Request: Audit changesets on the antd-v6 PR and clean up iterative fix/patch entries.
Motivation: 45 changesets accumulated over iterative development — many "fix" entries
were fixing features introduced on the same branch, not user-visible bugs.

Decisions:
- Absorb fix changesets into parent feature changesets rather than keeping separate entries
- Split grab-bag changeset (menu-links-dark-mode-fixes) into focused single-concern entries
- Add ErrorBar mention to server-dev code-docs

Changes:
- Deleted 8 changesets absorbed into parent features (e2e-test-fixes, numberinput-fix, fix-dayjs-utc-postcss-calendar, fix-block-tailwind-and-antd-deps, fix-loaders-dark-mode-tokens, gallery-docs, shortcut-badge-in-blocks, menu-links-dark-mode-fixes)
- Updated 9 changesets with absorbed content and cleaned prefixes
- Created build-error-messages.md and menu-operator-links.md from split grab-bag
- server-dev.md: Added ErrorBar section under Client Components

Tags: changesets, changeset-cleanup, antd-v6, changelog, docs, server-dev, errorbar

Request: Add the v5 release article to the lowdefy website's articles section.
Motivation: The v5 release article was written in lowdefy-design and needs to be published on the website.

Changes:
- lowdefy-5-whats-new.md: Full v5 release article covering Tailwind, dark mode, shortcuts, antd v6, slots, new blocks, plugin updates, DX improvements
- index.js: Register article in the articles content registry
- layout.jsx: SEO and OpenGraph metadata for the article route
- page.jsx: Article page component with Header/Footer
- opengraph-image.jsx: Social media preview image generator

Tags: website, article, v5-release, docs, blog

…format.

Request: Fix _js error showing as LowdefyInternalError with no config path
Motivation: When _js is used with wrong format (e.g. _js: { expr: '...' } instead of
_js: '...'), the error was a plain Error wrapped in LowdefyInternalError — giving the
user no indication of where the bad config is.

Changes:
- jsMapParser.js: Throw ConfigError instead of plain Error, include configKey from ~k
  marker and the received value in the message. ConfigError.isLowdefyError = true so
  buildPageJit's catch handler preserves it instead of wrapping in LowdefyInternalError.

Tags: _js, config-error, jsMapParser, error-tracing, build

Request: Add a height property to define the dragger area height in pixels
Motivation: Allow users to control the dragger area size.

Changes:
- S3UploadDragger.js: Pass properties.height to antd Dragger's built-in height prop
- meta.js: Add height property metadata
- schema.js: Add height property schema

Tags: s3-upload, dragger, height, plugin-aws

Request: Add _math.mod operator
Motivation: JavaScript's Math object lacks a modulo method, but remainder is a common operation in configs.

Changes:
- math.js: Add mod to meta, wrap Math with Object.create(Math) to add custom mod function
- math.test.js: Add mod tests (array and object forms), update inline snapshots
- _math.yaml: Add mod method entry to user-facing docs
- js.md: Add mod to supported methods list in code-docs
- feat-math-mod-operator.md: Changeset for patch bump

Tags: operators-js, math, mod, modulo, remainder

Request: Fix PhoneNumberInput phone_number formatting.
Motivation: Raw string concatenation produced malformed phone numbers — leading
zeros weren't stripped ("+270821234567"), non-digit characters passed through,
and empty input stored just the dial code ("+27") instead of empty string.

Changes:
- formatPhoneNumber.js: New helper strips non-digits and leading zeros from input
- PhoneNumberInput.js: Use formatPhoneNumber for both onChange handlers, remove phone_number from null init
- PhoneNumberInput.e2e.spec.js: Add 3 formatting tests (leading zeros, non-digits, empty init)
- PhoneNumberInput.e2e.yaml: Add format_test and empty_test blocks with display spans
- fix-phone-number-formatting.md: Changeset for patch bump

Tags: phone-number, formatting, blocks-antd, phone-input, dial-code, strip-zeros

Request: Fix logger crash "Converting circular structure to JSON" when AxiosHttp requests fail
Motivation: extractErrorProps included plain objects by reference without deep-cleaning, so Axios error
responses containing Node.js request/response cycles crashed JSON.stringify.

