@lowdefy/docs-content 0.0.0-experimental-20260928120643 → 6.1.0

package/content/container-blocks/tabs.md

@@ -341,39 +341,6 @@ Free standard shipping (3-5 business days). Express shipping available for $9.99
               for $9.99 (1-2 business days).
 ```
 
-Billed every month. Cancel any time.
-
-Billed once a year with two months free.
-
-```yaml
-- id: centered_tabs
-  type: Tabs
-  properties:
-    centered: true
-    tabBarGutter: 40
-    indicator:
-      size: 24
-      align: center
-    tabs:
-      - key: centered_monthly
-        title: Monthly
-      - key: centered_yearly
-        title: Yearly
-  slots:
-    centered_monthly:
-      blocks:
-        - id: centered_monthly_content
-          type: Paragraph
-          properties:
-            content: Billed every month. Cancel any time.
-    centered_yearly:
-      blocks:
-        - id: centered_yearly_content
-          type: Paragraph
-          properties:
-            content: Billed once a year with two months free.
-```
-
 **Small:**
 
 Compact tabs for dense interfaces where screen space is at a premium. Ideal for side panels and secondary navigation.
@@ -654,16 +621,16 @@ Monthly target progress at 85%. On track for completion by end of quarter.
     tabs:
       - key: icon_home
         title: Home
-        icon: home
+        icon: AiOutlineHome
       - key: icon_users
         title: Users
-        icon: users
+        icon: AiOutlineTeam
       - key: icon_settings
         title: Settings
-        icon: settings
+        icon: AiOutlineSetting
       - key: icon_chart
         title: Analytics
-        icon: chart
+        icon: AiOutlineBarChart
   slots:
     icon_home:
       blocks:
@@ -717,17 +684,17 @@ Monthly target progress at 85%. On track for completion by end of quarter.
       - key: ci_success
         title: Passed
         icon:
-          name: check-circle
+          name: AiOutlineCheckCircle
           color: "#52c41a"
       - key: ci_warning
         title: Warnings
         icon:
-          name: warning
+          name: AiOutlineWarning
           color: "#faad14"
       - key: ci_error
         title: Failed
         icon:
-          name: close-circle
+          name: AiOutlineCloseCircle
           color: "#ff4d4f"
   slots:
     ci_success:
@@ -885,7 +852,7 @@ Your video library. Supports MP4, WebM, and MOV formats. Maximum file size is 50
             flex: 0 0 auto
           properties:
             title: Upload
-            icon: upload
+            icon: AiOutlineUpload
             color: primary
             variant: solid
             size: small
@@ -932,13 +899,13 @@ Yesterday - Alex created 3 new issues in the backlog tracker.
     tabs:
       - key: rich_dashboard
         title: Dashboard
-        icon: Gauge
+        icon: AiOutlineDashboard
       - key: rich_team
         title: Team
-        icon: users
+        icon: AiOutlineTeam
       - key: rich_activity
         title: Activity
-        icon: history
+        icon: AiOutlineHistory
   slots:
     rich_dashboard:
       blocks:
@@ -1697,13 +1664,7 @@ Press Cmd+3 (Mac) or Ctrl+3 (Windows) to jump to this tab.
 | Property | Type | Default | Description |
 | --- | --- | --- | --- |
 | `animated` | boolean | `true` | Whether to change tabs with animation. Only works while tabPlacement is top or bottom. |
-| `centered` | boolean | `false` | Center the tabs in the tab bar. |
 | `defaultActiveKey` | string | - | Initial active TabPane's key, if activeKey is not set. |
-| `destroyOnHidden` | boolean | `false` | Unmount the content of inactive tabs. Blocks in a hidden tab keep their state values. |
-| `indicator` | object | - | Size and alignment of the active tab indicator (ink bar). |
-| `indicator.size` | number | - | Length of the indicator in pixels. Defaults to the width of the tab. |
-| `indicator.align` | string | `"center"` | Alignment of the indicator along the tab when size is set. Enum: `start`, `center`, `end`. |
-| `tabBarGutter` | number | - | Gap between tabs in pixels. |
 | `size` | string | `"default"` | Size of the tabs. Enum: `default`, `small`, `large`. |
 | `tabPlacement` | string | `"top"` | Position of the tabs. Enum: `top`, `end`, `bottom`, `start`. |
 | `tabType` | string | `"line"` | Type of tabs. Enum: `line`, `card`. |
@@ -1712,24 +1673,13 @@ Press Cmd+3 (Mac) or Ctrl+3 (Windows) to jump to this tab.
 | `tabs.$.key` | string | - | Area key of the tab. |
 | `tabs.$.eventName` | string | - | Block-level event name to trigger when this tab becomes active, in addition to onChange. Declare an event with this name under `events:`. The event receives `{ key }` of the now-active tab. |
 | `tabs.$.disabled` | boolean | `false` | Disable the tab if true. |
-| `tabs.$.icon` | string \| object | - | Icon name (a semantic name like `edit`, a Lucide icon name like `Pencil`, or a set-qualified name like `tabler:Pencil`) or properties of an Icon block to customize icon to show in tab title. |
-| `tabs.$.icon.name` | string | - | Icon name: a semantic name like `edit`, a Lucide icon name like `Pencil`, or a set-qualified name like `tabler:Pencil`. |
-| `tabs.$.icon.color` | string | - | Icon color. |
-| `tabs.$.icon.size` | string \| number | - | Size of the icon. Defaults to `theme.icons.size`. |
-| `tabs.$.icon.rotate` | number | - | Number of degrees to rotate the icon. |
