@veil-runtime/ui 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+# 0.4.2 — renderer stability patch candidate
+
+- Preserve existing text nodes for Text, Heading, Status and Button updates; skip unchanged text and update changed text in place.
+- Fix WebKit mouse activation lost when an input blur commits state during a button press.
+- Keep public APIs, revision semantics, action handlers, keyed reconciliation and transaction boundaries unchanged.
+- Add cross-browser regressions for repeated and changed text, HTML escaping, nested keyed identity, rejected updates and ordinary mouse activation after blur.
+- Candidate only; publication requires maintainer approval of the exact qualified artifact.
+
 # 0.3.0-rc.2 — review remediation candidate
 
 - Reject inherited composition field names and stage bounded state changes before acceptance.
@@ -49,6 +57,11 @@ Behavior changes from the private lab extraction: older Core peer ranges are rem
 
 This package supplies descriptions, not a React renderer, execution host, authentication service, workflow engine, or resumable-operation protocol. Historical lab UI/Emergence limitations remain outside the supported preview. Publication requires explicit maintainer approval of the exact qualified tarball and release action; these are proposed notes, not an announcement of availability.
 
+## 0.4.1 — Developer Preview patch
+
+- Document and test a runnable backend integration example in the source repository; the server, application, and browser fixture are excluded from the npm package.
+- Preserve the 0.4.0 runtime API and optional Core peer contract. This version resolves the already published 0.4.0 package identity.
+
 ## 0.4.0 — Developer Preview
 
 - Add bounded compound conditions and runtime-enforced conditional Button disabling.

package/README.md

@@ -1,9 +1,11 @@
 # Veil UI — Deterministic Composition Engine (Developer Preview)
 
-The v0.4.0 Developer Preview's framework-neutral interface engine is documented in [UNIVERSAL-INTERFACE.md](docs/UNIVERSAL-INTERFACE.md) and [v0.4.0.md](docs/v0.4.0.md). It supports bounded JSON definitions, validated multi-input forms, conditional controls, keyed dynamic updates, local state retention, trusted component lifecycles, and host-controlled actions without Veil Core. See [RELEASE-0.4.0.md](docs/RELEASE-0.4.0.md) for release scope and limits.
+The v0.4.1 Developer Preview's framework-neutral interface engine is documented in [UNIVERSAL-INTERFACE.md](docs/UNIVERSAL-INTERFACE.md) and [v0.4.0.md](docs/v0.4.0.md). It supports bounded JSON definitions, validated multi-input forms, conditional controls, keyed dynamic updates, local state retention, trusted component lifecycles, and host-controlled actions without Veil Core. See [RELEASE-0.4.1.md](docs/RELEASE-0.4.1.md) for release scope and limits.
 
 The one-screen composition API and DOM renderer are documented in [COMPOSITION.md](docs/COMPOSITION.md), with a working [stock treatment example](examples/composed). The root capability-description API remains available alongside the newer interface APIs.
 
+The runnable [backend integration example](https://github.com/veil-runtime/veil-ui-lab/tree/main/packages/ui/examples/backend) lives in the source repository only. Its server, application, and browser fixture are not in the npm tarball. The tarball includes the public runtime, declarations, documentation, and the standalone, composed, and universal examples listed in `package.json`.
+
 The root API derives and validates interface descriptions from governed capability contracts. It is framework-neutral: it returns graphs, fields, surfaces, and interaction descriptors. Your host renders those descriptions and executes authorized operations through Core.
 
 **Developer Preview: publication requires explicit maintainer approval of the exact qualified tarball and release action.**
@@ -25,7 +27,7 @@ In a separate application, use the printed absolute tarball path:
 
 ```sh
 npm init -y
-npm install /absolute/path/veil-runtime-ui-0.4.0.tgz
+npm install /absolute/path/veil-runtime-ui-0.4.1.tgz
 ```
 
 Then copy [examples/standalone/index.mjs](examples/standalone/index.mjs) into that application and run:
@@ -100,6 +102,6 @@ The laboratory React UI and Emergence remain historical experiments outside this
 
 Apache License 2.0, approved by the maintainer for this package. [LICENSE](LICENSE) and [NOTICE](NOTICE) are included in the qualified tarball. External dependencies retain their own licenses; see [THIRD_PARTY.md](docs/THIRD_PARTY.md). Root laboratory metadata remains separate.
 
