvents();
+    init_ParseAuthAdapter();
     init_SessionStore();
     init_TokenLifecycle();
     DEFAULT_POCKETBASE_USER_COLLECTION = "users";
@@ -36269,12 +36829,20 @@ var init_RestAuthAdapter = __esm({
           { method, path: this.path(profile, profile.me), token, body: method === "POST" ? {} : void 0 },
           {
             ok: (body) => {
+              if (sessionTokenOf(this.getCurrentUser(handle)) !== sessionTokenOf(stored)) {
+                options.error(SESSION_MOVED_MESSAGE);
+                return;
+              }
               const session = this.readSession(profile, body, Object.assign({}, stored, { sessionToken: token })) ?? Object.assign({}, stored, this.readUser(profile, body), { sessionToken: token });
               this.setSession(handle, session);
               this.emitAuthEvent("sessionGained", session);
               options.success(session);
             },
             fail: (error) => {
+              if (sessionTokenOf(this.getCurrentUser(handle)) !== sessionTokenOf(stored)) {
+                options.error(SESSION_MOVED_MESSAGE);
+                return;
+              }
               if (error.status === 401 || error.status === 403) {
                 this.sessionStore(handle).clear();
                 this.emitAuthEvent("sessionLost", error.error);
@@ -38775,8 +39343,9 @@ function schemaFor(collectionName2) {
   try {
     collection = CloudStore._collections[collectionName2];
   } catch (e) {
-    return void 0;
+    collection = void 0;
   }
+  if (!collection) collection = hostCollection(collectionName2);
   if (!collection) return void 0;
   if (collection.schema) return { collection: collectionName2, properties: collection.schema.properties };
   if (Array.isArray(collection.columns)) {
@@ -38790,6 +39359,15 @@ function schemaFor(collectionName2) {
   }
   return void 0;
 }
+function hostCollection(collectionName2) {
+  if (typeof _noodl_cloud_runtime_version === "undefined" || typeof _noodl_cloudservices === "undefined") return void 0;
+  if (!_noodl_cloudservices || typeof _noodl_cloudservices.collections !== "function") return void 0;
+  try {
+    return (_noodl_cloudservices.collections() || []).find((c) => c && c.name === collectionName2);
+  } catch (e) {
+    return void 0;
+  }
+}
 function backendType() {
   try {
     const handle = CloudStore.instance && CloudStore.instance._handle && CloudStore.instance._handle();
@@ -70138,7 +70716,7 @@ function syncDataAttributesOnElement(node) {
   node._appliedDataAttributes = Object.keys(want);
 }
 function claimDataAttributeInputs(node) {
-  const own = node.registerInputIfNeeded;
+  const own2 = node.registerInputIfNeeded;
   node.registerInputIfNeeded = function(name2) {
     if (!this.hasInput(name2) && DATA_ATTRIBUTE_NAME.test(name2)) {
       this.registerInput(name2, {
@@ -70150,7 +70728,7 @@ function claimDataAttributeInputs(node) {
       });
       return;
     }
-    return own ? own.call(this, name2) : void 0;
+    return own2 ? own2.call(this, name2) : void 0;
   };
 }
 function scrollNodeIntoView(node, align) {
@@ -71700,7 +72278,7 @@ var init_Checkbox2 = __esm({
 });
 
 // ../noodl-viewer-react/src/guid.ts
-function guid() {
+function guid2() {
   function s4() {
     return Math.floor((1 + Math.random()) * 65536).toString(16).substring(1);
   }
@@ -71709,7 +72287,7 @@ function guid() {
 var guid_default;
 var init_guid = __esm({
   "../noodl-viewer-react/src/guid.ts"() {
-    guid_default = guid;
+    guid_default = guid2;
   }
 });
 
@@ -71929,6 +72507,17 @@ var init_checkbox = __esm({
 });
 
 // ../noodl-viewer-react/src/components/controls/Select/Select.tsx
+function domValueOf(item) {
+  if (item.Value === void 0 || item.Value === null || typeof item.Value === "boolean") {
+    const label = item.Label;
+    return (label === void 0 || label === null || typeof label === "boolean" ? "" : String(label)).replace(/[ \t\n\f\r]+/g, " ").trim();
+  }
+  return String(item.Value);
+}
+function offersValue(items, value2) {
+  if (!items || typeof value2 !== "string") return false;
+  return items.some((item) => item !== null && item !== void 0 && domValueOf(item) === value2);
+}
 function Select(props) {
   const [value2, setValue] = (0, import_react6.useState)(props.value);
   (0, import_react6.useEffect)(() => {
@@ -71942,7 +72531,7 @@ function Select(props) {
     style2 = Object.assign({}, props.textStyle, style2);
     style2.color = props.noodlNode.context.styles.resolveColor(style2.color);
   }
-  const selectedIndex = !props.items || value2 === void 0 ? -1 : props.items.findIndex((i2) => i2.Value === value2);
+  const selectedIndex = !props.items || value2 === void 0 ? -1 : props.items.findIndex((i2) => i2 !== null && i2 !== void 0 && domValueOf(i2) === value2);
   const { height, ...otherStyles } = style2;
   function _renderIcon() {
     if (props.iconSourceType === "image" && props.iconImageSource !== void 0)
@@ -72050,7 +72639,7 @@ function Select(props) {
       {
         ...inputProps,
         disabled: !props.enabled,
-        value: options.find((i2) => i2.props.value === value2) ? value2 : void 0,
+        value: offersValue(props.items, value2) ? value2 : "",
         ...utils_default.controlEvents(props),
         onChange: (e) => {
           setValue(e.target.value);
@@ -72223,12 +72812,14 @@ var init_options = __esm({
         this.props.id = "input-" + guid_default();
         this.props.items = DEFAULT_ITEMS.map((item) => ({ ...item }));
         this.props.value = this._internal.value = DEFAULT_ITEMS[0].Value;
+        this._internal.valueIsSeed = true;
         this.props.valueWrites = 0;
         this.props.valueChanged = (value2) => {
           const changed = this._internal.value !== value2;
           this.props.value = this._internal.value = value2;
           this.props.valueWrites++;
           if (changed) {
+            this._internal.valueIsSeed = false;
             this.flagOutputDirty("value");
             this.sendSignalOnOutput("onChange");
           }
@@ -72281,6 +72872,16 @@ var init_options = __esm({
               if (newValue && typeof newValue.on === "function") newValue.on("change", this._itemsChanged);
             }
             this.props.items = optionItems(this._internal.items);
+            if (this._internal.valueIsSeed) {
+              const offered = this.props.items;
+              const seed = this._internal.value;
+              if (!Array.isArray(offered) || !offered.some((item) => item && item.Value === seed)) {
+                this._internal.valueIsSeed = false;
+                this.props.value = this._internal.value = "";
+                this.props.valueWrites++;
+                this.flagOutputDirty("value");
+              }
+            }
             this.forceUpdate();
           }
         },
@@ -72299,6 +72900,7 @@ var init_options = __esm({
             }
             const changed = value2 !== this._internal.value;
             this.props.value = this._internal.value = value2;
+            this._internal.valueIsSeed = false;
             this.props.valueWrites++;
             if (changed) {
               this.forceUpdate();
@@ -78605,11 +79207,11 @@ var init_foreach = __esm({
           const internal2 = this._internal;
           const children = internal2.target.getChildren();
           let at = children.indexOf(this) + 1;
-          let own = 0;
+          let own2 = 0;
           for (let i2 = at; i2 < children.length; i2++) {
             if (internal2.itemNodes.indexOf(children[i2]) === -1) continue;
-            if (own === listIndex) return i2;
-            own++;
+            if (own2 === listIndex) return i2;
+            own2++;
             at = i2 + 1;
           }
           return at;
@@ -90999,8 +91601,8 @@ var init_timer = __esm({
           const a = this._internal._animation;
           if (a._isRunning !== true || this._internal.paused) return;
           const left = a.durationLeft();
-          const own = this._internal.resumed || { duration: a.duration, delay: a.delay };
-          this._internal.paused = { left: typeof left === "number" && left >= 0 ? left : a.duration, ...own };
+          const own2 = this._internal.resumed || { duration: a.duration, delay: a.delay };
+          this._internal.paused = { left: typeof left === "number" && left >= 0 ? left : a.duration, ...own2 };
           a.stop();
         },
         _onPageShown: function() {
@@ -95191,6 +95793,7 @@ __export(cloudfunction2_exports, {
   default: () => cloudfunction2_default
 });
 function _makeRequest(path10, options) {
+  options = holdOptionsForWrite(options);
   const xhr = new XMLHttpRequest();
   xhr.onreadystatechange = function() {
     if (xhr.readyState === 4) {
@@ -95235,6 +95838,7 @@ var init_cloudfunction2 = __esm({
   "../noodl-viewer-react/src/nodes/std-library/data/cloudfunction2.ts"() {
     import_runtime10 = __toESM(require_noodl_runtime());
     init_SessionStore();
+    init_pressguard();
     init_outcome();
     CALL_ERROR_CODE = "cloud-function/call-failed";
     CloudFunctionNode = {
@@ -97873,453 +98477,6 @@ var init_router_navigate = __esm({
   }
 });
 