-| `tabs.$.icon.spin` | boolean | - | Continuously spin the icon with animation. |
-| `tabs.$.icon.strokeWidth` | number | - | Stroke width of the icon lines, in pixels of the 24px icon grid. Defaults to `theme.icons.strokeWidth` (2). |
-| `tabs.$.icon.nonScalingStroke` | boolean | - | Keep the stroke width constant at any icon size. Defaults to `theme.icons.nonScalingStroke`. |
-| `tabs.$.icon.title` | string | - | Icon hover title for accessibility. An empty string marks the icon as decorative. |
-| `tabs.$.icon.disableLoadingIcon` | boolean | - | While loading after the icon has been clicked, don't render the loading icon. |
+| `tabs.$.icon` | string \| object | - | Name of an React-Icon (See all icons) or properties of an Icon block to customize icon to show in tab title. |
 | `tabs.$.shortcut` | string | - | Keyboard shortcut to switch to this tab. Use "mod" for Cmd/Ctrl. |
 | `extraAreaKey` | string | - | Area key for the extra area blocks. |
 | `theme` | object | - | Antd design token overrides for this block. See [antd design tokens](https://ant.design/components/overview#design-token). See [Ant Design tabs tokens](https://ant.design/components/tabs#design-token). |
 | `theme.cardBg` | string | `"rgba(0, 0, 0, 0.02)"` | Background color of card-type tab. |
 | `theme.cardGutter` | number | `2` | Gap between card-type tabs. |
 | `theme.cardHeight` | number | `40` | Height of card-type tab. |
-| `theme.cardHeightSM` | number | `32` | Height of small card-type tab. |
-| `theme.cardHeightLG` | number | `48` | Height of large card-type tab. |
 | `theme.cardPadding` | string | `"8px 16px"` | Padding of card-type tab. |
 | `theme.cardPaddingLG` | string | `"11px 16px"` | Padding of large card-type tab. |
 | `theme.cardPaddingSM` | string | `"4px 8px"` | Padding of small card-type tab. |
@@ -1764,7 +1714,5 @@ Press Cmd+3 (Mac) or Ctrl+3 (Windows) to jump to this tab.
 | `/tabBar` | The Tabs tab bar. |
 | `/tabPane` | The Tabs tab pane. |
 | `/inkBar` | The Tabs ink bar. |
-| `/item` | Each tab in the tab bar. |
-| `/popup` | The dropdown that lists tabs that overflow the tab bar. |
 
 Slot keys are user-defined in your config and resolved at build time — not generated at runtime. The block typically pairs slots with an array property (`tabs`, `panels`, `slides`) listed in the Properties table; see the examples above for the expected shape.

package/content/container-blocks/tooltip.md

@@ -689,7 +689,7 @@ Hover over this text to see the tooltip.
       layout:
         flex: 0 0 auto
       properties:
-        icon: delete
+        icon: AiOutlineDelete
         hideTitle: true
         color: danger
         variant: text
@@ -749,8 +749,7 @@ Hover over this text to see the tooltip.
     flex: 0 0 auto
   properties:
     title: Tooltip with custom overlay style
-  style:
-    .inner:
+    overlayStyle:
       boxShadow: 0 4px 12px rgba(0, 0, 0, 0.3)
   blocks:
     - id: tooltip_overlay_style_btn
@@ -921,7 +920,7 @@ Hover me (Tailwind element class)
   properties:
     title: Tailwind on element wrapper
   class:
-    .element: cursor-help
+    element: cursor-help
   blocks:
     - id: tooltip_class_element_text
       type: Paragraph
@@ -934,7 +933,7 @@ Hover me (Tailwind element class)
   properties:
     title: Tailwind on inner popup
   class:
-    .inner: text-lg font-bold
+    inner: text-lg font-bold
   blocks:
     - id: tooltip_class_inner_btn
       type: Button
@@ -1089,19 +1088,47 @@ $8,230
       properties:
         label:
           title: Username
-          tooltip:
-            title: Your unique username. Must be 3-20 characters, letters and numbers only.
-            color: "#8c8c8c"
+          extra:
+            - id: tooltip_form_username_help
+              type: Tooltip
+              layout:
+                flex: 0 0 auto
+              properties:
+                title: Your unique username. Must be 3-20 characters, letters and numbers only.
+                placement: right
+              blocks:
+                - id: tooltip_form_username_icon
+                  type: Icon
+                  layout:
+                    flex: 0 0 auto
+                  properties:
+                    name: AiOutlineQuestionCircle
+                    size: 14
+                    color: "#8c8c8c"
         placeholder: Enter your username
     - id: tooltip_form_email
       type: TextInput
       properties:
         label:
           title: Email Address
-          tooltip:
-            title: We will send account notifications to this address. You can change it at
-              any time.
-            color: "#8c8c8c"
+          extra:
+            - id: tooltip_form_email_help
+              type: Tooltip
+              layout:
+                flex: 0 0 auto
+              properties:
+                title: We will send account notifications to this address. You can change it at
+                  any time.
+                placement: right
+              blocks:
+                - id: tooltip_form_email_icon
+                  type: Icon
+                  layout:
+                    flex: 0 0 auto
+                  properties:
+                    name: AiOutlineQuestionCircle
+                    size: 14
+                    color: "#8c8c8c"
         placeholder: Enter your email
 ```
 
