@nodegx/preview 0.2.5 → 0.2.6

package/dist/noodl-preview.cjs

@@ -18277,6 +18277,27 @@ var init_run_on_value_change = __esm({
   }
 });
 
+// ../noodl-runtime/src/tracecause.ts
+function currentTraceCause(context) {
+  const c = context;
+  return c && c.traceEnabled ? c._currentCause || 0 : 0;
+}
+function withTraceCause(context, cause, fn) {
+  const c = context;
+  if (!cause || !c || !c.traceEnabled) return fn();
+  const previous = c._currentCause;
+  c._currentCause = cause;
+  try {
+    return fn();
+  } finally {
+    c._currentCause = previous;
+  }
+}
+var init_tracecause = __esm({
+  "../noodl-runtime/src/tracecause.ts"() {
+  }
+});
+
 // ../noodl-runtime/src/outputproperty.ts
 var require_outputproperty = __commonJS({
   "../noodl-runtime/src/outputproperty.ts"(exports2, module2) {
@@ -18452,6 +18473,7 @@ var require_node2 = __commonJS({
     init_diagnostics();
     init_outcome();
     init_run_on_value_change();
+    init_tracecause();
     var OutputProperty = require_outputproperty();
     var NAN_INPUT_KEY = "node/nan-input/";
     var SIGNAL_PULSE = Object.freeze({ __noodlSignalPulse: true });
@@ -18964,6 +18986,8 @@ var require_node2 = __commonJS({
     });
     Node17.prototype.beginOutcome = function(inputData) {
       const token = { reported: void 0 };
+      const cause = currentTraceCause(this.context);
+      if (cause) token.cause = cause;
       const scope = this.nodeScope;
       const runContext = scope && scope.runContext;
       if (runContext && runContext.beginStep) {
@@ -18999,6 +19023,10 @@ var require_node2 = __commonJS({
         return;
       }
       token.reported = outcome;
+      const traceContext = this.context;
+      const tokenCause = token.cause;
+      const causeBefore = traceContext ? traceContext._currentCause : 0;
+      if (tokenCause && traceContext && traceContext.traceEnabled) traceContext._currentCause = tokenCause;
       this._raisingForOutcome = true;
       try {
         if (outcome === "failure" && !(options && options.raise === false)) {
@@ -19028,6 +19056,7 @@ var require_node2 = __commonJS({
         }
       } finally {
         this._raisingForOutcome = false;
+        if (tokenCause && traceContext && traceContext.traceEnabled) traceContext._currentCause = causeBefore;
       }
       const step = token.step;
       if (step !== void 0 && step !== null) {
@@ -19123,7 +19152,12 @@ var require_node2 = __commonJS({
       this.flagDirty();
     };
     Node17.prototype.scheduleAfterInputsHaveUpdated = function(callback) {
-      this._afterInputsHaveUpdatedCallbacks.push(callback);
+      const cause = currentTraceCause(this.context);
+      this._afterInputsHaveUpdatedCallbacks.push(
+        cause ? function() {
+          return withTraceCause(this.context, cause, () => callback.call(this));
+        } : callback
+      );
       this.flagDirty();
     };
     Node17.prototype.setNodeModel = function(nodeModel) {
@@ -19226,6 +19260,60 @@ var require_node2 = __commonJS({
   }
 });
 
+// ../nodegx-project-contract/renamed-ports.ts
+function renamedOutput(typeName2, port) {
+  const renames = own.call(RENAMED_OUTPUTS, typeName2) ? RENAMED_OUTPUTS[typeName2] : void 0;
+  return renames && own.call(renames, port) ? renames[port] : void 0;
+}
+var RENAMED_OUTPUTS, own;
+var init_renamed_ports = __esm({
+  "../nodegx-project-contract/renamed-ports.ts"() {
+    "use strict";
+    RENAMED_OUTPUTS = {
+      AddDbModelRelation: { relationAdded: "done" },
+      Boolean: { stored: "completed" },
+      CloudFunction2: { success: "done" },
+      CollectionClear: { modified: "done" },
+      CollectionInsert: { modified: "done" },
+      CollectionNew: { created: "done" },
+      CollectionRemove: { modified: "done" },
+      Color: { stored: "completed" },
+      DeleteDbModelProperties: { deleted: "done" },
+      "Event Sender": { sent: "done" },
+      NavigationClosePopup: { success: "done" },
+      NewDbModelProperties: { created: "done" },
+      NewModel: { created: "done" },
+      Number: { stored: "completed" },
+      "Open File Picker": { success: "done", cancelled: "unchanged" },
+      PageStackNavigate: { navigated: "done" },
+      PageStackNavigateBack: { success: "done" },
+      PageStackNavigateToPath: { success: "done" },
+      RemoveDbModelRelation: { relationRemoved: "done" },
+      RouterNavigate: { navigated: "done" },
+      RunTasks: { success: "done" },
+      SetDbModelProperties: { stored: "done" },
+      SetModelProperties: { stored: "done" },
+      "Sign File URL": { success: "done" },
+      String: { stored: "completed" },
+      "Unique Id": { generated: "done" },
+      "Upload File": { success: "done" },
+      "net.noodl.HTTP": { success: "done" },
+      "net.noodl.SetComponentObjectProperties": { stored: "done" },
+      "net.noodl.SetParentComponentObjectProperties": { stored: "done" },
+      "net.noodl.externallink": { success: "done" },
+      "net.noodl.user.LogIn": { success: "done" },
+      "net.noodl.user.LogOut": { success: "done" },
+      "net.noodl.user.RequestMagicLink": { success: "done" },
+      "net.noodl.user.SetUserProperties": { success: "done" },
+      "net.noodl.user.SignInWith": { success: "done" },
+      "net.noodl.user.SignUp": { success: "done" },
+      "noodl.cloud.response": { sent: "done" },
+      "noodl.cloud.sendemail": { sent: "done", failed: "failure" }
+    };
+    own = Object.prototype.hasOwnProperty;
+  }
+});
+
 // ../noodl-runtime/src/guid.ts
 var require_guid = __commonJS({
   "../noodl-runtime/src/guid.ts"(exports2, module2) {
@@ -19243,6 +19331,7 @@ var require_guid = __commonJS({
 var require_nodescope = __commonJS({
   "../noodl-runtime/src/nodescope.ts"(exports2, module2) {
     "use strict";
+    init_renamed_ports();
     var guid4 = require_guid();
     function hasNode(map2, id) {
       return Object.prototype.hasOwnProperty.call(map2, id);
@@ -19275,11 +19364,15 @@ var require_nodescope = __commonJS({
         var sourceNode = this.getNodeWithId(connectionData.sourceId), targetNode = this.getNodeWithId(connectionData.targetId);
         targetNode.registerInputIfNeeded(connectionData.targetPort);
         sourceNode.registerOutputIfNeeded(connectionData.sourcePort);
-        targetNode.connectInput(connectionData.targetPort, sourceNode, connectionData.sourcePort);
+        targetNode.connectInput(connectionData.targetPort, sourceNode, sourcePortOf(sourceNode, connectionData.sourcePort));
       } catch (e) {
         console.error(e.message);
       }
     };
+    function sourcePortOf(sourceNode, port) {
+      if (sourceNode.hasOutput(port)) return port;
+      return renamedOutput(sourceNode.name, port) ?? port;
+    }
     NodeScope.prototype.setNodeParameters = function(node, nodeModel) {
       const variant = this.context.variants.getVariant(nodeModel.type, nodeModel.variant);
       if (variant) {
@@ -19287,10 +19380,10 @@ var require_nodescope = __commonJS({
       } else {
         const parameters = nodeModel.parameters;
         var inputNames = Object.keys(parameters);
-        const RUN_ON_CHANGE_PREFIX3 = "runOnChange-";
+        const RUN_ON_CHANGE_PREFIX4 = "runOnChange-";
         const metadata = this.context.nodeRegister.hasNode(node.name) ? this.context.nodeRegister.getNodeMetadata(node.name) : void 0;
         const priorityOf = function(name2) {
-          if (name2.indexOf(RUN_ON_CHANGE_PREFIX3) === 0) return Number.MAX_SAFE_INTEGER;
+          if (name2.indexOf(RUN_ON_CHANGE_PREFIX4) === 0) return Number.MAX_SAFE_INTEGER;
           const input2 = metadata ? metadata.inputs[name2] : void 0;
           return input2 ? input2.inputPriority : 0;
         };
@@ -19464,7 +19557,9 @@ var require_nodescope = __commonJS({
     };
     NodeScope.prototype.removeConnection = function(connectionModel) {
       var targetNode = this.getNodeWithId(connectionModel.targetId);
-      targetNode.removeInputConnection(connectionModel.targetPort, connectionModel.sourceId, connectionModel.sourcePort);
+      const sourceNode = this.hasNodeWithId(connectionModel.sourceId) ? this.getNodeWithId(connectionModel.sourceId) : void 0;
+      const sourcePort = sourceNode ? sourcePortOf(sourceNode, connectionModel.sourcePort) : connectionModel.sourcePort;
+      targetNode.removeInputConnection(connectionModel.targetPort, connectionModel.sourceId, sourcePort);
     };
     NodeScope.prototype.setComponentModel = async function(componentModel) {
       this.componentModel = componentModel;
@@ -27078,7 +27173,9 @@ var init_function_ports = __esm({
     INPUT_PATTERNS = [/Inputs\.([A-Za-z0-9_]+)/g, /Inputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]/g];
     SIGNAL_PATTERNS = [
       /Outputs\.([A-Za-z0-9_]+)\s*\(\s*\)/g,
-      /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\(\s*\)/g
+      /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\(\s*\)/g,
+      /Outputs\.([A-Za-z0-9_]+)\.send\s*\(\s*\)/g,
+      /Outputs\s*\[\s*(?:'([^'\n]*)'|"([^"\n]*)")\s*\]\.send\s*\(\s*\)/g
     ];
     OUTPUT_PATTERNS = [/Outputs\.([A-Za-z0-9_]+)/g, /Outputs\s*\[\s*"([^"]*)"\s*\]/g];
     REGEX_AFTER = /* @__PURE__ */ new Set(["(", ",", "=", ":", "[", "!", "&", "|", "?", "{", "}", ";", "+", "-", "*", "%", "<", ">", "~", "^"]);
@@ -27095,6 +27192,7 @@ var require_simplejavascript = __commonJS({
     init_functionDiagnostics();
     init_scriptfiles();
     init_function_ports();
+    init_tracecause();
     var Node17 = require_node2();
     var JavascriptNodeParser4 = require_javascriptnodeparser();
     var { logJavaScriptNodeError: logJavaScriptNodeError2, thrownMessage: thrownMessage3 } = (init_utils(), __toCommonJS(utils_exports));
@@ -27464,11 +27562,12 @@ var require_simplejavascript = __commonJS({
           }
           const inputs = this._internal.inputValues;
           const outputs = this._internal.outputValuesProxy;
+          const runCause = currentTraceCause(this.context);
           placingSignalPorts(this).forEach((key) => {
             const _sendSignal = () => {
               this._internal.outputWrites.add(key.substring("out-".length));
               publishHeldWrites(this);
-              if (this.hasOutput(key)) this.sendSignalOnOutput(key);
+              if (this.hasOutput(key)) withTraceCause(this.context, runCause, () => this.sendSignalOnOutput(key));
             };
             const signalValue = _sendSignal;
             signalValue.send = _sendSignal;
@@ -27493,7 +27592,7 @@ var require_simplejavascript = __commonJS({
                 this._internal.lastError = "";
                 this.flagOutputDirty("error");
               }
-              this.sendSignalOnOutput("success");
+              withTraceCause(this.context, runCause, () => this.sendSignalOnOutput("success"));
               reportOutcomes(this, tokens, "done");
             }
           } catch (e) {
@@ -35613,6 +35712,466 @@ var init_TokenLifecycle = __esm({
   }
 });
 
