@lowdefy/docs-content 0.0.0-experimental-20260909201552 → 6.0.0

package/index.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.5.1",
+  "version": "5.4.0",
   "docs": [
     {
       "slug": "other/introduction",
@@ -283,48 +283,12 @@
       "section": "User Authentication",
       "path": "content/user-authentication/login-and-logout.md"
     },
-    {
-      "slug": "user-authentication/two-factor",
-      "title": "Two-Factor Authentication",
-      "section": "User Authentication",
-      "path": "content/user-authentication/two-factor.md"
-    },
-    {
-      "slug": "user-authentication/organizations",
-      "title": "Organizations & Multi-Tenancy",
-      "section": "User Authentication",
-      "path": "content/user-authentication/organizations.md"
-    },
-    {
-      "slug": "user-authentication/auth-steps",
-      "title": "Auth Steps",
-      "section": "User Authentication",
-      "path": "content/user-authentication/auth-steps.md"
-    },
-    {
-      "slug": "user-authentication/mcp-oauth",
-      "title": "MCP Server & OAuth",
-      "section": "User Authentication",
-      "path": "content/user-authentication/mcp-oauth.md"
-    },
-    {
-      "slug": "user-authentication/user-object",
-      "title": "User Object",
-      "section": "User Authentication",
-      "path": "content/user-authentication/user-object.md"
-    },
     {
       "slug": "other/next-auth-providers",
       "title": "next-auth-providers",
       "section": "Other",
       "path": "content/other/next-auth-providers.md"
     },
-    {
-      "slug": "other/mongodbadapter",
-      "title": "MongoDBAdapter",
-      "section": "Other",
-      "path": "content/other/mongodbadapter.md"
-    },
     {
       "slug": "testing/e2e-introduction",
       "title": "E2E Testing",
@@ -385,14 +349,6 @@
       "kind": "block",
       "typeName": "ButtonSelector"
     },
-    {
-      "slug": "input-blocks/captcha",
-      "title": "Captcha",
-      "section": "Input Blocks",
-      "path": "content/input-blocks/captcha.md",
-      "kind": "block",
-      "typeName": "Captcha"
-    },
     {
       "slug": "input-blocks/checkboxselector",
       "title": "CheckboxSelector",
@@ -585,22 +541,6 @@
       "kind": "block",
       "typeName": "Switch"
     },
-    {
-      "slug": "input-blocks/tagmultipleselector",
-      "title": "TagMultipleSelector",
-      "section": "Input Blocks",
-      "path": "content/input-blocks/tagmultipleselector.md",
-      "kind": "block",
-      "typeName": "TagMultipleSelector"
-    },
-    {
-      "slug": "input-blocks/tagselector",
-      "title": "TagSelector",
-      "section": "Input Blocks",
-      "path": "content/input-blocks/tagselector.md",
-      "kind": "block",
-      "typeName": "TagSelector"
-    },
     {
       "slug": "input-blocks/textarea",
       "title": "TextArea",
@@ -1521,22 +1461,6 @@
       "kind": "action",
       "typeName": "DownloadCsv"
     },
-    {
-      "slug": "actions/emailotpsend",
-      "title": "EmailOtpSend",
-      "section": "Actions",
-      "path": "content/actions/emailotpsend.md",
-      "kind": "action",
-      "typeName": "EmailOtpSend"
-    },
-    {
-      "slug": "actions/emailotpverify",
-      "title": "EmailOtpVerify",
-      "section": "Actions",
-      "path": "content/actions/emailotpverify.md",
-      "kind": "action",
-      "typeName": "EmailOtpVerify"
-    },
     {
       "slug": "actions/fetch",
       "title": "Fetch",
@@ -1577,14 +1501,6 @@
       "kind": "action",
       "typeName": "Logout"
     },
-    {
-      "slug": "actions/magiclinkverify",
-      "title": "MagicLinkVerify",
-      "section": "Actions",
-      "path": "content/actions/magiclinkverify.md",
-      "kind": "action",
-      "typeName": "MagicLinkVerify"
-    },
     {
       "slug": "actions/pdfmake",
       "title": "PdfMake",
@@ -2343,26 +2259,12 @@
       "kind": "block",
       "typeName": ":try"
     },
-    {
-      "slug": "controls/while",
-      "title": ":while",
-      "section": "Controls",
-      "path": "content/controls/while.md",
-      "kind": "block",
-      "typeName": ":while"
-    },
     {
       "slug": "migration/upgrade-guide",
       "title": "Upgrade Guide",
       "section": "Migration",
       "path": "content/migration/upgrade-guide.md"
     },
-    {
-      "slug": "migration/auth-upgrade",
-      "title": "Auth Upgrade (BetterAuth)",
-      "section": "Migration",
-      "path": "content/migration/auth-upgrade.md"
-    },
     {
       "slug": "migration/v5-to-v6",
       "title": "Version 5 to Version 6",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/docs-content",
-  "version": "0.0.0-experimental-20260909201552",
+  "version": "6.0.0",
   "license": "Apache-2.0",
   "description": "Lowdefy documentation extracted as markdown for AI coding agents.",
   "homepage": "https://lowdefy.com",
@@ -20,13 +20,11 @@
   "type": "module",
   "exports": {
     "./index.json": "./index.json",
-    "./hazards.json": "./hazards.json",
     "./scripts/extractAgentDocs.js": "./scripts/extractAgentDocs.js",
     "./content/*": "./content/*"
   },
   "files": [
     "content/**",
-    "hazards.json",
     "index.json",
     "scripts/*"
   ],