@@ -1148,7 +1175,7 @@ Monthly Revenue
                   layout:
                     flex: 0 0 auto
                   properties:
-                    name: info
+                    name: AiOutlineInfoCircle
                     size: 14
                     color: "#8c8c8c"
         - id: tooltip_dashboard_users_stat
@@ -1193,7 +1220,7 @@ Monthly Revenue
                   layout:
                     flex: 0 0 auto
                   properties:
-                    name: info
+                    name: AiOutlineInfoCircle
                     size: 14
                     color: "#8c8c8c"
         - id: tooltip_dashboard_revenue_stat
@@ -1210,18 +1237,15 @@ Monthly Revenue
 
 | Property | Type | Default | Description |
 | --- | --- | --- | --- |
-| `arrow` | boolean \| object | `true` | Whether to show the arrow. Set `{ pointAtCenter: true }` to point the arrow at the center of the target. |
-| `arrow.pointAtCenter` | boolean | `false` | Whether the arrow is pointed at the center of target. |
-| `arrowPointAtCenter` | boolean | `false` | Whether the arrow is pointed at the center of target. Same as `arrow: { pointAtCenter: true }`. |
+| `arrowPointAtCenter` | boolean | `false` | Whether the arrow is pointed at the center of target. |
 | `autoAdjustOverflow` | boolean | `true` | Whether to adjust popup placement automatically when popup is off screen. |
 | `color` | string | - | The background color. |
 | `defaultOpen` | boolean | `false` | Whether the floating tooltip card is visible by default. |
-| `destroyOnHidden` | boolean | `false` | Whether to destroy the tooltip DOM when hidden. |
-| `destroyTooltipOnHide` | boolean | `false` | Same as destroyOnHidden, which takes precedence. |
+| `destroyTooltipOnHide` | boolean | `false` | Whether to destroy the tooltip DOM when hidden. |
 | `mouseEnterDelay` | number | `0.1` | Delay in seconds, before tooltip is shown on mouse enter. |
-| `mouseLeaveDelay` | number | `0.1` | Delay in seconds, before tooltip is hidden on mouse leave. |
+| `mouseLeaveDelay` | number | `0.1` | Delay in seconds, before tooltip is shown on mouse enter. |
 | `placement` | string | `"top"` | The position of the tooltip relative to the target. Enum: `top`, `left`, `right`, `bottom`, `topLeft`, `topRight`, `bottomLeft`, `bottomRight`, `leftTop`, `leftBottom`, `rightTop`, `rightBottom`. |
-| `trigger` | string | `"hover"` | Tooltip trigger mode. `contextMenu` opens the tooltip on right click. Enum: `hover`, `focus`, `click`, `contextMenu`. |
+| `trigger` | string | `"hover"` | Tooltip trigger mode. Enum: `hover`, `focus`, `click`. |
 | `title` | string | - | Title to show in the title area - supports html. Overwritten by blocks in the title content area. |
 | `zIndex` | integer | - | The z-index of the Tooltip. |
 | `theme` | object | - | Antd design token overrides for this block. See [antd design tokens](https://ant.design/components/overview#design-token). See [Ant Design tooltip tokens](https://ant.design/components/tooltip#design-token). |
@@ -1237,7 +1261,7 @@ Monthly Revenue
 
 | Event | Event Data | Description |
 | --- | --- | --- |
-| `onOpenChange` | `{ open }` | Trigger action when visibility of the tooltip card is changed. |
+| `onOpenChange` | \- | Trigger action when visibility of the tooltip card is changed. |
 