+// ../noodl-runtime/src/api/backends/ParseAuthAdapter.ts
+function pageSays(response, phrase) {
+  return typeof response === "string" && response.indexOf(phrase) !== -1;
+}
+function htmlPageError(error, invalidPhrase, invalidMessage, fallback) {
+  if (typeof error !== "string" || error.indexOf("<") === -1) return error || fallback;
+  return error.indexOf(invalidPhrase) !== -1 ? invalidMessage : fallback;
+}
+function sessionTokenOf(session) {
+  return session ? session.sessionToken : void 0;
+}
+var guid, HANDOFF_PARAM, AUTH_ERROR_PARAM, SESSION_MOVED_MESSAGE, ParseAuthAdapter;
+var init_ParseAuthAdapter = __esm({
+  "../noodl-runtime/src/api/backends/ParseAuthAdapter.ts"() {
+    init_AuthEvents();
+    init_SessionStore();
+    init_TokenLifecycle();
+    guid = require_guid();
+    HANDOFF_PARAM = "nodegx_auth";
+    AUTH_ERROR_PARAM = "nodegx_auth_error";
+    SESSION_MOVED_MESSAGE = "Someone signed in or out while this was being checked, so its answer was not used. Check again.";
+    ParseAuthAdapter = class extends AuthEvents {
+      constructor(options) {
+        super();
+        /** BAK-004: the state of a sign-in returning from a provider or a magic link. */
+        this.oauthReturn = { inProgress: false };
+        /**
+         * One store and one controller per backend, keyed by application id.
+         *
+         * Per handle rather than per adapter because the contract's whole point is
+         * that a project may have more than one backend, and two backends have two
+         * sessions — the phase decided explicitly that they are never shared.
+         */
+        this.stores = /* @__PURE__ */ new Map();
+        this.controllers = /* @__PURE__ */ new Map();
+        this.serializeObject = options.serializeObject;
+        this.createStore = options.createStore || parseSessionStore;
+        this.lifecycle = options.lifecycle || { kind: "eternal" };
+      }
+      // ── Session storage ──────────────────────────────────────────────────────
+      sessionStore(handle) {
+        const appId = handle.publicToken;
+        const cacheKey = String(appId);
+        let store = this.stores.get(cacheKey);
+        if (store === void 0) {
+          store = this.createStore(appId);
+          this.stores.set(cacheKey, store);
+        }
+        return store;
+      }
+      /**
+       * The lifecycle controller for this backend.
+       *
+       * On Parse this is an `eternal` controller: it arms no timer, subscribes to no
+       * storage events, and its gate is a synchronous pass-through. It is on the
+       * request path anyway, so that BCN-004 adds a `performRefresh` rather than a
+       * call site.
+       */
+      lifecycleController(handle) {
+        const cacheKey = String(handle.publicToken);
+        let controller = this.controllers.get(cacheKey);
+        if (controller === void 0) {
+          controller = new TokenLifecycleController({
+            lifecycle: this.lifecycle,
+            store: this.sessionStore(handle),
+            onSessionLost: (reason) => {
+              this.emitAuthEvent("sessionChanged", void 0);
+              this.emitAuthEvent("sessionLost", reason);
+            },
+            onSessionClearedElsewhere: () => {
+              this.emitAuthEvent("sessionChanged", void 0);
+              this.emitAuthEvent("loggedOut");
+            }
+          });
+          controller.start();
+          this.controllers.set(cacheKey, controller);
+        }
+        return controller;
+      }
+      /** The stored session, or `undefined`. Not a contract method. */
+      getCurrentUser(handle) {
+        return this.sessionStore(handle).read();
+      }
+      setSession(handle, session) {
+        this.sessionStore(handle).write(session);
+        this.lifecycleController(handle).sessionChanged();
+        this.emitAuthEvent("sessionChanged", session);
+      }
+      clearSession(handle) {
+        this.sessionStore(handle).clear();
+        this.lifecycleController(handle).sessionChanged();
+        this.emitAuthEvent("sessionChanged", void 0);
+      }
+      // ── The wire ─────────────────────────────────────────────────────────────
+      /**
+       * The Parse auth seam. Moved from `userservice.ts:198` with one substitution:
+       * `this.endpoint`/`this.appId` became `handle.url`/`handle.publicToken`.
+       *
+       * It is deliberately *not* `ParseWireAdapter._makeRequest`. The two differ in
+       * three ways that all matter: this one sends `X-Parse-Installation-Id`, never
+       * sends a master key, and hands its error callback Parse's `code` (the `209`
+       * the session check turns on). Merging them would be a rewrite in a task
+       * whose value is that nothing was rewritten.
+       */
+      _makeRequest(handle, path8, options) {
+        if (!handle.url) {
+          if (options.error) {
+            options.error({ error: "No active cloud service", status: 0 });
+          }
+          return;
+        }
+        const store = this.sessionStore(handle);
+        this.lifecycleController(handle).withSession((session) => {
+          const xhr = new XMLHttpRequest();
+          xhr.onreadystatechange = function() {
+            if (xhr.readyState === 4) {
+              let json;
+              try {
+                json = JSON.parse(xhr.response);
+              } catch (e) {
+              }
+              if (xhr.status === 200 || xhr.status === 201) {
+                options.success(json || xhr.response);
+              } else options.error(json || { error: xhr.responseText, status: xhr.status });
+            }
+          };
+          xhr.open(options.method || "GET", handle.url + path8, true);
+          xhr.setRequestHeader("X-Parse-Application-Id", handle.publicToken);
+          const iidKey = parseInstallationIdKey(handle.publicToken);
+          let _iid = store.readKey(iidKey);
+          if (_iid === void 0) {
+            _iid = guid();
+            store.writeKey(iidKey, _iid);
+          }
+          xhr.setRequestHeader("X-Parse-Installation-Id", _iid);
+          if (options.sessionToken) xhr.setRequestHeader("X-Parse-Session-Token", options.sessionToken);
+          else if (session !== void 0) {
+            xhr.setRequestHeader("X-Parse-Session-Token", session.sessionToken);
+          }
+          xhr.setRequestHeader("Content-Type", "application/json");
+          xhr.send(JSON.stringify(options.content));
+        });
+      }
+      // ── The ten ──────────────────────────────────────────────────────────────
+      logIn(handle, options) {
+        this._makeRequest(handle, "/login", {
+          method: "POST",
+          content: {
+            username: options.username,
+            password: options.password,
+            _method: "GET"
+          },
+          success: (response) => {
+            this.setSession(handle, response);
+            options.success(response);
+            this.emitAuthEvent("loggedIn", response);
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      logOut(handle, options) {
+        this._makeRequest(handle, "/logout", {
+          method: "POST",
+          content: {},
+          success: () => {
+            this.clearSession(handle);
+            options.success();
+            this.emitAuthEvent("loggedOut");
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      signUp(handle, options) {
+        const additionalUserProps = options.properties ? this.serializeObject({ ...options.properties }, "_User") : {};
+        this._makeRequest(handle, "/users", {
+          method: "POST",
+          content: Object.assign({}, additionalUserProps, {
+            username: options.username,
+            password: options.password,
+            email: options.email
+          }),
+          success: (response) => {
+            const identity2 = { username: options.username };
+            if (options.email !== void 0) identity2.email = options.email;
+            const _cu = Object.assign(response, identity2, options.properties);
+            if (_cu.emailVerified === void 0) _cu.emailVerified = false;
+            this.setSession(handle, _cu);
+            options.success(response);
+            this.emitAuthEvent("loggedIn", _cu);
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      fetchCurrentUser(handle, options) {
+        const asked = sessionTokenOf(this.getCurrentUser(handle));
+        this._makeRequest(handle, "/users/me", {
+          method: "GET",
+          sessionToken: options.sessionToken,
+          success: (response) => {
+            if (sessionTokenOf(this.getCurrentUser(handle)) !== asked) {
+              options.error(SESSION_MOVED_MESSAGE);
+              return;
+            }
+            this.setSession(handle, response);
+            this.emitAuthEvent("sessionGained", response);
+            options.success(response);
+          },
+          error: (e) => {
+            if (sessionTokenOf(this.getCurrentUser(handle)) !== asked) {
+              options.error(SESSION_MOVED_MESSAGE);
+              return;
+            }
+            if (e.code === 209) {
+              this.sessionStore(handle).clear();
+              this.emitAuthEvent("sessionLost");
+            }
+            options.error(e.error);
+          }
+        });
+      }
+      verifyEmail(handle, options) {
+        this._makeRequest(
+          handle,
+          "/apps/" + handle.publicToken + "/verify_email?username=" + options.username + "&token=" + options.token,
+          {
+            method: "GET",
+            // This endpoint answers with an HTML page rather than JSON, so the outcome has to be
+            // read out of the page's text.
+            success: (response) => {
+              if (pageSays(response, "Successfully verified your email")) {
+                options.success();
+              } else if (pageSays(response, "Invalid Verification Link")) {
+                options.error("Invalid verification token");
+              } else {
+                options.error("Failed to verify email");
+              }
+            },
+            error: (e) => {
+              options.error(htmlPageError(e.error, "Invalid Verification Link", "Invalid verification token", "Failed to verify email"));
+            }
+          }
+        );
+      }
+      sendEmailVerification(handle, options) {
+        this._makeRequest(handle, "/verificationEmailRequest", {
+          method: "POST",
+          content: { email: options.email },
+          success: () => {
+            options.success();
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      resetPassword(handle, options) {
+        this._makeRequest(handle, "/apps/" + handle.publicToken + "/request_password_reset", {
+          method: "POST",
+          content: {
+            username: options.username,
+            token: options.token,
+            new_password: options.newPassword
+          },
+          success: (response) => {
+            if (pageSays(response, "Password successfully reset") || pageSays(response, "Successfully updated your password")) {
+              options.success();
+            } else if (pageSays(response, "Invalid Link")) {
