smbls 3.14.855 → 3.14.857

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # smbls
 
+## 3.14.857
+
+### Patch Changes
+
+- 7b3795b: A part of a pre-built page whose query runs after its create (on a state change, once its `enabled` turns true) is taken over as the page shows it. The render records which of its queries each element ran (`fetchRunsOf`), the page carries that record in its seed block, and the element takes those queries' recorded answers at its init — no loading look between the takeover and its data, no request. An element that never ran a query never takes another element's answer. `elementPath` moves to `@symbo.ls/utils` (still exported by `@symbo.ls/element`).
+- 8700d85: Inside a `breakpointsFrom` container, `vw` lengths measure the container, not the window (XMA round 6, item F, the vw half). A new optional element feature, `containerVw` (`src/containerVw.js`, a `FEATURES` slot like the view events), does it. The container's class gives its children `--smbls-cvw: 1cqi`, a `<length>` custom property registered with `CSS.registerProperty` (initial value `1vw`), so it inherits as px and a nested card container does not re-measure it. It also re-declares every design-system token with a `vw` length in `--smbls-cvw`, plus each token that refers to one. A descendant's own `vw` / `svw` / `lvw` / `dvw` values (static and reactive classes, case blocks, `style` blocks, inline writes) are written as `calc(N * var(--smbls-cvw))`. `breakpointsFrom: 'window'` inside a container gives its subtree the window's `vw` again. Apps without a container emit the same CSS as before. The lean engine (the smbls embed) leaves the feature out, and `build.treeShakeFeatures` drops it (`containerVw`, trigger `breakpointsFrom`) from a build whose source never names `breakpointsFrom`.
+- 9184c58: fetch.early (XMA 3.14.855 report): `script` bundles the project's own pre-boot module into the early file (one request; its exported hooks are the script's); `adopt: 'init'` lets an element take an answer that is already in at its init on the app shell; `startLang(ctx)` names the start language (asked in, stored as polyglot's choice) and a request's `lang: '<code>'` asks in its own; `slice: '<argument>'` slices an rpc, and with `adopt: 'init'` an early answer with fewer rows is a bigger call's first part; `firstView(ctx)` runs once the first view is in (after the takeover on a built page; after load and first contentful paint on the shell), at idle. All opt-in.
+
+## 3.14.856
+
+### Patch Changes
+
+- A payload key can no longer write to a prototype, a shared library reaches a consumer as copies, and a server render takes back its own library entries (merge programme 2026-10-25, lane F1).
+
+  - Security: `deepDestringifyFunctions` and `destringifyGlobalScope` (`@symbo.ls/utils`, and so the `smbls` bundle) and the renderer's own reviver (`@symbo.ls/mermaid` `deepDestringifyFunctions`, `stripFunctionStrings`) skip the keys `__proto__`, `constructor` and `prototype`. Before, a served page payload with a `__proto__` key wrote its object into `Object.prototype` (every object of the process then carried its keys, the next server render in the same process too), and a revived global scope inherited from an object the payload chose. The library merge (`deepDefaults` and its copies) skips the same keys.
+  - A library's `polyglot.translations` fill a consumer that has translations of its own, language by language and key by key: the app's key wins, an app with `polyglot.fetch` keeps its own maps, and a flat dotted library key never shadows a nested app value. `@symbo.ls/sync` puts the library keys back after a livesync snapshot or op.
+  - The merge hands a consumer copies of a library's design system and bags, never the library's objects, so one consumer's boot can no longer write into a library payload that other consumers share. A cycle in a library value is kept, not followed. Every `smbls` boot starts from its own default containers.
+  - `@symbo.ls/brender`: a render takes back only the `__SMBLS_PKGS__` entries its own libraries added; the process keeps one package registry and its framework entries.
+
 ## 3.14.855
 
 ### Patch Changes