 | Key | Target |
 | --- | --- |

package/content/container-blocks/watermark.md

@@ -91,24 +91,6 @@ Watermark overlay with text, image, and font customization.
         height: 200px
 ```
 
-```yaml
-- id: per_line_font
-  type: Watermark
-  properties:
-    text:
-      - text: CONFIDENTIAL
-        font:
-          fontSize: 22
-          fontWeight: bold
-          color: rgba(255, 0, 0, 0.12)
-      - Prepared for the finance team
-  blocks:
-    - id: per_line_font_child
-      type: Box
-      style:
-        height: 200px
-```
-
 ```yaml
 - id: align_left
   type: Watermark
@@ -296,7 +278,7 @@ Drag and drop files here or click to browse
 - id: css_gradient_bg
   type: Watermark
   class:
-    .element: bg-gradient-to-br from-primary/10 to-primary/5 rounded-lg p-4
+    element: bg-gradient-to-br from-primary/10 to-primary/5 rounded-lg p-4
   properties:
     text: Preview
     font:
@@ -313,7 +295,7 @@ Drag and drop files here or click to browse
 - id: css_dark_surface
   type: Watermark
   class:
-    .element: bg-bg-layout rounded-lg p-4
+    element: bg-bg-layout rounded-lg p-4
   properties:
     text: Dark Theme
     font:
@@ -338,7 +320,7 @@ Drag and drop files here or click to browse
 - id: css_bordered_area
   type: Watermark
   class:
-    .element: border-2 border-dashed border-border rounded-xl p-6
+    element: border-2 border-dashed border-border rounded-xl p-6
   properties:
     text: Upload Area
     font:
@@ -513,7 +495,7 @@ Mobile app for real-time inventory tracking across multiple warehouses. Integrat
 | `inherit` | boolean | `true` | Inherit watermark config from parent Watermark block. |
 | `offset` | array | - | Offset of the watermark from the top-left as [x, y]. |
 | `rotate` | number | `-22` | Rotation angle of watermark in degrees. |
-| `text` | string \| array | - | Watermark text content. An array renders one line per item. A line can be a string, or `{ text, font }` to give that line its own font style. |
+| `text` | string \| array | - | Watermark text content. Maps to antd "content" prop. |
 | `theme` | object | - | Antd design token overrides for this block. See [antd design tokens](https://ant.design/components/overview#design-token). See [Ant Design watermark tokens](https://ant.design/components/watermark#design-token). |
 | `theme.colorFill` | string | - | Default watermark text color when font.color is not set. Maps to the global colorFill token. |
 | `theme.fontSizeLG` | number | `16` | Default watermark font size when font.fontSize is not set. Maps to the global fontSizeLG token. |

package/content/controls/reject.md

@@ -7,11 +7,9 @@
 The `:reject` control is used to return a user-friendly error to the client when validation fails or business rules are violated.
 Unlike [`:throw`](/:throw), which indicates a system error, `:reject` represents an expected failure condition that should be communicated to the user.
 The control immediately stops routine execution and returns with a `"reject"` status.
-Importantly, `:reject` does not trigger `:catch` blocks in [`:try`](/:try) statements: the reject flows past every enclosing `:try`, so a `:catch` in an outer `:try` never runs either, while `:finally` still runs.
-This makes `:reject` ideal for handling validation and business logic errors separately from system errors.
-Choose [`:throw`](/:throw) when a step failed and the routine may recover; choose `:reject` when the routine decided the request cannot be fulfilled.
+Importantly, `:reject` does not trigger `:catch` blocks in [`:try`](/:try) statements, making it ideal for handling validation and business logic errors separately from system errors.
 
-`:reject` also takes an Error as its message, such as the error a `:catch` caught: `:reject: { _error: true }`. The reject message is then "Something went wrong.", unless the error was a `UserError` or an auth refusal (`AuthenticationError`, `AuthorizationError` or `TwoFactorEnrolmentRequiredError`), whose message is kept. To reject with the caught error's real message, name it: `:reject: { _error: message }`. See [`_error`](/_error).
+`:reject` also takes an Error as its message, such as the error a `:catch` caught: `:reject: { _error: true }`. The reject message is then "Something went wrong.", unless the error was a `UserError` or an authentication error, whose message is kept. To reject with the caught error's real message, name it: `:reject: { _error: message }`. See [`_error`](/_error).
 
 #### Keys
 

package/content/controls/throw.md

@@ -8,7 +8,6 @@ The `:throw` control creates a system error that immediately stops routine execu
 Unlike [`:reject`](/:reject), which handles expected user errors, `:throw` is designed for unexpected system failures, programming errors, or critical issues that require attention.
 The key difference is that `:throw` can be caught and handled by [`:try`](/:try)/`:catch` blocks, while [`:reject`](/:reject) cannot.
 This makes `:throw` ideal for recoverable system errors where you might want to implement fallback logic.
-Choose `:throw` when a step failed and the routine may recover; choose [`:reject`](/:reject) when the routine decided the request cannot be fulfilled.
 
 `:throw` also takes an Error as its message, such as the error a `:catch` caught: `:throw: { _error: true }`. The error is rethrown as it is, with its own class and cause, and `:cause` is ignored. The client receives it with the message "Something went wrong.", keeping its `code` and `statusCode`, unless it was a `UserError`, whose message is kept. To show the user the caught error's real message, name it: `:throw: { _error: message }`. See [`_error`](/_error).
 

package/content/controls/try.md

@@ -7,14 +7,13 @@
 If one control in the routine chain defined in the `:try` key fails by throwing an error, the steps in the list following the failed control will not be executed.
 To handle any errors thrown by a routine element, a routine can be provided using `catch` key.
 The routine defined using the `:finally` key will be run regardless of whether or not the routine throws an error.
-A [`:reject`](/:reject) inside the `:try` routine is __not__ caught. `:reject` is the routine's own reply — it stops the routine, returns a `"reject"` status to the caller, and flows past every enclosing `:catch`. `:finally` still runs. Use [`:throw`](/:throw) for failures a `:catch` should handle.
 Inside the `:catch` routine, the [`_error`](/_error) operator returns the error that was caught, so the routine can branch on its `statusCode` or `code`, or read its `message`. `_error` returns the error of the innermost `:catch` that encloses it, and `null` outside a `:catch`.
 
