Changelog

Live collaboration — Real-time multiplayer editing, turned on with collaboration: { doc }.

• Editors on the same doc see each other's edits, carets and avatars, named by collaboration.user.
• offline: true survives a reload by writing document content to browser storage.
• Every tool must support read-only, because a collaboration editor boots read-only.

persistence, server and ticket — The document wiring that used to be yours to write.

• persistence: { load, save } loads on mount and saves as the document changes, against your endpoint.
• Saves are queued, never parallel, and only the newest pending document is sent.
• server fills in the uploader and preview endpoints. ticket names the endpoint minting an access pass.

Documents convert outside the browser — Blok.Server runs the editor's own serializer in-process.

• AddBlokDocuments() registers it, and AddBlokServer already includes it.
• IBlokDocumentConverter gives Markdown, HTML and plain text out, and Markdown in.
• Markdown cannot express every block, so both directions report what changed.

Translate a document without handing a model its JSON — extractTexts and injectTexts move the prose past a model.

• The model never sees the structure, so it cannot drop ids or reorder blocks.
• URLs, file names and code blocks are left out of the list.
• A list whose length does not match the document throws rather than misplacing a translation.

Markdown out of a saved document — blocksToMarkdown is the synchronous, DOM-free twin of markdownToBlocks.

• Headings become #, lists - or 1., and tables GFM pipe grids.
• blocksToMarkdownWithReport also names every construct dropped or emitted lossily.
• Markup written into Markdown comes back as literal text, since Blok has no raw-HTML block.

A heading keeps the anchor its links point at — HeaderData.anchor renders as the heading's id.

• It is captured from a pasted heading's own id, so in-document links survive a paste and a save.
• restoreHeadingAnchors repairs documents already imported without it.
• That pass reports every fragment it refused as no-match or ambiguous, rather than guessing.

An uploader can delete what it stored — delete?(url, ctx) is a third optional method on BlokUploader.

• Blok sweeps the assets this session uploaded and then stopped using.
• With the method absent nothing is ever deleted, which is what happened until now.
• UploaderConfig.headers may now be a function, so a short-lived pass is minted per request.

Change a live document from outside the browser — POST /sync/{doc}/edit and /reset work over HTTP.

• An edit inserts, updates or removes blocks, all-or-nothing, and reaches every open tab.
• A reset reloads the document from your endpoint and tells every tab to pick it up.
• Both require a pass with write: true naming that document.

Pasted HTML ran before anything sanitized it — A pasted <img src=x onerror=…> executed before clean() saw it.

• Clipboard HTML was parsed into an element owned by the live document, which still loads resources.
• Untrusted parses now use a document with no browsing context.
• The URL scheme check moved inside clean(), so a pasted javascript: link is no longer clickable.

A long article could not be converted at all — An article that died on the server's engine now converts in milliseconds.

• Both serializers reallocated the whole accumulated document for every block.
• blocksToHtml also sent every inline field through a sanitizer that parsed twice.
• Measured on the real engine: 600 KB went from failing outright to 7 ms.

A legacy document's nested content read as empty — Plain text, Markdown and HTML all dropped a legacy block's children.

• Documents written before nesting moved to parent and content keep their children inside data.
• Those shapes are now expanded once, in the document model, so every reader sees them.
• One unreadable block is skipped and reported, rather than costing the caller the whole article.

Markdown export lost the fence language and the nesting — Code fences exported unlabelled, and Tab-nested paragraphs exported as code.

• Four leading spaces after a blank line is an indented code block, so that indent survives only inside a list item.
• A container rendered only its direct children, so a list inside a toggle lost every level below the first.
• Lossy conversions now report what changed, instead of reading as "nothing was lost".

The caret did not survive a read-only round trip — Entering read-only remembers where the caret stood, and leaving it puts it back.

• It holds on both the in-place toggle and the save, clear and render path.
• The restore declines when the user focused something else, or when the block is gone.
• A collaboration status blip that changes nothing no longer kills a live caret.

A link to somewhere on the same page opened a new tab — A bare #fragment reopened the whole document instead of moving inside it.

• So did the absolute URL that "Copy link to block" hands out.
• A fragment now scrolls, an identical URL does nothing, and a query-only difference navigates in place.
• Following a link is reading, so the handler no longer unbinds in read-only.

The server runs its own Yjs engine — Nothing it ships carries native code any more.

• YDotNet and the native build matrix are replaced by a managed C# implementation.
• Each wave was verified against a shared Yjs oracle rather than against itself.
• A service account with no home directory now needs no configuration.

blok-sync.v2 is on the wire, and deliberately not spoken yet — The service negotiates it, and the client still offers only v1.

• The operation, acknowledgement and rejection codecs exist on both sides against pinned fixtures.
• An operation id is settled and journalled before anyone can see the write.
• Do not build on the v2 frames until the client negotiates them.

The documentation site was one step from being indexed as its error state — A crawl recorded the homepage's only <h1> as "Application Error".

• A component drew with Math.random() during render, so React 19 discarded the server HTML.
• Docs had also not deployed for three days, blocked by a script demanding impossible release assets.
• A post-deploy smoke test now asserts what the host actually serves.

yarn serve starts the collaboration backend — The dev playground boots the sync service beside it.

• Multiplayer is exercised locally by default.
• Pass --no-server to run the playground alone.

Gates and dependencies — The .NET solution keeps three test layers plus conformance and package smoke tests.

• CI requires 80% line and branch coverage on merged production code.
• It audits NuGet packages, scans for secrets, scans the built image, and analyzes C# with CodeQL.
• Mutation testing runs on the diff alone, carrying surviving mutants between commits.

@bloklabs/server is one C# implementation now, in two forms — The Go service that shipped in 1.11.0 is ASP.NET Core.

• Blok.Server.AspNetCore runs the same handlers inside an app you already have, with no second process.
• npx @bloklabs/server and ghcr.io/jackuait/blok-server still deliver the standalone host.
• Routes, flags and every response wire are unchanged, pinned by a 58-case conformance suite.

Answers pasted from ChatGPT and Gemini keep their structure — A pasted formula used to arrive as roughly 870 layout spans.

• Math is replaced by the <span data-latex> the equation tool already whitelists.
• A code block collapses to one <pre><code>, and its language rides as data-blok-code-language.
• There is deliberately no Claude branch: its share pages sit behind a bot check.

Markdown copied out of an AI answer lost half its structure — A code fence nested under a list item vanished without trace.

• Nested content is emitted as sibling blocks, and later items carry start so markers do not restart at 1.
• Fence languages are normalized through one module that knows the aliases models emit.
• Bold, inline code and strikethrough inside a list item now survive a save.

The Go implementation is gone, and the tag ships the C# one — It was removed only after the dual-target conformance gate passed unwaived.

• The tag workflow packs both NuGet packages and proves them from an isolated feed.
• It smoke-tests the archive and the container image before publishing anything.
• The NuGet credential is minted over OIDC immediately before the push.

Two gates that only CI could see — The dotnet format check was red on main from the day it landed.

• The repository carried no .editorconfig, so the tool fell back to four-space indentation.
• That produced 12689 whitespace complaints, and every step after it never ran.
• The .NET tree now carries its own config, so a laptop and a runner agree.

@bloklabs/presets — Ready-made uploaders, so config.uploader is no longer something every project writes.