Decisions:
- Fix in extractErrorProps, not the serializer: extractErrorProps broke its contract to return serialisable output
- Separate objectDepth/causeDepth counters: object nesting (5 levels) and cause chains (3 levels) are independent limits
- Shared seen Set between cleanValue and _extractErrorProps: tracks circular refs across error cause chains and nested objects in one pass

Changes:
- extractErrorProps.js: Add cleanValue helper, wire into plain-object/array/non-Error-cause branches, split _extractErrorProps depth param into objectDepth+causeDepth
- extractErrorProps.test.js: Add 6 tests for circular refs in plain objects, deep nesting truncation, array cleaning, non-Error cause cleaning, errors inside plain objects
- serializer.test.js: Add integration test exercising full serialize path with Axios-shaped circular error
- fix-serialize-circular-errors.md: Changeset for @lowdefy/helpers patch
- code-docs/utils/helpers.md: Document cleanValue deep-cleaning behaviour
- code-docs/architecture/error-tracing.md: Note deep-cleaning in error serialization section

Tags: extractErrorProps, cleanValue, circular-reference, serializer, axios, error-serialization, helpers

Request: Fix failing build package tests.
Motivation: writeGlobalsCss now emits a layer-order.css build artifact but
the 54 snapshot files were not regenerated.

Changes:
- 54 snapshot.json files: Added layer-order.css entry to match new build output

Tags: build, snapshots, layer-order, css, test-fix

…r handling.

Motivation: Need to validate or confirm files before upload begins, and upload
failures were silently swallowed with no diagnostic information.

Changes:
- meta.js (S3UploadButton, S3UploadDragger): Add onBeforeUpload event definition
- useFileList.js: Trigger onBeforeUpload before upload, cancel if action throws; serialize file metadata to plain object to survive serializer.copy()
- getS3Upload.js: Rewrite XHR upload as Promise-based with proper error propagation; throw ServiceError on CORS/network failures
- feat-s3-upload-before-upload.md: Changeset for minor bump

Tags: plugin-aws, s3-upload, onBeforeUpload, file-validation, error-handling, xhr, cors

Request: Investigate the bad icon import error and make it pretty.
Motivation: When a user writes a bad icon name (e.g. AiOutlineToolOutlined),
the Lowdefy build generates a massive single-line import that Next.js dumps
as a wall of unreadable text. The actual useful info is buried.

Decisions:
- Warning not error: invalid icons emit ConfigWarning so build continues
- Proportional Levenshtein threshold: maxDistance scales with icon name length to catch suffix typos like "ToolOutlined" → "Tool"
- Graceful fallback: if a react-icons package can't be loaded, skip validation

Changes:
- validateIconImports.js: New — validates icon names against actual react-icons package exports, filters invalid ones, emits ConfigWarning with "did you mean?" suggestion
- buildIconImports.js: Call validateIconImports after collecting icons
- extractIconData.js: Add warning with suggestion in JIT path for invalid icons
- validateIconImports.test.js: 7 tests covering valid/invalid icons, suggestions, package load failure, caching

Tags: build, icons, validation, react-icons, config-warning, did-you-mean

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…plugins.

Request: Should we apply changes to the plugin dependency definitions in the lowdefy repo?
Motivation: All block plugins declared react and react-dom as direct dependencies
(pinned 18.2.0). In consuming workspaces, if any other package pulls a different
React version, pnpm installs two copies — two React instances means two context
trees and ConfigProvider theme (dark mode, compact, tokens) becomes invisible to
plugin components.