 #### Keys
 
 - `:try: routine`: __Required__ - The routine to be run.
-- `:catch: routine`: The routine to execute if any step in the routine defined errors. Runs on a thrown error only — a `:reject` is not caught.
-- `:finally: routine`: The routine to be run regardless of the out come of the initial routine. Runs on success, error and reject.
+- `:catch: routine`: The routine to execute if any step in the routine defined errors.
+- `:finally: routine`: The routine to be run regardless of the out come of the initial routine.
 
 #### Examples
 

package/content/deployment/deployment-environments.md

@@ -1,6 +1,6 @@
 # Deployment environments
 
-Most apps run as more than one deployment: production, a staging copy, a developer's machine. Everything that differs between them is declared once, under `config.environments`, and each deployment says which environment it is with the `LOWDEFY_ENVIRONMENT` environment variable. Lowdefy then takes every environment-specific default from the **current environment** — the app URL, crons, the email delivery filter, Sentry, PostHog, and the feature switches — so none of them needs its own variable or operator chain.
+Most apps run as more than one deployment: production, a staging copy, a developer's machine. Everything that differs between them is declared once, under `config.environments`, and each deployment says which environment it is with the `LOWDEFY_ENVIRONMENT` environment variable. Lowdefy then takes every environment-specific default from the **current environment** — the app URL, crons, the email delivery filter, Sentry, and the feature switches — so none of them needs its own variable or operator chain.
 
 ```yaml
 # lowdefy.yaml
@@ -46,18 +46,17 @@ Every setting is optional, and every feature is **on by default**: only an expli
 | `email.filter` | none | Delivery filter (`replaceAddress`, `allowlist`, `regex`) for mail requests. |
 | `email.enabled` | `true` | `false`: mail requests send nothing. |
 | `sentry.enabled` | `true` | `false`: Sentry off, server and client. |
-| `posthog.enabled` | `true` | `false`: PostHog off — `PostHogInit` behaves as `enabled: false`. |
 | `guards.secrets`, `guards.env` | none | Regular expressions the named secrets and environment variables must match, or the build fails. |
 
 ## URL
 
 The current environment's `url` is the default for:
 
-- the auth canonical URL (`BETTER_AUTH_URL`) — password-reset, magic-link and verification links, the CSRF origin allowlist, and the MCP resource URIs;
+- the auth base URL (`AUTH_URL`) — sign-in callbacks and auth links;
 - the `serverUrl` of `RenderNotification` steps — the links and logo in notification emails;
 - where crons are forwarded to, when another environment forwards to this one.
 
-An explicit `BETTER_AUTH_URL` or `serverUrl` still wins. The dev server (`lowdefy dev`) never uses the current environment's `url`: notification and auth links use the request origin, the local app, even when your local `.env` names a deployed environment. Production never uses the request origin, since a spoofed `Host` header would then steer the links in outgoing mail. A production server with `auth.email` configured refuses to start when neither `BETTER_AUTH_URL` nor the current environment's `url` is set.
+An explicit `AUTH_URL` / `NEXTAUTH_URL` or `serverUrl` still wins. The dev server (`lowdefy dev`) never uses the current environment's `url`: auth and notification links use the request origin, the local app, even when your local `.env` names a deployed environment. Production never uses the request origin, since a spoofed `Host` header would then steer the links in outgoing mail.
 
 Every deployment that names an environment is taken to be served at its `url`. Preview deployments that should not sign users in on the staging host need their own environment, e.g. a `preview` environment with no `url` and the same `email.filter` and guards as staging.
 
@@ -81,11 +80,10 @@ Endpoint `schedules` can be keyed by environment name, with a `default` for the
 
 See the [SMTP](/SMTP) and [SendGridMail](/SendGridMail) connections for the filter fields.
 
-## Logs, Sentry and PostHog
+## Logs and Sentry
 
 - Every server log line carries `environment` next to `app_name`, `app_version` and `git_sha`, so one log drain can hold every environment. Logging cannot be switched off.
 - Sentry reports under the environment name unless `logger.sentry.environment` is set, and `sentry.enabled: false` turns it off on the server and in the browser.
-- `PostHogInit` registers the environment name as the `environment` super property, so every PostHog event carries it. `posthog.enabled: false` switches PostHog off in that environment: `PostHogInit` behaves as `enabled: false` whatever its params say, needs no `apiKey`, and every other PostHog action is a no-op.
 
 ## Guards
 
@@ -100,7 +98,7 @@ config:
         secrets: # Lowdefy secrets, by name (LOWDEFY_SECRET_<name>)
           MONGODB_URI: 'acme-prod\.a1b2c\.mongodb\.net'
         env: # any environment variable
-          BETTER_AUTH_URL: '^https://app\.example\.com$'
+          AUTH_URL: '^https://app\.example\.com$'
 ```
 