-// ../noodl-runtime/src/api/backends/ParseAuthAdapter.ts
-function pageSays(response, phrase) {
-  return typeof response === "string" && response.indexOf(phrase) !== -1;
-}
-function htmlPageError(error, invalidPhrase, invalidMessage, fallback) {
-  if (typeof error !== "string" || error.indexOf("<") === -1) return error || fallback;
-  return error.indexOf(invalidPhrase) !== -1 ? invalidMessage : fallback;
-}
-var guid2, HANDOFF_PARAM, AUTH_ERROR_PARAM, ParseAuthAdapter;
-var init_ParseAuthAdapter = __esm({
-  "../noodl-runtime/src/api/backends/ParseAuthAdapter.ts"() {
-    init_AuthEvents();
-    init_SessionStore();
-    init_TokenLifecycle();
-    guid2 = require_guid();
-    HANDOFF_PARAM = "nodegx_auth";
-    AUTH_ERROR_PARAM = "nodegx_auth_error";
-    ParseAuthAdapter = class extends AuthEvents {
-      constructor(options) {
-        super();
-        /** BAK-004: the state of a sign-in returning from a provider or a magic link. */
-        this.oauthReturn = { inProgress: false };
-        /**
-         * One store and one controller per backend, keyed by application id.
-         *
-         * Per handle rather than per adapter because the contract's whole point is
-         * that a project may have more than one backend, and two backends have two
-         * sessions — the phase decided explicitly that they are never shared.
-         */
-        this.stores = /* @__PURE__ */ new Map();
-        this.controllers = /* @__PURE__ */ new Map();
-        this.serializeObject = options.serializeObject;
-        this.createStore = options.createStore || parseSessionStore;
-        this.lifecycle = options.lifecycle || { kind: "eternal" };
-      }
-      // ── Session storage ──────────────────────────────────────────────────────
-      sessionStore(handle) {
-        const appId = handle.publicToken;
-        const cacheKey = String(appId);
-        let store2 = this.stores.get(cacheKey);
-        if (store2 === void 0) {
-          store2 = this.createStore(appId);
-          this.stores.set(cacheKey, store2);
-        }
-        return store2;
-      }
-      /**
-       * The lifecycle controller for this backend.
-       *
-       * On Parse this is an `eternal` controller: it arms no timer, subscribes to no
-       * storage events, and its gate is a synchronous pass-through. It is on the
-       * request path anyway, so that BCN-004 adds a `performRefresh` rather than a
-       * call site.
-       */
-      lifecycleController(handle) {
-        const cacheKey = String(handle.publicToken);
-        let controller = this.controllers.get(cacheKey);
-        if (controller === void 0) {
-          controller = new TokenLifecycleController({
-            lifecycle: this.lifecycle,
-            store: this.sessionStore(handle),
-            onSessionLost: (reason) => {
-              this.emitAuthEvent("sessionChanged", void 0);
-              this.emitAuthEvent("sessionLost", reason);
-            },
-            onSessionClearedElsewhere: () => {
-              this.emitAuthEvent("sessionChanged", void 0);
-              this.emitAuthEvent("loggedOut");
-            }
-          });
-          controller.start();
-          this.controllers.set(cacheKey, controller);
-        }
-        return controller;
-      }
-      /** The stored session, or `undefined`. Not a contract method. */
-      getCurrentUser(handle) {
-        return this.sessionStore(handle).read();
-      }
-      setSession(handle, session) {
-        this.sessionStore(handle).write(session);
-        this.lifecycleController(handle).sessionChanged();
-        this.emitAuthEvent("sessionChanged", session);
-      }
-      clearSession(handle) {
-        this.sessionStore(handle).clear();
-        this.lifecycleController(handle).sessionChanged();
-        this.emitAuthEvent("sessionChanged", void 0);
-      }
-      // ── The wire ─────────────────────────────────────────────────────────────
-      /**
-       * The Parse auth seam. Moved from `userservice.ts:198` with one substitution:
-       * `this.endpoint`/`this.appId` became `handle.url`/`handle.publicToken`.
-       *
-       * It is deliberately *not* `ParseWireAdapter._makeRequest`. The two differ in
-       * three ways that all matter: this one sends `X-Parse-Installation-Id`, never
-       * sends a master key, and hands its error callback Parse's `code` (the `209`
-       * the session check turns on). Merging them would be a rewrite in a task
-       * whose value is that nothing was rewritten.
-       */
-      _makeRequest(handle, path10, options) {
-        if (!handle.url) {
-          if (options.error) {
-            options.error({ error: "No active cloud service", status: 0 });
-          }
-          return;
-        }
-        const store2 = this.sessionStore(handle);
-        this.lifecycleController(handle).withSession((session) => {
-          const xhr = new XMLHttpRequest();
-          xhr.onreadystatechange = function() {
-            if (xhr.readyState === 4) {
-              let json2;
-              try {
-                json2 = JSON.parse(xhr.response);
-              } catch (e) {
-              }
-              if (xhr.status === 200 || xhr.status === 201) {
-                options.success(json2 || xhr.response);
-              } else options.error(json2 || { error: xhr.responseText, status: xhr.status });
-            }
-          };
-          xhr.open(options.method || "GET", handle.url + path10, true);
-          xhr.setRequestHeader("X-Parse-Application-Id", handle.publicToken);
-          const iidKey = parseInstallationIdKey(handle.publicToken);
-          let _iid = store2.readKey(iidKey);
-          if (_iid === void 0) {
-            _iid = guid2();
-            store2.writeKey(iidKey, _iid);
-          }
-          xhr.setRequestHeader("X-Parse-Installation-Id", _iid);
-          if (options.sessionToken) xhr.setRequestHeader("X-Parse-Session-Token", options.sessionToken);
-          else if (session !== void 0) {
-            xhr.setRequestHeader("X-Parse-Session-Token", session.sessionToken);
-          }
-          xhr.setRequestHeader("Content-Type", "application/json");
-          xhr.send(JSON.stringify(options.content));
-        });
-      }
-      // ── The ten ──────────────────────────────────────────────────────────────
-      logIn(handle, options) {
-        this._makeRequest(handle, "/login", {
-          method: "POST",
-          content: {
-            username: options.username,
-            password: options.password,
-            _method: "GET"
-          },
-          success: (response) => {
-            this.setSession(handle, response);
-            options.success(response);
-            this.emitAuthEvent("loggedIn", response);
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      logOut(handle, options) {
-        this._makeRequest(handle, "/logout", {
-          method: "POST",
-          content: {},
-          success: () => {
-            this.clearSession(handle);
-            options.success();
-            this.emitAuthEvent("loggedOut");
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      signUp(handle, options) {
-        const additionalUserProps = options.properties ? this.serializeObject({ ...options.properties }, "_User") : {};
-        this._makeRequest(handle, "/users", {
-          method: "POST",
-          content: Object.assign({}, additionalUserProps, {
-            username: options.username,
-            password: options.password,
-            email: options.email
-          }),
-          success: (response) => {
-            const identity2 = { username: options.username };
-            if (options.email !== void 0) identity2.email = options.email;
-            const _cu = Object.assign(response, identity2, options.properties);
-            if (_cu.emailVerified === void 0) _cu.emailVerified = false;
-            this.setSession(handle, _cu);
-            options.success(response);
-            this.emitAuthEvent("loggedIn", _cu);
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      fetchCurrentUser(handle, options) {
-        this._makeRequest(handle, "/users/me", {
-          method: "GET",
-          sessionToken: options.sessionToken,
-          success: (response) => {
-            this.setSession(handle, response);
-            this.emitAuthEvent("sessionGained", response);
-            options.success(response);
-          },
-          error: (e) => {
-            if (e.code === 209) {
-              this.sessionStore(handle).clear();
-              this.emitAuthEvent("sessionLost");
-            }
-            options.error(e.error);
-          }
-        });
-      }
-      verifyEmail(handle, options) {
-        this._makeRequest(
-          handle,
-          "/apps/" + handle.publicToken + "/verify_email?username=" + options.username + "&token=" + options.token,
-          {
-            method: "GET",
-            // This endpoint answers with an HTML page rather than JSON, so the outcome has to be
-            // read out of the page's text.
-            success: (response) => {
-              if (pageSays(response, "Successfully verified your email")) {
-                options.success();
-              } else if (pageSays(response, "Invalid Verification Link")) {
-                options.error("Invalid verification token");
-              } else {
-                options.error("Failed to verify email");
-              }
-            },
-            error: (e) => {
-              options.error(htmlPageError(e.error, "Invalid Verification Link", "Invalid verification token", "Failed to verify email"));
-            }
-          }
-        );
-      }
-      sendEmailVerification(handle, options) {
-        this._makeRequest(handle, "/verificationEmailRequest", {
-          method: "POST",
-          content: { email: options.email },
-          success: () => {
-            options.success();
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      resetPassword(handle, options) {
-        this._makeRequest(handle, "/apps/" + handle.publicToken + "/request_password_reset", {
-          method: "POST",
-          content: {
-            username: options.username,
-            token: options.token,
-            new_password: options.newPassword
-          },
-          success: (response) => {
-            if (pageSays(response, "Password successfully reset") || pageSays(response, "Successfully updated your password")) {
-              options.success();
-            } else if (pageSays(response, "Invalid Link")) {
-              options.error("Invalid or expired reset link");
-            } else {
-              options.error("Failed to reset password");
-            }
-          },
-          error: (e) => {
-            options.error(htmlPageError(e.error, "Invalid Link", "Invalid or expired reset link", "Failed to reset password"));
-          }
-        });
-      }
-      requestPasswordReset(handle, options) {
-        this._makeRequest(handle, "/requestPasswordReset", {
-          method: "POST",
-          content: { email: options.email },
-          success: () => {
-            options.success();
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      /**
-       * Send the browser to a provider. This NAVIGATES AWAY: nothing after it runs,
-       * and the result arrives on a later page load through {@link consumeAuthReturn}.
-       *
-       * `redirect` defaults to the current page (minus any leftover sign-in
-       * parameters), so the user comes back where they were. The backend refuses
-       * any target that is neither same-origin nor on its `redirectAllowList` — if
-       * sign-in dead-ends with "origin not allowed", that list is the fix.
-       */
-      signInWithProvider(handle, options) {
-        if (!handle.url) {
-          if (options.error) options.error("No active cloud service");
-          return;
-        }
-        if (!options.provider) {
-          if (options.error) options.error("Sign In With: no provider was set.");
-          return;
-        }
-        const redirect = options.redirect || this._currentUrlWithoutAuthParams();
-        const url = `${handle.url}/oauth/${encodeURIComponent(options.provider)}/start?redirect=${encodeURIComponent(redirect)}`;
-        window.location.href = url;
-      }
-      /**
-       * Ask the backend to email a one-click sign-in link.