• supabaseStorage, presignedStorage, cloudinaryStorage, fetchStorage and indexedDBStorage.
• Zero runtime dependencies: a vendor client is passed in, never imported, so your own auth session applies.
• BlokUploader, UploadContext and UploadedAsset are now exported from @bloklabs/core.

@bloklabs/server — A sidecar handling file uploads and link previews, so you write no backend for either.

• POST /upload, POST /upload-by-url and GET /unfurl, run through npx or the container image.
• Uploaded bytes land in a local directory or any S3-compatible bucket.
• Access modes none, proxy and ticket are enforced by startup interlocks rather than warnings.

Cross-block text selection — Dragging across blocks selects the characters under the pointer, not whole blocks.

• Copy, cut, typing, Enter, paste and the mark engine all split the range per editing host.
• It works in Firefox, which Notion's own implementation does not.
• Escape promotes the text selection to a selection of the same blocks.

Block controls on either side — config.toolbarPosition: 'left' | 'right' moves the plus button and drag handle.

• It is live through toolbar.setPosition(), and the reserved gutter width moves with it.
• Logical tokens throughout, so RTL mirrors for free.
• Before this, the only lever was hiding the controls entirely with hideToolbar.

Dev override seam — Every @bloklabs/core entry consults globalThis.__BLOK_DEV_OVERRIDE__ before its bundled implementation.

• It is a passive, in-realm read: nothing is fetched, evaluated or resolved from a URL.
• The editor root carries data-blok-version, so what is running is inspectable.
• To drop the branch from your bundle, alias the newly exported ./dist/* subpath.

onChange fired late, or not at all — Sustained typing produced zero calls until the user paused.

• Every mutation restarted the 400 ms window, which now opens on the first change and never extends.
• onChange leads the window on the next microtask, and the rest coalesces into one trailing call.
• onSave keeps the trailing edge only, since serializing the document is too expensive to front-run.

Selection beside a nested block — A lasso drawn beside a nested table selected the whole toggle section.

• Selection now resolves which block owns a row through the same rule the toolbar uses.
• A fast drag no longer drops every row above the first throttled mousemove.
• One keystroke inside a nested block no longer runs the pipeline once per ancestor.

Empty-block placeholders displaced the caret — An empty paragraph painted its caret 315 px to the right.

• A placeholder in normal flow consumes real inline advance at the start of the line box.
• Placeholders now paint their text while claiming zero advance.
• Media captions stay in normal flow, since a zero-width box would spill a centred caption sideways.

A bookmark that could not be previewed — It showed an error after the paste, and an ordinary card after a reload.

• The error state never reached saved data.
• A failed preview now degrades to a plain link on both paths.
• Roughly 30% of sites publish no preview data, so this is the ordinary case rather than a fault.

Audio player card — Descenders in the title and artist lines were sliced flat.

• text-overflow: ellipsis forces overflow: hidden, which clips at the padding box.
• At a line height of exactly 1, that box is shorter than the font's content area.
• Both lines now use the line-height token the file-name row already carries.

Release and CI wiring — Nothing here iterates workspaces, so a package missing from a list drops out silently.

• Both new packages are registered across all seven lists, from version lockstep to the publish gate.
• The server's binaries and image ship from a tag-triggered workflow, not from a maintainer's laptop.
• A compiler-API law fingerprints every type @bloklabs/presets hand-copies into its declaration.

Docs — New /presets and /server pages, linked from the navigation and localized in both languages.

• /server leads with the path that runs no service at all, and states its limits on the page.
• A new page documents the dev override seam, its threat model and its opt-out.
• SECURITY.md commits to acknowledging a report within five business days.

Framework adapters — useBlocks takes { within: blockId }, so a container re-renders only for its own subtree.

• Unscoped, a page of N containers turned one keystroke into N re-renders.
• childContentAttributes applies per-child decoration on each child's content wrapper.
• toolbarAnchorRef and ctx.setToolbarAnchor answer getToolbarAnchorElement from inside the component tree.

View — renderLatex and createLatexRenderer are exported from @bloklabs/core/view.

• The KaTeX chunk was already bundled, but hosts were told to add katex themselves.
• Both apply the options Blok trusts for untrusted input, including trust: false.
• createLatexRenderer() awaits the load once and hands back a synchronous renderer.

insertChild({ caret }) — The caret was permanently lost for a portal-rendered child.

• A React, Vue or Angular child returns an empty host and commits its editable a frame later.
• The block was not yet focusable, so the caret helper cleared the selection instead.
• Placement now re-applies once the child's holder produces an input, one-shot.

Adapter parity — The per-child decoration pass was triplicated across the adapters and is now one implementation.

• Three architecture laws pin the new surface.
• The view entry gained an export-to-declaration drift check.

Container tools — Five things a container block used to hand-roll are now declared. static childTools = { allow?, deny? } lets any container state which tools may be its direct children, enforced by core on insert (a disallowed tool is demoted to allow[0], so Enter always produces a block), on a cross-boundary move (refused) and in the toolbox (hidden) — the selective, insert-aware counterpart to ownsChildren, and the generic form of the Table-only restrictedTools. data-blok-keyboard-owner marks a subtree whose keyboard belongs to the tool: block-level and editor-level keydown/input handling stand down inside it, tag-agnostically, replacing per-key stopPropagation handlers. BlockAPI.insertChild gained an options argument with the same vocabulary as the adapters' useBlocks insert (focus, caret, id, tunes, replace), threaded through insertInsideParent.

Inline tools — InlineToolConstructable.hydrate(root) is a declared contract, called by Block after render, after an in-place setData and after onPaste. Whatever a hook writes is marked data-blok-mutation-free, so re-rendering derived markup is not an edit.

View — blocksToHtml and <BlokView> accept inlineRenderers: tag-keyed, post-sanitize, output inserted verbatim — the inline counterpart of renderers. A DOM-free render can plug in katex.renderToString or a mention chip without Blok shipping either.

Block tree — { blocks: [...] } is now a spec node (BlockRunSpec), valid at the root or as a child of a tree node. A migration holding an already-flat saved document can splice it verbatim: ids are kept, only un-parented blocks are re-parented onto the enclosing node, and only those join its content. Passing a pre-flat block as a tree node throws instead of silently dropping its parent/content links.

Inline equations — A KaTeX span's markup is derived from data-latex, and the sanitizer dropped its tags while keeping their text, so E=mc^2 was persisted as E=mc2E=mc^2E=mc2. What was supposed to hide that — re-rendering on load — never ran: EquationInlineTool.hydrate() had zero call sites repo-wide, so equations went inert on every reload, in the editor and not just in the view. The sanitizer rule now rewrites an equation span's content back to its source on both the DOM and the parse5 pipeline, so new saves are clean and a load heals documents that already carry residue. htmlTextContent reads a mark's source, so previews, outline and search stop reading rendered fragments.

onChange arming — The documented "handler presence arms the change pipeline" contract was false: core defaulted onChange to a no-op unconditionally, so the gate could never disarm and all three adapters' careful handler-presence omission was pointless. Hosts were passing dummy handlers to arm a pipeline that was already armed — and an onSave one also forces a full serialization per change batch. The injection is gone, so the contract holds as written.

Published types — types/data-attributes.d.ts was hand-transcribed and had drifted: 17 attributes missing (including nestedBlocks, the container slot every nesting tool's stylesheet targets) and one phantom key the runtime never had. It is now generated from source and any drift fails an architecture test. The React BlokViewProps was also missing classes.