+              options.error("Invalid or expired reset link");
+            } else {
+              options.error("Failed to reset password");
+            }
+          },
+          error: (e) => {
+            options.error(htmlPageError(e.error, "Invalid Link", "Invalid or expired reset link", "Failed to reset password"));
+          }
+        });
+      }
+      requestPasswordReset(handle, options) {
+        this._makeRequest(handle, "/requestPasswordReset", {
+          method: "POST",
+          content: { email: options.email },
+          success: () => {
+            options.success();
+          },
+          error: (e) => {
+            options.error(e.error);
+          }
+        });
+      }
+      /**
+       * Send the browser to a provider. This NAVIGATES AWAY: nothing after it runs,
+       * and the result arrives on a later page load through {@link consumeAuthReturn}.
+       *
+       * `redirect` defaults to the current page (minus any leftover sign-in
+       * parameters), so the user comes back where they were. The backend refuses
+       * any target that is neither same-origin nor on its `redirectAllowList` — if
+       * sign-in dead-ends with "origin not allowed", that list is the fix.
+       */
+      signInWithProvider(handle, options) {
+        if (!handle.url) {
+          if (options.error) options.error("No active cloud service");
+          return;
+        }
+        if (!options.provider) {
+          if (options.error) options.error("Sign In With: no provider was set.");
+          return;
+        }
+        const redirect = options.redirect || this._currentUrlWithoutAuthParams();
+        const url = `${handle.url}/oauth/${encodeURIComponent(options.provider)}/start?redirect=${encodeURIComponent(redirect)}`;
+        window.location.href = url;
+      }
+      /**
+       * Ask the backend to email a one-click sign-in link.
+       *
+       * Succeeds identically for a known and an unknown address — the endpoint is
+       * anonymous and anti-enumerating by design, so "success" here means "the
+       * request was accepted", never "an account exists". The node's help text says
+       * so, because a UI that claims "check your inbox" only for real accounts
+       * re-creates the oracle the endpoint removed.
+       */
+      requestMagicLink(handle, options) {
+        this._makeRequest(handle, "/auth/magic-link", {
+          method: "POST",
+          content: { email: options.email, redirect: options.redirect || this._currentUrlWithoutAuthParams() },
+          success: () => options.success(),
+          error: (e) => options.error(e.error)
+        });
+      }
+      // ── Not contract, and deliberately so ────────────────────────────────────
+      /**
+       * Write user-profile fields onto the signed-in user.
+       *
+       * Not one of the ten. It is the `Set User Properties` node's whole
+       * implementation, and BCN-006's Desired State §3 makes it schema-driven across
+       * five backends — which is step 6, not this pass. It moves with the wire
+       * because leaving it behind would have left a second `_makeRequest` in
+       * `userservice.ts`, and the entire claim of this move is that there is one.
+       */
+      setUserProperties(handle, options) {
+        const _cu = this.getCurrentUser(handle);
+        if (_cu === void 0) {
+          options.error("Nobody is signed in.");
+          return;
+        }
+        {
+          const propsToSave = this.serializeObject({ ...options.properties }, "_User");
+          const _content = Object.assign(
+            {},
+            { email: options.email, username: options.username },
+            propsToSave
+          );
+          delete _content.emailVerified;
+          delete _content.createdAt;
+          delete _content.updatedAt;
+          this._makeRequest(handle, "/users/" + _cu.objectId, {
+            method: "PUT",
+            content: _content,
+            success: (response) => {
+              Object.assign(_cu, _content);
+              this.setSession(handle, _cu);
+              options.success(response);
+            },
+            error: (e) => {
+              options.error(e.error);
+            }
+          });
+        }
+      }
+      /** The sign-in methods this backend offers — for rendering a set of buttons. */
+      listAuthProviders(handle, options) {
+        this._makeRequest(handle, "/auth/providers", {
+          method: "GET",
+          success: (response) => options.success(response),
+          error: (e) => options.error(e.error)
+        });
+      }
+      // ── BAK-004 — the provider return leg ────────────────────────────────────
+      /**
+       * Look for a sign-in result in the current URL and act on it.
+       *
+       * Returns true when this page load IS a sign-in return, so the caller can skip
+       * its ordinary stale-session validation.
+       *
+       * **Per backend, not contract.** BCN-006 step 5 is four different redirect
+       * shapes — Parse `authData`, Directus SSO, Supabase, PocketBase
+       * `auth-with-oauth2` — and this is the first of the four. What they have in
+       * common is only the *outcome*: a session, established. That is where the
+       * contract's surface is, and it is `signInWithProvider` plus a `loggedIn`.
+       */
+      consumeAuthReturn(handle) {
+        if (typeof window === "undefined" || !window.location) return false;
+        let params;
+        try {
+          params = new URLSearchParams(window.location.search);
+        } catch (e) {
+          return false;
+        }
+        const code = params.get(HANDOFF_PARAM);
+        const error = params.get(AUTH_ERROR_PARAM);
+        if (!code && !error) return false;
+        params.delete(HANDOFF_PARAM);
+        params.delete(AUTH_ERROR_PARAM);
+        this._stripAuthParamsFromUrl(params);
+        if (error) {
+          this.oauthReturn = { inProgress: false, succeeded: false, error };
+          setTimeout(() => this.emitAuthEvent("oauthReturn", this.oauthReturn), 0);
+          return true;
+        }
+        this.oauthReturn = { inProgress: true };
+        this._makeRequest(handle, "/oauth/exchange", {
+          method: "POST",
+          content: { code },
+          success: (response) => {
+            this.setSession(handle, response);
+            this.oauthReturn = {
+              inProgress: false,
+              succeeded: true,
+              outcome: response.authOutcome,
+              notice: response.authNotice || void 0
+            };
+            this.emitAuthEvent("oauthReturn", this.oauthReturn);
+            this.emitAuthEvent("loggedIn", response);
+          },
+          error: (e) => {
+            this.oauthReturn = {
+              inProgress: false,
+              succeeded: false,
+              error: e && e.error || "Sign-in could not be completed."
+            };
+            this.emitAuthEvent("oauthReturn", this.oauthReturn);
+          }
+        });
+        return true;
+      }
+      /** Rewrite the address bar without the sign-in parameters, keeping everything else. */
+      _stripAuthParamsFromUrl(remaining) {
+        if (!window.history || typeof window.history.replaceState !== "function") return;
+        const query = remaining.toString();
+        const cleaned = window.location.pathname + (query ? `?${query}` : "") + window.location.hash;
+        try {
+          window.history.replaceState(window.history.state, "", cleaned);
+        } catch (e) {
+        }
+      }
+      _currentUrlWithoutAuthParams() {
+        const url = new URL(window.location.href);
+        url.searchParams.delete(HANDOFF_PARAM);
+        url.searchParams.delete(AUTH_ERROR_PARAM);
+        return url.toString();
+      }
+    };
+  }
+});
+
 // ../noodl-runtime/src/api/backends/RestAuthAdapter.ts
 function restAuthProfileFor(type) {
   return PROFILES[type];
@@ -35704,6 +36263,7 @@ var init_RestAuthAdapter = __esm({
   "../noodl-runtime/src/api/backends/RestAuthAdapter.ts"() {
     init_src();
     init_AuthEvents();
+    init_ParseAuthAdapter();
     init_SessionStore();
     init_TokenLifecycle();
     DEFAULT_POCKETBASE_USER_COLLECTION = "users";
@@ -36269,12 +36829,20 @@ var init_RestAuthAdapter = __esm({
           { method, path: this.path(profile, profile.me), token, body: method === "POST" ? {} : void 0 },
           {
             ok: (body) => {
+              if (sessionTokenOf(this.getCurrentUser(handle)) !== sessionTokenOf(stored)) {
+                options.error(SESSION_MOVED_MESSAGE);
+                return;
+              }
               const session = this.readSession(profile, body, Object.assign({}, stored, { sessionToken: token })) ?? Object.assign({}, stored, this.readUser(profile, body), { sessionToken: token });
               this.setSession(handle, session);
               this.emitAuthEvent("sessionGained", session);
               options.success(session);
             },
             fail: (error) => {
+              if (sessionTokenOf(this.getCurrentUser(handle)) !== sessionTokenOf(stored)) {
+                options.error(SESSION_MOVED_MESSAGE);
+                return;
+              }
               if (error.status === 401 || error.status === 403) {
                 this.sessionStore(handle).clear();
                 this.emitAuthEvent("sessionLost", error.error);
@@ -38775,8 +39343,9 @@ function schemaFor(collectionName2) {
   try {
     collection = CloudStore._collections[collectionName2];
   } catch (e) {
-    return void 0;
+    collection = void 0;
   }
+  if (!collection) collection = hostCollection(collectionName2);
   if (!collection) return void 0;
   if (collection.schema) return { collection: collectionName2, properties: collection.schema.properties };
   if (Array.isArray(collection.columns)) {
@@ -38790,6 +39359,15 @@ function schemaFor(collectionName2) {
   }
   return void 0;
 }
+function hostCollection(collectionName2) {
+  if (typeof _noodl_cloud_runtime_version === "undefined" || typeof _noodl_cloudservices === "undefined") return void 0;
+  if (!_noodl_cloudservices || typeof _noodl_cloudservices.collections !== "function") return void 0;
+  try {
+    return (_noodl_cloudservices.collections() || []).find((c) => c && c.name === collectionName2);
+  } catch (e) {
+    return void 0;
+  }
+}
 function backendType() {
   try {
     const handle = CloudStore.instance && CloudStore.instance._handle && CloudStore.instance._handle();
@@ -70138,7 +70716,7 @@ function syncDataAttributesOnElement(node) {
   node._appliedDataAttributes = Object.keys(want);
 }
 function claimDataAttributeInputs(node) {
-  const own = node.registerInputIfNeeded;
+  const own2 = node.registerInputIfNeeded;
   node.registerInputIfNeeded = function(name2) {
     if (!this.hasInput(name2) && DATA_ATTRIBUTE_NAME.test(name2)) {
       this.registerInput(name2, {
@@ -70150,7 +70728,7 @@ function claimDataAttributeInputs(node) {
       });
       return;
     }
-    return own ? own.call(this, name2) : void 0;
+    return own2 ? own2.call(this, name2) : void 0;
   };
 }
 function scrollNodeIntoView(node, align) {
@@ -71700,7 +72278,7 @@ var init_Checkbox2 = __esm({
 });
 