 - Patterns match anywhere in the value, so a distinctive substring is enough; add `^` and `$` to pin the whole value. A pattern is committed with your config, so never put the sensitive part of a secret in it — a host name or database name is enough.
@@ -113,7 +111,7 @@ config:
 Environment settings stay on the server. The browser only learns the current environment's **name** and the list of features it switches off, through the app metadata:
 
 - `_app: environment` — the current environment's name.
-- `_app: disabled` — the switched-off features, e.g. `[email, posthog]`.
+- `_app: disabled` — the switched-off features, e.g. `[email, sentry]`.
 
 Other environments' settings, URLs, secret names, email filters and guards never reach the client bundle. Only the current environment's guards are kept in the build output, in the server-only `config.json`, for the startup check.
 

package/content/deployment/docker.md

@@ -15,7 +15,7 @@ The generated Dockerfile:
 ```text
 # syntax=docker/dockerfile:1
 
-FROM node:24-slim AS builder
+FROM node:22-slim AS builder
 
 WORKDIR /lowdefy
 
@@ -41,7 +41,7 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
   && npx lowdefy@"$LOWDEFY_VERSION" build \
   && npx lowdefy@"$LOWDEFY_VERSION" docker-output
 
-FROM node:24-slim AS runner
+FROM node:22-slim AS runner
 
 ENV NODE_ENV=production
 ENV PORT=3000
@@ -93,7 +93,7 @@ Key properties of this setup:
 - **Fast rebuilds**: the pnpm store is kept in a BuildKit cache mount, so changing app config only re-downloads dependencies that actually changed.
 - **Small runtime image**: `docker-output` traces the server's real import graph and copies only what the server loads at runtime — a fraction of the installed `node_modules`, since the client-side block packages are already compiled into `dist/client` and never imported by the server.
 - **Non-root**: the server runs as the `node` user built into the official Node.js images.
-- For stronger supply-chain guarantees, pin the base images by digest (`node:24-slim@sha256:...`) and let a bot like Renovate or Dependabot keep the digest updated.
+- For stronger supply-chain guarantees, pin the base images by digest (`node:22-slim@sha256:...`) and let a bot like Renovate or Dependabot keep the digest updated.
 
 ### Health checks
 
@@ -124,7 +124,7 @@ The server is configured entirely through environment variables at runtime — t
 | `LOWDEFY_SECRET_*`  | App secrets, accessed with the [`_secret`](/_secret) operator.           |
 | `AUTH_SECRET`       | Required when using [Lowdefy Auth](/users-introduction).                 |
 | `LOWDEFY_ENVIRONMENT` | Read at build time: the environment this image is built for, one of `config.environments`. |
-| `BETTER_AUTH_URL`   | The app's canonical origin for auth links and the MCP resource URIs. Defaults to the `url` of the current environment in `config.environments`. The server refuses to start without one of the two when `auth.email` is configured. Set it when a proxy terminates TLS in front of the container: without it, auth trusts only the origin the request reached the server on (`http://…`), and refuses sign-in from the `https://` page. |
+| `AUTH_URL`          | The deployed app URL, required for OAuth providers. Defaults to the `url` of the current environment in `config.environments`. |
 | `CRON_SECRET`       | Bearer token protecting `/api/cron/*` and `/api/detached/*` endpoints.   |
 | `LOWDEFY_LOG_LEVEL` | Server log level: `debug`, `info` (default), `warn`, `error`.            |
 | `SENTRY_DSN`        | Enables Sentry error reporting when set.                                 |
@@ -148,21 +148,6 @@ RUN --mount=type=secret,id=sentry,env=SENTRY_AUTH_TOKEN \
   npx lowdefy@"$LOWDEFY_VERSION" build
 ```
 
-### Behind a reverse proxy
-
-The server takes each request's client address from its connection. Auth rate limits count attempts per client address (for example 3 sign-in attempts per 10 seconds), sessions record it, and the request log writes it as `client_address`. `X-Forwarded-For` is not read by default, because any client can send it.
-
-Behind a reverse proxy, load balancer or ingress, every connection comes from the proxy, so every client would share its address and its rate limits. List the proxy addresses, or CIDR ranges, in `config.trustedProxies`:
-
-```yaml
-config:
-  trustedProxies:
-    - 10.0.0.0/8
-    - 172.16.0.0/12
-```
-
-When a request's connection comes from a trusted proxy, the server reads `X-Forwarded-For` from the right, skips every trusted hop, and takes the first address that is not trusted. Entries further left were written by the client and are ignored. Do not list `0.0.0.0/0` or `::/0`: they trust every address, so any client could choose its own, and the build warns about them. The proxy must append to `X-Forwarded-For` (nginx: `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`). The server logs a warning the first time a request carries `X-Forwarded-For` while `trustedProxies` is not set.
-
 ### Logging
 