Dependencies — postcss, brace-expansion, fast-uri, ip-address and undici bumped across the root and docs workspaces.

Superscript / subscript — A new inline tool takes the tenth slot in the inline toolbar, bound to ⌘/Ctrl+Period and ⌘/Ctrl+Comma. The two modes are mutually exclusive, so applying one clears the other. Shipped with glyphs drawn into the shared inline-toolbar type system, translations in all 69 locales, and docs.

Toolbox — Slash-menu entries are grouped under labeled sections, so a long tool list is scannable instead of a flat run of items. Each entry declares its own section.

Tool contract — Blocks carry creation provenance (user/load/api/paste/convert/replay/probe), so a container can tell an author's gesture apart from a document load, a refetch or an undo replay. Enter's container-escape became a per-tool declaration instead of a hardcoded list of Blok's own tool names, so a custom container keeps Enter inside itself without an editor-global onEnter hook. insertInsideParent and BlockAPI.insertChild take an optional tool name, making an appended typed child one atomic operation and one undo entry.

Framework adapters — The React, Vue and Angular block spec gained a general statics passthrough (toolbar anchor, ownsChildren, conversionConfig, the new Enter policy), an api handle, child-tree reactivity, per-child decoration, and an onMounted signal backed by a block:childrenMounted event. Handler presence is runtime-settable through api.handlers.set(), so passing onEnter at all no longer permanently decides Enter's semantics.

Editor — A new opt-in captureClicksBelowEditor places the caret in the last block when the host clicks empty space below the editor. Off by default; registered as a config key in the React and Vue adapters too.

Link — The link field sizes itself to its content, capped at the previous fixed width, and its create, error and edit states were polished.

Nesting — setBlockParent no longer lets a container on the block's own ancestor or descendant chain veto a reparent; an enclosing container claiming a holder used to leave model and DOM permanently divergent (Enter inside a callout nested in another container), and a descendant doing the same nested every appended child inside its predecessor. mountChildBlocks now reclaims a holder stranded in any ancestor container, re-mounts it at its model position rather than last, and preserves the caret across the adoption. Depth indentation moved from an inline margin with a hardcoded exemption list to a depth multiplier resolved through --blok-block-indent-step, so a container tool declines the indent with ordinary CSS and no !important.

Block API — Every handed-out BlockAPI is live, so getChildren() can no longer answer [] for a populated container and setParent/insertChild/moveChild can no longer silently no-op. api.blocks.update() prefers a tool's in-place setData when there are no tunes to apply, so it stops composing a replacement block that destroyed the previous one's portal and left the holder permanently empty.

Inline toolbar — destroy() threw and aborted blok.destroy(), leaking listeners in every module torn down after it: hide() emits Closed synchronously, the handler then ran close(), which nulled the popover mid-teardown. The reference is now detached before hiding.

Popover — Control-less HTML items (the new toolbox section headers) are no longer keyboard focus stops, so a role="presentation" header can't steal initial focus, shift every Arrow/Tab, or be pointed at by aria-activedescendant. Sibling active states refresh after an item is activated, and clicking the item that opened a popover now does nothing instead of reopening it.

List — Tab/Shift+Tab moved the model but not the render: both handlers wrote depth into the tool's live data before calling api.blocks.update, whose in-place diff then saw no change, so save() and the DOM silently disagreed.

Events and data — Keydown from a native form control a tool renders is no longer claimed by the editor. The toolbox merge and the save() extraction stop mutating tool-owned objects, so a toolbox entry carrying data no longer throws on a frozen save() result. A load is not an edit: a block arriving without a timestamp is no longer stamped at construction, so a save round-trip equals the document it came from.

Adapters — The portal registries reject a teardown from a superseded instance, so a same-id re-register survives a late destroy; Vue additionally defined one wrapper component per tool *type*, so a re-register patched the superseded instance and rendered stale data — the wrapper is now per block instance. A React element toolbox icon serializes instead of rendering as [object Object], and the imperative handle keeps the controlled baseline in sync so restoring a draft after clear() is no longer swallowed as an echo.

Styles — The icon stroke is scoped to Blok's own icon markup instead of every path in the subtree. The column floor moved to --blok-column-min-width in CSS, and the static-gutter attribute plus the block-padding tokens are now declared.

Build — scripts/build-angular.mjs derived its adapters contract from a hand-copied list that silently drifted whenever a staged module gained an import; it now derives it from src/adapters.ts, and the staging law test walks the same graph so drift fails at test time instead of build time.

Tests — 23 red e2e tests were root-caused rather than weakened: three were real product bugs (fixed above) and four were stale specs asserting behaviour that later commits deliberately changed. A leaked 600ms language-detection debounce in the code-tool unit tests was also cancelled, removing a load-dependent flake.

Embed — A stored generic embed the host hasn't allowed to be framed now renders as a clickable link card instead of the inert "No embed link" state, so the URL stays visible in both read and edit views and can never be silently lost. A new linkPaste.allowedEmbedOrigins hostname/wildcard trust list gives hosts fine-grained control as a middle ground before the all-or-nothing allowGenericEmbed flag. Tampered stored data stays fully inert, and no new iframe paths are introduced.

Editor — Queries for a block's first editable element now skip mutation-free markers such as a list item's bullet span, closing the remaining "marker ghost" sites where Enter could write an item's own HTML into the bullet and the toolbar centred on the marker's box instead of the text. An architecture test now enforces the guard on every contenteditable selector in the codebase.

Font size — config.style.fontSize now carries one entry per text scenario in every text-bearing block (paragraph, headings, quote, callout, code, toggle, list, checklist, table cells, captions, bookmark cards). Each entry writes that block's --blok-*-font-size custom property, so the same knob is reachable through style.tokens, editor.tokens.set() and plain CSS. An unconfigured editor renders byte-identically to before.

API — beginTransaction/endTransaction group operations spanning a pointer gesture into a single undo entry, for cases where the synchronous transact(fn) cannot reach across async boundaries.

Table corner drag — The bottom-right corner now behaves the way Notion documents it: the grid tracks the pointer through live geometry instead of a unit frozen at pointerdown, a Notion-style grip replaces the old 8px dot, hovering it explains the gesture, appended columns are full width, and the whole gesture commits as one undo entry.

Table auto-scroll — Holding the corner at the scroll container's edge or in the viewport's top/bottom band scrolls and grows the table as it goes. Growth follows the pointer — 8px/s for every pixel held past the edge — rather than a fixed clock.

Table selection — Dragging a row or column grip paints the entire dragged range instead of boxing only the focused cell.

Playground — A text-size slider (80%–150%) scales every style.fontSize scenario from its own CSS default.

Table — An inward corner drag stops at the first trailing row or column that holds content instead of deleting typed cells; the handle is anchored to the grid rather than the wrapper, so it no longer drifts inside the table as it grows; a caret click no longer leaves the corner handle and "+" buttons dead until the user clicks outside; clicking inside a merged cell boxes only that cell, and expanding a selection reaches merge origins, not just spans; a stale pointercancel listener no longer accumulates per completed drag.

Styles — Callout emoji and list markers stay aligned with their text as the font size scales, and the bookmark card's padding, line boxes, gaps and favicon scale with the card's own type. fontSize.callout now wins over fontSize.paragraph in the callout body.

Types — The public Blok class exposes its full API surface.

