Why

Follow-up to #284 (App Actions V3 return-shape fix). Yuliia Kovalenko's finding turned out to be one instance of a recurring bug class, so the entire API/ + REST-API/ doc tree (144 verifiable pages) was audited against source. ~40 confirmed discrepancies fixed here. Each was re-verified against fliplet-api/widget source at master before editing; nothing was changed on a guess.

Full audit report: AUDIT/audits/docs-correctness-audit-2026-06-30.md.

HIGH — documented example threw or returned wrong data

• organizations.md — Settings examples used singular Fliplet.Organization (namespace is plural Fliplet.Organizations) → TypeError.
• fliplet-content.md — query() example passed the filter at top level; the lib reads where.content, so the filter was silently ignored and ALL entries returned. Now nested under where.
• fliplet-datasources.md — subscribe() callback accessed changes.inserted.length etc. unconditionally; threw on update-only changes. Guarded.
• v3/auth.md — dataSource.validate example omitted the required match column → HTTP 400.
• components/record-container.md — removed 4 non-existent instance props; hook payload key vm → instance.
• components/dynamic-container.md — removed non-existent container.load(); get() is by id, not name.
• fliplet-table.md — search event is actually search:change {term,data}; removed sort:change/row:click/page:change (never fired in source).
• helpers/references/fields.md — item.get() → item.field('name').get().
• fliplet-ui-panzoom.md — marker.vars is a property, not marker.vars().

MED / LOW

oauth2 grantType: 'implicit'→'token' and the "Returns null" fix; encryption getKey() resolves the key string (not {key}); datasources upload folderId (not mediaFolderId) and delete-query resolves entries (not a count); notifications instance.remove; ui-typeahead returns Array; ui-actions/ui-timerange copy-paste fixes; router no-session reason code; gamify dependency name; payments webhook URL path; like-buttons title; biometrics return values; helpers views type + ready() syntax; v3 analytics _route/_pageTitle; csv malformed example literal; REST status codes (apps publish 201, data-source entry 200) and a copy-pasted analytics heading.

Security

v3/auth.md sendValidation carried a false "no information leak / returns 204 regardless of whether the email exists" claim. The standard (non-domain) flow actually rejects an unknown email with a 400. The false claim is removed and reworded to the success contract only, deliberately without documenting the distinguisher (so the doc doesn't hand out an enumeration recipe). The underlying implementation divergence (likely email-enumeration oracle) is being raised separately for engineering, not addressed here.

AI indexes

Regenerated .well-known/{llms.txt,llms-full.txt,agent-skills,mcp,llms-v3-libraries.json} + v3/capabilities.md via bin/build-agent-indexes.mjs so the LLM-facing index reflects these fixes (it also folds in #284, which never regenerated the index). check:docs --strict passes.

Not in this PR (follow-ups)

• Source bug in fliplet-media media.js:464: images.push = imageInfo; (should be images.push(imageInfo)) — overwrites the array's push in the native getCachedImages path. Needs a Jira ticket + code fix.
• Security: the sendValidation email-enumeration divergence above.

Docs-only; auto-deploys to developers.fliplet.com via Cloudflare Pages on merge.

🤖 Generated with Claude Code