chore(deps): bump the minor-and-patch group across 1 directory with 39 updates

[dependabot]

Bumps the minor-and-patch group with 39 updates in the / directory:

Package	From	To
@ai-sdk/provider-utils	5.0.51	5.0.57
@astryxdesign/cli	0.6.3	0.6.6
@astryxdesign/core	0.6.3	0.6.6
@biomejs/biome	2.5.14	2.5.15
@electron/asar	4.3.0	4.3.1
@types/node	26.6.3	26.6.4
knip	6.38.0	6.40.0
@modelcontextprotocol/client	2.2.0	2.3.1
@modelcontextprotocol/node	2.1.0	2.1.1
@modelcontextprotocol/server	2.1.0	2.3.1
@modelcontextprotocol/server-legacy	2.0.0	2.3.1
@ai-sdk/anthropic	4.0.68	4.0.76
@ai-sdk/code-mode	1.0.79	1.0.90
@ai-sdk/cohere	4.0.52	4.0.58
@ai-sdk/google	4.0.85	4.0.92
@ai-sdk/open-responses	2.0.56	2.0.62
@ai-sdk/openai	4.0.80	4.0.89
@ai-sdk/openai-compatible	3.0.59	3.0.66
@ai-sdk/provider	4.0.19	4.0.25
@openai/agents-core	0.18.0	0.19.0
@slack/socket-mode	3.0.1	3.1.0
@slack/web-api	8.1.1	8.2.0
ai	7.0.122	7.0.133
ws	8.21.3	8.22.0
@types/ws	8.18.1	8.18.2
@types/ws	8.18.1	8.18.2
@agentclientprotocol/sdk	1.5.0	1.7.0
systeminformation	5.33.13	5.33.15
katex	0.18.9	0.19.0
lucide-react	1.48.0	1.53.0
virtua	0.52.7	0.53.3
opencli-mcp	0.0.22	0.0.28
@astryxdesign/theme-neutral	0.6.3	0.6.6
@playwright/test	1.63.0	1.64.0
@storybook/react-vite	10.6.0	10.6.1
@vitejs/plugin-react	6.1.1	6.1.2
simple-icons	16.32.0	16.34.0
storybook	10.6.0	10.6.1
vite	8.3.1	8.3.4
astro	7.3.5	7.3.7

Updates @ai-sdk/provider-utils from 5.0.51 to 5.0.57

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.57

Patch Changes

• 9184a35: Add ordered text, file, and JSON parts to experimental decision state. Support image input in OpenAI Decisions and language model adapters. Gateway retains its existing string and JSON request format and rejects files, as does TypeSafe AI.

  Arrays passed directly as state now contain decision state parts. Wrap JSON arrays in an object or a json part.

  Normalize all public state forms into an array of parts before calling decision providers. Providers receive text and JSON objects as text and json parts.

  Serialize decision file bytes as base64 in OpenTelemetry state attributes. Model-call spans record normalized state parts, while outer spans retain public state inputs.

  Preserve native JSON state in TypeSafe AI when state contains one JSON part. Label shared state in language-model decision prompts.

• Updated dependencies [9184a35]

  • @​ai-sdk/provider@​4.0.25

5.0.56

Patch Changes

• Updated dependencies [d3bcad9]
  • @​ai-sdk/provider@​4.0.24

5.0.55

Patch Changes

• fc1e19e: fix: limit jsonl rows to 64mb during batch result downloads

• 5094ebd: fix(provider-utils): preserve parallel tool calls when stream labels are missing or reused

• 268225c: feat(provider): add a portable max reasoning level with native provider mappings, compatibility coercions, and budget-based fallback support.

  Compatibility notes:

  • TypeScript source compatibility: Adding max widens LanguageModelV4CallOptions['reasoning'] and the derived ReasoningLevel type. Third-party providers and consumers with exhaustive switches or Record<ReasoningLevel, ...> mappings must handle max before upgrading. Ordinary calls using existing reasoning levels remain accepted.
  • Amazon Bedrock: Existing Nova 2 calls using portable reasoning: 'xhigh' now send maxReasoningEffort: 'high' instead of the unsupported 'max', and return a compatibility warning. Anthropic and OpenAI Bedrock effort mappings retain their existing xhigh behavior. Partial Bedrock reasoning configurations continue to preserve explicit values and derive missing fields; explicit effort/budget overrides and disabled thinking no longer emit warnings for portable mappings that are not sent.
  • Fireworks: Existing portable minimal and xhigh calls keep their request mappings to low and high, respectively, and now return compatibility warnings in generation and streaming results. Portable max maps to high with the same warning behavior.

  Release classification: This remains a patch changeset under the repository's explicit release policy, which uses patch releases for both fixes and features. The TypeScript source-compatibility caveat for exhaustive consumers is disclosed above. Maintainers can override this classification with a major label if they decide to align the provider-spec addition with a future AI SDK major release.