 // ../noodl-viewer-react/src/guid.ts
-function guid() {
+function guid2() {
   function s4() {
     return Math.floor((1 + Math.random()) * 65536).toString(16).substring(1);
   }
@@ -71709,7 +72287,7 @@ function guid() {
 var guid_default;
 var init_guid = __esm({
   "../noodl-viewer-react/src/guid.ts"() {
-    guid_default = guid;
+    guid_default = guid2;
   }
 });
 
@@ -71929,6 +72507,17 @@ var init_checkbox = __esm({
 });
 
 // ../noodl-viewer-react/src/components/controls/Select/Select.tsx
+function domValueOf(item) {
+  if (item.Value === void 0 || item.Value === null || typeof item.Value === "boolean") {
+    const label = item.Label;
+    return (label === void 0 || label === null || typeof label === "boolean" ? "" : String(label)).replace(/[ \t\n\f\r]+/g, " ").trim();
+  }
+  return String(item.Value);
+}
+function offersValue(items, value2) {
+  if (!items || typeof value2 !== "string") return false;
+  return items.some((item) => item !== null && item !== void 0 && domValueOf(item) === value2);
+}
 function Select(props) {
   const [value2, setValue] = (0, import_react6.useState)(props.value);
   (0, import_react6.useEffect)(() => {
@@ -71942,7 +72531,7 @@ function Select(props) {
     style2 = Object.assign({}, props.textStyle, style2);
     style2.color = props.noodlNode.context.styles.resolveColor(style2.color);
   }
-  const selectedIndex = !props.items || value2 === void 0 ? -1 : props.items.findIndex((i2) => i2.Value === value2);
+  const selectedIndex = !props.items || value2 === void 0 ? -1 : props.items.findIndex((i2) => i2 !== null && i2 !== void 0 && domValueOf(i2) === value2);
   const { height, ...otherStyles } = style2;
   function _renderIcon() {
     if (props.iconSourceType === "image" && props.iconImageSource !== void 0)
@@ -72050,7 +72639,7 @@ function Select(props) {
       {
         ...inputProps,
         disabled: !props.enabled,
-        value: options.find((i2) => i2.props.value === value2) ? value2 : void 0,
+        value: offersValue(props.items, value2) ? value2 : "",
         ...utils_default.controlEvents(props),
         onChange: (e) => {
           setValue(e.target.value);
@@ -72223,12 +72812,14 @@ var init_options = __esm({
         this.props.id = "input-" + guid_default();
         this.props.items = DEFAULT_ITEMS.map((item) => ({ ...item }));
         this.props.value = this._internal.value = DEFAULT_ITEMS[0].Value;
+        this._internal.valueIsSeed = true;
         this.props.valueWrites = 0;
         this.props.valueChanged = (value2) => {
           const changed = this._internal.value !== value2;
           this.props.value = this._internal.value = value2;
           this.props.valueWrites++;
           if (changed) {
+            this._internal.valueIsSeed = false;
             this.flagOutputDirty("value");
             this.sendSignalOnOutput("onChange");
           }
@@ -72281,6 +72872,16 @@ var init_options = __esm({
               if (newValue && typeof newValue.on === "function") newValue.on("change", this._itemsChanged);
             }
             this.props.items = optionItems(this._internal.items);
+            if (this._internal.valueIsSeed) {
+              const offered = this.props.items;
+              const seed = this._internal.value;
+              if (!Array.isArray(offered) || !offered.some((item) => item && item.Value === seed)) {
+                this._internal.valueIsSeed = false;
+                this.props.value = this._internal.value = "";
+                this.props.valueWrites++;
+                this.flagOutputDirty("value");
+              }
+            }
             this.forceUpdate();
           }
         },
@@ -72299,6 +72900,7 @@ var init_options = __esm({
             }
             const changed = value2 !== this._internal.value;
             this.props.value = this._internal.value = value2;
+            this._internal.valueIsSeed = false;
             this.props.valueWrites++;
             if (changed) {
               this.forceUpdate();
@@ -78605,11 +79207,11 @@ var init_foreach = __esm({
           const internal2 = this._internal;
           const children = internal2.target.getChildren();
           let at = children.indexOf(this) + 1;
-          let own = 0;
+          let own2 = 0;
           for (let i2 = at; i2 < children.length; i2++) {
             if (internal2.itemNodes.indexOf(children[i2]) === -1) continue;
-            if (own === listIndex) return i2;
-            own++;
+            if (own2 === listIndex) return i2;
+            own2++;
             at = i2 + 1;
           }
           return at;
@@ -90999,8 +91601,8 @@ var init_timer = __esm({
           const a = this._internal._animation;
           if (a._isRunning !== true || this._internal.paused) return;
           const left = a.durationLeft();
-          const own = this._internal.resumed || { duration: a.duration, delay: a.delay };
-          this._internal.paused = { left: typeof left === "number" && left >= 0 ? left : a.duration, ...own };
+          const own2 = this._internal.resumed || { duration: a.duration, delay: a.delay };
+          this._internal.paused = { left: typeof left === "number" && left >= 0 ? left : a.duration, ...own2 };
           a.stop();
         },
         _onPageShown: function() {
@@ -95191,6 +95793,7 @@ __export(cloudfunction2_exports, {
   default: () => cloudfunction2_default
 });
 function _makeRequest(path8, options) {
+  options = holdOptionsForWrite(options);
   const xhr = new XMLHttpRequest();
   xhr.onreadystatechange = function() {
     if (xhr.readyState === 4) {
@@ -95235,6 +95838,7 @@ var init_cloudfunction2 = __esm({
   "../noodl-viewer-react/src/nodes/std-library/data/cloudfunction2.ts"() {
     import_runtime10 = __toESM(require_noodl_runtime());
     init_SessionStore();
+    init_pressguard();
     init_outcome();
     CALL_ERROR_CODE = "cloud-function/call-failed";
     CloudFunctionNode = {
@@ -97873,453 +98477,6 @@ var init_router_navigate = __esm({
   }
 });
 