package/content/actions/emailotpsend.md

@@ -1,58 +0,0 @@
-# EmailOtpSend
-
-```
-(params: {
-  email: string
-  captchaToken?: string
-}): void
-```
-
-The `EmailOtpSend` action emails a one-time sign-in code to an address. It requires `auth.emailOTP` to be enabled — see [Configuration](/auth-configuration).
-
-A code is typed into the tab the person started from, so the sign-in survives corporate mail security that pre-fetches links (which consumes a single-use magic link before the person clicks it), and it works when the email is read on another device.
-
-Use [`EmailOtpVerify`](/EmailOtpVerify) to complete the sign-in with the code.
-
-When `auth.magicLink` is enabled alongside `auth.emailOTP`, the magic-link email already carries the code: the [`Login`](/Login) action with `magicLink: true` sends one email that serves both paths, and `EmailOtpSend` is then only needed for a code-only page that offers no link at all.
-
-Under an invite-only signup policy an address that is not admitted gets no email, and the action still resolves successfully — the response is identical either way, so the "check your email" screen gives nothing away about who has an account.
-
-#### Parameters
-
-###### object
-- `email: string`: __required__ - The email address to send the sign-in code to.
-- `captchaToken: string`: A captcha token minted by a `Captcha` block, sent as the `x-captcha-response` header when `auth.captcha` is enabled. Tokens are single-use, so reset the `Captcha` block in `onError` for retries.
-
-#### Examples
-
-###### Send a sign-in code:
-```yaml
-- id: send_code
-  type: EmailOtpSend
-  params:
-    email:
-      _state: email
-```
-
-###### Send a code and tell the user to check their inbox:
-```yaml
-- id: send_code
-  type: Button
-  properties:
-    title: Send code
-  events:
-    onClick:
-      - id: validate
-        type: Validate
-        params:
-          regex: ^email$
-      - id: send
-        type: EmailOtpSend
-        params:
-          email:
-            _state: email
-      - id: sent
-        type: DisplayMessage
-        params:
-          content: Check your email for the sign-in code.
-```

