@mavea/mavea 2.1.1 → 2.2.1

package/CHANGELOG.md

@@ -6,6 +6,63 @@ All notable changes to Mavéa are documented here. The format is based on
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-08-22
+
+### Fixed
+
+- **The embedded PDF reader showed a broken-document tile instead of the document.** It framed the
+  file with an empty `sandbox`, and Chrome's built-in viewer will not run inside a sandboxed frame
+  at all — so the attribute bought no isolation and silently replaced every embedded PDF with an
+  error placeholder. The frame is still confined to same-origin `.pdf` paths (or the audited
+  forwarder) by its own URL gate and by `frame-src 'self'`.
+- The reference card cited the wrong document. The bundled report is NASA TM 108834 (Holst, 1994),
+  not the contractor report the label named.
+- **The gallery's family filter could not be scrolled past the visible chips.** The row scrolls,
+  but it hid its scrollbar on both engines, so with a mouse there was neither a cue that families
+  continued past the right edge nor a way to reach them. It has a visible, themed scrollbar now.
+
+### Changed
+
+- The demo résumé is an unmistakably fictional person. It previously carried an address on a live
+  mail domain and a `linkedin.com/in/` slug that would resolve to somebody real; it now uses only
+  forms reserved for documentation, and a new test holds every fixture to that standard — RFC 2606
+  domains for e-mail, the 555 exchange for telephone numbers, and no real profile URLs.
+- The README screenshots in `docs/media` ship in the npm package but were covered by no licence
+  gate. They are declared in the asset credits and checked by the same completeness test as the
+  bundled media, with the rule a future capture has to satisfy written down — a screenshot showing
+  a map carries OpenStreetMap's ODbL credit, which is mandatory, unlike the CC0 media around it.
+
+## [2.2.0] - 2026-08-22
+
+### Added
+
+- **A new family of applied briefs — 17 cards for the work people actually bring to an
+  assistant.** Decision records, assumption ledgers, requirement boards, experiment and
+  negotiation plans, stakeholder maps, service blueprints, approval flows, resource and
+  maintenance plans, contact directories, trip budgets, care instructions, clause comparisons,
+  incident briefs, coverage checks and offer breakdowns. The component catalog is now 625
+  contracts across 24 families.
+- **The UI gate can sweep more than one data shape.** The gallery derives `verbose` and `minimal`
+  variants of any fixture, and `pnpm audit:ui -- --variants all` renders every block against all
+  three. It also collects render failures — duplicate keys, thrown renderers, NaN attributes —
+  rather than only measuring geometry.
+
+### Changed
+
+- Blocks now derive their geometry from the data they are handed rather than the fixture they
+  were authored against: the diagram family sized nodes and routed edges off the authored node
+  count, the relationship map placed labels from a fixed count, and several components assumed
+  optional fields were present.
+- The selector's prompt states its contracts as executable requirements — a component whose
+  contract cannot be satisfied is omitted rather than sent half-filled — and can now express
+  required fields nested inside objects and closed vocabularies on required sibling fields.
+
+### Fixed
+
+- The spoken answer's headline runs to the divider beneath it again. Each workspace template caps
+  body text at its own reading measure with a more specific rule, which quietly won over the
+  headline's own full-width cap and left a blank strip before the rule.
+
 ## [2.1.1] - 2026-08-22
 
 ### Changed