-       *
-       * Succeeds identically for a known and an unknown address — the endpoint is
-       * anonymous and anti-enumerating by design, so "success" here means "the
-       * request was accepted", never "an account exists". The node's help text says
-       * so, because a UI that claims "check your inbox" only for real accounts
-       * re-creates the oracle the endpoint removed.
-       */
-      requestMagicLink(handle, options) {
-        this._makeRequest(handle, "/auth/magic-link", {
-          method: "POST",
-          content: { email: options.email, redirect: options.redirect || this._currentUrlWithoutAuthParams() },
-          success: () => options.success(),
-          error: (e) => options.error(e.error)
-        });
-      }
-      // ── Not contract, and deliberately so ────────────────────────────────────
-      /**
-       * Write user-profile fields onto the signed-in user.
-       *
-       * Not one of the ten. It is the `Set User Properties` node's whole
-       * implementation, and BCN-006's Desired State §3 makes it schema-driven across
-       * five backends — which is step 6, not this pass. It moves with the wire
-       * because leaving it behind would have left a second `_makeRequest` in
-       * `userservice.ts`, and the entire claim of this move is that there is one.
-       */
-      setUserProperties(handle, options) {
-        const _cu = this.getCurrentUser(handle);
-        if (_cu === void 0) {
-          options.error("Nobody is signed in.");
-          return;
-        }
-        {
-          const propsToSave = this.serializeObject({ ...options.properties }, "_User");
-          const _content = Object.assign(
-            {},
-            { email: options.email, username: options.username },
-            propsToSave
-          );
-          delete _content.emailVerified;
-          delete _content.createdAt;
-          delete _content.updatedAt;
-          this._makeRequest(handle, "/users/" + _cu.objectId, {
-            method: "PUT",
-            content: _content,
-            success: (response) => {
-              Object.assign(_cu, _content);
-              this.setSession(handle, _cu);
-              options.success(response);
-            },
-            error: (e) => {
-              options.error(e.error);
-            }
-          });
-        }
-      }
-      /** The sign-in methods this backend offers — for rendering a set of buttons. */
-      listAuthProviders(handle, options) {
-        this._makeRequest(handle, "/auth/providers", {
-          method: "GET",
-          success: (response) => options.success(response),
-          error: (e) => options.error(e.error)
-        });
-      }
-      // ── BAK-004 — the provider return leg ────────────────────────────────────
-      /**
-       * Look for a sign-in result in the current URL and act on it.
-       *
-       * Returns true when this page load IS a sign-in return, so the caller can skip
-       * its ordinary stale-session validation.
-       *
-       * **Per backend, not contract.** BCN-006 step 5 is four different redirect
-       * shapes — Parse `authData`, Directus SSO, Supabase, PocketBase
-       * `auth-with-oauth2` — and this is the first of the four. What they have in
-       * common is only the *outcome*: a session, established. That is where the
-       * contract's surface is, and it is `signInWithProvider` plus a `loggedIn`.
-       */
-      consumeAuthReturn(handle) {
-        if (typeof window === "undefined" || !window.location) return false;
-        let params;
-        try {
-          params = new URLSearchParams(window.location.search);
-        } catch (e) {
-          return false;
-        }
-        const code = params.get(HANDOFF_PARAM);
-        const error = params.get(AUTH_ERROR_PARAM);
-        if (!code && !error) return false;
-        params.delete(HANDOFF_PARAM);
-        params.delete(AUTH_ERROR_PARAM);
-        this._stripAuthParamsFromUrl(params);
-        if (error) {
-          this.oauthReturn = { inProgress: false, succeeded: false, error };
-          setTimeout(() => this.emitAuthEvent("oauthReturn", this.oauthReturn), 0);
-          return true;
-        }
-        this.oauthReturn = { inProgress: true };
-        this._makeRequest(handle, "/oauth/exchange", {
-          method: "POST",
-          content: { code },
-          success: (response) => {
-            this.setSession(handle, response);
-            this.oauthReturn = {
-              inProgress: false,
-              succeeded: true,
-              outcome: response.authOutcome,
-              notice: response.authNotice || void 0
-            };
-            this.emitAuthEvent("oauthReturn", this.oauthReturn);
-            this.emitAuthEvent("loggedIn", response);
-          },
-          error: (e) => {
-            this.oauthReturn = {
-              inProgress: false,
-              succeeded: false,
-              error: e && e.error || "Sign-in could not be completed."
-            };
-            this.emitAuthEvent("oauthReturn", this.oauthReturn);
-          }
-        });
-        return true;
-      }
-      /** Rewrite the address bar without the sign-in parameters, keeping everything else. */
-      _stripAuthParamsFromUrl(remaining) {
-        if (!window.history || typeof window.history.replaceState !== "function") return;
-        const query2 = remaining.toString();
-        const cleaned = window.location.pathname + (query2 ? `?${query2}` : "") + window.location.hash;
-        try {
-          window.history.replaceState(window.history.state, "", cleaned);
-        } catch (e) {
-        }
-      }
-      _currentUrlWithoutAuthParams() {
-        const url = new URL(window.location.href);
-        url.searchParams.delete(HANDOFF_PARAM);
-        url.searchParams.delete(AUTH_ERROR_PARAM);
-        return url.toString();
-      }
-    };
-  }
-});
-
 // ../noodl-viewer-react/src/nodes/std-library/user/userservice.ts
 var import_events2, import_runtime14, import_cloudstore2, UserService, _instance, userservice_default;
 var init_userservice = __esm({
@@ -98865,44 +99022,20 @@ var signup_exports = {};
 __export(signup_exports, {
   default: () => signup_default
 });
-function updatePorts6(nodeId, _parameters, editorConnection, systemCollections) {
-  const ports = [];
-  if (systemCollections) {
-    const c = systemCollections.find((c2) => c2.name === "_User");
-    if (c && c.schema && c.schema.properties) {
-      const props = c.schema.properties;
-      const _ignoreKeys = ["authData", "password", "username", "createdAt", "updatedAt", "emailVerified", "email", "ACL"];
-      for (const key in props) {
-        if (_ignoreKeys.indexOf(key) !== -1) continue;
-        const p = props[key];
-        if (ports.find((_p) => _p.name === key)) continue;
-        if (p.type === "Relation") {
-        } else {
-          const _typeMap = {
-            String: "string",
-            Boolean: "boolean",
-            Number: "number",
-            Date: "date"
-          };
-          ports.push({
-            type: {
-              name: _typeMap[p.type] ? _typeMap[p.type] : "*"
-            },
-            plug: "input",
-            group: "Properties",
-            name: "prop-" + key,
-            displayName: key
-          });
-        }
-      }
-    }
-  }
-  editorConnection.sendDynamicPorts(nodeId, ports);
+function updatePorts6(nodeId, editorConnection, graphModel) {
+  const ctx = userSchemaContext(graphModel, {});
+  const ignore = isParseWireContext(ctx) ? USER_INPUT_IGNORE_PARSE_BROWSER : USER_INPUT_IGNORE_REST;
+  sendSchemaPorts(editorConnection, nodeId, userPropertyPorts(ctx, { plug: "input", ignore }), {
+    staticPorts: staticPortNames(SignUpNodeDefinition)
+  });
 }
 var SIGN_UP_ERROR_CODE, SignUpNodeDefinition, SignUpModule, signup_default;
 var init_signup = __esm({
   "../noodl-viewer-react/src/nodes/std-library/user/signup.ts"() {
     "use strict";
+    init_record_ports();
+    init_schema_ports();
+    init_user_ports();
     init_outcome();
     init_userservice();
     SIGN_UP_ERROR_CODE = "user/sign-up-failed";
@@ -99040,23 +99173,11 @@ var init_signup = __esm({
           return;
         }
         function _managePortsForNode(node) {
-          updatePorts6(
-            node.id,
-            node.parameters,
-            editorConnection,
-            graphModel.getMetaData("systemCollections")
-          );
-          node.on("parameterUpdated", function() {
-            updatePorts6(
-              node.id,
-              node.parameters,
-              editorConnection,
-              graphModel.getMetaData("systemCollections")
-            );
-          });
-          graphModel.on("metadataChanged.systemCollections", function(data) {
-            updatePorts6(node.id, node.parameters, editorConnection, data);
-          });
+          const rebuild = () => updatePorts6(node.id, editorConnection, graphModel);
+          rebuild();
+          graphModel.on("metadataChanged.systemCollections", rebuild);
+          graphModel.on("metadataChanged.dbCollections", rebuild);
+          graphModel.on("metadataChanged.backendServices", rebuild);
         }
         graphModel.on("editorImportComplete", () => {
           graphModel.on("nodeAdded.net.noodl.user.SignUp", function(node) {
@@ -100237,6 +100358,7 @@ __export(cloudfunction_exports, {
   default: () => cloudfunction_default
 });
 function _makeRequest2(path10, options) {
+  options = holdOptionsForWrite(options);
   const xhr = new XMLHttpRequest();
   xhr.onreadystatechange = function() {
     if (xhr.readyState === 4) {
@@ -100265,6 +100387,7 @@ var init_cloudfunction = __esm({
     import_runtime15 = __toESM(require_noodl_runtime());
     import_cloudstore3 = __toESM(require_cloudstore());
     init_SessionStore();
+    init_pressguard();
     CloudFunctionNode2 = {
       name: "Cloud Function",
       category: "Cloud Services",
@@ -167354,11 +167477,12 @@ var node_catalog_default = {
         ],
         items: [
           "nothing handed (undefined): the list it has stays",
+          "the value is still the placed node's seed and the list does not offer it: the list is kept, and the value is cleared to '' and sent",
           "otherwise: the list is kept as handed and drawn at the next paint; the value stays, so a list handed again keeps the pick"
         ],
         value: [
           "null: ignored",
-          "the value it already holds, as text: nothing",
+          "the value it already holds, as text: nothing (it is no longer the seed)",
           "a change: kept as text, Value follows, and the list selects it at the next paint if it names an option \u2014 Changed does not fire (only a person's pick fires it)"
         ],
         mounted: [
@@ -179739,7 +179863,7 @@ var node_catalog_default = {
           group: "Request",
           plug: "output",
           type: {
-            name: "boolean"
+            name: "string"
           },
           isSignal: false,
           description: "Id of the user the session token resolved to, and blank for an unauthenticated request"
@@ -180965,8 +181089,8 @@ var CatalogIndex = class _CatalogIndex {
   suggestPort(typeName4, plug, unknown, kind) {
     const names2 = this.portNames(typeName4, plug);
     const candidates = kind ? names2.filter((name2) => {
-      const own = this.portKind(typeName4, plug, name2);
-      return own === void 0 || own === kind;
+      const own2 = this.portKind(typeName4, plug, name2);
+      return own2 === void 0 || own2 === kind;
     }) : names2;
     return nearest(unknown, candidates);
   }
@@ -196603,7 +196727,8 @@ function coerce(type, value2) {
     }
   }
 }
-function applyRequestContract(specs2, body) {
+function applyRequestContract(specs2, parsed2) {
+  const body = parsed2 !== null && typeof parsed2 === "object" && !Array.isArray(parsed2) ? parsed2 : {};
   const values2 = { ...body };
   const errors = [];
   for (const spec of specs2) {
@@ -196723,7 +196848,21 @@ for (const invocation of invocations) {
 HOSTS3.push({ invocation: invocations[0], cloudServices: { ...CLOUD, runId: "run-1" } });
 var CloudRequest = defineNode({
   type: "noodl.cloud.request",
-  version: 1,
+  version: 3,
+  changes: [
+    {
+      version: 2,