-// ../noodl-runtime/src/api/backends/ParseAuthAdapter.ts
-function pageSays(response, phrase) {
-  return typeof response === "string" && response.indexOf(phrase) !== -1;
-}
-function htmlPageError(error, invalidPhrase, invalidMessage, fallback) {
-  if (typeof error !== "string" || error.indexOf("<") === -1) return error || fallback;
-  return error.indexOf(invalidPhrase) !== -1 ? invalidMessage : fallback;
-}
-var guid2, HANDOFF_PARAM, AUTH_ERROR_PARAM, ParseAuthAdapter;
-var init_ParseAuthAdapter = __esm({
-  "../noodl-runtime/src/api/backends/ParseAuthAdapter.ts"() {
-    init_AuthEvents();
-    init_SessionStore();
-    init_TokenLifecycle();
-    guid2 = require_guid();
-    HANDOFF_PARAM = "nodegx_auth";
-    AUTH_ERROR_PARAM = "nodegx_auth_error";
-    ParseAuthAdapter = class extends AuthEvents {
-      constructor(options) {
-        super();
-        /** BAK-004: the state of a sign-in returning from a provider or a magic link. */
-        this.oauthReturn = { inProgress: false };
-        /**
-         * One store and one controller per backend, keyed by application id.
-         *
-         * Per handle rather than per adapter because the contract's whole point is
-         * that a project may have more than one backend, and two backends have two
-         * sessions — the phase decided explicitly that they are never shared.
-         */
-        this.stores = /* @__PURE__ */ new Map();
-        this.controllers = /* @__PURE__ */ new Map();
-        this.serializeObject = options.serializeObject;
-        this.createStore = options.createStore || parseSessionStore;
-        this.lifecycle = options.lifecycle || { kind: "eternal" };
-      }
-      // ── Session storage ──────────────────────────────────────────────────────
-      sessionStore(handle) {
-        const appId = handle.publicToken;
-        const cacheKey = String(appId);
-        let store = this.stores.get(cacheKey);
-        if (store === void 0) {
-          store = this.createStore(appId);
-          this.stores.set(cacheKey, store);
-        }
-        return store;
-      }
-      /**
-       * The lifecycle controller for this backend.
-       *
-       * On Parse this is an `eternal` controller: it arms no timer, subscribes to no
-       * storage events, and its gate is a synchronous pass-through. It is on the
-       * request path anyway, so that BCN-004 adds a `performRefresh` rather than a
-       * call site.
-       */
-      lifecycleController(handle) {
-        const cacheKey = String(handle.publicToken);
-        let controller = this.controllers.get(cacheKey);
-        if (controller === void 0) {
-          controller = new TokenLifecycleController({
-            lifecycle: this.lifecycle,
-            store: this.sessionStore(handle),
-            onSessionLost: (reason) => {
-              this.emitAuthEvent("sessionChanged", void 0);
-              this.emitAuthEvent("sessionLost", reason);
-            },
-            onSessionClearedElsewhere: () => {
-              this.emitAuthEvent("sessionChanged", void 0);
-              this.emitAuthEvent("loggedOut");
-            }
-          });
-          controller.start();
-          this.controllers.set(cacheKey, controller);
-        }
-        return controller;
-      }
-      /** The stored session, or `undefined`. Not a contract method. */
-      getCurrentUser(handle) {
-        return this.sessionStore(handle).read();
-      }
-      setSession(handle, session) {
-        this.sessionStore(handle).write(session);
-        this.lifecycleController(handle).sessionChanged();
-        this.emitAuthEvent("sessionChanged", session);
-      }
-      clearSession(handle) {
-        this.sessionStore(handle).clear();
-        this.lifecycleController(handle).sessionChanged();
-        this.emitAuthEvent("sessionChanged", void 0);
-      }
-      // ── The wire ─────────────────────────────────────────────────────────────
-      /**
-       * The Parse auth seam. Moved from `userservice.ts:198` with one substitution:
-       * `this.endpoint`/`this.appId` became `handle.url`/`handle.publicToken`.
-       *
-       * It is deliberately *not* `ParseWireAdapter._makeRequest`. The two differ in
-       * three ways that all matter: this one sends `X-Parse-Installation-Id`, never
-       * sends a master key, and hands its error callback Parse's `code` (the `209`
-       * the session check turns on). Merging them would be a rewrite in a task
-       * whose value is that nothing was rewritten.
-       */
-      _makeRequest(handle, path8, options) {
-        if (!handle.url) {
-          if (options.error) {
-            options.error({ error: "No active cloud service", status: 0 });
-          }
-          return;
-        }
-        const store = this.sessionStore(handle);
-        this.lifecycleController(handle).withSession((session) => {
-          const xhr = new XMLHttpRequest();
-          xhr.onreadystatechange = function() {
-            if (xhr.readyState === 4) {
-              let json;
-              try {
-                json = JSON.parse(xhr.response);
-              } catch (e) {
-              }
-              if (xhr.status === 200 || xhr.status === 201) {
-                options.success(json || xhr.response);
-              } else options.error(json || { error: xhr.responseText, status: xhr.status });
-            }
-          };
-          xhr.open(options.method || "GET", handle.url + path8, true);
-          xhr.setRequestHeader("X-Parse-Application-Id", handle.publicToken);
-          const iidKey = parseInstallationIdKey(handle.publicToken);
-          let _iid = store.readKey(iidKey);
-          if (_iid === void 0) {
-            _iid = guid2();
-            store.writeKey(iidKey, _iid);
-          }
-          xhr.setRequestHeader("X-Parse-Installation-Id", _iid);
-          if (options.sessionToken) xhr.setRequestHeader("X-Parse-Session-Token", options.sessionToken);
-          else if (session !== void 0) {
-            xhr.setRequestHeader("X-Parse-Session-Token", session.sessionToken);
-          }
-          xhr.setRequestHeader("Content-Type", "application/json");
-          xhr.send(JSON.stringify(options.content));
-        });
-      }
-      // ── The ten ──────────────────────────────────────────────────────────────
-      logIn(handle, options) {
-        this._makeRequest(handle, "/login", {
-          method: "POST",
-          content: {
-            username: options.username,
-            password: options.password,
-            _method: "GET"
-          },
-          success: (response) => {
-            this.setSession(handle, response);
-            options.success(response);
-            this.emitAuthEvent("loggedIn", response);
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      logOut(handle, options) {
-        this._makeRequest(handle, "/logout", {
-          method: "POST",
-          content: {},
-          success: () => {
-            this.clearSession(handle);
-            options.success();
-            this.emitAuthEvent("loggedOut");
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      signUp(handle, options) {
-        const additionalUserProps = options.properties ? this.serializeObject({ ...options.properties }, "_User") : {};
-        this._makeRequest(handle, "/users", {
-          method: "POST",
-          content: Object.assign({}, additionalUserProps, {
-            username: options.username,
-            password: options.password,
-            email: options.email
-          }),
-          success: (response) => {
-            const identity2 = { username: options.username };
-            if (options.email !== void 0) identity2.email = options.email;
-            const _cu = Object.assign(response, identity2, options.properties);
-            if (_cu.emailVerified === void 0) _cu.emailVerified = false;
-            this.setSession(handle, _cu);
-            options.success(response);
-            this.emitAuthEvent("loggedIn", _cu);
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      fetchCurrentUser(handle, options) {
-        this._makeRequest(handle, "/users/me", {
-          method: "GET",
-          sessionToken: options.sessionToken,
-          success: (response) => {
-            this.setSession(handle, response);
-            this.emitAuthEvent("sessionGained", response);
-            options.success(response);
-          },
-          error: (e) => {
-            if (e.code === 209) {
-              this.sessionStore(handle).clear();
-              this.emitAuthEvent("sessionLost");
-            }
-            options.error(e.error);
-          }
-        });
-      }
-      verifyEmail(handle, options) {
-        this._makeRequest(
-          handle,
-          "/apps/" + handle.publicToken + "/verify_email?username=" + options.username + "&token=" + options.token,
-          {
-            method: "GET",
-            // This endpoint answers with an HTML page rather than JSON, so the outcome has to be
-            // read out of the page's text.
-            success: (response) => {
-              if (pageSays(response, "Successfully verified your email")) {
-                options.success();
-              } else if (pageSays(response, "Invalid Verification Link")) {
-                options.error("Invalid verification token");
-              } else {
-                options.error("Failed to verify email");
-              }
-            },
-            error: (e) => {
-              options.error(htmlPageError(e.error, "Invalid Verification Link", "Invalid verification token", "Failed to verify email"));
-            }
-          }
-        );
-      }
-      sendEmailVerification(handle, options) {
-        this._makeRequest(handle, "/verificationEmailRequest", {
-          method: "POST",
-          content: { email: options.email },
-          success: () => {
-            options.success();
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      resetPassword(handle, options) {
-        this._makeRequest(handle, "/apps/" + handle.publicToken + "/request_password_reset", {
-          method: "POST",
-          content: {
-            username: options.username,
-            token: options.token,
-            new_password: options.newPassword
-          },
-          success: (response) => {
-            if (pageSays(response, "Password successfully reset") || pageSays(response, "Successfully updated your password")) {
-              options.success();
-            } else if (pageSays(response, "Invalid Link")) {
-              options.error("Invalid or expired reset link");
-            } else {
-              options.error("Failed to reset password");
-            }
-          },
-          error: (e) => {
-            options.error(htmlPageError(e.error, "Invalid Link", "Invalid or expired reset link", "Failed to reset password"));
-          }
-        });
-      }
-      requestPasswordReset(handle, options) {
-        this._makeRequest(handle, "/requestPasswordReset", {
-          method: "POST",
-          content: { email: options.email },
-          success: () => {
-            options.success();
-          },
-          error: (e) => {
-            options.error(e.error);
-          }
-        });
-      }
-      /**
-       * Send the browser to a provider. This NAVIGATES AWAY: nothing after it runs,
-       * and the result arrives on a later page load through {@link consumeAuthReturn}.
-       *
-       * `redirect` defaults to the current page (minus any leftover sign-in
-       * parameters), so the user comes back where they were. The backend refuses
-       * any target that is neither same-origin nor on its `redirectAllowList` — if
-       * sign-in dead-ends with "origin not allowed", that list is the fix.
-       */
-      signInWithProvider(handle, options) {
-        if (!handle.url) {
-          if (options.error) options.error("No active cloud service");
-          return;
-        }
-        if (!options.provider) {
-          if (options.error) options.error("Sign In With: no provider was set.");
-          return;
-        }
-        const redirect = options.redirect || this._currentUrlWithoutAuthParams();
-        const url = `${handle.url}/oauth/${encodeURIComponent(options.provider)}/start?redirect=${encodeURIComponent(redirect)}`;
-        window.location.href = url;
-      }
-      /**
-       * Ask the backend to email a one-click sign-in link.
-       *
-       * Succeeds identically for a known and an unknown address — the endpoint is
-       * anonymous and anti-enumerating by design, so "success" here means "the
-       * request was accepted", never "an account exists". The node's help text says
-       * so, because a UI that claims "check your inbox" only for real accounts
-       * re-creates the oracle the endpoint removed.
-       */
-      requestMagicLink(handle, options) {
-        this._makeRequest(handle, "/auth/magic-link", {
-          method: "POST",