-### v0.4.0
+### v0.4.1
 
-See [validation, conditions, and new inputs](docs/v0.4.0.md) and the [validated request example](examples/universal/validated.mjs). Submission validation is opt-in with `validate: true` on a Button; hosts retain execution and authorization responsibility.
+This patch release adds a [source-only backend integration example](https://github.com/veil-runtime/veil-ui-lab/tree/main/packages/ui/examples/backend). See [validation, conditions, and new inputs](docs/v0.4.0.md) and the [validated request example](examples/universal/validated.mjs). Submission validation is opt-in with `validate: true` on a Button; hosts retain execution and authorization responsibility.

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "inputs": {
-    "package.json": "4ebc32386b4b6e35fa6ae6eb80c6d0140803d6ff65d2026b2e1638fd8c715754",
+    "package.json": "2565895a0cb51b34fbdfd92695d4a2c1edf144f9e8574d1706b91d437633f858",
     "scripts/artifact.mjs": "92d2ffd8836d0e14742528da9ddc96e0834ef873ffa81097a3ebae58d825aace",
     "scripts/build.mjs": "54ca91e728925b1efefa61e5aeeb9e5bf549d25c2faa8ceb618009c214a7e03c",
     "scripts/check-boundary.mjs": "5c09c118f7340f3a111e3947c2d98579f73903728ded9d604ac13b93077a5b29",
@@ -16,7 +16,7 @@
     "src/composition.ts": "4d06b8fe4ed61b2e0a4daf07770be708b2f0167a35ae41140b4047b7cd8fbd78",
     "src/derive-input-fields.ts": "cf8c7ee9f98ed0838dbf299fb4653814c3e70004fc121d8c99752aa137331efd",
     "src/derive-output-view.ts": "81d622d5430f7b9333a41c33794d8d22e3e539e861e04830ce089d83a6790a8e",
-    "src/dom.ts": "a7580ecc8599de9df2554390beaf430ac5217b0adb7e7e9145f0caaedc39e3f1",
+    "src/dom.ts": "a89250bb7d00453f34de62812f34364c66f8173ccd51000d67dd3d40d474ee7e",
     "src/execution-request.ts": "775c3beba47aae482acbc2a48461ab8f947ca7b773c71a69077af387557ae344",
     "src/experience-orchestration.ts": "f156497d99828d15da2b42f3155e4ec0b77fc72ad6e6d846bb9bbea4d6791fa4",
     "src/format-semantic-value.ts": "2192cd723c5a9d64164287ddae99c0aa105024e1d0778a597d0b71a2ea8ab9dd",
@@ -55,7 +55,7 @@
     "derive-output-view.d.ts": "9ca3c32ac65215bb85ae74b75121c55c2ac82d04d7754d38ebc0de94d3fa898a",
     "derive-output-view.js": "e54de4b2ece567a518d346cfd8d96fe2179f5a1fcf76cc6306c5222184e19b73",
     "dom.d.ts": "ae12ba88b9bf43bdc99a9c2ca8923764cf28e77d55b132a05dc5965cba34a6a5",
-    "dom.js": "decdde492af176b865643e0c11992724e33c4146b155f9b9f9ca10f889769b6f",
+    "dom.js": "d878b9c62e1a52e3be73233b6c04721356b9a01746a4381de3e1a69511b3e194",
     "execution-request.d.ts": "f8b68cf456bfbeb63a968378e5ccaef5f55a908022e323901668ca99ebe75a3a",
     "execution-request.js": "f32bd2e9de70dd9f243d08d0fce4898e847fa3d34d77d3376a1b3c5839edb611",
     "experience-orchestration.d.ts": "45fa9770a37acccaeb6e0f267e0a566c6d6cda6133d6e1077589859478effd77",