+      says: "A body that is not a JSON object, sent to a function whose parameters declare a contract, names no fields: a Required one refuses the request with the 400 naming it, and with none Required the function runs. It threw a TypeError reading a name off null (a 500)",
+      row: "P107-S97-NULLBODY (the Beta sweep s5)",
+      migration: { none: "Nothing a project stores changes: only a caller sending a body that is not an object to a function with a contract gets a different answer" }
+    },
+    {
+      version: 3,
+      says: "User Id is text (it carries the id of the person the session token resolved to). It was declared a flag, so a wire into a Number read the id as NaN and the canvas offered it to a signal input",
+      row: "P107-S97-USERIDBOOLEAN (the Beta sweep s6)",
+      migration: { none: "No saved wire stops connecting: measured 106 wires from User Id in 13,839 project files, 70 into script inputs (any type), 35 into text ports, 1 into a record field, none into a signal" }
+    }
+  ],
   source: "packages/noodl-viewer-cloud/src/nodes/cloud/request.ts; packages/noodl-viewer-cloud/src/nodes/cloud/requestContract.ts; packages/noodl-viewer-cloud/src/nodes/cloud/requestOrigin.ts; packages/noodl-viewer-cloud/src/services/userservice.js",
   needs: ["host", "network", "random"],
   worldPool: {
@@ -196758,7 +196897,7 @@ var CloudRequest = defineNode({
     // :120-128 — its getter, `!!`
     auth: { type: "boolean", from: (s) => !!s.authenticated, displayName: "Authenticated", group: "Request", description: "Whether the request carried a session token that resolved to a user" },
     // :129-137 — declared `boolean`, carries the id
-    userId: { type: "boolean", from: (s) => s.authUserId, displayName: "User Id", group: "Request", description: "Id of the user the session token resolved to, and blank for an unauthenticated request" },
+    userId: { type: "string", from: (s) => s.authUserId, displayName: "User Id", group: "Request", description: "Id of the user the session token resolved to, and blank for an unauthenticated request" },
     // :142-151
     origin: { type: "string", from: (s) => s.origin, displayName: "Origin", group: "Request", description: "The address the calling app is served from \u2014 its Origin header, or this backend\u2019s own host when the caller sent none. Blank when neither is known (a workflow step has no caller). Caller-supplied like every header: right for links sent back to whoever called, not a proof of where the request came from." }
   }
@@ -199092,7 +199231,7 @@ var Model27 = defineNode({
     // :250-272
     modelId: (s, value2, i2, w) => {
       let v = value2;
-      const own = [];
+      const own2 = [];
       if (w.registry.isRecord(v)) v = v.getId();
       else if (typeof v === "object" && v !== null) {
         const data = v;
@@ -199105,20 +199244,20 @@ var Model27 = defineNode({
             if (key === "id" || before3[key] === data[key]) continue;
             if (s.properties.includes(key)) {
               w.send("prop-" + key, s);
-              own.push({ derived: "changed-" + key });
+              own2.push({ derived: "changed-" + key });
             }
-            own.push("changed");
+            own2.push("changed");
           }
         }
       }
       const previous = s.modelId;
       if (valueDidChange2(previous, v) && i2["runOnChange-modelId"]) {
         const st = { ...s, modelId: v };
-        const pulses = [...own];
+        const pulses = [...own2];
         setModelID(st, w, v, pulses);
         return { says: "a new Id, ticked under Run On Value Change: bound to the object it names now (made if none has it) and Fetched fires \u2014 an empty Id unbinds, silently; an object handed writes its keys onto that object first", set: { modelId: v, bound: st.bound, jobs: st.jobs, storeScheduled: st.storeScheduled }, send: [], pulses };
       }
-      return { says: "otherwise (the same Id, or unticked): Id is sent and the binding stays; an object handed still writes its keys onto the object it names", set: { modelId: v }, send: ["id"], pulses: own };
+      return { says: "otherwise (the same Id, or unticked): Id is sent and the binding stays; an object handed still writes its keys onto the object it names", set: { modelId: v }, send: ["id"], pulses: own2 };
     },
     // :274-280 — `set: function () {}`
     properties: () => ({ says: "always: nothing while it runs; each name makes an input, an output and its own Changed", send: [] }),
@@ -199179,9 +199318,9 @@ var Model27 = defineNode({
               const model2 = w.registry.model(st.bound);
               for (const key of Object.keys(st.dirty)) {
                 const value2 = st.inputValues[key];
-                const own = key.indexOf(".") === -1 && model2.get(key) !== value2;
+                const own2 = key.indexOf(".") === -1 && model2.get(key) !== value2;
                 model2.set(key, value2, { resolve: true });
-                if (own && i2["runOnChange-object"]) {
+                if (own2 && i2["runOnChange-object"]) {
                   if (st.properties.includes(key)) {
                     w.send("prop-" + key, st);
                     pulses.push({ derived: "changed-" + key });
@@ -199219,8 +199358,8 @@ var Model27 = defineNode({
       change: (s, i2, e) => {
         if (e.kind !== "model" || e.id !== s.bound || !i2["runOnChange-object"]) return { send: [] };
         const key = String(e.name);
-        const own = s.properties.includes(key);
-        return { sendDerived: own ? ["prop-" + key] : [], emitDerived: own ? ["changed-" + key] : [], emit: ["changed"], send: [] };
+        const own2 = s.properties.includes(key);
+        return { sendDerived: own2 ? ["prop-" + key] : [], emitDerived: own2 ? ["changed-" + key] : [], emit: ["changed"], send: [] };
       }
     }
   }
@@ -201821,7 +201960,9 @@ var Dropdown = defineNode({
   // v8 (P107 R21, P107-S88-OPTIONSCAST): a word in a list on Items is an option, labelled and valued by the word — v7 drew an option with no text and the value ''
   // v9 (NSP-019 R35): a Focus that finds the node off the page shows as its warning until a Focus reaches it, and an Icon Source that is not an icon shows as one until an icon or nothing arrives (`diagnostics`)
   // v10 (NSP-019 R38): a wired Width in a row, or a wired Height in a column, that is a percent shows as its warning (wired-grow.ts)
-  version: 10,
+  // v11 (P121-TWO005-DROPDOWNSTALE): Items that do not offer the placed node's seed ("Option 1") clear it to '' and send Value
+  // v12 (BETA-S7-DROPDOWNFIRSTPICK): with the value in no option, the element keeps its hidden empty option selected, so every option is a pick
+  version: 12,
   // NSP-010 — v7 is the spec correcting itself, not the runtime changing
   changes: [
     {
@@ -201841,7 +201982,23 @@ var Dropdown = defineNode({
       }
     },
     focusAndIconSourceChange(9),
-    growChange(10)
+    growChange(10),
+    {
+      version: 11,
+      says: `A Dropdown nobody has given a Value or a pick holds the first default option, "Option 1", so a placed node shows a real option. When Items arrive and do not offer it, Value now becomes '' (empty) and is sent, as the list shows its placeholder. Before, Value went on saying "Option 1", an option the list did not have, and a form that checked whether anything was chosen sent it. A Value somebody wrote, or a person's pick, is never changed`,
+      row: "P121-TWO005-DROPDOWNSTALE",
+      migration: {
+        none: "Only a value the screen never showed changes: the placeholder was already drawn, and the community template, which met it, already set Value to '' itself. No stored project changes"
+      }
+    },
+    {
+      version: 12,
+      says: "While the Dropdown shows its placeholder because its value is in no option, choosing the first option now chooses it: Value and Changed. Before, the list underneath had already selected that first option (the browser does when the selected option leaves the list, or when options arrive in an empty one), so choosing it did nothing and the placeholder stayed. Every other option was already a pick",
+      row: "BETA-S7-DROPDOWNFIRSTPICK",
+      migration: {
+        none: "A pick that did nothing now does what the person asked; nothing an app could rely on, and no stored project changes"
+      }
+    }
   ],
   diagnostics: { ...focusDiagnostics(controlFocusNotMounted("dropdown")), ...iconSourceDiagnostics(), ...wiredGrowDiagnostic },
   source: "packages/noodl-viewer-react/src/nodes/controls/options.ts",
@@ -201864,7 +202021,8 @@ var Dropdown = defineNode({
     focusMissed: false,
     value: "Option 1",
     items: DEFAULT_ITEMS2,
-    domSelected: ""
+    domSelected: "",
+    seeded: true
   },
   // utils.ts :402-411 `outcomeOutputs({ done, unchanged })` (addFocusActions)
   outcomes: ["done", "unchanged"],
@@ -202086,7 +202244,12 @@ var Dropdown = defineNode({
     },
     // options.ts :158-171 — `undefined` is no opinion; anything else is kept as handed, drawn at the next paint (`painted`); the
     // node's value stays (R14: a list handed again keeps the pick — the runtime's effect took the author's Value back until P109 ISL-031, row D34)
-    items: (s, v) => v === void 0 ? { says: "nothing handed (undefined): the list it has stays", send: [] } : { says: "otherwise: the list is kept as handed and drawn at the next paint; the value stays, so a list handed again keeps the pick", set: { items: v }, send: [] },
+    items: (s, v) => {
+      if (v === void 0) return { says: "nothing handed (undefined): the list it has stays", send: [] };
+      if (s.seeded && !offersValue2(v, s.value))
+        return { says: "the value is still the placed node's seed and the list does not offer it: the list is kept, and the value is cleared to '' and sent", set: { items: v, value: "", seeded: false }, send: ["value"] };
+      return { says: "otherwise: the list is kept as handed and drawn at the next paint; the value stays, so a list handed again keeps the pick", set: { items: v }, send: [] };
+    },
     // options.ts :181-200 — `null` has no `toString` and is ignored (:182-184); what is not text is made text; a change sends
     // Value and never Changed, and the selection follows it at the next paint (R14: the last word wins — the runtime's effect
     // keyed on the author's Value React last rendered, so a write back to it after a pick left the pick on the screen, row C71,
@@ -202094,8 +202257,8 @@ var Dropdown = defineNode({
     value: (s, v) => {
       if (v === null) return { says: "null: ignored", send: [] };
       const value2 = v === void 0 ? void 0 : String(v);
-      if (value2 === s.value) return { says: "the value it already holds, as text: nothing", send: [] };
-      return { says: "a change: kept as text, Value follows, and the list selects it at the next paint if it names an option \u2014 Changed does not fire (only a person's pick fires it)", set: { value: value2 }, send: ["value"] };
+      if (value2 === s.value) return { says: "the value it already holds, as text: nothing (it is no longer the seed)", set: { seeded: false }, send: [] };
+      return { says: "a change: kept as text, Value follows, and the list selects it at the next paint if it names an option \u2014 Changed does not fire (only a person's pick fires it)", set: { value: value2, seeded: false }, send: ["value"] };
     },
     // react-component-node.ts :2310-2320
     mounted: (_s, v) => ({ says: "always: the list is put on the page (Did Mount), or taken off it (Will Unmount), at the next paint", set: { mounted: !!v }, send: [] }),
@@ -202157,7 +202320,7 @@ var Dropdown = defineNode({
         if (!option || option.disabled) return NONE4;
         const focus = p.elementFocused ? NONE4 : focusTaken2();
         if (p.domSelected === picked) return focus;
-        return join3(focus, { set: { value: picked, domSelected: picked }, send: ["value"], emit: ["onChange"] });
+        return join3(focus, { set: { value: picked, domSelected: picked, seeded: false }, send: ["value"], emit: ["onChange"] });
       }, "keyboard")
     }
   }
@@ -202176,6 +202339,12 @@ function readStoredItems(stored) {
 function editorItems(items) {
   return typeof items === "string" ? readStoredItems(items) : itemRows(items);
 }
+function offersValue2(items, value2) {
+  if (!items) return false;
+  const rows = typeof items === "string" ? readStoredItems(items) : Array.isArray(items) ? items : [];