package/content/actions/emailotpverify.md

@@ -1,77 +0,0 @@
-# EmailOtpVerify
-
-```
-(params: {
-  email: string
-  otp: string
-  callbackUrl?: {
-    home?: boolean
-    pageId?: string
-    url?: string
-    urlQuery?: object
-  } | false
-}): void
-```
-
-The `EmailOtpVerify` action signs a user in with the one-time code emailed to them by [`EmailOtpSend`](/EmailOtpSend), or carried on the magic-link email when `auth.magicLink` and `auth.emailOTP` are both enabled. It requires `auth.emailOTP` to be enabled — see [Configuration](/auth-configuration).
-
-On success the session cookie is set — creating the account on first sign-in, unless `emailOTP.disableSignUp` is `true` — and the browser lands on the resolved `callbackUrl`. Three sources are consulted, in order:
-
-1. The `callbackUrl` param, if given.
-2. The `?callbackUrl=` query parameter, which Lowdefy sets when it redirects an unauthenticated user to the sign-in page.
-3. The app's home page.
-
-To sign in without navigating, set `callbackUrl: false` — valid here, unlike on the magic-link and social paths, because this is a plain JSON sign-in with no redirect hop.
-
-If the user has two-factor authentication enrolled, the code mints a challenge rather than a session: the action navigates to `authPages.twoFactor` carrying the resolved destination as `?callbackUrl=`, where [`TwoFactorVerify`](/two-factor) finishes the sign-in, and the event chain stops.
-
-An expired, mistyped or already-used code is the auth server rejecting the attempt, not an app fault. The action throws a `UserError`: `catch` actions still run and the message still displays, but it is logged to the browser console only and is never reported to the server.
-
-#### Parameters
-
-###### object
-- `email: string`: __required__ - The email address the code was sent to.
-- `otp: string`: __required__ - The one-time code from the email.
-- `callbackUrl: object | false`: Set to `false` to sign in without navigating. As an object:
-  - `home: boolean`: Land on the app's home page.
-  - `pageId: string`: The pageId to land on.
-  - `url: string`: The URL to land on. An absolute URL is not `basePath`-prefixed, so it can be an external landing page.
-  - `urlQuery: object`: The urlQuery to set on the destination.
-
-#### Examples
-
-###### Sign in with the code and land on the home page (or the page the user was bounced from):
-```yaml
-- id: verify_code
-  type: EmailOtpVerify
-  params:
-    email:
-      _state: email
-    otp:
-      _state: otp
-```
-
-###### Sign in and land on a specific page:
-```yaml
-- id: verify_code
-  type: EmailOtpVerify
-  params:
-    email:
-      _state: email
-    otp:
-      _state: otp
-    callbackUrl:
-      pageId: dashboard
-```
-
-###### Sign in inside a modal, without navigating:
-```yaml
-- id: verify_code
-  type: EmailOtpVerify
-  params:
-    email:
-      _state: email
-    otp:
-      _state: otp
-    callbackUrl: false
-```

package/content/actions/magiclinkverify.md

@@ -1,113 +0,0 @@
-# MagicLinkVerify
-
-```
-(params?: {
-  callbackUrl?: {
-    home?: boolean
-    pageId?: string
-    url?: string
-    urlQuery?: object
-  }
-  errorCallbackUrl?: {
-    home?: boolean
-    pageId?: string
-    url?: string
-    urlQuery?: object
-  }
-  newUserCallbackUrl?: {
-    home?: boolean
-    pageId?: string
-    url?: string
-    urlQuery?: object
-  }
-  token?: string
-}): void
-```
-
-The `MagicLinkVerify` action completes a magic-link sign-in from the landing page the sign-in email points at. It navigates the browser to the auth server's verify endpoint, which sets the session cookie and redirects the user on to their destination.
-
-## Why a landing page
-
-A magic-link token is single-use, and the verify endpoint consumes it on the **first** `GET` of the URL. Corporate mail security — Microsoft Defender Safe Links, Proofpoint URL Defense, Mimecast — fetches every link in a message as it is delivered. When the email links straight at the verify endpoint the scanner spends the token minutes before the person clicks, and the person lands on the auth error page with `INVALID_TOKEN`.
-
-Setting [`auth.authPages.magicLink`](/auth-configuration#the-magic-link-landing-page) to a page in your app moves the email's link to that page, carrying the token and callback destinations on the URL query. Fetching a Lowdefy page has no side effect, so the token stays unspent until a person clicks a button that runs `MagicLinkVerify`.
-
-This action **must** be bound to a click. Do not run it in `onMount` and do not auto-redirect from the landing page: scanning sandboxes that execute JavaScript would consume the token anyway, and you would be no better off than linking at the verify endpoint directly.
-
-## Defaults come from the URL query
-
-Every parameter is optional. The auth server minted the landing URL with the verify query on it, so the action reads its defaults from the page's own URL:
-
-| Parameter | Default |
-| --------- | ------- |
-| `token` | the `?token=` query parameter |
-| `callbackUrl` | the `?callbackURL=` query parameter, else the auth server's default |
-| `newUserCallbackUrl` | the `?newUserCallbackURL=` query parameter, else `callbackUrl` |
-| `errorCallbackUrl` | the `?errorCallbackURL=` query parameter, else `auth.authPages.error` |
-
-Pass a parameter only to override what the email carried. The action throws if there is no token in either place, because there is nothing to verify.
-
-`callbackUrl: false` is not valid here. Verification redirects through a hop the app does not control, so there is no staying put.
-
-The event chain ends after this action, like every other action that navigates the browser away — a step after it would race the page being replaced.
-
-#### Parameters
-
-###### object
-- `token: string`: The single-use magic-link token. Defaults to the `?token=` URL query parameter of the landing page.
-- `callbackUrl: object`: Where a successful sign-in lands. Defaults to the `?callbackURL=` URL query parameter.
-  - `home: boolean`: Land on the app's home page.
-  - `pageId: string`: The pageId to land on.
-  - `url: string`: The URL to land on. An absolute URL is not `basePath`-prefixed, so it can be an external landing page.
-  - `urlQuery: object`: The urlQuery to set on the destination.
-- `newUserCallbackUrl: object`: Where a sign-in that creates a new account lands, for a first-run or onboarding page. Defaults to the `?newUserCallbackURL=` URL query parameter. Same fields as `callbackUrl`.
-- `errorCallbackUrl: object`: Where a failed verification lands, with the reason in `?error=`. Defaults to the `?errorCallbackURL=` URL query parameter, then to `auth.authPages.error`. Same fields as `callbackUrl`.
-
-#### Examples
-
-###### The landing page, with everything taken from the URL query:
-```yaml
-id: magic-link
-type: PageHeaderMenu
-blocks:
-  - id: content
-    type: Box
-    blocks:
-      - id: title
-        type: Title
-        properties:
-          content: Sign in
-          level: 3
-      - id: description
-        type: Paragraph
-        properties:
-          content: Click the button below to finish signing in.
-      - id: verify_button
-        type: Button
-        properties:
-          title: Sign in
-        events:
-          onClick:
-            - id: verify
-              type: MagicLinkVerify
-```
-
-###### Send a new user to an onboarding page instead:
-```yaml
-- id: verify
-  type: MagicLinkVerify
-  params:
-    newUserCallbackUrl:
-      pageId: welcome
-```
-
-###### Override where a successful sign-in lands:
-```yaml
-- id: verify
-  type: MagicLinkVerify
-  params:
-    callbackUrl:
-      pageId: dashboard
-      urlQuery:
-        source: magic-link
-```

