@pixelmatters/markup 1.18.5 → 1.18.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -6
- package/dist/widget.js +30 -21
- package/dist/widget.js.map +1 -1
- package/package.json +1 -1
- package/skills/install-markup-widget/SKILL.md +4 -4
package/package.json
CHANGED
|
@@ -7,7 +7,7 @@ sources:
|
|
|
7
7
|
- 'Pixelmatters/markup:packages/widget/src/widget.ts'
|
|
8
8
|
metadata:
|
|
9
9
|
library: pixelmatters-markup
|
|
10
|
-
library_version: '1.18.
|
|
10
|
+
library_version: '1.18.6'
|
|
11
11
|
---
|
|
12
12
|
|
|
13
13
|
`@pixelmatters/markup` is a Preact widget that runs inside a shadow DOM and talks to a hosted Convex backend at `https://<deployment>.convex.site`. The host page calls `init({ apiUrl, apiKey })` once at the app root and gets back a `destroy()` function. Everything else lives inside the widget bundle: pin anchoring, threads, mentions, identity, screenshots, real-time updates.
|
|
@@ -26,7 +26,7 @@ For a `<script>`-tag drop-in (no bundler / CMS / page-builder), use the inline E
|
|
|
26
26
|
|
|
27
27
|
```html
|
|
28
28
|
<script type="module">
|
|
29
|
-
import { init } from 'https://esm.sh/@pixelmatters/markup@1.18.
|
|
29
|
+
import { init } from 'https://esm.sh/@pixelmatters/markup@1.18.6'
|
|
30
30
|
init({ apiUrl: '…', apiKey: '…' })
|
|
31
31
|
</script>
|
|
32
32
|
```
|
|
@@ -36,7 +36,7 @@ If the host disallows inline JS, use the auto-init form. `data-markup-widget="tr
|
|
|
36
36
|
```html
|
|
37
37
|
<script
|
|
38
38
|
type="module"
|
|
39
|
-
src="https://esm.sh/@pixelmatters/markup@1.18.
|
|
39
|
+
src="https://esm.sh/@pixelmatters/markup@1.18.6"
|
|
40
40
|
data-markup-widget="true"
|
|
41
41
|
data-api-url="…"
|
|
42
42
|
data-api-key="…"
|
|
@@ -203,7 +203,7 @@ Walk these in order when the widget is misbehaving:
|
|
|
203
203
|
- **Don't wrap in a provider component.** `init` is the whole public API.
|
|
204
204
|
- **Don't call `init` inside a route component.** Mount at the app root once.
|
|
205
205
|
- **Don't hardcode the API key.** Use env vars so rotations don't require a code change.
|
|
206
|
-
- **Don't ship CDN URLs without a version pin.** `@pixelmatters/markup@1.18.
|
|
206
|
+
- **Don't ship CDN URLs without a version pin.** `@pixelmatters/markup@1.18.6`, not `@pixelmatters/markup`.
|
|
207
207
|
- **Don't add `https://*.convex.site` to `connect-src` and assume that's the whole CSP story.** The deployment domain (`<your-deployment>.convex.site`) is what the widget hits over HTTP, and it must be listed explicitly. Live thread updates go to `wss://<your-deployment>.convex.cloud`, an origin the widget derives from `apiUrl`, so `connect-src` needs both. `img-src` needs `blob:`, `data:`, and the host serving profile pictures; `style-src` needs `'unsafe-inline'` because the widget appends its stylesheet as a `<style>` element inside its shadow root. Add `https://esm.sh` to `script-src` only if you took the CDN path.
|
|
208
208
|
|
|
209
209
|
## Versioning & releases
|