View renderer — @bloklabs/core/view now reaches visual parity with the read-only editor: every core block (paragraph, header, quote, list, checklist, code, callout, toggle, divider, spacer) renders from single-sourced class modules shared with the editor, view.css is generated from those modules, and a soft isolation root plus reproduced block scaffolding keep the output pixel-equal. A class-parity gate and a view↔read-only visual parity gate now run in CI, and the playground gains a side-by-side Blok View comparison panel.

Paste — Google Docs layout tables are now recognized: multi-row two-column tables carrying photos convert into column blocks, and single-column layout tables unwrap into their content instead of arriving as one-cell tables.

Inline toolbar — The convert menu now opens sideways with its trigger marked selected, and the convert row is styled as the card's header.

Callout — A newly picked emoji jumps into the old one's place, and the emoji picker opens instantly without waiting on its dataset to download.

Tools — data-blok-tool is now stamped on code, callout, divider and spacer roots.

Docs — The docs site advertises its markdown mirrors and declares Content-Signal; the published @bloklabs/core/icons subpath is documented; the README is restructured around benefits, facts and a runnable example.

Security — Stored javascript: XSS closed on two sinks: media download hrefs are scheme-gated, and stored embed renders are gated on the provider registry rather than a bare https: check.

Drag & Drop — Drops on the seam between two blocks now resolve instead of dead-ending; the drop indicator no longer promises a nesting the drop would refuse; side-drops are gated on the columns tool actually being registered.

Columns — The drop animation no longer balloons the row while a block lands.

Code — In read-only mode the language label renders as plain text and the language dropdown toggle is hidden; the copy button keeps the same height in its "Copied!" state.

Toolbar — Multiple editors on one page now show one set of block controls instead of stacking duplicates; the slash-search caret is sized to the input, not the block.

Tooltip — A bubble is never parked in the viewport corner when its anchor stops rendering.

List — The checklist checkbox is centred on its text at any font size.

Embed — Provider popups (e.g. "open in app") can escape the iframe sandbox again.

Audio — Cover art uploads are routed to the image pipeline instead of the audio endpoint.

Shortcuts — BACKSLASH/SLASH render as \ and / in shortcut hints.

Dependencies — All 40 open Dependabot alerts remediated at their root causes.

Marks — New range-aware api.marks inline-formatting engine, with the built-in bold/italic/underline/strikethrough tools migrated onto it. Exposes MarkSpec identity/family/transparent semantics for authoring custom inline tools.

View renderer — New synchronous, DOM-free view renderer published at @bloklabs/core/view (defineBlokSchema + a central dispatcher, plus a React BlokView), for rendering stored block content without booting a full editor.

i18n — New runtime editor.i18n.update() API that makes config.i18n live and repaints already-rendered block DOM, wired reactively through all three adapters.

Config — Reactive contract for readOnly, hideToolbar and inlineToolbar: setting them after construction now takes effect live across the React, Vue and Angular adapters (with sanitize-cache invalidation on inlineToolbar).

Readiness — Scoped, reactive editor readiness: whenAllReady({ within, settleOn }), readyState/subscribeReady, and a useBlokReady hook in all three adapters.

Docs — The documentation site is now crawlable (prerendered metadata, sitemap, AI mirrors) and carries Google Analytics coverage across pages.

Playground — Dev settings panel gains a language picker and an RTL toggle.

Marks — Fixed the trailing-whitespace extension eating later content when a mark ended on a boundary.

Styles — Surface background tokens (--blok-bg-light/-secondary/-tertiary) are now a test-enforced public contract; the gutter stays put in plain read-only so readOnly flips no longer shift layout.

Types — MarkSpec is now imported into the main declaration entry so it resolves for consumers.

Docs — Russian pages are headed by their localized H1; @bloklabs/core/view resolves in the docs build and React fixtures.

Release — The Angular README is now staged into the directory npm packs.

i18n — Locale audits completed across Slovak, Sinhala, Sindhi, Russian, Romanian, Portuguese, Pashto, Polish, Punjabi, Norwegian, Dutch, Nepali, Burmese, Malay, Marathi, Mongolian, Malayalam, Macedonian, Latvian, Lithuanian, Lao, Sorani, Korean and Kannada.

Migrated the docs site to React Router framework mode.

Renamed the default branch from master to main.

Completed npm metadata across the package family and hardened the view/reactive-contract law tests.

API — New public editor.tokens getter/setter for runtime --blok-* theme tokens, with replace semantics and pre-ready buffering (like theme/width/placeholder). Wired reactively through all three adapters: React style.tokens, Vue style.tokens, Angular [styleTokens]. --blok-content-max-width is now honored by database centring and toolbar control placement.

Tools — Custom-tool authoring fixes: tools.update(name, { toolbox }) now flips a tool's toolbox entry at runtime (permission-style insert gating no longer requires recreating the editor), including its insertion shortcut; React createReactBlock accepts a viewComponent rendered while the editor is read-only; React toolbox icons may be React elements; commit() echo idempotency is now a documented public contract.

Embed — Google Docs/Sheets/Slides/Forms/Drive embeds render at a user-adjustable pixel height with a bottom resize handle (200–2000px), persisted to data.height. Aspect-ratio media providers (YouTube, Vimeo, …) are unchanged.

CDN bundles — dist/blok.iife.js and dist/blok.umd.js shipped zero generated Tailwind utilities since the v3→v4 migration, so every unpkg/jsDelivr consumer loaded an unstyled editor. Both configs now run the Tailwind plugin (+34KB gzip each), guarded by a dist-level assertion.

Adapters — Five root causes from a downstream audit: a stale controlled-data echo no longer clobbers the caret (bounded echo window instead of last-payload-only dedup); equalsOutputData compares block ids only when both sides carry one; React inline tools accept a titleKey for localization; the zero-specificity gutter default is a test-enforced public contract.

Dependencies — Seven phantom dependencies (bare imports resolving only via hoisting, including @testing-library/jest-dom used by the global unit setup) are now declared, with a law test preventing new ones.

i18n — Review passes completing Armenian, Croatian, Dhivehi, Filipino, Georgian, Gujarati, Hebrew, Hungarian, Indonesian, Japanese, Kannada and Khmer, plus tool interpolation variable forwarding.

Upgraded to Node 26, Angular 22 and TypeScript 6, then root-caused six defects the upgrade shipped green — most importantly the entire unit-angular vitest project loading zero tests (a fake green), and the docs test suite missing the Node 26 webstorage guard.

Local E2E suite runtime cut from ~47.5 min to ~10 min (parallel/skip-when-fresh build:test, shared page per worker), plus broad E2E stabilization.

Fixed ESLint cache poisoning that replayed stale errors in CI lint runs.

Media — Playback speed and loop preferences now persist across audio and video blocks. They are stored in localStorage under shared per-media-type keys (blok:audio:rate/loop, blok:video:rate/loop), joining the existing shared volume and per-source position keys, and are restored when a player attaches — without dirtying block data.

Quote — Saving a quote block no longer strips href/target/rel from links (leaving dead anchors in stored content) or unwraps bold/italic marks. Quote now uses the same inline-text sanitize rules as paragraph and header, so links, formatting, and color styles survive save and conversion.

Audio — OneDrive share links from SPO-migrated accounts (the new /u/c/<cid> form) can't be resolved anonymously and produced a silently dead player; they now surface a clear "needs an uploader backend" error instead.

Toolbar — The plus button and drag handle no longer stay stuck at the wrong offset after the slash-command popover opens or closes; the toolbar repositions on toolbox open/close instead of relying on a resize side effect.