package/dist/dom.js

@@ -393,8 +393,17 @@ export function mountInterface(target, controller, components = {}, onError) {
             element.setAttribute("aria-label", node.ariaLabel);
         else
             element.removeAttribute("aria-label");
-        if (["Text", "Heading", "Status", "Button"].includes(node.component))
-            element.textContent = resolveText(node, snapshot);
+        if (["Text", "Heading", "Status", "Button"].includes(node.component)) {
+            const text = resolveText(node, snapshot);
+            // Retain the pressed button's text node across blur-driven state commits.
+            if (element.textContent !== text) {
+                const child = element.firstChild;
+                if (child?.nodeType === 3 && child === element.lastChild)
+                    child.nodeValue = text;
+                else
+                    element.textContent = text;
+            }
+        }
         if (node.component === "List") {
             const items = resolveInterfaceBinding(snapshot, node.binding);
             if (items !== undefined && (!Array.isArray(items) || items.length > 100))

package/docs/RELEASE-0.4.1.md

@@ -0,0 +1,9 @@
+# Veil UI 0.4.1 — Developer Preview patch
+
+Veil UI 0.4.1 preserves the published 0.4.0 runtime API. The patch documents and tests a runnable [backend integration example in the source repository](https://github.com/veil-runtime/veil-ui-lab/tree/main/packages/ui/examples/backend). Its server, application, and browser fixture are excluded from the npm package. Existing root, `/inspection`, `/composition`, `/interface`, and `/dom` entry points remain available. [v0.4.0.md](v0.4.0.md) describes the interface contract and migration details.
+
+The package is ESM. Node.js 24 or newer is the qualified server baseline; the DOM entry point is qualified in Chrome at mobile and desktop sizes. TypeScript 6.0.2 with strict NodeNext resolution is the qualified type baseline. UI has one runtime dependency, Zod 4.x. Core remains an optional peer with range `^0.4.0`: the interface and DOM APIs do not require it, while capability graph consumers can install Core. Published Core 0.4.0 is the supported and qualified integration baseline. Isolated 0.5.0 and 0.6.0 probes do not expand the declared peer range.
+
+Hosts must bound raw bytes before parsing, allowlist actions, validate inputs again at the service boundary, and authorize effects. Trusted custom components own their external resources. Candidate preparation failures preserve controller state, revision, and mounted view. A commit-phase exception preserves controller state and revision, but cannot generally undo already applied DOM changes or external effects; renderer commits must be nonthrowing. Live-model reliability, Firefox, WebKit, and actual screen-reader behavior are outside the current qualification evidence.
+
+Install the exact qualified tarball for review with `npm install /absolute/path/veil-runtime-ui-0.4.1.tgz`. Publication and any `v0.4.1` Git tag require separate maintainer approval of the final source commit and artifact SHA-256. The published 0.4.0 package and existing `v0.4.0` tag remain unchanged. This document is release text, not a publication announcement.

package/docs/v0.4.0.md

@@ -45,3 +45,7 @@ The existing component allowlist, safe bindings, bounded data/tree limits, text-
 The exported `InterfaceCondition` retains the v0.3.0 equality interface with required `binding` and `equals`. `InterfaceConditionExpression` is the expanded union used by visibility, disabling, and the evaluator. Existing interface inheritance and direct equality-binding access remain supported.
 
 Candidate preparation failures leave controller state, revision, and the mounted DOM unchanged. Disposal during preparation or commit rejects controller state advancement and stops subsequent commits. A commit-phase exception preserves controller state/revision and discards prepared candidates in reverse order, but discard is resource cleanup, not a general rollback of already-applied DOM or external side effects. Renderer commits must therefore be nonthrowing; arbitrary commit failures cannot promise cross-renderer visual rollback. This limitation is explicitly tested rather than claimed as full transaction atomicity.
+
+## Connecting an existing backend
+
+Application code handles `onEvent` and owns HTTP, credentials, authorization, and teardown. The [source repository's backend example](https://github.com/veil-runtime/veil-ui-lab/tree/main/packages/ui/examples/backend) demonstrates a local HTTP service and a mounted interface using request identities, abort signals, revision checks, safe error messages and user-initiated retry. From a source checkout, run the package build, then `node packages/ui/examples/backend/server.mjs`; see the example's README for the complete pattern. The server, application, and browser fixture are not included in the npm package.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veil-runtime/ui",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",