smbls 3.14.866 → 3.14.868

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # smbls
 
+## 3.14.868
+
+### Patch Changes
+
+- fc45ef2: The smbls bundle (dist ESM/CJS/IIFE, and the runtime the hosted renderer inlines) carries the r16 element and helmet changes: faceWait reads styles once per animation frame, with one frame per window (XMA #850), and helmet's `extractMetadata` finds the page by the key the router mounted (K4). smbls lists `@symbo.ls/element`, `@symbo.ls/utils` and `@symbo.ls/helmet` as devDependencies (it bundles them), so their changesets alone do not bump it.
+- b5a504c: The router never throws on an address with a malformed escape. `/compare/100%` (a `%` without two hex digits after it) is an address a visitor can type; the router decoded each param with a bare `decodeURIComponent`, threw `URIError` in `onRenderRouter`, and the page never rendered its route. The raw segment is now the param, as the served head reads it (`@symbo.ls/utils` getPageMetadata) and as the early fetch already guards. A well-formed escape still decodes. `smbls` bundles the router, so its bundle is bumped too.
+
+## 3.14.867
+
+### Patch Changes
+
+- d8e2dff: XMA follow-ups (r15).
+
+  - faceWait: an element with no box is held (it asks for no face) until it gets one, so the frame its box comes in never paints the fallback face (Firefox); a `display: contents` element counts as drawn when its text is. A `class` / `style` / `lang` write that changes a waiting element's font checks it again, read once per animation frame and only where the write reaches a waiting element; `el.checkFaces()` checks again after a change no attribute shows. Every list `el.facesReady()` resolves with carries `late`: a promise of the faces that came after the cap, or null.
+  - `el.getAdoption()` answers before the element's node is made: `onInit` and a create-time query's `transform` read `'adopted'` / `'replaced'` / `null` as the node will get it.
+  - A `.ttf` / `.otf` / `.eot` design-system font is written with the CSS format name (`truetype`, `opentype`, `embedded-opentype`); `format('ttf')` made Chrome drop the face.
+  - The visitor's-input kit of a replace boot is a lazy module: a code-splitting build (`smbls/core`) keeps it in a file of its own, which a hydrating page never requests; a page built to be replaced starts its load at the boot's first step.
+  - `fetch.early` requests given as data are made at build time; `fetch.early.inline` puts the early script in the page with its CSP hash. The runner writes the early script after `<meta charset>`.
+
 ## 3.14.866
 
 ### Patch Changes

package/README.md

@@ -375,7 +375,7 @@ A failure rejects with an `Error` that has `code`, `specifier` and `retryable`.
 Rules for a page that should stay lazy:
 
 - Write only the on-demand form; no static `import … from '@symbo.ls/sdk'` anywhere in the page's parts (app, libraries, kits).
-- Name the specifier nowhere else inside a function body — frank publishes body comments and strings as written, and any other mention makes the page inline the SDK (it still works: the marker then answers from the registry).
+- Quote the specifier nowhere else in the page's parts — frank publishes body comments and strings as written, and any other quoted `'@symbo.ls/sdk'` (a string literal, a code sample in copy) makes the page inline the SDK (it still works: the marker then answers from the registry). A mention in prose reads nothing: a comment or copy such as `npm install @symbo.ls/sdk` keeps the page lazy.
 - Push with a CLI whose frank has the marker. An older frank publishes the `import()` as written, and a browser cannot resolve that bare private specifier.
 
 ## SEO metadata