Toolbox — Opening the toolbox silenced the current block's mutation watching and never re-armed it, leaving the block permanently deaf to later content changes until re-render. Watching is now re-armed on both close paths, and the toolbar follows any inner-geometry change that doesn't resize the block holder.

CI — The build artifact now ships the extracted packages/*/dist adapter bundles alongside dist/, fixing downstream unit and E2E jobs; yarn.lock was synced to the ^1.1.1 core peer range.

Docs — README and the docs site updated for the @bloklabs/* package family; the rename notice was subsequently dropped from the README.

Audio — Share links from seven more services — Dropbox, OneDrive, GitHub, GitLab, Hugging Face, Google Cloud Storage, and Internet Archive — are recognized and rewritten to their direct-content form, so they play in the browser with no backend. Google Drive share links (hotlink-blocked server-side) are normalized and routed through the consumer's uploadByUrl backend, with a Drive-specific error message when none is configured. The error state gets a styled callout with a retry button.

Read-only — readOnly now accepts an object form: { hideControls: true } enables read-only mode and suppresses the toolbar, block settings, and inline toolbar. Exposed via isControlsHidden, normalized across the React, Vue, and Angular adapters, and ReadOnlyModeConfig is exported from the types root.

Image — compress: { format: 'avif' } now produces real AVIF via WebCodecs when the canvas encoder cannot, and a new fallbackFormat option (e.g. 'webp') covers browsers with no AV1 encoder instead of silently uploading the original bytes.

Audio — Audio inserted by URL is now enriched like uploads: waveform, title/artist metadata, and cover art, failing soft to a plain scrubber when the host blocks the CORS fetch.

Table — Undo inside a table no longer duplicates cell blocks into invisible ghosts that reappear under the table after save; blocks placed at the top of a cell no longer drift to the bottom or become orphans on save. The Saver gains save-boundary guards for cell membership and cell block order (throw in dev/test, repair the emitted output in production).

Tooltip — The tooltip bubble is click-transparent, so it never swallows clicks on controls it covers (e.g. color-picker swatches under a bottom-row tooltip).

Popover — Nested popovers no longer collapse to their padding in WebKit; the marker color picker rendered as a 12px sliver in Safari.

Styles — Body-mounted UI (link hover card, notifier toasts, drag previews) now carries the scope attribute, so its styles survive in consumer apps; a new architecture test enforces the invariant for every document.body mount.

Angular — The ng-packagr build stages the readonly-config module, fixing a CI-only TS2307; an architecture test now walks the adapter's import graph to catch unstaged modules.

Playground — Gallery empty states run the real tool per state (with per-state tool config) instead of static mockups, including a live Google Drive error demo.

Tests — Adversarial table undo probes (merge undo, insert undo/redo), tooltip click-transparency lifecycle guards, and an exhaustive swatch hit-test sweep.

Header — Toggle headings are now offered at all six levels, staying in sync 1:1 with regular headings.

Migration — The legacy Editor.js grammar is now authored as ESM so consumer dev servers can load blok's source graph without a build step.

Columns — Blocks inserted via the plus button no longer save at the bottom of the column; saved order now matches the on-screen (WYSIWYG) order.

Styles — Injected utilities are scoped so a host application's CSS reset can't flatten the editor.

Migration — Single-source LEGACY_GRAMMAR shared by both the runtime and the codemod; the codemod's source rewrite is now AST-guided (via the consumer's @babel/parser) to avoid mangling comments, strings, and unrelated identifiers.

CI — Root-caused CI failures: scoped-utility drift on body-mounted UI, lint, and test flake fixes (webkit paste timing, six-level toggle-heading counts).

Spacer — New adjustable-height spacer block. Drag either edge to resize (dual-edge grips), with a text-block-height floor, snap-to-sibling and snap-to-column alignment guidelines, an on-edge capsule resize pill, and accent hover cues. Fully invisible in read-only/published renders.

Image — Uploads are now automatically compressed and re-encoded (compress, on by default), with opt-in smaller output formats. In-cell images gain a resize floor and fluid chrome via container queries.

Toolbar — Cmd/Ctrl+Slash opens the block menu in read-only mode.

Table — Large batch of Notion-parity fixes: paste-header handling, the cell color picker, the cell menu, arrow-key navigation between cells, and column width reset. The cell box now follows the caret (instead of the pointer) and the resize handle no longer forces overflow. Focus stays inside a cell when its content is deleted, the caret stays put after clearing a multi-cell selection, multi-line cell selections merge into one rounded shape, drag-selecting several lines within a single cell works, and list items scale to the cell font instead of outsizing sibling paragraphs.

Columns — Stranded resize separators left behind by removing a column no longer render as a phantom column.

Core — Never Tab-indent a block into a tool-owned container.

Toolbox — Keep plus-button blocks on a table out of its cells, and anchor fuzzy search at word boundaries.

Selection — Stop hijacking intra-line text drags inside table cells.

Embed — Validate stored URLs at render time (stored-XSS guard).

List — Keep bullet markers non-editable so Enter never ghosts an item.

Toolbar — Read-only drag-handle refinements: announce it as a menu button, show a pointer cursor, and drop the ⌘/ and "Drag to move" hint lines; no read-only handle appears beside blocks that paint nothing.

Tunes — Hide the copy-link shortcut hint in read-only mode.

Styles — Right contentAlign no longer collapses into centering, and preflight resets are scoped to @layer base so Blok's own utilities win.

React — Guard against stale dist exports and a StrictMode readiness race.

Vue — New first-class @jackuait/blok/vue adapter: BlokEditor component, useBlok, and provideBlok, plus createVueBlock/useBlocks for authoring custom blocks and driving the block tree from Vue. Custom Vue blocks support read-only in-place toggling.

Angular — New first-class @jackuait/blok/angular adapter shipped as an Angular Package Format build (ng-packagr): the editor component/directive, a block portal registry, the BLOK_BLOCK_CONTEXT render-context token, createAngularBlock authoring, and the reactive injectBlocks block-tree API.

React — New useBlocks hook exported from @jackuait/blok/react: a reactive block-tree API with reads, insert (position + append-to-parent, explicit id, tunes, replace), move (before/after/toIndex), nest/unnest/remove/transact, insertMany, atomic insertTree for nested subtrees, and additive insertMarkdown. Block-creation semantics are hardened across hierarchy edges with compile-time drift guards against the core API.

Adapters — Closed React/Vue/Angular parity gaps across component paths and escape hatches; shared one blocks-api core so Vue's useBlocks reaches React parity, and extracted shared fillDefaults/PropSchema helpers. Custom-block authoring is now first-class on the public API surface.

Accessibility — Five-wave overhaul adapting shadcn/ui interaction patterns to Blok's UI primitives: dismissal-layer/popover teardown/scroll-lock/announcer foundations, an anchored-positioning engine and shared modal Dialog, keyboard reachability for toolbars/menus/radios/rename, and assistive-tech feedback parity across selection, drag, menus, and arrival.

Link — Clickable links with a hover card in both edit and read-only modes (with enter/leave animation), an edit mode featuring a title field and remove-link action, refined hover-card chrome, blocking of unsafe-scheme navigation, and a consistent same-page/anchor-link rule that opens such links in the same window across all link-creation paths.

Blocks — Structural parentId nesting: any block can now be nested inside any list (flat per-block indent), with list keyboard nesting and drag/serialization migrated onto the structural block tree.