+  const words = rows.some((item) => item === null || item === void 0 || typeof item !== "object");
+  return rows.filter((item) => item !== null && item !== void 0).map((item) => words && typeof item !== "object" ? { Value: String(item) } : item).some((item) => typeof item === "object" && item.Value === value2);
+}
 function itemRows(source2) {
   if (!Array.isArray(source2)) return [];
   const out = [];
@@ -202221,12 +202390,7 @@ function painted4(s) {
   const value2 = s.value;
   const options = optionsOf(s.items);
   const inList = value2 !== void 0 && options.some((o) => o.value === value2);
-  const firstEnabled = options.find((o) => !o.disabled)?.value ?? null;
-  let dom = s.domSelected;
-  if (fresh) dom = inList ? value2 : "";
-  else if (inList) dom = value2;
-  else if (dom !== "" && dom !== null && !options.some((o) => o.value === dom)) dom = firstEnabled;
-  else if (dom === null) dom = firstEnabled;
+  const dom = inList ? value2 : "";
   if (dom !== s.domSelected) set.domSelected = dom;
   return { set, send: [], emit: emit2 };
 }
@@ -207776,7 +207940,7 @@ function copy(w, src) {
   return hearingRecords(w, () => copyInto(w, src));
 }
 function copyInto(w, src) {
-  const own = w.st.own;
+  const own2 = w.st.own;
   const source2 = src || [];
   let empty2 = 0;
   for (let i2 = 0; i2 < source2.length; i2++) if (source2[i2] === null || source2[i2] === void 0) empty2++;
@@ -207792,13 +207956,13 @@ function copyInto(w, src) {
     src = Array.prototype.filter.call(source2, (item) => item !== null && item !== void 0);
   }
   const ops = [];
-  const list2 = own;
+  const list2 = own2;
   const add = (a) => void ops.push({ kind: "add", rec: a.item, index: a.index });
   const remove = (a) => void ops.push({ kind: "remove", rec: a.item });
   list2.on("add", add);
   list2.on("remove", remove);
   try {
-    own.set(src);
+    own2.set(src);
   } finally {
     list2.off("add", add);
     list2.off("remove", remove);
@@ -207966,11 +208130,11 @@ function addItem(w, rec, _index) {
 }
 function childIndexFor(rows, listIndex) {
   let at = 0;
-  let own = 0;
+  let own2 = 0;
   for (let i2 = 0; i2 < rows.length; i2++) {
     if (rows[i2].leaving) continue;
-    if (own === listIndex) return i2;
-    own += 1;
+    if (own2 === listIndex) return i2;
+    own2 += 1;
     at = i2 + 1;
   }
   return at;
@@ -209331,13 +209495,13 @@ function merge(a, b) {
 function then(s, first2, next2) {
   return merge(first2, next2({ ...s, ...first2.set }));
 }
-function select(s, v, own) {
+function select(s, v, own2) {
   if (!s.inGroup || s.gValue === v) return NONE14;
   const set = { gValue: v };
   if (!s.onPage) return { set, send: [], emit: [] };
   const c = v === s.value;
   if (c === s.checked) return { set, send: [], emit: [] };
-  return { set: { ...set, checked: c }, send: ["checked"], emit: own || !c ? ["onChange"] : [] };
+  return { set: { ...set, checked: c }, send: ["checked"], emit: own2 || !c ? ["onChange"] : [] };
 }
 function painted14(s) {
   const set = { ...s.pageEnabled === s.enabled ? {} : { pageEnabled: s.enabled }, ...s.pageVisible === s.visible ? {} : { pageVisible: s.visible } };
@@ -212670,7 +212834,8 @@ var LogIn = defineNode({
 var SignUp = defineNode({
   type: "net.noodl.user.SignUp",
   // v2 (P107 s92, P107-S84-USERACL ruled R29): no `prop-ACL` input (signup.ts `_ignoreKeys` names ACL)
-  version: 2,
+  // v3 (P107-S102-SIGNUPBACKEND): the `prop-` inputs are the active backend's accounts table, not the Parse `_User` always
+  version: 3,
   changes: [
     {
       version: 2,
@@ -212679,6 +212844,14 @@ var SignUp = defineNode({
       migration: {
         none: `Ruled "Hide it, like the Record nodes" (R29). The reach measured on 2026-10-12 was 429 User-family nodes in 58 of Richard's projects and none wired to or from ACL, so no saved wire is dropped`
       }
+    },
+    {
+      version: 3,
+      says: "The property inputs are the columns of the active backend's accounts table (directus_users on Directus, users on PocketBase, none on Supabase), as Set User Properties draws them, less the columns that backend owns. Before, Sign Up always offered the Parse _User's columns, so a Directus app was offered fields its users table does not have. On the Parse wire nothing moves",
+      row: "P107-S102-SIGNUPBACKEND",
+      migration: {
+        none: "Measured in s102: 4 of 721 projects on Richard's machine have a REST backend and none uses Sign Up on one, so no saved wire is dropped. On the Parse wire the ignore list is the same seven names"
+      }
     }
   ],
   source: "packages/noodl-viewer-react/src/nodes/std-library/user/signup.ts; userservice.ts; RestAuthAdapter.ts",
@@ -212706,12 +212879,15 @@ var SignUp = defineNode({
   },
   {
     derived: {
-      // NSP-020 s84 — what the editor draws (signup.ts `updatePorts` :199-250, from `systemCollections`): one `prop-` per column
-      // of `_User` less the ones a sign-up does not set and every Relation ("cannot be set at sign-up time"), typed by the
-      // Parse table. No Backend picker. At play there is no schema: a write registers each (:185-195)
+      // NSP-020 s84, P107-S102-SIGNUPBACKEND — what the editor draws (signup.ts `updatePorts`, user-ports.ts as Set User
+      // Properties): one `prop-` per column of the ACTIVE backend's accounts class less the ones a browser cannot write
+      // (`USER_INPUT_IGNORE_PARSE_BROWSER`; off the Parse wire `USER_INPUT_IGNORE_REST`) and every Relation. No Backend picker,
+      // and a saved `backendId` is not read (the builder gives this type the active backend's schema). At play there is no
+      // schema: a write registers each (:185-195)
       inputs: (_params, context) => {
         const out = {};
-        for (const [p, decl] of userFields(context, ["authData", "password", "username", "createdAt", "updatedAt", "emailVerified", "email"], "_User")) out["prop-" + p] = { ...signUpProperty(p), type: recordFieldType(decl) };
+        const ignore = onParseWire(context) ? USER_INPUT_IGNORE_PARSE_BROWSER2 : USER_INPUT_IGNORE_REST2;
+        for (const [p, decl] of userFields(context, ignore)) out["prop-" + p] = { ...signUpProperty(p), ...recordFieldPort(decl) };
         return out;
       },
       needs: ["schema"],
@@ -214244,10 +214420,10 @@ var WebSocketNode = defineNode({
       run5.own = { pending: true };
       const url = (run5.getConnection().cfg.url || "").trim();
       run5.connect(false);
-      const own = run5.own.settled;
+      const own2 = run5.own.settled;
       const p = run5.patch();
-      if (own) {
-        const failed = { ...p, outcome: own.outcome, ...own.error !== void 0 ? { error: own.error } : {}, ...settles ? { settles } : {} };
+      if (own2) {
+        const failed = { ...p, outcome: own2.outcome, ...own2.error !== void 0 ? { error: own2.error } : {}, ...settles ? { settles } : {} };
         if (!url)
           return said(
             "a blank URL: any socket held is closed quietly and the countdown and heartbeat stopped (a Connect still waiting: Unchanged), then it fails at once \u2014 Connection State error, Last Error `URL is required to connect`, Retry Count 0, the Status outputs sent, On Error; Failure (websocket/connect-failed)",
@@ -215290,9 +215466,9 @@ var ServerSentEvents = defineNode({
       const settles = s.pendingConnect ? [{ outcome: "unchanged" }] : void 0;
       run5.s.pendingConnect = false;
       run5.doConnect(true);
-      const own = run5.own.settled;
+      const own2 = run5.own.settled;
       const p = run5.patch();
-      const patch = own ? { ...p, outcome: own.outcome, ...own.error !== void 0 ? { error: own.error } : {}, ...settles ? { settles } : {} } : { ...p, outcome: "pending", ...settles ? { settles } : {} };
+      const patch = own2 ? { ...p, outcome: own2.outcome, ...own2.error !== void 0 ? { error: own2.error } : {}, ...settles ? { settles } : {} } : { ...p, outcome: "pending", ...settles ? { settles } : {} };
       if (!s.url)
         return said(
           "no URL: a stream already open or retrying is dropped silently (its request abandoned, its timer cancelled; a Connect still waiting: Unchanged), then it fails for good \u2014 Last Error `No URL was set on the stream`, On Error, Connection State error (Connected false, Retry Count 0), On Close; Failure (sse/connect-failed)",
@@ -218623,7 +218799,9 @@ var Expression = defineNode({
 var INPUT_PATTERNS2 = [/Inputs\.([A-Za-z0-9_]+)/g, /Inputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]/g];
 var SIGNAL_PATTERNS2 = [
   /Outputs\.([A-Za-z0-9_]+)\s*\(\s*\)/g,
-  /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\(\s*\)/g
+  /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\(\s*\)/g,
+  /Outputs\.([A-Za-z0-9_]+)\.send\s*\(\s*\)/g,
+  /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\.send\s*\(\s*\)/g
 ];
 var OUTPUT_PATTERNS2 = [/Outputs\.([A-Za-z0-9_]+)/g, /Outputs\s*\[\s*"([^"]*)"\s*\]/g];
 function collect2(source2, patterns, into, skip) {
@@ -218823,7 +219001,18 @@ var schedule3 = { scheduled: true };
 var JavaScriptFunction = defineNode({
   type: "JavaScriptFunction",
   // v2 (P109 ISL-051, s33): Error cleared to blank text and sent by a run that works and by a new Script (row C146)
-  version: 2,
+  // v3 (P107-S83-SENDFORM): `Outputs.x.send()` names a signal port, as `Outputs.x()` does
+  version: 3,
+  changes: [
+    {
+      version: 3,
+      says: "Code that fires a signal as `Outputs.done.send()` now makes `done` a signal port, and the call fires it (before, `done` was a value port, the call threw \"Cannot read properties of undefined (reading 'send')\", and the run reported Error and Failure every time)",
+      row: "P107-S83-SENDFORM",
+      migration: {
+        none: "Each before was a throw at every run: no value ever reached a `done` read as a value, so a wire from it carried nothing, and the same wire now carries the signal the code meant"
+      }
+    }
+  ],
   source: "packages/noodl-runtime/src/nodes/std-library/simplejavascript.ts",
   contract: "ports from the code and the written lists; when the code runs (the Script \u2014 only while Run is not wired, P107-C155 \u2014, Run, a changed ticked input; once a frame); Inputs, this and Noodl as the code sees them; publish on change; signal outputs; Success and Done after an await; a throw, sync or async; a compile failure; no script \u2014 FUNCTION_FIXTURES, one per rule",
   state: {
@@ -219834,12 +220023,12 @@ function run4(s, trigger, _world) {
 }
 function blockPorts(ws) {
   const io = detectIO2(typeof ws === "string" ? ws : void 0);
-  const own = (list2) => (n) => list2.indexOf(n) === -1;
+  const own2 = (list2) => (n) => list2.indexOf(n) === -1;
   return {
-    inputs: io.inputs.map((p) => p.name).filter(own(RESERVED_INPUTS2)),
-    signalInputs: io.signalInputs.filter(own(RESERVED_INPUTS2)),
-    outputs: io.outputs.map((p) => p.name).filter(own(RESERVED_OUTPUTS4)),
-    signalOutputs: io.signalOutputs.filter(own(RESERVED_OUTPUTS4))
+    inputs: io.inputs.map((p) => p.name).filter(own2(RESERVED_INPUTS2)),
+    signalInputs: io.signalInputs.filter(own2(RESERVED_INPUTS2)),
+    outputs: io.outputs.map((p) => p.name).filter(own2(RESERVED_OUTPUTS4)),
+    signalOutputs: io.signalOutputs.filter(own2(RESERVED_OUTPUTS4))
   };
 }
 var typeOf = (ws, plug, name2) => typeOfPort2(detectIO2(typeof ws === "string" ? ws : void 0), plug, name2);
@@ -220123,7 +220312,7 @@ function portContextReader(project, options = {}) {
     if (wired.length) context.wired = wired;
     if (wiredOutputs.length) context.wiredOutputs = wiredOutputs;
     if (backends.length) context.backends = backends.map((b) => ({ ...b }));
-    const schema = schemaFor3(project.metadata, node.parameters ?? {});
+    const schema = schemaFor3(project.metadata, NO_BACKEND_INPUT.includes(node.type) ? {} : node.parameters ?? {});
     if (schema) context.schema = schema;
     if (stacks.length) context.stacks = stacks;
     if (routers.length) context.routers = routers;
@@ -220132,6 +220321,7 @@ function portContextReader(project, options = {}) {
     return context;
   };
 }
+var NO_BACKEND_INPUT = ["net.noodl.user.SignUp"];
 function unique(names2) {
   return [...new Set(names2)];
 }
@@ -231753,6 +231943,12 @@ var fs7 = __toESM(require("fs"));
 var path8 = __toESM(require("path"));
 