• 0af2f7c: chore: upgrade to TypeScript 6

• Updated dependencies [268225c]

  • @​ai-sdk/provider@​4.0.23

5.0.54

Patch Changes

• 2959d35: feat: rename evaluate to decide
• 59116e6: fix(groq,google): use JSON response tool for structured outputs with tool calling

... (truncated)

Commits

• be51c73 Version Packages (#22274)
• 9184a35 feat: accept multimodal input in decide (#22229)
• e7f55a4 Version Packages (#22198)
• 8f4eb0d Version Packages (#22124)
• fc1e19e fix(provider-utils): add option to limit jsonl rows in batch downloads (#22096)
• 5094ebd fix: preserve parallel tool calls when streaming indexes are reused or labels...
• 268225c feat: add a portable max reasoning level across supported providers (#22045)
• 0af2f7c chore: upgrade to TypeScript 6 (#21786)
• 92e2a4b Version Packages (#21938)
• 2959d35 refactor(ai): rename experimental_evaluate to experimental_decide (#21935)
• Additional commits viewable in compare view

Updates @astryxdesign/cli from 0.6.3 to 0.6.6

Release notes

Sourced from @​astryxdesign/cli's releases.

Astryx 0.6.6 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Features

• Add a shared upload icon, and use it for FileInput's upload affordance instead of the directional arrowUp Themes draw upload through icons.upload, separately from arrowUp, so sort arrows and every other arrowUp use stay unchanged. Every bundled theme and theme template draws upload in its own icon style. FileInput keeps its icon size, placement, color, and accessibility in both modes; a theme with no upload artwork shows the default upload-into-tray glyph there.

  A complete IconRegistry may still omit upload in this release. The next minor makes it required, so add an upload entry to any registry you type as IconRegistry.

• BottomSheet is a container, like Dialog. A new padding prop takes a spacing step, and a theme's padding on bottom-sheet now pads the sheet's content box through container tokens instead of padding the panel. The padded content box publishes its inset, so a Section that is the sheet's only child, and bleed children such as Table and Divider, align against it. With neither set, the content box stays unpadded as before.

• ComplexSelector can hang off a control the caller renders. A new renderTrigger render prop renders the control the popup hangs off — a glyph in a list row, a chip, an icon button — in place of the selector's own field and button. Spread the given props onto it; the popup is anchored to it, keeps its dialog label from label, opens on click or ArrowDown, and returns focus to the control on close. The existing handleRef and onOpenChange work unchanged beside it. Off by default; existing selectors are unchanged.

• ContextMenu takes triggerAs (div | span) so a reference inside prose can own a context menu without breaking the text flow.

• Export the canonical 56-token StyleX dataVars group for CSS-capable data visualization consumers.

• Export decodeMarkdownCharacterReferences from @astryxdesign/core/Markdown/parser and @astryxdesign/core/Markdown It decodes character references the way Markdown renders them — ©, &[#169](https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/169);, and © become ©; unknown names and references without their semicolon stay as written — using the same table Markdown uses. It works on plain text, so leave code and backslash-escaped references out. The parser subpath has no use-client boundary, so server code can call it.

• Add DropdownMenuGroup, a titled role="group" of rows for compound-mode menus. The items data API could title a group ({type: 'section', title, items}); a menu written with children — checkbox rows, radio groups, rows mounted only while open — could not. DropdownMenuGroup (also ContextMenuGroup and BreadcrumbMenuGroup) renders a role="group" named by its heading through aria-labelledby; the heading shares the data mode's typography and astryx-dropdown-menu-section-heading theme target, is not a menu item, and is skipped by arrow keys and typeahead. Existing menus are unchanged.

• The message a component shows when a query matched nothing is now emptySearchText everywhere, and it takes a ReactNode. Selector, MultiSelector, and CommandPalette already called it emptySearchText and already accepted a node. Tokenizer, Typeahead, BaseTypeahead, and each ChatComposerInput trigger called it emptySearchResultsText and accepted only a string — so the same product could offer a "no results, create one" row in one component and not in its neighbour, and a builder who learned one had to discover the other.

  Nothing breaks. The type only widens, so every existing value stays valid, and emptySearchResultsText keeps working exactly as released. Set both and emptySearchText wins, with a development warning. Migration is the name alone.

  Deprecation lifecycle (spec:AST-017 FR28, FR31) — removal only in a later minor whose frozen manifest carries both ids of a pair:

• The layer runtime owns the viewport inset: one gutter, one cap, one fallback order, and one place an app declares a floating bar. Every anchored layer — Popover, DropdownMenu and its submenus, Typeahead, Tooltip, HoverCard, the selectors — now keeps the same gutter from each viewport edge (the spacing-4 step or the device safe-area inset, whichever is larger) and is capped to the viewport. Four components used to carry their own copies of that gutter, and they had drifted.

• Add the first-party Markdown heading-links module. createMarkdownHeadingLinks() is exported from @astryxdesign/core/Markdown/plugins and gives every built-in h1–h6 a collision-safe generated fragment plus an accessible inline trailing # copy button, including headings nested in blockquotes and lists. Its frozen, versioned entry carries the namespace and safe URL base across compatible Core package copies without module-local state. The heading row uses useContainerReveal: the button is hidden at fine-pointer rest, reveals on row hover or keyboard focus, and follows the canonical coarse/touch behavior. An unmodified tap, click, Enter, or Space copies the canonical URL without navigating, scrolling, or mutating the hash and briefly shows a check confirmation; failures stay silent. The same opaque plugin entry keeps Markdown-derived Outline aligned, supports Unicode NFKC slugs, an optional caller-owned namespace and safe permalink URL base, and leaves default Markdown plus custom heading renderers unchanged.