Keyboard — Cmd+Left/Cmd+Right navigate between blocks at block edges; Backspace at the start of a nested block removes one indent level; mixed-list Tab indents both kinds; and numerous Notion-parity Tab/arrow/Delete/Backspace fixes.

Paste — Paste-without-formatting (Cmd/Ctrl+Shift+V); recovery of buildin/Notion toggles and soft breaks from lossy GFM HTML fallback.

Inline — Link-markdown auto-format and a link-paste menu; shortcut-triggered Link/Equation/Marker now open a standalone menu positioned right under the selection.

Popover — Custom cross-platform scrollbar that hides the classic OS bar while keeping a stable gutter; reel-like edge distortion replacing the scroll haze.

Convert — Shared buildConvertMenuEntries with titleKey resolution, used by both block settings and the inline "Turn into" menu (which now lists the full text family), guarded by parity E2E.

Image — Configurable auto-retry on image load failure (default 5).

CRDT/Yjs — Undo/redo no longer yanks the caret to the top of the document; the caret restores to the correct position, split() inherits full tool data (correct heading undo caret), redo moves the caret to the new block on an Enter split, and five further Yjs sync gaps in tools and modules were closed.

List — Closed dozens of Notion-parity divergences across convert, keyboard, drag, selection, and copy/paste; source ordered lists renumber when an item is dragged away; bullet glyphs refresh on depth change.

Text/Header — Fixed 30+ Notion-parity bugs by root cause (slash+space, duplicate pulse, indent toolbar, caret offset preservation on turn-into, and more).

Table — Preserve merged cells and lists when pasting external tables, and keep list markup when copying cells out to external apps.

Paste — Preserve lists and quote-ness in pasted blockquotes; pasted links use the default link color; the link menu shows on non-empty blocks without erasing content; closed remaining sanitizer/merge data-loss gaps found by an audit.

Blocks — Re-parent a merged block's children onto the survivor instead of orphaning them; release toggle children as siblings when turning a toggle into text; fire the tool moved() hook on setBlockParent; never write split text into a mutation-free decoration.

Columns — Match Notion's inter-column gutter spacing; restore DOM order when undoing column creation.

Drag — List-item drop line tucks under the text with a marker lead-in; depth changes apply on same-slot drops; non-list blocks stop previewing nested drops they can't reach.

Selection — Fake highlight matches the native selection color and stays visible while a menu input is focused; Cmd+A container-scoped staging.

Marker — Reset <mark> background so colored text never shows the browser's yellow highlight.

Toggle — Arrow container stays a constant 28px square and pins to the first line for multi-line toggle/heading.

Styles — Reserve a scrollbar gutter on all scrollable components and keep it in nested inline-toolbar menus; auto-hide scrollbars system-style while keeping the gutter.

Paste — Mechanically enforce the paste attribute law and the paste stamp law via architecture tests.

Tests — Repaired all CI-matrix E2E shards; added regression coverage across list keyboard shortcuts, columns undo order, popover scrollbar spec, and adapter integration/e2e.

Lint — Resolved all 69 root ESLint problems at the root cause.

React — A blessed <BlokEditor> component is now the recommended way to embed Blok in React. It forwards a typed ref to the live editor instance, takes an uncontrolled data seed, and reactively syncs readOnly, autofocus, theme, and width props without recreating the editor. Its onReady callback fires after the ref commits, so consumers can safely call ref.current from inside it. The lower-level useBlok hook plus BlokContent remain available as an escape hatch.

React — useBlok now reactively syncs theme and width prop changes to the editor instance, mirroring the existing readOnly/autofocus pattern.

Docs — The demo wrapper now dogfoods BlokEditor, and the README React section documents the recommended BlokEditor path, the uncontrolled data contract, reactive props, and the useBlok + BlokContent escape hatch.

Tests — Added e2e coverage for save-via-ref and live prop toggles, a published-vs-source type-drift guard, and data-blok-testid-based locators.

Paste — Content copied from buildin.ai now imports as native Blok blocks at full fidelity. buildin's clipboard carries a lossless text/next-space-blocks JSON payload beside a lossy Markdown/HTML twin; Blok previously fell back to the twin, where tables collapsed to literal |pipes|, media degraded to links, and callouts, toggles, columns, to-dos, and code language flattened away. A new handler decodes the JSON directly, reconstructing the same native blocks as a Blok→Blok paste — paragraphs, to-dos, H1–H4, tables (grid + parented cells), bulleted/numbered lists, toggles, dividers, quotes, callouts (emoji + colour), code (with language), equations, toggle-headings, column lists, and image/video/audio/file/embed-bookmark media. (Inline marks — bold/italic/link/colour — are a documented follow-up.)

Paste — Callout body and colour now survive import from both Notion and buildin.ai. Blok's callout stores its body in child blocks, so the inline title/body text the parsers emitted as data.text was silently discarded — the callout is now emitted (colours only) plus a child paragraph carrying its text. Out-of-palette callout colours (e.g. buildin's British grey, or any name outside Blok's 9-colour preset) previously produced an undefined CSS variable that dropped both the background and the border; colours now normalize through Blok's preset palette (grey→gray; unknown names clamp to null).

Paste — Rich clipboards (Notion and similar) ship both a faithful HTML payload and a lossy Markdown twin. Routing now prefers the HTML handler, so pasted images, links, and structure the Markdown twin drops are preserved.

Paste — Notion content keeps its document order: nested children no longer render above their parents (only table cells stay children-first, since the table tool resolves cell ids on insert). Internal references that previously vanished — sub-pages, linked databases / collection views, and inline page mentions — now paste as Notion bookmarks/links instead of being dropped or leaking the raw "‣" glyph, and uploaded media whose binary isn't on the clipboard becomes a Notion-link bookmark carrying the filename rather than a bare filename paragraph.

Paste — Pasted external Notion audio now shows its title (the player reads data.title, which was left blank), and a malformed inline date annotation no longer leaks the raw "‣" placeholder glyph.

Tests — Added regression coverage for HTML-over-Markdown routing, document-order preservation, internal-reference rescue, pasted audio titles, and date-glyph handling.

Paste — Content copied from Notion now migrates as native blocks with full state preserved. When Notion's lossless clipboard JSON is present it is used directly (the high-fidelity path), with an HTML fallback for sources that only expose markup. Inline equations and page mentions are mapped to their Blok equivalents.

Audio — Custom cover art. A cover picker (file upload or image URL) opens from an editable overlay button on the player; covers can be set, replaced, or removed (via a "Remove cover" block setting), with an animated picker open, a sliding Upload/Link tab transition, a themed surface that matches the player, and i18n across all locales. Audio blocks with no cover now show an inertial spinning-vinyl turntable placeholder instead of an empty panel.

Audio — Repaired the transport controls and the video-style playback-speed menu, which now stays open after picking a preset. The volume bar fill is fixed so a muted track reads differently from a full one, and the playing waveform pulses smoothly without gouging its dots. The caption toggle stays on the compositor, and the cover picker no longer jumps height on tab swap, gets an explicit width so the URL field isn't cramped, and revokes leaked cover blobs on a destroy race.

Table — Pinned the top toolbar anchor flush to the table edge.

Tests — Added unit and e2e coverage for custom cover set/remove and for real Notion page-mention arity, and cleared the lint/type violations the cover-art work introduced.