 // src/projectExport.ts
+var LOOPBACK = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?(\/|$)/i;
+function loopbackBackendWarning(metadata) {
+  const endpoint = metadata?.cloudservices?.endpoint;
+  if (typeof endpoint !== "string" || !LOOPBACK.test(endpoint)) return void 0;
+  return `This app talks to a backend on this computer (${endpoint}), and the deployed copy will ask each visitor's own computer for it, so its records, sign-in and functions will not work for anyone else. Put the backend on a server first (deploy_to_vm, or nodegx-deploy --full-stack, ships both), or point the project at a backend others can reach, then deploy again.`;
+}
 function resolveRootNode(project) {
   const components = project.getComponents();
   const byName = (name2) => components.find((c) => c.name === name2);
@@ -231786,7 +231982,18 @@ function projectModelFromLegacy(legacy) {
 var fs6 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 init_scriptfiles();
-var readJson = (file) => JSON.parse(fs6.readFileSync(file, "utf8"));
+var readJson = (file) => {
+  const text3 = fs6.readFileSync(file, "utf8");
+  try {
+    return JSON.parse(text3);
+  } catch (e) {
+    const why = text3.trim() === "" ? "the file is empty, so it is not valid JSON" : e instanceof Error ? e.message : String(e);
+    throw Object.assign(new Error(`${file.split(path7.sep).join("/")}: ${why}`), { projectFile: file });
+  }
+};
+function isProjectFileError(error) {
+  return !!error && typeof error.projectFile === "string";
+}
 function resolveTarget(target) {
   const abs = path7.resolve(target);
   if (!fs6.existsSync(abs)) throw new Error(`No such file or directory: ${abs}`);
@@ -231916,6 +232123,9 @@ function flatten3(roots) {
   for (const root2 of roots) visit(root2, void 0);
   return out;
 }
+function recordedVisualRoots(list2) {
+  return Array.isArray(list2) && list2.length > 0 ? { visualRoots: list2.filter((id) => typeof id === "string") } : {};
+}
 function fromLegacyProject(project) {
   const components = [];
   for (const comp of project.components ?? []) {
@@ -231929,7 +232139,8 @@ function fromLegacyProject(project) {
     components.push({
       name: comp.name,
       nodes: flatten3(graph.roots ?? []),
-      connections
+      connections,
+      ...recordedVisualRoots(graph.visualRoots)
     });
   }
   return {
@@ -232677,6 +232888,7 @@ function cloudPortMeaning(type, plug) {
 