 The server writes structured JSON logs (one JSON object per line, via [pino](https://getpino.io)) to stdout — the format container platforms and log collectors (CloudWatch, Loki, Datadog, etc.) expect. Nothing is written to files inside the container.
@@ -203,7 +188,7 @@ The container inherits the Dockerfile `HEALTHCHECK`, so `docker compose ps` repo
 docker compose up --build
 ```
 
-If you set a container memory limit, Node.js 24+ sizes its heap from the container's cgroup limit automatically. To control it explicitly, set `NODE_OPTIONS=--max-old-space-size=<MiB>` a comfortable margin below the container limit.
+If you set a container memory limit, Node.js 22+ sizes its heap from the container's cgroup limit automatically. To control it explicitly, set `NODE_OPTIONS=--max-old-space-size=<MiB>` a comfortable margin below the container limit.
 
 ### Config files or plugins outside the config directory
 
@@ -214,7 +199,7 @@ Sometimes files outside of the config directory need to be accessed by the Lowde
 ```text
 # syntax=docker/dockerfile:1
 
-FROM node:24-slim AS builder
+FROM node:22-slim AS builder
 
 WORKDIR /lowdefy
 
@@ -232,7 +217,7 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
   && npx lowdefy@"$LOWDEFY_VERSION" build --config-directory ./app \
   && npx lowdefy@"$LOWDEFY_VERSION" docker-output --config-directory ./app
 
-FROM node:24-slim AS runner
+FROM node:22-slim AS runner
 
 ENV NODE_ENV=production
 ENV PORT=3000

package/content/deployment/node-server.md

@@ -22,10 +22,6 @@ from inside the folder, or `pnpm start`. The server listens on `PORT` (default 3
 
 Always run the build before restarting the server — the server reads the client asset manifest once at startup.
 
-With `auth.email` configured, the server needs the app's canonical origin — `BETTER_AUTH_URL`, or the `url` of the current environment in `config.environments` — or it refuses to start, so emailed auth links cannot take their host from a request. To test the production server locally, set `BETTER_AUTH_URL=http://localhost:3000`.
-
-Behind a reverse proxy or load balancer, list its addresses in `config.trustedProxies` so auth rate limits count each client, not the proxy. See [Behind a reverse proxy](/docker#behind-a-reverse-proxy).
-
 ### Alternative
 
 An alternative option would be to make use of [Docker](./docker) to deploy the app. Docker has a few advantages, including scalability, application portability, version control and deployment speed, amoung others.

package/content/deployment/vercel.md

@@ -27,17 +27,14 @@ In the Vercel project:
     - Eg: if `lowdefy.yaml` is at the top level of the repository, set the root directory to `deploy`; if it is in `apps/app_name`, set it to `apps/app_name/deploy`.
 - **Install Command:** `bash vercel.install.sh`. Leave the **Build Command** to `vercel.json` (do not override it in the dashboard). There is no **Output Directory** setting — the build emits `.vercel/output`, which Vercel detects automatically.
 - Enable **"Include files outside the root directory in the Build Step"** — the Lowdefy config usually lives in the parent of `deploy/`.
-- **Node.js Version:** `24.x` or newer. The install and build steps run the Lowdefy CLI, which requires Node.js 24; the function itself runs on the `nodejs24.x` runtime set in the generated Build Output.
 
 ###### Public files
 
-Files in your app's `public/` directory (favicon, icons, images, `manifest.webmanifest`, etc.) are copied into `dist/client` by Vite during the build, placed in `.vercel/output/static`, and served by the Vercel CDN — no extra configuration needed. With `config.basePath` set, they are placed and served under the base path, as are the generated cron paths below.
+Files in your app's `public/` directory (favicon, icons, images, `manifest.webmanifest`, etc.) are copied into `dist/client` by Vite during the build, placed in `.vercel/output/static`, and served by the Vercel CDN — no extra configuration needed.
 
 ###### Secrets and environment variables
 
-Secrets can be set in the Environment Variables settings section by creating environment variables prefixed with `LOWDEFY_SECRET_`. Pin the auth canonical URL with the current environment's `url` (see [Deployment environments](/deployment-environments)) or `BETTER_AUTH_URL`; with `auth.email` configured the app refuses to start without it. Different secrets can be set for production and preview deployments.
-
-On Vercel the client address used by auth rate limits, sessions and request logs comes from the platform (`x-real-ip`), which Vercel sets on every request. `config.trustedProxies` is not used.
+Secrets can be set in the Environment Variables settings section by creating environment variables prefixed with `LOWDEFY_SECRET_`. Use `AUTH_SECRET` (and `AUTH_URL` for OAuth, which defaults to the current environment's `url` — see [Deployment environments](#deployment-environments)) for authentication. Different secrets can be set for production and preview deployments.
 
