@pixelmatters/markup 1.22.0 → 1.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pixelmatters/markup",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Embeddable feedback widget for collecting visual bug reports, screenshots, and comments on live web apps.",
   "keywords": [
     "annotation",

package/skills/install-markup-widget/SKILL.md

@@ -7,7 +7,7 @@ sources:
   - 'Pixelmatters/markup:packages/widget/src/widget.ts'
 metadata:
   library: pixelmatters-markup
-  library_version: '1.22.0'
+  library_version: '1.23.0'
 ---
 
 `@pixelmatters/markup` is a Preact widget that runs inside a shadow DOM and talks to a hosted Convex backend at `https://<deployment>.convex.site`. The host page calls `init({ apiUrl, apiKey })` once at the app root and gets back a `destroy()` function. Everything else lives inside the widget bundle: pin anchoring, threads, mentions, identity, screenshots, real-time updates.
@@ -26,7 +26,7 @@ For a `<script>`-tag drop-in (no bundler / CMS / page-builder), use the inline E
 
 ```html
 <script type="module">
-  import { init } from 'https://esm.sh/@pixelmatters/markup@1.22.0'
+  import { init } from 'https://esm.sh/@pixelmatters/markup@1.23.0'
   init({ apiUrl: '…', apiKey: '…' })
 </script>
 ```
@@ -36,7 +36,7 @@ If the host disallows inline JS, use the auto-init form. `data-markup-widget="tr
 ```html
 <script
   type="module"
-  src="https://esm.sh/@pixelmatters/markup@1.22.0"
+  src="https://esm.sh/@pixelmatters/markup@1.23.0"
   data-markup-widget="true"
   data-api-url="…"
   data-api-key="…"
@@ -55,7 +55,7 @@ There is no framework-specific entrypoint: no `@pixelmatters/markup/react`, no p
 import { init, destroy } from '@pixelmatters/markup'
 ```
 
-`init` returns the matching `destroy`. Mount **once at the app root**, not per route. The widget patches `history.pushState` / `replaceState` and listens for `popstate` itself, so SPAs work without remounting. Calling `init` repeatedly is safe (the history wrapper is module-scoped, so init/destroy cycles don't stack), but it tears down the previous mount each time, so a render loop calling `init` will thrash. Always anchor it to a one-time mount lifecycle.
+`init` returns the matching `destroy`. Mount **once at the app root**, not per route. The widget patches `history.pushState` / `replaceState` and listens for `popstate` and `hashchange` itself, so SPAs work without remounting, hash routers included. Calling `init` repeatedly is safe (the history wrapper is module-scoped, so init/destroy cycles don't stack), but it tears down the previous mount each time, so a render loop calling `init` will thrash. Always anchor it to a one-time mount lifecycle.
 
 If `apiUrl` or `apiKey` is missing, `init` logs a `[markup]` console warning and returns a no-op `destroy` rather than mounting, which is worth knowing when debugging "nothing showed up."
 
@@ -203,7 +203,7 @@ Walk these in order when the widget is misbehaving:
 - **Don't wrap in a provider component.** `init` is the whole public API.
 - **Don't call `init` inside a route component.** Mount at the app root once.
 - **Don't hardcode the API key.** Use env vars so rotations don't require a code change.
-- **Don't ship CDN URLs without a version pin.** `@pixelmatters/markup@1.22.0`, not `@pixelmatters/markup`.
+- **Don't ship CDN URLs without a version pin.** `@pixelmatters/markup@1.23.0`, not `@pixelmatters/markup`.
 - **Don't add `https://*.convex.site` to `connect-src` and assume that's the whole CSP story.** The deployment domain (`<your-deployment>.convex.site`) is what the widget hits over HTTP, and it must be listed explicitly. Live thread updates go to `wss://<your-deployment>.convex.cloud`, an origin the widget derives from `apiUrl`, so `connect-src` needs both. `img-src` needs `blob:`, `data:`, and the host serving profile pictures; `style-src` needs `'unsafe-inline'` because the widget appends its stylesheet as a `<style>` element inside its shadow root. Add `https://esm.sh` to `script-src` only if you took the CDN path.
 
 ## Versioning & releases