Width — New public width API on the editor instance: instance.width.get(), set('full' | 'narrow'), and toggle() switch the content layout between 'narrow' (the default, constrained to --max-width-content) and 'full' (the content max-width is removed so it fills its container). It mirrors the theme API, including buffering a set() call made before the editor is ready and replaying it once the editor is initialized.

Types — Declare the history API on the exported Blok instance type. history (clear(), undo()/redo(), canUndo()/canRedo()) was already available at runtime; consumers no longer need to cast the instance to reach it.

Audio — New native Audio block tool. Now-playing card with cover art (lazy music-metadata extraction), a waveform canvas with click/drag seek, transport controls (play/pause, volume, playback speed, loop, keyboard shortcuts, persisted preferences), file and URL upload, paste handling routed away from the File block, read-only support, and i18n across all locales. The player card is a full-bleed redesign — a tall cover panel (music-note placeholder when there is no art), a hero waveform scrubber with rounded bars, a slim transport bar, and motion polish.

Media — Image, video, and audio blocks now accept any file of their media family (image/*, video/*, audio/*) by default. Restrict the accepted types through the existing types config, which now accepts both exact MIME types (image/png) and family wildcards (image/*).

Types — Export File, Audio, and Video (and their data/config/uploader types) and add the file/audio/video keys to defaultBlockTools from the @jackuait/blok/tools types entry. The runtime already exported these tools; consumers no longer need a local ambient type shim to import them.

Playground — Audio block states in the block-states gallery (real ID3-tagged track and a "No cover art" state) plus an e2e harness for insert/upload/play/seek.

Video — New native Video block with a custom Airbnb-style player, brought to YouTube parity: full keyboard control (j/l/k, 0–9, Home/End, frame-step, volume, speed), a scrubber with buffered range, hover frame-preview tooltip and mini progress bar, an in-player gear menu (Notion-style playback speed with glide, loop, ambient-glow intensity), and view modes — picture-in-picture, a FLIP-morphed theater/cinema mode, and a fade-in ambient glow. Player polish includes click-to-toggle play/pause, a centre play/pause burst, press-and-hold for 2× playback, arrow-key ±5s seek with side indicators, idle auto-hide, buffer spinner, time-remaining toggle, right-click menu, stats overlay and persisted preferences.

Video — Custom fullscreen surface with a top caption bar, a "Hide controls" tune for a control-free player, and GIF-style autoplay/loop tunes.

Image — Auto-convert dropped, pasted and remote-URL GIFs into a looping Video block via WebCodecs + webm-muxer, gated by the convertGifToVideo config (default on); the original GIF is kept on CORS failure, with a "Converting…" label shown during conversion.

Media — 30MB default upload limit with per-type maxSize configuration and human-readable too-large errors.

Paste — URL paste always prompts now; the previous auto-embed behaviour has been removed. Breaking: consumers relying on silent auto-embed must opt in through the paste menu.

Video — Reserve the aspect ratio before metadata loads to prevent squeeze-on-load, centre and letterbox the fullscreen player, strip editor chrome in fullscreen, and hide the bottom mini progress bar while fullscreen.

Video — Exit theater mode reliably on Escape via a capture-phase listener with a smooth deferred dismiss, and drive the scrubber fill with requestAnimationFrame for smooth playback tracking.

Build — Move webm-muxer to devDependencies so it is bundled rather than treated as an external runtime dependency.

README — Replace the logo with the optimized noodle mascot.

Playground — Use real self-hosted videos in the block-states gallery.

File — New File block tool. Tabbed empty state with upload (validation, progress bar, cancel), URL and drag-and-drop; per-type icon and tint; editable filename; consumer upload endpoints and download card. Rich preview modal dispatched by kind: PDF (top-layer modal with open-in-new-tab), Office (docx/xlsx/pptx via lazy renderers, xlsx parsed through JSZip), and text/code/markdown — including advanced markdown (math, footnotes, references, alerts, anchors, safe block-level raw HTML) with an animated Rendered ⇄ Raw toggle. Read-only support, i18n in every locale, and Storybook stories.

Embed — Generic embed: frame arbitrary URLs through a gated resolver, offered in the paste menu behind the linkPaste.allowGenericEmbed flag with an api.config accessor. Replace the source via an empty-state URL bar and an overlay more-menu item.

Migration — Complete Editor.js block-type coverage plus a drop-in UMD build; adapt legacy Editor.js inline tools and linkTool data.

Playground — Block-states selector as a fixed left side menu; real docx/xlsx/pptx, code and text samples for the File block; richer quarterly-budget sheet; File block wired into the editor demo.

Table — Resolve merged-cell coordinate bugs; preserve merges on load; split overlapped merges on paste so no destination data is dropped; keep empty cells editable on the read-only→edit toggle; harden input, clipboard and move-guard handling.

File — Unbreak pptx preview; vertically center the preview modal; stop wrong-colour strips and toggle flicker during preview transitions; block javascript: URLs in download hrefs.

Build — Make the published install self-contained (ship src, keep markdown and nanoid as runtime deps) so bundlephobia can build; green the self-contained-install and css-token audits.

Refactor — Extract table visual-subsystem orchestration into TableSubsystems; split BlockOperations into focused worker classes; share the media uploader empty state across the image and file tools.

Code — Cover every Prism token in both the light and dark themes.

Lint — Resolve all lint errors by root cause and mute advisory-only rules.

Docs — Refresh the README tool list and entry points; add a File block tool reference entry.

Link Paste — Pasting a URL now offers a Notion-style menu to keep it as a link, or convert it into a Bookmark card or rich Embed block. The pasted link shows immediately with the menu anchored at its end, and menu labels name the detected link type via provider metadata.

Embed — Worldwide embed registry covering ~115 services across video, audio, social, documents, design and developer domains, including Google published docs/forms and draw.io. Per-source minimum resize widths keep each provider's iframe legible, and fixed-width providers hug their content with figure, handles and toolbar.

Bookmark — Notion-parity bookmark card with a dev unfurl endpoint; crawler-UA retry recovers metadata from bot-blocked sites.

Playground — Smooth cross-fade theme switching via View Transitions, plus an Airbnb-style neutral redesign.

Embed — Preserve the live iframe across every editor action: caption and alignment toggles now apply in place instead of reloading the player. Selection highlight hugs the figure dimensions.

Drag & Drop — FLIP-animate the column drop moment and slim the vertical drop bar to read like the horizontal line.

Security — Harden URL-scheme filtering and neutralize XSS gaps in markdown paste, the inline link tool, and the paste/render pipeline.

Tools — Implement setReadOnly on embed, bookmark and column tools so read-only toggles in place without a full re-render.

Icons — Unify the icon set on the 20×20 / 1.25 house spec; refine heading family, quote, caption, pencil, cells, toggles, and numbered-list glyphs.

CI — Pin Node 24.14.1 to dodge a Playwright install hang; share Playwright setup to stop Storybook browser install hanging; repair 6 failing CI specs (5 stale expectations, 1 real drop-indicator regression).

Dependencies — Resolve all 52 open Dependabot alerts; bump brace-expansion, ws, smol-toml.

Tests — Embed/bookmark/link stories with screenshot baselines, wave-2 embed visual-regression baselines, verified real sample URLs replacing fixtures, refreshed main.css golden snapshot.

Docs & Playground — Embed, bookmark and link entries in tools data and the editor demo.