 ###### Function settings
 
@@ -85,11 +82,11 @@ Each schedule becomes a cron job pointing at `/api/cron/<endpointId>`. When it f
 
 ###### Deployment environments
 
-Declare the app's environments once under `config.environments` and name the current one with the `LOWDEFY_ENVIRONMENT` Environment Variable — see [Deployment environments](/deployment-environments) for every setting (URL, crons, email, Sentry, PostHog, feature switches, guards). On Vercel, add `LOWDEFY_ENVIRONMENT` to each Vercel environment (for example `prod` on Production and `staging` on the staging branch's Preview environment). Vercel Environment Variables are available at build time, which is when Lowdefy reads it and checks guards.
+Declare the app's environments once under `config.environments` and name the current one with the `LOWDEFY_ENVIRONMENT` Environment Variable — see [Deployment environments](/deployment-environments) for every setting (URL, crons, email, Sentry, feature switches, guards). On Vercel, add `LOWDEFY_ENVIRONMENT` to each Vercel environment (for example `prod` on Production and `staging` on the staging branch's Preview environment). Vercel Environment Variables are available at build time, which is when Lowdefy reads it and checks guards.
 
 ###### Crons for staging and other environments
 
-Vercel fires cron jobs only on the **production** deployment — a staging or preview deployment never runs its schedules on its own. Give an environment a `cron.secret` and the environment Vercel fires crons on registers that environment's schedules too; when one fires, production forwards it to that environment's own `/api/cron/<endpointId>` at its `url` (under `config.basePath` when one is set) and answers Vercel immediately (the ping is fire-and-forget, kept alive via the request context and bounded by `maxDuration`; its outcome is logged as `forward_scheduled_endpoint_done` / `_failed`).
+Vercel fires cron jobs only on the **production** deployment — a staging or preview deployment never runs its schedules on its own. Give an environment a `cron.secret` and the environment Vercel fires crons on registers that environment's schedules too; when one fires, production forwards it to that environment's own `/api/cron/<endpointId>` at its `url` and answers Vercel immediately (the ping is fire-and-forget, kept alive via the request context and bounded by `maxDuration`; its outcome is logged as `forward_scheduled_endpoint_done` / `_failed`).
 
 - **Forwarded environments:** an environment with a `cron.secret` is forwarded to, so it must have a `url`. `cron.secret` is the **name** of the Lowdefy secret holding that environment's own `CRON_SECRET` — a plain string such as `STAGING_CRON_SECRET`, not `{ _secret: ... }`: environment settings are resolved at build time, and the forward route reads the value at runtime from `LOWDEFY_SECRET_<name>`. Set `cron.enabled: false` on an environment to register no crons for it.
 - **Secrets on production:** for each forwarded environment add an Environment Variable `LOWDEFY_SECRET_<secret name>` (for example `LOWDEFY_SECRET_STAGING_CRON_SECRET`) to the production deployment, with that environment's `CRON_SECRET` as value. The forward route `/api/cron-forward/*` itself is secured by production's own `CRON_SECRET` like every cron route, and fails closed when the environment's secret is missing.
@@ -110,13 +107,9 @@ See [Async Endpoints](/lowdefy-api) and [Detached Endpoint Calls](/lowdefy-api)
 
 Vercel Fluid bills by execution duration, so a request that hangs (a stuck database, SMTP or external API call) is a real cost risk. Two guardrails apply:
 
-- **`config.requestTimeout`** (in `lowdefy.yaml`, default `30000` ms) — the server returns a timeout instead of letting a request run on, and cancels the AI model calls the request was waiting on. Set to `0` to disable. Agent streaming routes are exempt.
+- **`config.requestTimeout`** (in `lowdefy.yaml`, default `30000` ms) — the server returns a timeout instead of letting a request run on. Set to `0` to disable. Agent streaming routes are exempt.
 - **`config.vercel.maxDuration`** (default `60`) — a hard platform cap; Vercel stops the function at this many seconds. See Function settings above.
 
-Keep `config.requestTimeout` below `maxDuration`: when it is not, Vercel stops the function before the request timeout answers, so the upstream calls the request left running are not cancelled and the request ends without a logged timeout. The build warns when `config.requestTimeout` is not shorter than `maxDuration` (or than the 60-second default, when it runs on Vercel).
-
-On Vercel, only the request timeout cancels an AI model call a request is waiting on. A client that disconnects does not: the call runs until it finishes, reaches its own `timeout`, or hits the request timeout. On the Node server a disconnect cancels it too.
-
-> The function runs on Vercel's Node.js runtime. Streaming agent responses (`/api/agent/*`) are exempt from `config.requestTimeout` and are bounded only by `maxDuration` — for heavy streaming or agent workloads, a long-lived Node host (Docker, Fly.io, Railway, Render) may suit better. An agent run keeps running to the end when its client disconnects, so its work completes; a `GET` stream (such as an MCP client's notification stream) stops when its client goes, instead of holding the function until `maxDuration`.
+> The function runs on Vercel's Node.js runtime. Streaming agent responses (`/api/agent/*`) are exempt from `config.requestTimeout` and are bounded only by `maxDuration` — for heavy streaming or agent workloads, a long-lived Node host (Docker, Fly.io, Railway, Render) may suit better.
 
 All other Vercel configuration like domain names, preview deploy branches, serverless regions and redirects can be configured as desired.