Update low-code scripting docs

docs/en/low-code/custom-endpoints.md

@@ -43,7 +43,7 @@ Custom endpoints are defined in `model.json` or through the Low-Code Designer. E
 | `requireAuthentication` | bool | `true` | Whether the caller must be authenticated |
 | `requiredPermissions` | string[] | null | Permission names required to call the endpoint |
 
-`requiredPermissions` is checked only when `requireAuthentication` is true. Keep endpoints authenticated by default and use `requireAuthentication: false` only for intentionally public APIs.
+Permission checks require an authorized user even when `requireAuthentication` is set to `false`. Keep endpoints authenticated by default and use `requireAuthentication: false` only for intentionally public APIs without `requiredPermissions`.
 
 ## Route and Request Data
 
@@ -194,7 +194,7 @@ Default blocked headers also include hop-by-hop headers such as `Connection`, `T
 ## Security Notes
 
 * Prefer authenticated endpoints with explicit `requiredPermissions`.
-* Treat public endpoints as public API surface.
+* Treat endpoints with `requireAuthentication: false` and no `requiredPermissions` as public API surface.
 * Keep endpoint scripts small and focused.
 * Validate route, query, and body input before using it.
 * Use `take()` for list queries.

docs/en/low-code/interceptors.md

@@ -142,7 +142,13 @@ Inside interceptor scripts, you have access to:
 |--------|-------------|
 | `isAvailable` | Whether the email sender is configured and available |
 | `sendAsync(to, subject, body)` | Send a plain-text email |
+| `sendAsync(from, to, subject, body)` | Send a plain-text email with an explicit sender |
 | `sendHtmlAsync(to, subject, htmlBody)` | Send an HTML email |
+| `sendHtmlAsync(from, to, subject, htmlBody)` | Send an HTML email with an explicit sender |
+| `queueAsync(to, subject, body)` | Queue a plain-text email |
+| `queueAsync(from, to, subject, body)` | Queue a plain-text email with an explicit sender |
+| `queueHtmlAsync(to, subject, htmlBody)` | Queue an HTML email |
+| `queueHtmlAsync(from, to, subject, htmlBody)` | Queue an HTML email with an explicit sender |
 
 ### Logging
 
@@ -158,7 +164,7 @@ Inside interceptor scripts, you have access to:
 
 Full access to the [Scripting API](scripting-api.md) for querying and mutating data.
 
-Interceptors can also use common scripting services such as `user`, `tenant`, `auth`, `settings`, `features`, `events`, `jobs`, `files`, `images`, and `attachments` when they are enabled by the scripting capability profile.
+Interceptors can also use common scripting services such as `user`, `tenant`, `auth`, `settings`, `features`, `config`, `http`, `events`, `jobs`, `blob`, `encryption`, `textTemplating`, `files`, `images`, and `attachments` when they are enabled by the scripting capability profile.
 
 ### `globalError`
 

docs/en/low-code/scripting-api.md

@@ -217,7 +217,7 @@ All aggregations execute as SQL statements:
 | `min(x => x.Property)` | `SELECT MIN(...)` | `Promise<any>` |
 | `max(x => x.Property)` | `SELECT MAX(...)` | `Promise<any>` |
 | `distinct(x => x.Property)` | `SELECT DISTINCT ...` | `Promise<any[]>` |
-| `groupBy(x => x.Property)` | `GROUP BY ...` | `Promise<GroupResult[]>` |
+| `groupBy(x => x.Property)` | `GROUP BY ...` | `QueryBuilder` |
 
 ```javascript
 var productQuery = await db.query('Product');
@@ -275,7 +275,7 @@ var grouped = await productQuery
 
 | Limit | Default | Description |
 |-------|---------|-------------|
-| `MaxGroupCount` | No limit | Maximum groups |
+| `MaxGroupCount` | 500 | Maximum groups; set to `null` to disable this limit |
 
 ## Math Functions