@pixelmatters/markup 1.25.1 → 1.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pixelmatters/markup",
-  "version": "1.25.1",
+  "version": "1.26.0",
   "description": "Embeddable feedback widget for collecting visual bug reports, screenshots, and comments on live web apps.",
   "keywords": [
     "annotation",

package/skills/install-markup-widget/SKILL.md

@@ -7,7 +7,7 @@ sources:
   - 'Pixelmatters/markup:packages/widget/src/widget.ts'
 metadata:
   library: pixelmatters-markup
-  library_version: '1.25.1'
+  library_version: '1.26.0'
 ---
 
 `@pixelmatters/markup` is a Preact widget that runs inside a shadow DOM and talks to a hosted Convex backend at `https://<deployment>.convex.site`. The host page calls `init({ apiUrl, apiKey })` once at the app root and gets back a `destroy()` function. Everything else lives inside the widget bundle: pin anchoring, threads, mentions, identity, screenshots, real-time updates.
@@ -26,7 +26,7 @@ For a `<script>`-tag drop-in (no bundler / CMS / page-builder), use the inline E
 
 ```html
 <script type="module">
-  import { init } from 'https://esm.sh/@pixelmatters/markup@1.25.1'
+  import { init } from 'https://esm.sh/@pixelmatters/markup@1.26.0'
   init({ apiUrl: '…', apiKey: '…' })
 </script>
 ```
@@ -36,7 +36,7 @@ If the host disallows inline JS, use the auto-init form. `data-markup-widget="tr
 ```html
 <script
   type="module"
-  src="https://esm.sh/@pixelmatters/markup@1.25.1"
+  src="https://esm.sh/@pixelmatters/markup@1.26.0"
   data-markup-widget="true"
   data-api-url="…"
   data-api-key="…"
@@ -151,7 +151,7 @@ Tell users with strict compliance needs to opt into `strictScrub: true` and pin
 
 End users can also switch capture off for themselves with **Auto-capture screenshots** in the overflow menu. `screenshots.enabled: false` from the host still wins, and that row renders disabled.
 
-Capture degrades rather than failing outright: an image the browser won't hand over (a third-party avatar served without CORS headers is the usual culprit) comes through blank while the rest of the page captures; an oversized capture is re-encoded down a quality-then-scale ladder to fit the server's 2 MB cap; and if it still can't produce an image the composer says _Screenshot unavailable_ and the comment posts without one.
+Capture degrades rather than failing outright: an image the browser won't hand over (a third-party avatar served without CORS headers is the usual culprit) comes through blank while the rest of the page captures; the raster is capped at 1.5x device pixel ratio and encoded as WebP (JPEG where that isn't supported), then walked down a quality-then-scale ladder until it lands near 400 KB, with the server's 2 MB cap as the hard limit; and if it still can't produce an image the composer says _Screenshot unavailable_ and the comment posts without one.
 
 ## Mentions & inbox
 
@@ -203,7 +203,7 @@ Walk these in order when the widget is misbehaving:
 - **Don't wrap in a provider component.** `init` is the whole public API.
 - **Don't call `init` inside a route component.** Mount at the app root once.
 - **Don't hardcode the API key.** Use env vars so rotations don't require a code change.
-- **Don't ship CDN URLs without a version pin.** `@pixelmatters/markup@1.25.1`, not `@pixelmatters/markup`.
+- **Don't ship CDN URLs without a version pin.** `@pixelmatters/markup@1.26.0`, not `@pixelmatters/markup`.
 - **Don't add `https://*.convex.site` to `connect-src` and assume that's the whole CSP story.** The deployment domain (`<your-deployment>.convex.site`) is what the widget hits over HTTP, and it must be listed explicitly. Live thread updates go to `wss://<your-deployment>.convex.cloud`, an origin the widget derives from `apiUrl`, so `connect-src` needs both. `img-src` needs `blob:`, `data:`, and the host serving profile pictures; `style-src` needs `'unsafe-inline'` because the widget appends its stylesheet as a `<style>` element inside its shadow root. Add `https://esm.sh` to `script-src` only if you took the CDN path.
 
 ## Versioning & releases