-          content: { email: options.email, redirect: options.redirect || this._currentUrlWithoutAuthParams() },
-          success: () => options.success(),
-          error: (e) => options.error(e.error)
-        });
-      }
-      // ── Not contract, and deliberately so ────────────────────────────────────
-      /**
-       * Write user-profile fields onto the signed-in user.
-       *
-       * Not one of the ten. It is the `Set User Properties` node's whole
-       * implementation, and BCN-006's Desired State §3 makes it schema-driven across
-       * five backends — which is step 6, not this pass. It moves with the wire
-       * because leaving it behind would have left a second `_makeRequest` in
-       * `userservice.ts`, and the entire claim of this move is that there is one.
-       */
-      setUserProperties(handle, options) {
-        const _cu = this.getCurrentUser(handle);
-        if (_cu === void 0) {
-          options.error("Nobody is signed in.");
-          return;
-        }
-        {
-          const propsToSave = this.serializeObject({ ...options.properties }, "_User");
-          const _content = Object.assign(
-            {},
-            { email: options.email, username: options.username },
-            propsToSave
-          );
-          delete _content.emailVerified;
-          delete _content.createdAt;
-          delete _content.updatedAt;
-          this._makeRequest(handle, "/users/" + _cu.objectId, {
-            method: "PUT",
-            content: _content,
-            success: (response) => {
-              Object.assign(_cu, _content);
-              this.setSession(handle, _cu);
-              options.success(response);
-            },
-            error: (e) => {
-              options.error(e.error);
-            }
-          });
-        }
-      }
-      /** The sign-in methods this backend offers — for rendering a set of buttons. */
-      listAuthProviders(handle, options) {
-        this._makeRequest(handle, "/auth/providers", {
-          method: "GET",
-          success: (response) => options.success(response),
-          error: (e) => options.error(e.error)
-        });
-      }
-      // ── BAK-004 — the provider return leg ────────────────────────────────────
-      /**
-       * Look for a sign-in result in the current URL and act on it.
-       *
-       * Returns true when this page load IS a sign-in return, so the caller can skip
-       * its ordinary stale-session validation.
-       *
-       * **Per backend, not contract.** BCN-006 step 5 is four different redirect
-       * shapes — Parse `authData`, Directus SSO, Supabase, PocketBase
-       * `auth-with-oauth2` — and this is the first of the four. What they have in
-       * common is only the *outcome*: a session, established. That is where the
-       * contract's surface is, and it is `signInWithProvider` plus a `loggedIn`.
-       */
-      consumeAuthReturn(handle) {
-        if (typeof window === "undefined" || !window.location) return false;
-        let params;
-        try {
-          params = new URLSearchParams(window.location.search);
-        } catch (e) {
-          return false;
-        }
-        const code = params.get(HANDOFF_PARAM);
-        const error = params.get(AUTH_ERROR_PARAM);
-        if (!code && !error) return false;
-        params.delete(HANDOFF_PARAM);
-        params.delete(AUTH_ERROR_PARAM);
-        this._stripAuthParamsFromUrl(params);
-        if (error) {
-          this.oauthReturn = { inProgress: false, succeeded: false, error };
-          setTimeout(() => this.emitAuthEvent("oauthReturn", this.oauthReturn), 0);
-          return true;
-        }
-        this.oauthReturn = { inProgress: true };
-        this._makeRequest(handle, "/oauth/exchange", {
-          method: "POST",
-          content: { code },
-          success: (response) => {
-            this.setSession(handle, response);
-            this.oauthReturn = {
-              inProgress: false,
-              succeeded: true,
-              outcome: response.authOutcome,
-              notice: response.authNotice || void 0
-            };
-            this.emitAuthEvent("oauthReturn", this.oauthReturn);
-            this.emitAuthEvent("loggedIn", response);
-          },
-          error: (e) => {
-            this.oauthReturn = {
-              inProgress: false,
-              succeeded: false,
-              error: e && e.error || "Sign-in could not be completed."
-            };
-            this.emitAuthEvent("oauthReturn", this.oauthReturn);
-          }
-        });
-        return true;
-      }
-      /** Rewrite the address bar without the sign-in parameters, keeping everything else. */
-      _stripAuthParamsFromUrl(remaining) {
-        if (!window.history || typeof window.history.replaceState !== "function") return;
-        const query = remaining.toString();
-        const cleaned = window.location.pathname + (query ? `?${query}` : "") + window.location.hash;
-        try {
-          window.history.replaceState(window.history.state, "", cleaned);
-        } catch (e) {
-        }
-      }
-      _currentUrlWithoutAuthParams() {
-        const url = new URL(window.location.href);
-        url.searchParams.delete(HANDOFF_PARAM);
-        url.searchParams.delete(AUTH_ERROR_PARAM);
-        return url.toString();
-      }
-    };
-  }
-});
-
 // ../noodl-viewer-react/src/nodes/std-library/user/userservice.ts
 var import_events2, import_runtime14, import_cloudstore2, UserService, _instance, userservice_default;
 var init_userservice = __esm({
@@ -98865,44 +99022,20 @@ var signup_exports = {};
 __export(signup_exports, {
   default: () => signup_default
 });
-function updatePorts6(nodeId, _parameters, editorConnection, systemCollections) {
-  const ports = [];
-  if (systemCollections) {
-    const c = systemCollections.find((c2) => c2.name === "_User");
-    if (c && c.schema && c.schema.properties) {
-      const props = c.schema.properties;
-      const _ignoreKeys = ["authData", "password", "username", "createdAt", "updatedAt", "emailVerified", "email", "ACL"];
-      for (const key in props) {
-        if (_ignoreKeys.indexOf(key) !== -1) continue;
-        const p = props[key];
-        if (ports.find((_p) => _p.name === key)) continue;
-        if (p.type === "Relation") {
-        } else {
-          const _typeMap = {
-            String: "string",
-            Boolean: "boolean",
-            Number: "number",
-            Date: "date"
-          };
-          ports.push({
-            type: {
-              name: _typeMap[p.type] ? _typeMap[p.type] : "*"
-            },
-            plug: "input",
-            group: "Properties",
-            name: "prop-" + key,
-            displayName: key
-          });
-        }
-      }
-    }
-  }
-  editorConnection.sendDynamicPorts(nodeId, ports);
+function updatePorts6(nodeId, editorConnection, graphModel) {
+  const ctx = userSchemaContext(graphModel, {});
+  const ignore = isParseWireContext(ctx) ? USER_INPUT_IGNORE_PARSE_BROWSER : USER_INPUT_IGNORE_REST;
+  sendSchemaPorts(editorConnection, nodeId, userPropertyPorts(ctx, { plug: "input", ignore }), {
+    staticPorts: staticPortNames(SignUpNodeDefinition)
+  });
 }
 var SIGN_UP_ERROR_CODE, SignUpNodeDefinition, SignUpModule, signup_default;
 var init_signup = __esm({
   "../noodl-viewer-react/src/nodes/std-library/user/signup.ts"() {
     "use strict";
+    init_record_ports();
+    init_schema_ports();
+    init_user_ports();
     init_outcome();
     init_userservice();
     SIGN_UP_ERROR_CODE = "user/sign-up-failed";
@@ -99040,23 +99173,11 @@ var init_signup = __esm({
           return;
         }
         function _managePortsForNode(node) {
-          updatePorts6(
-            node.id,
-            node.parameters,
-            editorConnection,
-            graphModel.getMetaData("systemCollections")
-          );
-          node.on("parameterUpdated", function() {
-            updatePorts6(
-              node.id,
-              node.parameters,
-              editorConnection,
-              graphModel.getMetaData("systemCollections")
-            );
-          });
-          graphModel.on("metadataChanged.systemCollections", function(data) {
-            updatePorts6(node.id, node.parameters, editorConnection, data);
-          });
+          const rebuild2 = () => updatePorts6(node.id, editorConnection, graphModel);
+          rebuild2();
+          graphModel.on("metadataChanged.systemCollections", rebuild2);
+          graphModel.on("metadataChanged.dbCollections", rebuild2);
+          graphModel.on("metadataChanged.backendServices", rebuild2);
         }
         graphModel.on("editorImportComplete", () => {
           graphModel.on("nodeAdded.net.noodl.user.SignUp", function(node) {
@@ -100237,6 +100358,7 @@ __export(cloudfunction_exports, {
   default: () => cloudfunction_default
 });
 function _makeRequest2(path8, options) {
+  options = holdOptionsForWrite(options);
   const xhr = new XMLHttpRequest();
   xhr.onreadystatechange = function() {
     if (xhr.readyState === 4) {
@@ -100265,6 +100387,7 @@ var init_cloudfunction = __esm({
     import_runtime15 = __toESM(require_noodl_runtime());
     import_cloudstore3 = __toESM(require_cloudstore());
     init_SessionStore();
+    init_pressguard();
     CloudFunctionNode2 = {
       name: "Cloud Function",
       category: "Cloud Services",
@@ -112336,7 +112459,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@nodegx/preview",
-      version: "0.2.5",
+      version: "0.2.6",
       description: "Standalone live-preview harness: renders a NodeGX (OpenNoodl) v2 project in a browser with no editor process, and reloads it when the files on disk change.",
       license: "GPL-3.0-only",
       homepage: "https://nodegx.io",
@@ -167046,11 +167169,12 @@ var node_catalog_default = {
         ],
         items: [
           "nothing handed (undefined): the list it has stays",
+          "the value is still the placed node's seed and the list does not offer it: the list is kept, and the value is cleared to '' and sent",
           "otherwise: the list is kept as handed and drawn at the next paint; the value stays, so a list handed again keeps the pick"
         ],
         value: [
           "null: ignored",
-          "the value it already holds, as text: nothing",
+          "the value it already holds, as text: nothing (it is no longer the seed)",
           "a change: kept as text, Value follows, and the list selects it at the next paint if it names an option \u2014 Changed does not fire (only a person's pick fires it)"
         ],
         mounted: [
@@ -179431,7 +179555,7 @@ var node_catalog_default = {
           group: "Request",
           plug: "output",
           type: {
-            name: "boolean"
+            name: "string"
           },
           isSignal: false,
           description: "Id of the user the session token resolved to, and blank for an unauthenticated request"
@@ -180657,8 +180781,8 @@ var CatalogIndex = class _CatalogIndex {
   suggestPort(typeName2, plug, unknown, kind) {
     const names = this.portNames(typeName2, plug);
     const candidates = kind ? names.filter((name2) => {
-      const own = this.portKind(typeName2, plug, name2);
-      return own === void 0 || own === kind;
+      const own2 = this.portKind(typeName2, plug, name2);
+      return own2 === void 0 || own2 === kind;
     }) : names;
     return nearest(unknown, candidates);
   }
@@ -191036,7 +191160,15 @@ function projectModelFromLegacy(legacy) {
 var fs3 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
 init_scriptfiles();
-var readJson = (file) => JSON.parse(fs3.readFileSync(file, "utf8"));
+var readJson = (file) => {
+  const text2 = fs3.readFileSync(file, "utf8");
+  try {
+    return JSON.parse(text2);
+  } catch (e) {
+    const why = text2.trim() === "" ? "the file is empty, so it is not valid JSON" : e instanceof Error ? e.message : String(e);
+    throw Object.assign(new Error(`${file.split(path4.sep).join("/")}: ${why}`), { projectFile: file });
+  }
+};
 function resolveTarget(target) {
   const abs = path4.resolve(target);
   if (!fs3.existsSync(abs)) throw new Error(`No such file or directory: ${abs}`);
@@ -191179,6 +191311,9 @@ function flatten3(roots) {
   for (const root2 of roots) visit(root2, void 0);
   return out;
 }
+function recordedVisualRoots(list) {
+  return Array.isArray(list) && list.length > 0 ? { visualRoots: list.filter((id) => typeof id === "string") } : {};
+}
 function fromLegacyProject(project) {
   const components = [];
   for (const comp of project.components ?? []) {
@@ -191192,7 +191327,8 @@ function fromLegacyProject(project) {
     components.push({
       name: comp.name,
       nodes: flatten3(graph.roots ?? []),
-      connections
+      connections,
+      ...recordedVisualRoots(graph.visualRoots)
     });
   }
   return {
@@ -192036,6 +192172,7 @@ function cloudPortMeaning(type, plug) {
 