Columns — New side-by-side layout tool (#67). Create 2–5 column presets from the toolbox, or drag a block beside another to spawn a column. Drop anywhere left/right of a block to make a new column, or into a column body to stack inside it. Columns nest, auto-unwrap when emptied, and stack vertically on narrow viewports.

Columns — "Turn into columns" command wraps a multi-block selection into a column layout, available from the Convert-to menu.

Columns — Hover-revealed resize separators between columns: drag to resize, keyboard-resizable with ARIA slider semantics, double-click a divider to equalize widths.

Columns — Horizontal arrow keys traverse between sibling columns; new columns animate in Notion-style.

Inline Toolbar — Appears instantly on selection release, no animation delay.

Inline Toolbar — Removed entry animation that delayed appearance.

i18n — Column resize aria-labels and turn-into-columns strings across all locales.

CI — Repair unit tests, e2e merge, and mirror push on master; mirror push works for both branch and tag events.

Tests — Exhaustive block-in-column compatibility suite, live-drag lifecycle specs for every block type, multi-select block-settings header i18n regression.

Playground — Columns example in the editor demo and block-states gallery.

Image — New image block tool (#66): drag-drop/URL/file upload, captions, alt text via inline popover, resize handles with symmetric growth, edge-pinned aspect-ratio resize, crop editor (rect/circle/oval) in modal, fullscreen lightbox with wheel/pinch zoom, drag-to-pan, rubber-band, alignment popover (left/center/right), block settings entries (size/download/copy-url), three-dots overflow menu for narrow images, empty/uploading/error states with unified card design, light-theme crop editor, legacy editor.js shape migration

Code — Migrate from Shiki to Prism.js for syntax highlighting with lazy grammar loading and class-based applier; add auto-indent and bracket expansion on Enter; add Mermaid highlighting with One Dark/Light palette; gutter line-number click focuses the line

Fonts — Bundle @fontsource fonts via generator script; new fontFamilySans/Serif/Mono/Handwriting config fields with CSS variable injection; font-display: swap for body text

Popover — Render above all elements via CSS Top Layer; nested-submenu viewport clamping on both axes; close transition via ghost clone; tighter item sizing; end-of-list padding hidden on empty search; simpler animations

Toolbar — Hide plus and dots buttons while toolbox is open; place block settings popover left of the dots button

Toolbox — Nowrap pill with tighter radius and unified plus/slash search styling

Playground — Icon gallery lightbox; block states gallery tab; settings panel shortcuts; hide header on scroll; logotype image example

CSS Variables — Tokenize radii, spacing, icon sizes, border widths, z-index ladder, duration/easing, typography; extract direct rgba literals to palette tokens; migrate @apply arbitrary hex values; split actions-icon/divider vars; add audit test and visual regression baselines

Database — Match Notion card shadow and radius on kanban cards; showcase all 10 column color variants

Block Settings — Add shortcut keys to i18n with regression tests

Icons — Migrate inline SVGs to shared icon layer

Inline Toolbar — Tighten item padding and radius; suppress toolbar inside code blocks; apply symmetric top/bottom padding

Code — Pin caret color so it does not inherit Prism token colors; restore trailing <br> after highlight so Enter works once; refresh gutter/highlight after native paste; focus line end when clicking empty strip of short lines; scope inline-code styling to not leak into code block; support contenteditable="plaintext-only" and preserve view mode on undo; correct syntax highlighting offset calculation

Toolbar — Reposition + / ⋮⋮ live while hovered block resizes; disable pointer-events on every actions descendant for left-edge blocks; keep slash search in inserted block after plus button

Popover — Distinguish synthesized hover from real hover; hide context label while searching; keep block settings menu visible and attached to dots trigger

Block Manager — Skip cross-container auto-heal inside move group

Tooltip — Anchor wrapper with position: fixed to survive page scroll; render above popover and survive UA stylesheet

Fonts — Add error handling for font load failures

Styles — Split main.css into 11 concern-files

License — Add fork attribution and NOTICE file

Build — Replace shiki with prismjs

Tests — Fix 60+ unit + E2E failures across the suite; add Prism integration test for all highlightable languages

Chore — Untrack .vscode; remove stale root files; add favicon to dev playground; drop .editorconfig

Code block — New CodeTool with syntax highlighting (via Shiki), line numbers toggle, language selector popover, copy button, wrap toggle, and preview tab for KaTeX/Mermaid rendering

Inline code — New InlineCodeTool with CMD+E shortcut

Quote block — Notion-style quote block with size options submenu

Divider block — Horizontal rule block with --- markdown shortcut

Callout block — Callout block with emoji picker and skin tone persistence

Toggle list — Collapsible toggle list block with drag & drop support inside toggles ([#46](https://github.com/JackUait/blok/pull/46), [#52](https://github.com/JackUait/blok/pull/52))

Toggle headings — Toggle heading blocks with markdown shortcuts (>#, >##, >###) and body placeholder

Marker inline tool — Color text/background inline tool with color picker and dark mode support

Underline & Strikethrough — New inline tools with CMD+U and CMD+SHIFT+S shortcuts

Table enhancements — Cell color picker, cell placement picker, HTML <table> rendering, corner drag, Tab/Arrow escape from cells, and cross-table block protection ([#38](https://github.com/JackUait/blok/pull/38), [#45](https://github.com/JackUait/blok/pull/45), [#63](https://github.com/JackUait/blok/pull/63))

Markdown import — importMarkdown() API method and paste handler with GFM support including math (KaTeX) extensions

React adapter — useBlok hook and BlokContent component for React integration

Read-only toggle — Seamless in-place readonly mode toggle with scroll position preservation

Editor width API — editor.width namespace with WidthManager module and config.width options

Content alignment — config.style.contentAlign option for global block content alignment

Font family config — config.style.fontFamily option for editor and popover typography

Theme API — ThemeAPI module for programmatic dark/light theme control

Fuzzy toolbox search — Ranked fuzzy search in slash menu with animated filtering

Toolbox plus button — Opens blocks menu directly without inserting /

Link suggestion chip — URL type detection chip in inline toolbar

Google Docs paste — Expand <details> tags into toggle blocks with parent-child wiring

blok-cli package — New @jackuait/blok-cli package with convert (HTML→JSON) and convert-gdocs commands

i18n search terms — Multilingual toolbox search via searchTermKeys across all 68 locales

Drag & drop — Toggle hierarchy, ghost preview, subtree depth preservation, and spring-load auto-expand for closed toggles

Toolbar — Drag handle reachability, left-edge overflow, and actions not intercepting toggle arrow clicks

Inline toolbar — Cross-block selection positioning, background element cleanup on close

Table — Cross-table block stealing, undo/redo focus, cell selection border persistence, and arrow key navigation between blocks

Marker — Partial selection color removal, dark theme palette, and active color display on toolbar button

Toggle — Backspace/Delete boundary crossing, undo atomicity for Enter, children DOM nesting, and collapse in read-only mode

List — Tab indent for multi-selected items, depth reduction cascade on outdent, and bullet marker pinning

Paste — Table cell content appearing outside table, marker formatting preservation, and math formula detection

CRDT-based undo/redo — The undo/redo system now uses Conflict-Free Replicated Data Type principles for better conflict resolution and history tracking

toolbar hover behavior after cross-block selection — The inline toolbar now resets its positioning state when extending selections across multiple blocks

PatternPasteEvent for internal cut/paste — Internal cut and paste operations now emit PatternPasteEvent, so external code can react to all clipboard actions