• Markdown: nested lists draw a different marker at each depth Bulleted lists cycle disc, circle, and square, and numbered lists cycle decimal, lower-alpha, and lower-roman, by how many lists of either kind enclose them, so each level can be told apart from the levels beside it. Numbering keeps each list's start and items. List and ListItem keep their public marker styles.

• Markdown plugins: read what a plugin declares, and render one plugin node as Markdown does getMarkdownPluginCapabilities(plugin), from @astryxdesign/core/Markdown/plugins, reports whether a plugin declares syntax and whether it declares a transform, and nothing else; plugin entries stay opaque. MarkdownPluginNodeRenderer, from the new client-only @astryxdesign/core/Markdown/plugin-renderer subpath, renders one parsed extension node with the given plugins exactly as Markdown presents it — the plugin's renderer inside the same error boundary and suspense fallback, the same readable fallback text, and the same failure report — with no element of its own. Markdown's own output is unchanged.

• DropdownMenu takes a trigger render prop: hang a menu off any control. trigger renders the control the menu opens from — an IconButton, a chip, an avatar, a list row — and hands it DropdownMenuTriggerProps to spread: the press model, the keyboard opens, the toggle click and the ARIA wiring. The menu is named by that control through aria-labelledby. button and trigger are mutually exclusive (a dev warning).

• Menu arrows wrap and PageUp/PageDown page. In DropdownMenu, ContextMenu and DropdownMenuSubMenu, ArrowDown on the last row wraps to the first and ArrowUp on the first to the last, as macOS menus do (Selector keeps clamping like a native select). PageDown and PageUp move to the last and first fully visible row of a scrolling menu, and pressed there again one viewport further, never wrapping. ArrowUp on the trigger opens the menu with the last row highlighted. The key that opened the menu no longer activates the first row through its auto-repeat, and typeahead ignores a key that is part of an input-method composition. useListFocus gains hasPaging.

• DropdownMenuItem takes href: a menu row that navigates is a real link. DropdownMenuItem (and a data-mode item) takes href, target and rel. The row renders as the anchor itself, with role="menuitem", routed through LinkProvider, so a ⌘-click, Ctrl-click or middle click keeps the browser's meaning and skips onClick; a plain click runs onClick, closes the menu and navigates. The touch sheet renders the same item as a link row. onClick now receives the click event. Enter and Space in every menu synthesize a click that carries the key's modifiers.

• DropdownMenu takes menuMaxHeight to lift the 300px cap for a menu that must fit its rows; the viewport still bounds it.

• Menus and pickers act on the row under the pointer at release, and the highlight follows a held finger or mouse. DropdownMenu, ContextMenu, DropdownMenuSubMenu, Selector and the menu bottom sheet share one press model, the one macOS and iOS menus use: the row under the pointer when it is released is the row that acts, and the highlight follows a held pointer across the rows. A finger that lands on one row and lifts on another acts on the second — once; the click the browser aims at the first row is swallowed. A mouse released outside a menu closes it; a finger released outside leaves it open. A menu whose rows fit declares touch-action: none so a slide stays a slide; one that scrolls lets the browser pan it and ends the gesture. Menu rows no longer paint a pressed look where hover does not exist. New public hook: useMenuPress.

• A mouse opens a DropdownMenu on press and can drag straight into it; a finger held on the trigger opens it with the finger down. A DropdownMenu trigger now opens its menu on a mouse press-down, and a drag from the trigger into the menu that lets go over a row picks it, as macOS menus do. The release of the opening press acts only after the pointer has entered the menu or the press has lasted about a third of a second, so a menu that opens under the pointer never picks a row nobody chose. Pressing the trigger of an open menu closes it without reopening in the same gesture. A tap still opens through its click; a finger held on the trigger for half a second opens the menu with the finger down, and a slide then picks. useMenuPress gains onTriggerPress, triggerProps, isTriggerClickFromPress and longPressDelayMs.

• DropdownMenuSubMenu drills in on a phone instead of opening a flyout. When a coarse pointer opened the menu, a sub-menu row replaces the menu's rows with its own and a "Back to " row, in the same box; Back, Escape or ArrowLeft return to the row. Works in compound and data mode, inside DropdownMenu and ContextMenu; presentation (flyout | drill-in | adaptive) overrides the policy.

... (truncated)

Changelog

Sourced from @​astryxdesign/cli's changelog.

0.6.6

New Features

• Add a shared upload icon, and use it for FileInput's upload affordance instead of the directional arrowUp Themes draw upload through icons.upload, separately from arrowUp, so sort arrows and every other arrowUp use stay unchanged. Every bundled theme and theme template draws upload in its own icon style. FileInput keeps its icon size, placement, color, and accessibility in both modes; a theme with no upload artwork shows the default upload-into-tray glyph there.

  A complete IconRegistry may still omit upload in this release. The next minor makes it required, so add an upload entry to any registry you type as IconRegistry.