package/content/controls/while.md

@@ -1,46 +0,0 @@
-# :while
-
-```
-({:while: boolean, :do: routine}): void
-```
-
-The `:while` control implements a while loop within a routine. The routine defined in the `:do` key will be repeated as long as the test defined using the `:while` key is true.
-
-#### Keys
-
-- `:while: boolean`: __Required__ - The test that will determine whether or not the defined routine should execute again.
-- `:do: routine`: __Required__ - The routine to run while the test condition holds.
-
-The `:while` condition is evaluated fresh before every iteration, against the routine's current `state` and `steps`. This is how the loop terminates - the routine in `:do` changes the state or step results that the condition reads.
-
-Unlike `:for`, a `:while` loop does not index the step results of its body. A `:while` has no item to index by, so each iteration overwrites the previous iteration's step results, and `_step: my_step` inside or after the loop reads the value from the latest iteration.
-
-There is no iteration cap and no timeout. A condition that the routine in `:do` never falsifies loops forever, exactly as it would in JavaScript.
-
-#### Examples
-
-###### Simple Example
-```
-- :set_state:
-    count: 0
-- :while:
-    _lt:
-      - _state: count
-      - 5
-  :do:
-    - :log:
-        _state: count
-    - :set_state:
-        count:
-          _sum:
-            - _state: count
-            - 1
-```
-Logs:
-```
-0
-1
-2
-3
-4
-```

package/content/input-blocks/captcha.md

@@ -1,40 +0,0 @@
-# Captcha
-
-Renders a captcha widget (Cloudflare Turnstile) and writes the minted token into state under its blockId. Configure `provider` and `siteKey` from the `_build.authConfig` projection when `auth.captcha` is enabled. The `reset` method clears the value and mints a fresh token; expiry clears the value automatically.
-
-> The widget script loads from the provider's CDN at render - apps behind a strict CSP should allowlist challenges.cloudflare.com. Tokens are single-use and short-lived: pass the block value as the `captchaToken` param of auth actions, and call the block's `reset` method from the action's `onError` chain to mint a fresh token for retries.
-
-```yaml
-- id: captcha_basic
-  type: Captcha
-  properties:
-    provider: cloudflare-turnstile
-    siteKey: 1x00000000000000000000AA
-```
-
-```yaml
-- id: captcha_compact
-  type: Captcha
-  properties:
-    provider: cloudflare-turnstile
-    siteKey: 1x00000000000000000000AA
-    theme: light
-    size: compact
-```
-
-| Property | Type | Default | Description |
-| --- | --- | --- | --- |
-| `provider` | string | `"cloudflare-turnstile"` | Captcha provider to render. Normally fed from the auth config projection: { _build.authConfig: captcha.provider }. Enum: `cloudflare-turnstile`. |
-| `siteKey` | string | - | The provider site key - public, rendered into the page. Normally fed from the auth config projection: { _build.authConfig: captcha.siteKey }. |
-| `theme` | string | `"auto"` | Widget theme. Enum: `auto`, `light`, `dark`. |
-| `size` | string | `"normal"` | Widget size. Enum: `normal`, `compact`, `flexible`. |
-
-| Event | Event Data | Description |
-| --- | --- | --- |
-| `onSuccess` | \- | Trigger actions when the captcha challenge succeeds and a token is minted. |
-| `onExpire` | \- | Trigger actions when the minted token expires - the block value is cleared so a late submit fails with a clear missing-token error. |
-| `onError` | \- | Trigger actions when the captcha provider reports an error. |
-
-No CSS keys defined.
-
-No slots defined.