Decisions:
- Use >=18 for react/react-dom, >=5 for antd (blocks-antd uses v5+ API), >=6 for antd in plugin-aws
- block-dev left unchanged: it's a test utility that correctly provides React for the test environment
- @lowdefy/client and @lowdefy/layout left unchanged: core packages that correctly own React

Changes:
- blocks-basic/package.json: react, react-dom → peerDependencies
- blocks-antd/package.json: react, react-dom, antd → peerDependencies
- blocks-echarts/package.json: react, react-dom → peerDependencies
- blocks-loaders/package.json: react, react-dom → peerDependencies
- blocks-markdown/package.json: react, react-dom → peerDependencies
- blocks-aggrid/package.json: react, react-dom → peerDependencies
- blocks-google-maps/package.json: react, react-dom → peerDependencies
- blocks-qr/package.json: react, react-dom → peerDependencies
- plugin-aws/package.json: react, react-dom, antd → peerDependencies
- block-utils/package.json: react, react-dom → peerDependencies
- pnpm-lock.yaml: Regenerated

Tags: plugins, peer-dependencies, react, antd, dual-instance, dark-mode, theme

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…d add border styles.

Changes:
- Header/meta.js, PageHeaderMenu/meta.js, PageSiderMenu/meta.js: Change profile dropdown trigger default from 'click' to 'hover'
- headerActions.js: Update runtime fallback to match new 'hover' default
- PageSiderMenu.js: Add borderBottom to header and borderInlineEnd to sider for visual separation

Tags: blocks-antd, profile-dropdown, hover, border, page-sider-menu, header-actions

…thor.

Request: Add article from external markdown file to the website with a new author profile
Motivation: Publishing a new opinion piece on config-driven development in the AI era

Changes:
- case-for-config-driven-development.md: New article with frontmatter
- authors.js: Added stephanie author profile
- index.js: Registered article import and parse entry
- page.jsx: Article page route component
- layout.jsx: Article layout with SEO metadata

Tags: website, article, author, config-driven, ai, stephanie, content

Add config-driven development article to website

…ations.

Request: Add missing icons to block meta so they are bundled in production builds.
Motivation: The build uses meta.icons to determine which react-icons to bundle. Icons used in code or as schema defaults but not declared in meta get tree-shaken out, causing missing icons in production.

Changes:
- Header/meta.js: Add AiOutlineLaptop (system dark mode toggle icon from headerActions.js)
- PageHeaderMenu/meta.js: Add AiOutlineLaptop
- PageSiderMenu/meta.js: Add AiOutlineLaptop
- Selector/meta.js: Add AiOutlineCloseCircle, AiOutlineDown (schema defaults for clearIcon, suffixIcon)
- MultipleSelector/meta.js: Add AiOutlineCheck, AiOutlineCloseCircle, AiOutlineDown (schema defaults for selectedIcon, clearIcon, suffixIcon)
- Icon/meta.js: Add AiOutlineCloseCircle (schema default for name property)

Tags: icons, meta, tree-shaking, dark-mode, selector, production-build, blocks-antd, blocks-basic

# Conflicts:
#	code-docs/architecture/build-pipeline.md
#	code-docs/packages/build.md
#	packages/build/package.json
#	packages/build/src/build/jit/shallowBuild.js
#	packages/build/src/tests/success/34-crud-app-complete/snapshot.json
#	packages/build/src/tests/success/39-global-state-app/snapshot.json
#	packages/build/src/tests/success/47-operators-comprehensive/snapshot.json
#	packages/build/src/tests/success/55-complete-enterprise-app/snapshot.json
#	packages/client/package.json
#	packages/docs/package.json
#	packages/engine/package.json
#	packages/layout/package.json
#	packages/plugins/blocks/blocks-aggrid/package.json
#	packages/plugins/blocks/blocks-algolia/CHANGELOG.md
#	packages/plugins/blocks/blocks-algolia/package.json
#	packages/plugins/blocks/blocks-antd/package.json
#	packages/plugins/blocks/blocks-basic/package.json
#	packages/plugins/blocks/blocks-color-selectors/CHANGELOG.md
#	packages/plugins/blocks/blocks-color-selectors/package.json
#	packages/plugins/blocks/blocks-echarts/package.json
#	packages/plugins/blocks/blocks-google-maps/package.json
#	packages/plugins/blocks/blocks-loaders/package.json
#	packages/plugins/blocks/blocks-qr/package.json
#	packages/plugins/connections/connection-axios-http/package.json
#	packages/plugins/connections/connection-elasticsearch/package.json
#	packages/plugins/connections/connection-google-sheets/package.json
#	packages/plugins/connections/connection-knex/package.json
#	packages/plugins/connections/connection-redis/package.json
#	packages/plugins/connections/connection-sendgrid/package.json
#	packages/plugins/connections/connection-stripe/package.json
#	packages/plugins/operators/operators-dayjs/package.json
#	packages/plugins/operators/operators-js/src/operators/shared/date.js
#	packages/plugins/operators/operators-moment/CHANGELOG.md
#	packages/plugins/plugins/plugin-aws/package.json
#	packages/servers/server-dev/package.json
#	packages/servers/server-e2e/package.json
#	packages/servers/server/package.json
#	packages/utils/block-dev/package.json
#	packages/utils/block-utils/package.json
#	packages/utils/nunjucks/package.json
#	packages/website/src/content/articles/index.js
#	pnpm-lock.yaml