• Templates declare their keywords, and build tells a part of a page from a page by the components the project can use (#6805)

• build chooses where to start with a checked-in table of word weights blended with the page ranker

• astryx docs <route> --depth <levels> reads as far down the docs tree as you ask, from one doc to everything below it. --depth 0 reads only the namespace you name, --depth 1 adds the docs right below it (what a read without --depth shows), and --depth all goes to the bottom. With --depth, --detail sets how much of each doc below shows: brief (the default) is one line each, named by where it sits so you can open it, compact adds its sections, and full prints it whole. So astryx docs cli --depth all is a map of every CLI doc, and astryx docs cli/integrations --depth all --detail full prints the integration guides as one read. Where a read stops, a namespace says how many docs sit below it. --json returns the same tree as docs.node: each child carries its own slots while the read goes deeper, childCount where it stops, and its text at compact or full. docs() takes the same depth and detail options. Reads without --depth are unchanged.

• Point at discover where people look for things to add Nothing an agent reads named discover, so agents asked to find a theme searched the package registry instead. The agent block astryx init writes now lists discover <words> (integrations you could add, and the ones you have), theme list ends with More themes in packages you could add: astryx discover theme, and a text search ends with More in packages you could add: astryx discover <query> (except --type hook, since no integration adds hooks). JSON output is unchanged.

• integration add theme --from <base> forks an existing theme as the starting point instead of a blank scaffold. The new theme copies the base's source files — renamed and rewritten for the new slug — with no link back. Use --from when you want to change a lot; for a small change that stays linked, use extends in defineTheme.

Fixes

• Say when a command did nothing: upgrade reports sourcePathFound, the integration checks report validated. Two commands could legitimately do nothing and produce an envelope identical to a clean success. Both now carry the fact in a field of their own response instead of only in human text.

  astryx upgrade defaults --path to ./src. A project laid out as app/ (or a typo) skipped every code codemod and still reported exit 0, filesChanged: 0, errors: [] and "Upgrade complete". The only warning was a log line --json suppresses by design. upgrade.run now carries sourcePathFound, and the human completion line names the directory it did not find.

  astryx doctor integration validate|components|docs|templates returned {name: null, version: null, issues: []} and exit 0 when no integration manifest was found — the same shape as a validated, healthy integration. All four envelopes now carry validated, false only when nothing was inspected.

• astryx manifest --json now takes each command's examples from its CommandDoc and its response types from the API function it wraps, so no example differs from the documented one and upgrade lists upgrade.registry, which upgrade --registry --json already emits.

• astryx template <name> <path> and astryx layout expand now say when they replaced Astryx demo media. The template.copy and layout.expand receipts carry demoMediaReplaced, the number of demo image and video references that became placeholders (one per reference, however many fixture paths its URL carries), and the text output names the file to update (when layout expand prints the code instead, the same line follows it as a comment, so the output is still valid TSX). Nothing about the copy itself changed.

• astryx template <name> and template() now return the same source that astryx template <name> <path> writes, and say how many Astryx demo media references they replaced. Demo images and videos that only Astryx's own previews serve are replaced the same way in both, so code copied from the printed source no longer points at media your project doesn't have. template.show gains demoMediaReplaced (0 when the template carried none); in text mode the count is stated on stderr so the printed source stays exact.

• A write that fails reports ERR_WRITE_FAILED instead of a raw Node errno. astryx template into an unwritable directory returned {"error": "EACCES: permission denied, open '/home/you/project/readonly/x.tsx'", "code": "ERR_UNKNOWN"}, and swizzle returned the mkdir equivalent. Two things were wrong: ERR_WRITE_FAILED is already in the frozen error registry for exactly this case, and the message carried an absolute host path where every other Astryx message names its target relative to the project.

  Both now throw ERR_WRITE_FAILED with the errno kept (it is the part that says what to fix) and the target named relative to the project. Nothing is left half-written: a swizzle that fails part-way removes the files it already copied and puts back any it replaced before it reports the error, and the message names any file it could not restore.

• When discover --available runs without a discover source, the CLI now explains what discover sources are and where to find Astryx packages on npm, instead of the misleading message that told users to add package names they had no way to find. The base discover with no integrations also gains a pointer to npm and the integrations docs.

• A package with a namespace doc or a placed guide needs @astryxdesign/cli 0.6.4, not 0.7.0. Published 0.6.4 reads an integration's docs tree: it lists the namespace and reads each guide placed in it. 0.6.3 rejects a namespace doc and hides every doc topic the package ships. integration add doc --parent wrote "@astryxdesign/cli": ">=0.7.0", a range no released CLI satisfies, and integration verify failed a docs-tree package whose CLI peer started at 0.6.4. integration add doc --parent now writes ">=0.6.4", marked optional, and integration verify accepts it. A template that sets replaces or keywords still needs ">=0.7.0".

• gap-report fails when a listed integration cannot load, instead of reporting a clean result. An integration whose astryx.integration module throws on import or fails validation was left out of the handler set. With no other handler, the report fell through to the built-in GitHub fallback for Core: the command exited 0 with consent_required, printed nothing on stderr, and offered --confirm-public to file on Core's public tracker a report the integration might have been meant to receive.

  The unloadable integration now records a failed delivery in its config position, with the load error and the fix in its message. Like any handler, it turns the fallback off, so the report never goes to another package's tracker. The command exits 1, and a failed or partial report now prints each failed delivery on stderr as well as in the receipt.