 // ../noodl-editor/src/editor/src/validation/functionScriptUses.ts
 init_scriptfiles();
+var FUNCTION_NODE_TYPE = "JavaScriptFunction";
 
 // ../noodl-editor/src/editor/src/validation/functionPorts.ts
 var SCRIPT_NODE_API_MEMBERS = [
@@ -232695,6 +232907,10 @@ var SCRIPT_DECLARATION = new RegExp(
   )
 );
 
+// ../noodl-editor/src/editor/src/validation/publicWriteDoor.ts
+var RECORD_WRITE_SCRIPT_MEMBERS = ["create", "save", "delete", "increment", "addRelation", "removeRelation"];
+var SCRIPT_WRITE_CALL = new RegExp(`\\bRecords\\s*\\.\\s*(${RECORD_WRITE_SCRIPT_MEMBERS.join("|")})\\s*\\(`);
+
 // ../noodl-editor/src/editor/src/validation/typedWordNotTranslated.ts
 var HAS_LETTER = new RegExp("\\p{L}", "u");
 
@@ -232891,7 +233107,11 @@ var AUTHORED_BLOCKING_WARNINGS = /* @__PURE__ */ new Set([
   // and **no `completed` wires at all**. `completed` is a rare port — authors
   // reach for `done` — so the blast radius of making this blocking is small, and
   // that is a measurement rather than a hope.
-  "completed-commits-unchecked" /* CompletedCommitsUnchecked */
+  "completed-commits-unchecked" /* CompletedCommitsUnchecked */,
+  // Bug P121-TWO003-SCRIPTCOMPILE — the runtime's own compile fails, so every Run fails. No benign
+  // reading for a graph an agent just wrote; the write said nothing before, and the first person
+  // to run the function got "That could not be done."
+  "function-script-not-compiled" /* FunctionScriptNotCompiled */
 ]);
 
 // ../noodl-editor/src/editor/src/validation/diagnosticExamples.ts
@@ -233020,6 +233240,17 @@ var DIAGNOSTIC_EXAMPLES = [
     code: "function-trusts-a-field-the-caller-wrote" /* FunctionTrustsAFieldTheCallerWrote */,
     examples: ["cloud-share-my-records-with-someone"],
     why: "a cloud function that returns the records of the shares' owners, never a field the page wrote"
+  },
+  // P112 OWN-026 FIX-06 B — a group joined only through its owner's invitation, written only by a function.
+  {
+    code: "role-named-by-a-field-the-caller-wrote" /* RoleNamedByAFieldTheCallerWrote */,
+    examples: ["cloud-members-can-edit-my-records"],
+    why: "a cloud function that names the role from the invitation's owner, so an invitation only lets someone into its creator's group"
+  },
+  {
+    code: "function-guards-an-open-collection" /* FunctionGuardsAnOpenCollection */,
+    examples: ["cloud-members-can-edit-my-records"],
+    why: `the records only a function creates, with the collection's create rule "nobody": the function runs as the system`
   }
 ];
 
@@ -233210,6 +233441,9 @@ var unknownNodeType = {
   }
 };
 
+// ../noodl-editor/src/editor/src/validation/rules/nonexistentPort.ts
+init_renamed_ports();
+
 // ../noodl-editor/src/editor/src/views/panels/propertyeditor/propertyPanelTiers.ts
 var ADVANCED_CSS_GROUPS = {
   // ── plumbing ────────────────────────────────────────────────────────────────
@@ -233288,18 +233522,23 @@ function otherEndKind(catalog, nodeById, conn, plug) {
   }
   return portKindOfTypeName(other.instancePortTypes?.[port5]);
 }
+function renamedPort(type, port5, plug) {
+  const to = plug === "output" ? renamedOutput(type, port5) : void 0;
+  return to ? { to, sentence: ` It was renamed "${to}" in August 2026: wire "${to}".` } : void 0;
+}
 function missingDrawnPort(catalog, nodeById, conn, component, node, port5, plug, drawn3) {
   const names2 = [...drawn3];
   const tail = (name2) => name2.slice(name2.indexOf("-") + 1).toLowerCase();
   const suffixed = names2.filter((name2) => tail(name2) === port5.toLowerCase() || tail(name2) === tail(port5));
-  const suggestion = suffixed.length > 0 ? nearest(port5, suffixed) ?? suffixed[0] : nearest(port5, names2);
+  const renamed = renamedPort(node.type, port5, plug);
+  const suggestion = renamed && drawn3.has(renamed.to) ? renamed.to : suffixed.length > 0 ? nearest(port5, suffixed) ?? suffixed[0] : nearest(port5, names2);
   const wireKind = otherEndKind(catalog, nodeById, conn, plug);
   const fromProject = names2.filter((name2) => !catalog.hasPort(node.type, plug, name2)).sort();
   const alternatives = [.../* @__PURE__ */ new Set([...fromProject, ...availableAlternatives(catalog, node.type, plug, wireKind).filter((name2) => drawn3.has(name2))])].slice(0, MAX_ALTERNATIVES3);
   return {
     code: "nonexistent-port" /* NonexistentPort */,
     severity: "error",
-    message: `${node.type} has no ${plug} named "${port5}" with its settings in this project.`,
+    message: `${node.type} has no ${plug} named "${port5}" with its settings in this project.` + (renamed && drawn3.has(renamed.to) ? renamed.sentence : ""),
     location: {
       component,
       nodeId: node.id,
@@ -233379,12 +233618,13 @@ var nonexistentPort = {
           }
           const wireKind = otherEndKind(catalog, nodeById, conn, plug);
           const prefixed = missingPrefix ? missingPrefix + port5 : void 0;
-          const suggestion = catalog.suggestPort(node.type, plug, port5, wireKind) ?? prefixed;
+          const renamed = renamedPort(node.type, port5, plug);
+          const suggestion = renamed?.to ?? catalog.suggestPort(node.type, plug, port5, wireKind) ?? prefixed;
           const alternatives = availableAlternatives(catalog, node.type, plug, wireKind);
           out.push({
             code: "nonexistent-port" /* NonexistentPort */,
             severity: "error",
-            message: `${node.type} has no ${plug} named "${port5}".` + (prefixed ? ` Its other ${plug}s exist only as "${missingPrefix}<name>", so a name without the prefix is never made and nothing goes through this wire. If "${port5}" is ${cloudPortMeaning(node.type, plug)}, wire "${prefixed}".` : ""),
+            message: `${node.type} has no ${plug} named "${port5}".` + (renamed?.sentence ?? "") + (prefixed ? ` Its other ${plug}s exist only as "${missingPrefix}<name>", so a name without the prefix is never made and nothing goes through this wire. If "${port5}" is ${cloudPortMeaning(node.type, plug)}, wire "${prefixed}".` : ""),
             location: {
               component: component.name,
               nodeId: node.id,
@@ -233587,6 +233827,7 @@ var detachedPageContent = {
 };
 
 // ../noodl-editor/src/editor/src/validation/rules/invalidHierarchy.ts
+var RECORDED_VISUAL_ROOT = { allowAsChild: true, category: "Visual" };
 function hierarchyTyper(ctx) {
   const byName = /* @__PURE__ */ new Map();
   for (const c of ctx.project.components) {
@@ -233606,8 +233847,9 @@ function hierarchyTyper(ctx) {
     const childIds = new Set(component.nodes.flatMap((n) => n.children));
     const roots = component.nodes.filter((n) => n.parent === void 0 && !childIds.has(n.id));
     const known = (n) => typeOf2(n.type);
+    const rootType = (n) => known(n) ?? (component.visualRoots?.includes(n.id) ? RECORDED_VISUAL_ROOT : void 0);
     const derived = componentHierarchyType(
-      roots.map(known).filter((t) => !!t),
+      roots.map(rootType).filter((t) => !!t),
       component.nodes.map(known).filter((t) => !!t)
     );
     inFlight.delete(typeName4);
@@ -234478,6 +234720,123 @@ var settingsDiagnostic = {
   }
 };
 