Request: Resolve merge conflict between antd-v6 and main.
Motivation: After merging main into antd-v6, package.json files needed @lowdefy/* internal dependency versions updated from 4.7.2 to 4.7.3 to match main's latest release.

Changes:
- 41 package.json files: Updated version and @lowdefy/* dependency versions from 4.7.2 to 4.7.3

Tags: version-bump, merge, package-json, 4.7.3

Request: Fix CI snapshot test failures.
Motivation: Snapshots were generated against stale dist/ files that lacked
the dynamic: true flag on _date.valueOf (operators-js) and new icons in
block metas (blocks-antd, blocks-basic). CI compiles fresh dist from src
before testing, so CI's build output differed from the stale-dist snapshots.

Decisions:
- Rebuilt operators-js, blocks-antd, blocks-basic dist before regenerating: ensures snapshots match what CI produces

Changes:
- 33-multifile-nested-refs/snapshot.json: Key reordering from collectSkeletonSourceFiles
- 34-crud-app-complete/snapshot.json: ~k shifts (+2) from _date server operator, new icon entries
- 39-global-state-app/snapshot.json: Same ~k shifts and _date additions
- 47-operators-comprehensive/snapshot.json: Same ~k shifts and _date additions
- 55-complete-enterprise-app/snapshot.json: Same ~k shifts and _date additions

Tags: snapshots, dist, ci, _date, dynamic, operators-js, blocks-antd, build

Request: "we can remove the claude code review in this repo"

Changes:
- claude-code-review.yml: Removed PR review workflow

Tags: ci, workflow, claude-code-review

Request: Harden ID validation across the build pipeline.
Motivation: Scattered `.includes('.')` checks only caught periods. A shared
validateId utility enforces a strict allowlist (A-Z, a-z, 0-9, "-", "_", "/")
and is applied consistently to endpoints, steps, requests, connections, and pages.

Changes:
- validateId.js: New shared utility with regex-based ID validation
- validateId.test.js: Tests for valid IDs, periods, traversal, spaces, specials
- validateStep.js: Replace inline period check with validateId
- validateEndpoint.js: Replace inline period check with validateId
- buildRequests.js: Replace inline period check with validateId
- buildConnections.js: Add validateId call for connection IDs
- buildPage.js: Add validateId call for page IDs
- buildApi.test.js: Update test name and expected error message
- buildRequests.test.js: Update test name and expected error message
- F4-request-id-with-period/expected.json: Update expected error strings

Tags: validate-id, build, security, id-validation, config-error

Request: Prevent directory traversal in config file reads.
Motivation: readConfigFile accepted arbitrary paths that could escape the build
directory via ".." or special characters. A regex allowlist and ".." check now
reject invalid paths before they reach the filesystem.

Changes:
- createReadConfigFile.js: Add validPathPattern regex and ".." guard
- createReadConfigFile.test.js: Add tests for traversal, spaces, and injection

Tags: path-traversal, security, api, readConfigFile, input-validation

Page IDs like ":reject" and ":throw" in the docs app use colons.
The validateId regex and readConfigFile path regex now permit ":".

Tags: validate-id, docs-build, colon, regex