• astryx integration add theme <name> --from <base> now adds the packages the copied theme files import to dependencies. A fork of a bundled theme such as neutral copies its icons.tsx, which imports lucide-react, but the package did not declare it. So astryx theme build on the fork failed with "Cannot find module 'lucide-react'", and an app that installed the package hit the same error. --from now adds each package the copied files import, at the range the bundled themes use. It leaves out Core and React, which every Astryx app already has, and anything the package already declares.

• astryx integration pack without --check now points only at astryx integration verify. It used to say "Pass --check to verify the integration tarball, or run astryx integration verify", which sent people to the deprecated spelling. It now says that integration pack is now integration verify, and that npm pack builds the tarball. The error code and exit code are unchanged, and integration pack --check still runs the same check as before.

• Search: differentiate all-word matches by total quality; index themes Within the all-words tier, every candidate whose strongest token hit was a keyword scored the same (e.g. 157), regardless of how the other query words matched. A doc matching both words by keyword outranked nothing, and search "how to use a theme" put API reference docs above the consumer theme guide.

... (truncated)

Commits

• d623c40 chore: version packages for v0.6.6 (#7139)
• 01fb22f feat(core): expose StyleX data token variables (#6832)
• aa0134e feat(cli): astryx docs --depth reads as far down the docs tree as you ask (...
• 69aa1cb feat(cli): build blends checked-in word weights with the page ranker to choos...
• 3104729 fix(cli): search ranks a theme's description as prose, not as keywords (#7042)
• 07a4096 fix(cli): integration add theme --from declares the packages the copied fil...
• a477e48 fix(cli): better search ranking, themes in search, and pointers to discover (...
• 374f2de fix(cli): honest message when discover has no source (#6958)
• 91d1017 fix(cli): gap-report fails when a listed integration cannot load (#6970)
• 33a14a2 feat(core): touch press model — a delegated controller replaces :active under...
• Additional commits viewable in compare view

Updates @astryxdesign/core from 0.6.3 to 0.6.6

Release notes

Sourced from @​astryxdesign/core's releases.

Astryx 0.6.6 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Features

• Add a shared upload icon, and use it for FileInput's upload affordance instead of the directional arrowUp Themes draw upload through icons.upload, separately from arrowUp, so sort arrows and every other arrowUp use stay unchanged. Every bundled theme and theme template draws upload in its own icon style. FileInput keeps its icon size, placement, color, and accessibility in both modes; a theme with no upload artwork shows the default upload-into-tray glyph there.

  A complete IconRegistry may still omit upload in this release. The next minor makes it required, so add an upload entry to any registry you type as IconRegistry.

• BottomSheet is a container, like Dialog. A new padding prop takes a spacing step, and a theme's padding on bottom-sheet now pads the sheet's content box through container tokens instead of padding the panel. The padded content box publishes its inset, so a Section that is the sheet's only child, and bleed children such as Table and Divider, align against it. With neither set, the content box stays unpadded as before.

• ComplexSelector can hang off a control the caller renders. A new renderTrigger render prop renders the control the popup hangs off — a glyph in a list row, a chip, an icon button — in place of the selector's own field and button. Spread the given props onto it; the popup is anchored to it, keeps its dialog label from label, opens on click or ArrowDown, and returns focus to the control on close. The existing handleRef and onOpenChange work unchanged beside it. Off by default; existing selectors are unchanged.

• ContextMenu takes triggerAs (div | span) so a reference inside prose can own a context menu without breaking the text flow.

• Export the canonical 56-token StyleX dataVars group for CSS-capable data visualization consumers.

• Export decodeMarkdownCharacterReferences from @astryxdesign/core/Markdown/parser and @astryxdesign/core/Markdown It decodes character references the way Markdown renders them — ©, &[#169](https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/169);, and © become ©; unknown names and references without their semicolon stay as written — using the same table Markdown uses. It works on plain text, so leave code and backslash-escaped references out. The parser subpath has no use-client boundary, so server code can call it.

• Add DropdownMenuGroup, a titled role="group" of rows for compound-mode menus. The items data API could title a group ({type: 'section', title, items}); a menu written with children — checkbox rows, radio groups, rows mounted only while open — could not. DropdownMenuGroup (also ContextMenuGroup and BreadcrumbMenuGroup) renders a role="group" named by its heading through aria-labelledby; the heading shares the data mode's typography and astryx-dropdown-menu-section-heading theme target, is not a menu item, and is skipped by arrow keys and typeahead. Existing menus are unchanged.

• The message a component shows when a query matched nothing is now emptySearchText everywhere, and it takes a ReactNode. Selector, MultiSelector, and CommandPalette already called it emptySearchText and already accepted a node. Tokenizer, Typeahead, BaseTypeahead, and each ChatComposerInput trigger called it emptySearchResultsText and accepted only a string — so the same product could offer a "no results, create one" row in one component and not in its neighbour, and a builder who learned one had to discover the other.

  Nothing breaks. The type only widens, so every existing value stays valid, and emptySearchResultsText keeps working exactly as released. Set both and emptySearchText wins, with a development warning. Migration is the name alone.