 // ../noodl-editor/src/editor/src/validation/functionScriptUses.ts
 init_scriptfiles();
+var FUNCTION_NODE_TYPE = "JavaScriptFunction";
 
 // ../noodl-editor/src/editor/src/validation/functionPorts.ts
 var SCRIPT_NODE_API_MEMBERS = [
@@ -192054,6 +192191,10 @@ var SCRIPT_DECLARATION = new RegExp(
   )
 );
 
+// ../noodl-editor/src/editor/src/validation/publicWriteDoor.ts
+var RECORD_WRITE_SCRIPT_MEMBERS = ["create", "save", "delete", "increment", "addRelation", "removeRelation"];
+var SCRIPT_WRITE_CALL = new RegExp(`\\bRecords\\s*\\.\\s*(${RECORD_WRITE_SCRIPT_MEMBERS.join("|")})\\s*\\(`);
+
 // ../noodl-editor/src/editor/src/validation/typedWordNotTranslated.ts
 var HAS_LETTER = new RegExp("\\p{L}", "u");
 
@@ -192250,7 +192391,11 @@ var AUTHORED_BLOCKING_WARNINGS = /* @__PURE__ */ new Set([
   // and **no `completed` wires at all**. `completed` is a rare port — authors
   // reach for `done` — so the blast radius of making this blocking is small, and
   // that is a measurement rather than a hope.
-  "completed-commits-unchecked" /* CompletedCommitsUnchecked */
+  "completed-commits-unchecked" /* CompletedCommitsUnchecked */,
+  // Bug P121-TWO003-SCRIPTCOMPILE — the runtime's own compile fails, so every Run fails. No benign
+  // reading for a graph an agent just wrote; the write said nothing before, and the first person
+  // to run the function got "That could not be done."
+  "function-script-not-compiled" /* FunctionScriptNotCompiled */
 ]);
 
 // ../noodl-editor/src/editor/src/validation/diagnosticExamples.ts
@@ -192379,6 +192524,17 @@ var DIAGNOSTIC_EXAMPLES = [
     code: "function-trusts-a-field-the-caller-wrote" /* FunctionTrustsAFieldTheCallerWrote */,
     examples: ["cloud-share-my-records-with-someone"],
     why: "a cloud function that returns the records of the shares' owners, never a field the page wrote"
+  },
+  // P112 OWN-026 FIX-06 B — a group joined only through its owner's invitation, written only by a function.
+  {
+    code: "role-named-by-a-field-the-caller-wrote" /* RoleNamedByAFieldTheCallerWrote */,
+    examples: ["cloud-members-can-edit-my-records"],
+    why: "a cloud function that names the role from the invitation's owner, so an invitation only lets someone into its creator's group"
+  },
+  {
+    code: "function-guards-an-open-collection" /* FunctionGuardsAnOpenCollection */,
+    examples: ["cloud-members-can-edit-my-records"],
+    why: `the records only a function creates, with the collection's create rule "nobody": the function runs as the system`
   }
 ];
 
@@ -192569,6 +192725,9 @@ var unknownNodeType = {
   }
 };
 
+// ../noodl-editor/src/editor/src/validation/rules/nonexistentPort.ts
+init_renamed_ports();
+
 // ../noodl-editor/src/editor/src/views/panels/propertyeditor/propertyPanelTiers.ts
 var ADVANCED_CSS_GROUPS = {
   // ── plumbing ────────────────────────────────────────────────────────────────
@@ -192647,18 +192806,23 @@ function otherEndKind(catalog, nodeById, conn, plug) {
   }
   return portKindOfTypeName(other.instancePortTypes?.[port]);
 }
+function renamedPort(type, port, plug) {
+  const to = plug === "output" ? renamedOutput(type, port) : void 0;
+  return to ? { to, sentence: ` It was renamed "${to}" in August 2026: wire "${to}".` } : void 0;
+}
 function missingDrawnPort(catalog, nodeById, conn, component, node, port, plug, drawn) {
   const names = [...drawn];
   const tail = (name2) => name2.slice(name2.indexOf("-") + 1).toLowerCase();
   const suffixed = names.filter((name2) => tail(name2) === port.toLowerCase() || tail(name2) === tail(port));
-  const suggestion = suffixed.length > 0 ? nearest(port, suffixed) ?? suffixed[0] : nearest(port, names);
+  const renamed = renamedPort(node.type, port, plug);
+  const suggestion = renamed && drawn.has(renamed.to) ? renamed.to : suffixed.length > 0 ? nearest(port, suffixed) ?? suffixed[0] : nearest(port, names);
   const wireKind = otherEndKind(catalog, nodeById, conn, plug);
   const fromProject = names.filter((name2) => !catalog.hasPort(node.type, plug, name2)).sort();
   const alternatives = [.../* @__PURE__ */ new Set([...fromProject, ...availableAlternatives(catalog, node.type, plug, wireKind).filter((name2) => drawn.has(name2))])].slice(0, MAX_ALTERNATIVES3);
   return {
     code: "nonexistent-port" /* NonexistentPort */,
     severity: "error",
-    message: `${node.type} has no ${plug} named "${port}" with its settings in this project.`,
+    message: `${node.type} has no ${plug} named "${port}" with its settings in this project.` + (renamed && drawn.has(renamed.to) ? renamed.sentence : ""),
     location: {
       component,
       nodeId: node.id,
@@ -192738,12 +192902,13 @@ var nonexistentPort = {
           }
           const wireKind = otherEndKind(catalog, nodeById, conn, plug);
           const prefixed = missingPrefix ? missingPrefix + port : void 0;
-          const suggestion = catalog.suggestPort(node.type, plug, port, wireKind) ?? prefixed;
+          const renamed = renamedPort(node.type, port, plug);
+          const suggestion = renamed?.to ?? catalog.suggestPort(node.type, plug, port, wireKind) ?? prefixed;
           const alternatives = availableAlternatives(catalog, node.type, plug, wireKind);
           out.push({
             code: "nonexistent-port" /* NonexistentPort */,
             severity: "error",
-            message: `${node.type} has no ${plug} named "${port}".` + (prefixed ? ` Its other ${plug}s exist only as "${missingPrefix}<name>", so a name without the prefix is never made and nothing goes through this wire. If "${port}" is ${cloudPortMeaning(node.type, plug)}, wire "${prefixed}".` : ""),
+            message: `${node.type} has no ${plug} named "${port}".` + (renamed?.sentence ?? "") + (prefixed ? ` Its other ${plug}s exist only as "${missingPrefix}<name>", so a name without the prefix is never made and nothing goes through this wire. If "${port}" is ${cloudPortMeaning(node.type, plug)}, wire "${prefixed}".` : ""),
             location: {
               component: component.name,
               nodeId: node.id,
@@ -192946,6 +193111,7 @@ var detachedPageContent = {
 };
 