+// ../noodl-editor/src/editor/src/validation/rules/functionScriptNotCompiled.ts
+var CODE_PREFIX3 = "const Script = (typeof Node !== 'undefined')?Node:undefined;\n";
+var PARAMS2 = ["Inputs", "Outputs", "Noodl", "Component", "Scripts"];
+function functionScriptCompileError(script2) {
+  try {
+    const AsyncFunction = Object.getPrototypeOf(async function() {
+    }).constructor;
+    new AsyncFunction(...PARAMS2, CODE_PREFIX3 + script2);
+    return void 0;
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    const line = syntaxErrorLine(script2);
+    return line === void 0 ? { message } : { message, line };
+  }
+}
+function syntaxErrorLine(script2) {
+  const file = "nodegx-function-script";
+  try {
+    const vm = typeof require === "function" ? require("vm") : void 0;
+    if (!vm?.Script) return void 0;
+    new vm.Script(`(async function (${PARAMS2.join(", ")}) {
+${script2}
+})`, { filename: file });
+  } catch (e) {
+    const stack = e && typeof e === "object" ? e.stack : void 0;
+    const match = typeof stack === "string" ? new RegExp(`${file}:(\\d+)`).exec(stack) : null;
+    if (match) return Math.max(1, Number(match[1]) - 1);
+  }
+  return void 0;
+}
+var functionScriptNotCompiled = {
+  code: "function-script-not-compiled" /* FunctionScriptNotCompiled */,
+  description: "A Function's script does not compile, so the Function can never run.",
+  defaultEnabled: true,
+  run(ctx) {
+    const out = [];
+    for (const { component } of ctx.components) {
+      for (const node of component.nodes) {
+        if (node.type !== FUNCTION_NODE_TYPE) continue;
+        const script2 = node.parameters?.functionScript;
+        if (typeof script2 !== "string" || script2.trim() === "") continue;
+        const error = functionScriptCompileError(script2);
+        if (!error) continue;
+        const name2 = node.label ? `"${node.label}"` : "This Function";
+        out.push({
+          code: "function-script-not-compiled" /* FunctionScriptNotCompiled */,
+          severity: "warning",
+          message: `${name2}'s script does not compile${error.line !== void 0 ? ` (line ${error.line})` : ""}: ${error.message}. It can never run: every Run fails with function/script-not-compiled. Fix the script; a regular expression or URL written inside a template literal loses its backslashes, so \`\\/\\/\` arrives as \`//\`, which starts a comment.`,
+          location: {
+            component: component.name,
+            nodeId: node.id,
+            nodeType: node.type,
+            nodeLabel: node.label,
+            port: "functionScript"
+          }
+        });
+      }
+    }
+    return out;
+  }
+};
+
+// ../noodl-editor/src/editor/src/validation/rules/functionNeverReruns.ts
+var RUN_ON_CHANGE_PREFIX3 = "runOnChange-";
+var functionNeverReruns = {
+  code: "function-never-reruns" /* FunctionNeverReruns */,
+  description: "Nothing re-runs a node when its inputs change: its control signal is unwired and every wired input is set not to run on change.",
+  defaultEnabled: true,
+  run(ctx) {
+    const out = [];
+    const { catalog } = ctx;
+    for (const { component } of ctx.components) {
+      const incoming = /* @__PURE__ */ new Map();
+      for (const c of component.connections) {
+        const list2 = incoming.get(c.toId);
+        if (list2) list2.push(c);
+        else incoming.set(c.toId, [c]);
+      }
+      for (const node of component.nodes) {
+        const isFunction2 = node.type === FUNCTION_NODE_TYPE;
+        if (!isFunction2 && !catalog.isRunOnValueChangeFamily(node.type)) continue;
+        const inbound = incoming.get(node.id) ?? [];
+        if (inbound.length === 0) continue;
+        if (inbound.some((c) => catalog.getPort(node.type, "input", c.toProperty)?.isSignal)) continue;
+        const governed = [
+          ...new Set(
+            inbound.map((c) => c.toProperty).filter(
+              (port5) => isFunction2 ? port5.startsWith("in-") : !!catalog.getPort(node.type, "input", RUN_ON_CHANGE_PREFIX3 + port5)
+            )
+          )
+        ];
+        if (governed.length === 0) continue;
+        const params = node.parameters ?? {};
+        if (!governed.every((port5) => params[RUN_ON_CHANGE_PREFIX3 + port5] === false)) continue;
+        const name2 = node.label ? `"${node.label}"` : isFunction2 ? "This Function" : "This node";
+        const shown = governed.map((p) => `"${isFunction2 ? p.slice("in-".length) : p}"`).join(", ");
+        out.push({
+          code: "function-never-reruns" /* FunctionNeverReruns */,
+          severity: "warning",
+          message: `Nothing re-runs ${name2} when its inputs change: Run is not wired, and every wired input (${shown}) has Run On Value Change unticked. ` + (isFunction2 ? "It runs once when it loads, and a new value on any of them never runs it again. " : "") + "Wire Run to what should start it, or tick Run On Value Change on the input whose new value should run it.",
+          location: {
+            component: component.name,
+            nodeId: node.id,
+            nodeType: node.type,
+            nodeLabel: node.label,
+            port: RUN_ON_CHANGE_PREFIX3 + governed[0],
+            plug: "input"
+          },
+          suggestion: `${RUN_ON_CHANGE_PREFIX3}${governed[0]}: true`,
+          alternatives: governed.map((p) => `${RUN_ON_CHANGE_PREFIX3}${p}: true`)
+        });
+      }
+    }
+    return out;
+  }
+};
+
 // ../noodl-editor/src/editor/src/validation/rules/index.ts
 var ALL_RULES = [
   duplicateNodeId,
@@ -234529,6 +234888,11 @@ var ALL_RULES = [
   // the first fires on `prep` and never on the `RunTasks` carrying the defect,
   // so this covers a hole in it rather than repeating it.
   completedCommitsUnchecked,
+  // P121 bugs SCRIPTCOMPILE / NEVERRUNS — a Function that can never run, and one that never
+  // re-runs: breakage of the graph's behaviour, so beside the outcome rules and before the
+  // arrangement ones.
+  functionScriptNotCompiled,
+  functionNeverReruns,
   repeatedSiblingSubtree,
   // DEF-025 — beside `repeatedSiblingSubtree` because both read the visual
   // tree's arrangement rather than wires: that one asks whether siblings
@@ -235223,6 +235587,35 @@ function describeWireHealth(reading) {
   return lines;
 }
 
+// src/skeleton.ts
+var SKELETON_PLACEHOLDER_MARKER = " \u2014 nothing built yet. Review the plan in docs/ and start when you are ready.";
+function untouchedSkeletonPages(project) {
+  const pages = [];
+  for (const component of project.getComponents()) {
+    const nodes = [];
+    component.graph.forEachNode((node) => {
+      nodes.push({ typename: node.typename, parameters: node.parameters ?? {} });
+    });
+    if (!nodes.some((n) => n.typename === "Page")) continue;
+    if (!isUntouchedSkeletonPage(nodes)) return [];
+    pages.push(component.name.replace(/^\/(#__page__\/)?/, ""));
+  }
+  return pages;
+}
+function isUntouchedSkeletonPage(nodes) {
+  if (nodes.length !== 2) return false;
+  const page = nodes.find((n) => n.typename === "Page");
+  const text3 = nodes.find((n) => n.typename === "Text");
+  if (!page || !text3) return false;
+  const value2 = text3.parameters["text"];
+  return typeof value2 === "string" && value2.endsWith(SKELETON_PLACEHOLDER_MARKER);
+}
+function skeletonWarning(pages) {
+  if (!pages.length) return void 0;
+  const named = pages.length === 1 ? `${pages[0]} is` : `${pages.join(", ")} are`;
+  return `Nothing is built in this project yet: ${named} still the placeholder create_project wrote, whose sentence is addressed to the agent, and it is what every visitor will see. It was published as it is; build the app, then deploy again.`;
+}
+
 // src/deploy.ts
 var DEPLOY_INDEX = path9.join(EXTERNAL_DIR, "deploy", "index.json");
 function assertDeployRuntime() {
@@ -235294,6 +235687,11 @@ async function deployProject(options) {
   } finally {
     if (stage) fs9.rmSync(stage.stage, { recursive: true, force: true });
   }
+  const cloudservices = project.getMetaData("cloudservices");
+  const loopback = fullStack ? void 0 : loopbackBackendWarning({ cloudservices });
+  const localBackend = loopback ? { endpoint: String(cloudservices?.endpoint), warning: loopback } : void 0;
+  const skeletonPages = untouchedSkeletonPages(project);
+  const skeleton = skeletonWarning(skeletonPages);
   const roots = readDeployedRoots(fullStack ? path9.join(options.outDir, "app") : options.outDir);
   return {
     outDir: options.outDir,
@@ -235312,10 +235710,16 @@ async function deployProject(options) {
     blank: gradeRoots(roots),
     engine,
     wires,
+    ...localBackend ? { localBackend: localBackend.endpoint } : {},
+    ...skeleton ? { skeletonPages } : {},
     // EXP-017 AC4 — a duplicate the copy step could not leave out reaches the person through the
     // same channel every other deploy warning does, rather than only the editor's console.
     warnings: [
       ...warnings,
+      // P112-OWN023-DEPLOYLOOPBACK — a static site cannot reach a backend on the builder's machine. A full-stack
+      // folder carries its backend, and the backend serves the app with its own address in place of this one.
+      ...localBackend ? [localBackend.warning] : [],
+      ...skeleton ? [skeleton] : [],
       ...describeWireHealth(wires),
       ...copyReport.duplicatesKept.map(
         (kept) => `${kept.path} (${kept.bytes} B) is the same file as ${kept.keep} and both were published \u2014 ${kept.reason}. Point that reference at ${kept.keep} to stop shipping it twice.`
@@ -235380,9 +235784,24 @@ async function main() {
     result2 = { ok: true, ...outcome };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    result2 = error instanceof DevelopmentEngineError ? { ok: false, stage: "engine", message, engine: error.engine } : error instanceof FullStackTargetError ? { ok: false, stage: "target", message } : error instanceof FullStackInstallError ? { ok: false, stage: "runtime", message } : { ok: false, stage: classify(message), message };
+    result2 = error instanceof DevelopmentEngineError ? { ok: false, stage: "engine", message, engine: error.engine } : error instanceof FullStackTargetError ? { ok: false, stage: "target", message } : error instanceof FullStackInstallError ? { ok: false, stage: "runtime", message } : (
+      // P112-S13-DEPLOYBADJSON: a project file that is not JSON was filed under `write`.
+      isProjectFileError(error) ? { ok: false, stage: "project", message } : { ok: false, stage: classify(message), message }
+    );
   }
   realWrite(JSON.stringify(result2) + "\n");
+  if (result2.ok && result2.localBackend) {
+    const sentence = result2.warnings.find((w) => w.includes(result2.localBackend));
+    if (sentence) process.stderr.write(`
+nodegx-deploy: ${sentence}
+`);
+  }
+  if (result2.ok && result2.skeletonPages) {
+    const sentence = result2.warnings.find((w) => w.startsWith("Nothing is built in this project yet"));
+    if (sentence) process.stderr.write(`
+nodegx-deploy: ${sentence}
+`);
+  }
   process.exitCode = 0;
 }
 main().catch((error) => {