  Deprecation lifecycle (spec:AST-017 FR28, FR31) — removal only in a later minor whose frozen manifest carries both ids of a pair:

• The layer runtime owns the viewport inset: one gutter, one cap, one fallback order, and one place an app declares a floating bar. Every anchored layer — Popover, DropdownMenu and its submenus, Typeahead, Tooltip, HoverCard, the selectors — now keeps the same gutter from each viewport edge (the spacing-4 step or the device safe-area inset, whichever is larger) and is capped to the viewport. Four components used to carry their own copies of that gutter, and they had drifted.

• Add the first-party Markdown heading-links module. createMarkdownHeadingLinks() is exported from @astryxdesign/core/Markdown/plugins and gives every built-in h1–h6 a collision-safe generated fragment plus an accessible inline trailing # copy button, including headings nested in blockquotes and lists. Its frozen, versioned entry carries the namespace and safe URL base across compatible Core package copies without module-local state. The heading row uses useContainerReveal: the button is hidden at fine-pointer rest, reveals on row hover or keyboard focus, and follows the canonical coarse/touch behavior. An unmodified tap, click, Enter, or Space copies the canonical URL without navigating, scrolling, or mutating the hash and briefly shows a check confirmation; failures stay silent. The same opaque plugin entry keeps Markdown-derived Outline aligned, supports Unicode NFKC slugs, an optional caller-owned namespace and safe permalink URL base, and leaves default Markdown plus custom heading renderers unchanged.

• Markdown: nested lists draw a different marker at each depth Bulleted lists cycle disc, circle, and square, and numbered lists cycle decimal, lower-alpha, and lower-roman, by how many lists of either kind enclose them, so each level can be told apart from the levels beside it. Numbering keeps each list's start and items. List and ListItem keep their public marker styles.

• Markdown plugins: read what a plugin declares, and render one plugin node as Markdown does getMarkdownPluginCapabilities(plugin), from @astryxdesign/core/Markdown/plugins, reports whether a plugin declares syntax and whether it declares a transform, and nothing else; plugin entries stay opaque. MarkdownPluginNodeRenderer, from the new client-only @astryxdesign/core/Markdown/plugin-renderer subpath, renders one parsed extension node with the given plugins exactly as Markdown presents it — the plugin's renderer inside the same error boundary and suspense fallback, the same readable fallback text, and the same failure report — with no element of its own. Markdown's own output is unchanged.

• DropdownMenu takes a trigger render prop: hang a menu off any control. trigger renders the control the menu opens from — an IconButton, a chip, an avatar, a list row — and hands it DropdownMenuTriggerProps to spread: the press model, the keyboard opens, the toggle click and the ARIA wiring. The menu is named by that control through aria-labelledby. button and trigger are mutually exclusive (a dev warning).

• Menu arrows wrap and PageUp/PageDown page. In DropdownMenu, ContextMenu and DropdownMenuSubMenu, ArrowDown on the last row wraps to the first and ArrowUp on the first to the last, as macOS menus do (Selector keeps clamping like a native select). PageDown and PageUp move to the last and first fully visible row of a scrolling menu, and pressed there again one viewport further, never wrapping. ArrowUp on the trigger opens the menu with the last row highlighted. The key that opened the menu no longer activates the first row through its auto-repeat, and typeahead ignores a key that is part of an input-method composition. useListFocus gains hasPaging.

• DropdownMenuItem takes href: a menu row that navigates is a real link. DropdownMenuItem (and a data-mode item) takes href, target and rel. The row renders as the anchor itself, with role="menuitem", routed through LinkProvider, so a ⌘-click, Ctrl-click or middle click keeps the browser's meaning and skips onClick; a plain click runs onClick, closes the menu and navigates. The touch sheet renders the same item as a link row. onClick now receives the click event. Enter and Space in every menu synthesize a click that carries the key's modifiers.

• DropdownMenu takes menuMaxHeight to lift the 300px cap for a menu that must fit its rows; the viewport still bounds it.

• Menus and pickers act on the row under the pointer at release, and the highlight follows a held finger or mouse. DropdownMenu, ContextMenu, DropdownMenuSubMenu, Selector and the menu bottom sheet share one press model, the one macOS and iOS menus use: the row under the pointer when it is released is the row that acts, and the highlight follows a held pointer across the rows. A finger that lands on one row and lifts on another acts on the second — once; the click the browser aims at the first row is swallowed. A mouse released outside a menu closes it; a finger released outside leaves it open. A menu whose rows fit declares touch-action: none so a slide stays a slide; one that scrolls lets the browser pan it and ends the gesture. Menu rows no longer paint a pressed look where hover does not exist. New public hook: useMenuPress.

• A mouse opens a DropdownMenu on press and can drag straight into it; a finger held on the trigger opens it with the finger down. A DropdownMenu trigger now opens its menu on a mouse press-down, and a drag from the trigger into the menu that lets go over a row picks it, as macOS menus do. The release of the opening press acts only after the pointer has entered the menu or the press has lasted about a third of a second, so a menu that opens under the pointer never picks a row nobody chose. Pressing the trigger of an open menu closes it without reopening in the same gesture. A tap still opens through its click; a finger held on the trigger for half a second opens the menu with the finger down, and a slide then picks. useMenuPress gains onTriggerPress, triggerProps, isTriggerClickFromPress and longPressDelayMs.

• DropdownMenuSubMenu drills in on a phone instead of opening a flyout. When a coarse pointer opened the menu, a sub-menu row replaces the menu's rows with its own and a "Back to " row, in the same box; Back, Escape or ArrowLeft return to the row. Works in compound and data mode, inside DropdownMenu and ContextMenu; presentation (flyout | drill-in | adaptive) overrides the policy.