 // ../noodl-editor/src/editor/src/validation/rules/invalidHierarchy.ts
+var RECORDED_VISUAL_ROOT = { allowAsChild: true, category: "Visual" };
 function hierarchyTyper(ctx) {
   const byName = /* @__PURE__ */ new Map();
   for (const c of ctx.project.components) {
@@ -192965,8 +193131,9 @@ function hierarchyTyper(ctx) {
     const childIds = new Set(component.nodes.flatMap((n) => n.children));
     const roots = component.nodes.filter((n) => n.parent === void 0 && !childIds.has(n.id));
     const known = (n) => typeOf(n.type);
+    const rootType = (n) => known(n) ?? (component.visualRoots?.includes(n.id) ? RECORDED_VISUAL_ROOT : void 0);
     const derived = componentHierarchyType(
-      roots.map(known).filter((t) => !!t),
+      roots.map(rootType).filter((t) => !!t),
       component.nodes.map(known).filter((t) => !!t)
     );
     inFlight.delete(typeName2);
@@ -193837,6 +194004,123 @@ var settingsDiagnostic = {
   }
 };
 
+// ../noodl-editor/src/editor/src/validation/rules/functionScriptNotCompiled.ts
+var CODE_PREFIX = "const Script = (typeof Node !== 'undefined')?Node:undefined;\n";
+var PARAMS2 = ["Inputs", "Outputs", "Noodl", "Component", "Scripts"];
+function functionScriptCompileError(script) {
+  try {
+    const AsyncFunction = Object.getPrototypeOf(async function() {
+    }).constructor;
+    new AsyncFunction(...PARAMS2, CODE_PREFIX + script);
+    return void 0;
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    const line = syntaxErrorLine(script);
+    return line === void 0 ? { message } : { message, line };
+  }
+}
+function syntaxErrorLine(script) {
+  const file = "nodegx-function-script";
+  try {
+    const vm = typeof require === "function" ? require("vm") : void 0;
+    if (!vm?.Script) return void 0;
+    new vm.Script(`(async function (${PARAMS2.join(", ")}) {
+${script}
+})`, { filename: file });
+  } catch (e) {
+    const stack = e && typeof e === "object" ? e.stack : void 0;
+    const match = typeof stack === "string" ? new RegExp(`${file}:(\\d+)`).exec(stack) : null;
+    if (match) return Math.max(1, Number(match[1]) - 1);
+  }
+  return void 0;
+}
+var functionScriptNotCompiled = {
+  code: "function-script-not-compiled" /* FunctionScriptNotCompiled */,
+  description: "A Function's script does not compile, so the Function can never run.",
+  defaultEnabled: true,
+  run(ctx) {
+    const out = [];
+    for (const { component } of ctx.components) {
+      for (const node of component.nodes) {
+        if (node.type !== FUNCTION_NODE_TYPE) continue;
+        const script = node.parameters?.functionScript;
+        if (typeof script !== "string" || script.trim() === "") continue;
+        const error = functionScriptCompileError(script);
+        if (!error) continue;
+        const name2 = node.label ? `"${node.label}"` : "This Function";
+        out.push({
+          code: "function-script-not-compiled" /* FunctionScriptNotCompiled */,
+          severity: "warning",
+          message: `${name2}'s script does not compile${error.line !== void 0 ? ` (line ${error.line})` : ""}: ${error.message}. It can never run: every Run fails with function/script-not-compiled. Fix the script; a regular expression or URL written inside a template literal loses its backslashes, so \`\\/\\/\` arrives as \`//\`, which starts a comment.`,
+          location: {
+            component: component.name,
+            nodeId: node.id,
+            nodeType: node.type,
+            nodeLabel: node.label,
+            port: "functionScript"
+          }
+        });
+      }
+    }
+    return out;
+  }
+};
+
+// ../noodl-editor/src/editor/src/validation/rules/functionNeverReruns.ts
+var RUN_ON_CHANGE_PREFIX3 = "runOnChange-";
+var functionNeverReruns = {
+  code: "function-never-reruns" /* FunctionNeverReruns */,
+  description: "Nothing re-runs a node when its inputs change: its control signal is unwired and every wired input is set not to run on change.",
+  defaultEnabled: true,
+  run(ctx) {
+    const out = [];
+    const { catalog } = ctx;
+    for (const { component } of ctx.components) {
+      const incoming = /* @__PURE__ */ new Map();
+      for (const c of component.connections) {
+        const list = incoming.get(c.toId);
+        if (list) list.push(c);
+        else incoming.set(c.toId, [c]);
+      }
+      for (const node of component.nodes) {
+        const isFunction2 = node.type === FUNCTION_NODE_TYPE;
+        if (!isFunction2 && !catalog.isRunOnValueChangeFamily(node.type)) continue;
+        const inbound = incoming.get(node.id) ?? [];
+        if (inbound.length === 0) continue;
+        if (inbound.some((c) => catalog.getPort(node.type, "input", c.toProperty)?.isSignal)) continue;
+        const governed = [
+          ...new Set(
+            inbound.map((c) => c.toProperty).filter(
+              (port) => isFunction2 ? port.startsWith("in-") : !!catalog.getPort(node.type, "input", RUN_ON_CHANGE_PREFIX3 + port)
+            )
+          )
+        ];
+        if (governed.length === 0) continue;
+        const params = node.parameters ?? {};
+        if (!governed.every((port) => params[RUN_ON_CHANGE_PREFIX3 + port] === false)) continue;
+        const name2 = node.label ? `"${node.label}"` : isFunction2 ? "This Function" : "This node";
+        const shown = governed.map((p) => `"${isFunction2 ? p.slice("in-".length) : p}"`).join(", ");
+        out.push({
+          code: "function-never-reruns" /* FunctionNeverReruns */,
+          severity: "warning",
+          message: `Nothing re-runs ${name2} when its inputs change: Run is not wired, and every wired input (${shown}) has Run On Value Change unticked. ` + (isFunction2 ? "It runs once when it loads, and a new value on any of them never runs it again. " : "") + "Wire Run to what should start it, or tick Run On Value Change on the input whose new value should run it.",
+          location: {
+            component: component.name,
+            nodeId: node.id,
+            nodeType: node.type,
+            nodeLabel: node.label,
+            port: RUN_ON_CHANGE_PREFIX3 + governed[0],
+            plug: "input"
+          },
+          suggestion: `${RUN_ON_CHANGE_PREFIX3}${governed[0]}: true`,
+          alternatives: governed.map((p) => `${RUN_ON_CHANGE_PREFIX3}${p}: true`)
+        });
+      }
+    }
+    return out;
+  }
+};
+
 // ../noodl-editor/src/editor/src/validation/rules/index.ts
 var ALL_RULES = [
   duplicateNodeId,
@@ -193888,6 +194172,11 @@ var ALL_RULES = [
   // the first fires on `prep` and never on the `RunTasks` carrying the defect,
   // so this covers a hole in it rather than repeating it.
   completedCommitsUnchecked,
+  // P121 bugs SCRIPTCOMPILE / NEVERRUNS — a Function that can never run, and one that never
+  // re-runs: breakage of the graph's behaviour, so beside the outcome rules and before the
+  // arrangement ones.
+  functionScriptNotCompiled,
+  functionNeverReruns,
   repeatedSiblingSubtree,
   // DEF-025 — beside `repeatedSiblingSubtree` because both read the visual
   // tree's arrangement rather than wires: that one asks whether siblings
@@ -194805,7 +195094,7 @@ var PreviewServer = class {
       if (!bundle) return this.notFound(res);
       return this.sendDynamic(res, bundle, "application/json; charset=utf-8");
     }
-    if (pathname === "/nodegx-config.json") return this.notFound(res);
+    if (pathname === "/nodegx-config.json") return this.sendDynamic(res, "{}", "application/json; charset=utf-8");
     const asset = pathname.slice(1);
     if (DEPLOY_ASSETS.includes(asset)) {
       return this.sendFile(req, res, deployAssetPath(asset));