@pixelmatters/markup 1.34.1 → 1.34.3

package/README.md

@@ -37,9 +37,9 @@ CDN drop-in, no build step. Paste this just before `</body>`:
 ```html
 <script type="module">
   // Pin the exact version; esm.sh resolves it from npm
-  import { init } from 'https://esm.sh/@pixelmatters/markup@1.34.1'
+  import { init } from 'https://esm.sh/@pixelmatters/markup@1.34.3'
   // or
-  // import { init } from 'https://esm.run/@pixelmatters/markup@1.34.1'
+  // import { init } from 'https://esm.run/@pixelmatters/markup@1.34.3'
 
   init({
     apiUrl: 'https://your-deployment.convex.site',
@@ -50,14 +50,14 @@ CDN drop-in, no build step. Paste this just before `</body>`:
 </script>
 ```
 
-> **Why pin the version?** CDN URLs without a version (`@pixelmatters/markup`) resolve to whatever's `latest` on npm, so a future major release will break your page with no warning. Always pin (`@pixelmatters/markup@1.34.1`).
+> **Why pin the version?** CDN URLs without a version (`@pixelmatters/markup`) resolve to whatever's `latest` on npm, so a future major release will break your page with no warning. Always pin (`@pixelmatters/markup@1.34.3`).
 
 If your platform doesn't allow inline JS (some CMS / page-builder editors), use the auto-init form instead. Point a `<script src=…>` at the bundle and pass config via `data-*` attributes:
 
 ```html
 <script
   type="module"
-  src="https://esm.sh/@pixelmatters/markup@1.34.1"
+  src="https://esm.sh/@pixelmatters/markup@1.34.3"
   data-markup-widget="true"
   data-api-url="https://your-deployment.convex.site"
   data-api-key="markup_..."
@@ -442,7 +442,7 @@ to start from `anchorSource` and confirm it, not to trust it blindly.
 
 Anonymous by default, with two opt-in upgrade paths:
 
-- **Sign in with Markup.** The widget POSTs to `/widget/popup-exchange` with the apiKey + Origin gate, gets back a single-use 60-second code, then opens `${apiUrl}/widget/auth?code=…` in a popup. Because the popup is first-party to the deployment origin, the better-auth session cookie is sent normally (sidestepping third-party cookie blocks). The popup `postMessage`s a verified identity plus a short-lived server-signed `Bearer` JWT back to the host page, which attaches it as `Authorization: Bearer` on subsequent writes. Where partitioned (CHIPS) cookies are available the tokens are held in `HttpOnly` cookies and the session refreshes for up to 7 days; where they aren't, the widget falls back to `markup.identity` in the host page's `localStorage` and the session is capped at 24 hours, since a token stored there is readable by any script on the page. The apiKey never appears in the popup URL.
+- **Sign in with Markup.** The click opens a blank popup straight away, so the browser doesn't block it. The widget then POSTs to `/widget/popup-exchange` with the apiKey + Origin gate, gets back a single-use code that lapses after five minutes, and sends the popup to `${apiUrl}/widget/auth?code=…`. Because the popup is first-party to the deployment origin, the better-auth session cookie is sent normally (sidestepping third-party cookie blocks). The popup `postMessage`s a verified identity plus a short-lived server-signed `Bearer` JWT back to the host page, which attaches it as `Authorization: Bearer` on subsequent writes. Where partitioned (CHIPS) cookies are available the tokens are held in `HttpOnly` cookies and the session refreshes for up to 7 days; where they aren't, the widget falls back to `markup.identity` in the host page's `localStorage` and the session is capped at 24 hours, since a token stored there is readable by any script on the page. Whether they are is checked once per tab, when a sign-in looks likely (the pointer on the avatar, its menu open, or a sign-in prompt shown), not on every page load. The apiKey never appears in the popup URL.
 - **Continue as a guest.** Name and optional email, stored alongside the server-issued anonymous `clientId` and JWT minted on first load.
 
 The popup origin is validated against the project's `allowedDomains` before any identity is returned, so only embeds on approved domains can resolve dashboard sessions. Verified JWTs can be invalidated before their TTL via the dashboard's "Sign out everywhere" action.
@@ -525,7 +525,7 @@ For a `<script>` tag drop-in (no bundler), use the inline ESM form and **pin the
 
 ```html
 <script type="module">
-  import { init } from 'https://esm.sh/@pixelmatters/markup@1.34.1'
+  import { init } from 'https://esm.sh/@pixelmatters/markup@1.34.3'
 
   init({
     apiUrl: '...',
@@ -541,7 +541,7 @@ If inline JS is disallowed (some CMS / page-builder editors), use the auto-init
 ```html
 <script
   type="module"
-  src="https://esm.sh/@pixelmatters/markup@1.34.1"
+  src="https://esm.sh/@pixelmatters/markup@1.34.3"
   data-markup-widget="true"
   data-api-url="..."
   data-api-key="..."