... (truncated)

Changelog

Sourced from @​astryxdesign/core's changelog.

0.6.6

New Features

• Add a shared upload icon, and use it for FileInput's upload affordance instead of the directional arrowUp Themes draw upload through icons.upload, separately from arrowUp, so sort arrows and every other arrowUp use stay unchanged. Every bundled theme and theme template draws upload in its own icon style. FileInput keeps its icon size, placement, color, and accessibility in both modes; a theme with no upload artwork shows the default upload-into-tray glyph there.

  A complete IconRegistry may still omit upload in this release. The next minor makes it required, so add an upload entry to any registry you type as IconRegistry.

• BottomSheet is a container, like Dialog. A new padding prop takes a spacing step, and a theme's padding on bottom-sheet now pads the sheet's content box through container tokens instead of padding the panel. The padded content box publishes its inset, so a Section that is the sheet's only child, and bleed children such as Table and Divider, align against it. With neither set, the content box stays unpadded as before.

• ComplexSelector can hang off a control the caller renders. A new renderTrigger render prop renders the control the popup hangs off — a glyph in a list row, a chip, an icon button — in place of the selector's own field and button. Spread the given props onto it; the popup is anchored to it, keeps its dialog label from label, opens on click or ArrowDown, and returns focus to the control on close. The existing handleRef and onOpenChange work unchanged beside it. Off by default; existing selectors are unchanged.

• ContextMenu takes triggerAs (div | span) so a reference inside prose can own a context menu without breaking the text flow.

• Export the canonical 56-token StyleX dataVars group for CSS-capable data visualization consumers.

• Export decodeMarkdownCharacterReferences from @astryxdesign/core/Markdown/parser and @astryxdesign/core/Markdown It decodes character references the way Markdown renders them — ©, &[#169](https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/169);, and © become ©; unknown names and references without their semicolon stay as written — using the same table Markdown uses. It works on plain text, so leave code and backslash-escaped references out. The parser subpath has no use-client boundary, so server code can call it.

• Add DropdownMenuGroup, a titled role="group" of rows for compound-mode menus. The items data API could title a group ({type: 'section', title, items}); a menu written with children — checkbox rows, radio groups, rows mounted only while open — could not. DropdownMenuGroup (also ContextMenuGroup and BreadcrumbMenuGroup) renders a role="group" named by its heading through aria-labelledby; the heading shares the data mode's typography and astryx-dropdown-menu-section-heading theme target, is not a menu item, and is skipped by arrow keys and typeahead. Existing menus are unchanged.

• The message a component shows when a query matched nothing is now emptySearchText everywhere, and it takes a ReactNode. Selector, MultiSelector, and CommandPalette already called it emptySearchText and already accepted a node. Tokenizer, Typeahead, BaseTypeahead, and each ChatComposerInput trigger called it emptySearchResultsText and accepted only a string — so the same product could offer a "no results, create one" row in one component and not in its neighbour, and a builder who learned one had to discover the other.

  Nothing breaks. The type only widens, so every existing value stays valid, and emptySearchResultsText keeps working exactly as released. Set both and emptySearchText wins, with a development warning. Migration is the name alone.

  Deprecation lifecycle (spec:AST-017 FR28, FR31) — removal only in a later minor whose frozen manifest carries both ids of a pair:

• The layer runtime owns the viewport inset: one gutter, one cap, one fallback order, and one place an app declares a floating bar. Every anchored layer — Popover, DropdownMenu and its submenus, Typeahead, Tooltip, HoverCard, the selectors — now keeps the same gutter from each viewport edge (the spacing-4 step or the device safe-area inset, whichever is larger) and is capped to the viewport. Four components used to carry their own copies of that gutter, and they had drifted.

• Add the first-party Markdown heading-links module. createMarkdownHeadingLinks() is exported from @astryxdesign/core/Markdown/plugins and gives every built-in h1–h6 a collision-safe generated fragment plus an accessible inline trailing # copy button, including headings nested in blockquotes and lists. Its frozen, versioned entry carries the namespace and safe URL base across compatible Core package copies without module-local state. The heading row uses useContainerReveal: the button is hidden at fine-pointer rest, reveals on row hover or keyboard focus, and follows the canonical coarse/touch behavior. An unmodified tap, click, Enter, or Space copies the canonical URL without navigating, scrolling, or mutating the hash and briefly shows a check confirmation; failures stay silent. The same opaque plugin entry keeps Markdown-derived Outline aligned, supports Unicode NFKC slugs, an optional caller-owned namespace and safe permalink URL base, and leaves default Markdown plus custom heading renderers unchanged.

• Markdown: nested lists draw a different marker at each depth Bulleted lists cycle disc, circle, and square, and numbered lists cycle decimal, lower-alpha, and lower-roman, by how many lists of either kind enclose them, so each level can be told apart from the levels beside it. Numbering keeps each list's start and items. List and ListItem keep their public marker styles.