package/content/input-blocks/tagmultipleselector.md

@@ -1,101 +0,0 @@
-# TagMultipleSelector
-
-Multi-select input rendered as a row of toggleable, colored tag pills.
-
-```yaml
-- id: basic_strings
-  type: TagMultipleSelector
-  properties:
-    title: Domains
-    options:
-      - Ethics
-      - Environment
-      - Governance
-      - Social
-      - Data Privacy
-```
-
-```yaml
-- id: label_value
-  type: TagMultipleSelector
-  properties:
-    title: Status Filter
-    options:
-      - label: Draft
-        value: draft
-      - label: In Review
-        value: in_review
-      - label: Published
-        value: published
-      - label: Archived
-        value: archived
-        disabled: true
-```
-
-```yaml
-- id: explicit_colors
-  type: TagMultipleSelector
-  properties:
-    title: Priorities
-    options:
-      - label: Low
-        value: low
-        color: "#59A14F"
-      - label: Medium
-        value: medium
-        color: "#EDC948"
-      - label: High
-        value: high
-        color: "#E15759"
-- id: single_accent
-  type: TagMultipleSelector
-  properties:
-    title: Interests
-    colored: false
-    options:
-      - Design
-      - Engineering
-      - Product
-      - Research
-```
-
-| Property | Type | Default | Description |
-| --- | --- | --- | --- |
-| `options` | array | - | Options to select from. Primitives, or { label, value, color, disabled } - an explicit color overrides the stable palette color. |
-| `options.$.label` | string | - | Tag label. Defaults to the value. |
-| `options.$.value` | - | - | Option value written into the selection array. |
-| `options.$.color` | string | - | Explicit tag color (hex or CSS color). Overrides the stable palette color. |
-| `options.$.disabled` | boolean | `false` | Disable this tag. |
-| `colored` | boolean | `true` | Give each option a stable color (hash of its value over a fixed palette). false = single primary accent. |
-| `disabled` | boolean | `false` | Disable the block if true. |
-| `size` | string | `"default"` | Size of the block. Enum: `small`, `default`, `large`. |
-| `label` | object | - | Label properties. |
-| `label.align` | string | `"left"` | Align label left or right when inline. Enum: `left`, `right`. |
-| `label.colon` | boolean | `true` | Append label with colon. |
-| `label.extra` | string | - | Extra text to display beneath the content - supports html. |
-| `label.title` | string | - | Label title - supports html. |
-| `label.tooltip` | string \| object | - | Help tooltip shown via an icon beside the label. A string sets the tooltip text (supports html), or an object to also customize the icon and color. Use the block's onTooltipClick event to respond to clicks on the icon. |
-| `label.tooltip.title` | string | - | Tooltip text shown on hover - supports html. |
-| `label.tooltip.icon` | string | `"AiOutlineQuestionCircle"` | Name of the icon to show beside the label. |
-| `label.tooltip.color` | string | - | Color of the tooltip icon. |
-| `label.span` | number | - | Label inline span. |
-| `label.disabled` | boolean | `false` | Hide input label. |
-| `label.hasFeedback` | boolean | `true` | Display feedback extra from validation, this does not disable validation. |
-| `label.inline` | boolean | `false` | Render input and label inline. |
-| `title` | string | - | Title to describe the input component, if no title is specified the block id is displayed - supports html. |
-
-| Event | Event Data | Description |
-| --- | --- | --- |
-| `onChange` | `{ value }` | Trigger actions when the selection is changed. |
-| `onTooltipClick` | \- | Trigger actions when the tooltip icon is clicked. |
-
-| Key | Target |
-| --- | --- |
-| `/block` | Outer block wrapper (always available). |
-| `/element` | The TagMultipleSelector tag row. |
-| `/tag` | Each tag pill. |
-| `/label` | The TagMultipleSelector label. |
-| `/extra` | The TagMultipleSelector extra content. |
-| `/feedback` | The TagMultipleSelector validation feedback. |
-
-No slots defined.