• Markdown plugins: read what a plugin declares, and render one plugin node as Markdown does getMarkdownPluginCapabilities(plugin), from @astryxdesign/core/Markdown/plugins, reports whether a plugin declares syntax and whether it declares a transform, and nothing else; plugin entries stay opaque. MarkdownPluginNodeRenderer, from the new client-only @astryxdesign/core/Markdown/plugin-renderer subpath, renders one parsed extension node with the given plugins exactly as Markdown presents it — the plugin's renderer inside the same error boundary and suspense fallback, the same readable fallback text, and the same failure report — with no element of its own. Markdown's own output is unchanged.

• DropdownMenu takes a trigger render prop: hang a menu off any control. trigger renders the control the menu opens from — an IconButton, a chip, an avatar, a list row — and hands it DropdownMenuTriggerProps to spread: the press model, the keyboard opens, the toggle click and the ARIA wiring. The menu is named by that control through aria-labelledby. button and trigger are mutually exclusive (a dev warning).

• Menu arrows wrap and PageUp/PageDown page. In DropdownMenu, ContextMenu and DropdownMenuSubMenu, ArrowDown on the last row wraps to the first and ArrowUp on the first to the last, as macOS menus do (Selector keeps clamping like a native select). PageDown and PageUp move to the last and first fully visible row of a scrolling menu, and pressed there again one viewport further, never wrapping. ArrowUp on the trigger opens the menu with the last row highlighted. The key that opened the menu no longer activates the first row through its auto-repeat, and typeahead ignores a key that is part of an input-method composition. useListFocus gains hasPaging.

• DropdownMenuItem takes href: a menu row that navigates is a real link. DropdownMenuItem (and a data-mode item) takes href, target and rel. The row renders as the anchor itself, with role="menuitem", routed through LinkProvider, so a ⌘-click, Ctrl-click or middle click keeps the browser's meaning and skips onClick; a plain click runs onClick, closes the menu and navigates. The touch sheet renders the same item as a link row. onClick now receives the click event. Enter and Space in every menu synthesize a click that carries the key's modifiers.

• DropdownMenu takes menuMaxHeight to lift the 300px cap for a menu that must fit its rows; the viewport still bounds it.

• Menus and pickers act on the row under the pointer at release, and the highlight follows a held finger or mouse. DropdownMenu, ContextMenu, DropdownMenuSubMenu, Selector and the menu bottom sheet share one press model, the one macOS and iOS menus use: the row under the pointer when it is released is the row that acts, and the highlight follows a held pointer across the rows. A finger that lands on one row and lifts on another acts on the second — once; the click the browser aims at the first row is swallowed. A mouse released outside a menu closes it; a finger released outside leaves it open. A menu whose rows fit declares touch-action: none so a slide stays a slide; one that scrolls lets the browser pan it and ends the gesture. Menu rows no longer paint a pressed look where hover does not exist. New public hook: useMenuPress.

• A mouse opens a DropdownMenu on press and can drag straight into it; a finger held on the trigger opens it with the finger down. A DropdownMenu trigger now opens its menu on a mouse press-down, and a drag from the trigger into the menu that lets go over a row picks it, as macOS menus do. The release of the opening press acts only after the pointer has entered the menu or the press has lasted about a third of a second, so a menu that opens under the pointer never picks a row nobody chose. Pressing the trigger of an open menu closes it without reopening in the same gesture. A tap still opens through its click; a finger held on the trigger for half a second opens the menu with the finger down, and a slide then picks. useMenuPress gains onTriggerPress, triggerProps, isTriggerClickFromPress and longPressDelayMs.

• DropdownMenuSubMenu drills in on a phone instead of opening a flyout. When a coarse pointer opened the menu, a sub-menu row replaces the menu's rows with its own and a "Back to " row, in the same box; Back, Escape or ArrowLeft return to the row. Works in compound and data mode, inside DropdownMenu and ContextMenu; presentation (flyout | drill-in | adaptive) overrides the policy.

• MultiSelector can offer a Create "<query>" row for a search that matches nothing. With hasSearch, the new hasCreate switch puts a Create "<query>" row first in the list when the trimmed query equals no option label under the search's own case-insensitive matching and the options have loaded. Picking it, or Enter with nothing highlighted, calls onChange with the query appended to the value and a second argument {type: 'create', query} (exported as MultiSelectorChange), then clears the search; the caller adds an option for the new value in that same update. Every other change passes no descriptor, so existing one-argument handlers are unchanged. hasCreate without hasSearch warns in development and offers nothing. Off by default.

• MultiSelector can hang off a control the caller renders. A new renderTrigger render prop renders the control the panel hangs off — a glyph in a list row, a chip, an icon button — in place of the selector's own field and button. Spread the given props onto it; the listbox is anchored to it, named by label, takes focus on open, and focus returns to the control on close. handleRef (open/close/toggle/isOpen, the ComplexSelectorHandle shape) and onOpenChange let the caller open the panel from a keystroke elsewhere and observe every open and close. All three are off by default; existing selectors are unchanged.

... (truncated)

Commits

• d623c40 chore: version packages for v0.6.6 (#7139)
• 3a16495 fix(Markdown, richtext): read a code fence indented up to three spaces as Com...
• 78db903 fix(a11y): read menu state after aborted press (#7112)
• 5f76965 fix(PowerSearch): reopen the menu on an already-focused input (#6850)
• 2e9a71a fix(richtext)...

  Description has been truncated