v1.11.0

Features

• @bloklabs/presets — Ready-made uploaders, so config.uploader is no longer something every project writes.
  • supabaseStorage, presignedStorage, cloudinaryStorage, fetchStorage and indexedDBStorage.
  • Zero runtime dependencies: a vendor client is passed in, never imported, so your own auth session applies.
  • BlokUploader, UploadContext and UploadedAsset are now exported from @bloklabs/core.
• @bloklabs/server — A sidecar handling file uploads and link previews, so you write no backend for either.
  • POST /upload, POST /upload-by-url and GET /unfurl, run through npx or the container image.
  • Uploaded bytes land in a local directory or any S3-compatible bucket.
  • Access modes none, proxy and ticket are enforced by startup interlocks rather than warnings.
• Cross-block text selection — Dragging across blocks selects the characters under the pointer, not whole blocks.
  • Copy, cut, typing, Enter, paste and the mark engine all split the range per editing host.
  • It works in Firefox, which Notion's own implementation does not.
  • Escape promotes the text selection to a selection of the same blocks.
• Block controls on either side — config.toolbarPosition: 'left' | 'right' moves the plus button and drag handle.
  • It is live through toolbar.setPosition(), and the reserved gutter width moves with it.
  • Logical tokens throughout, so RTL mirrors for free.
  • Before this, the only lever was hiding the controls entirely with hideToolbar.
• Dev override seam — Every @bloklabs/core entry consults globalThis.__BLOK_DEV_OVERRIDE__ before its bundled implementation.
  • It is a passive, in-realm read: nothing is fetched, evaluated or resolved from a URL.
  • The editor root carries data-blok-version, so what is running is inspectable.
  • To drop the branch from your bundle, alias the newly exported ./dist/* subpath.

Bug Fixes

• onChange fired late, or not at all — Sustained typing produced zero calls until the user paused.
  • Every mutation restarted the 400 ms window, which now opens on the first change and never extends.
  • onChange leads the window on the next microtask, and the rest coalesces into one trailing call.
  • onSave keeps the trailing edge only, since serializing the document is too expensive to front-run.
• Selection beside a nested block — A lasso drawn beside a nested table selected the whole toggle section.
  • Selection now resolves which block owns a row through the same rule the toolbar uses.
  • A fast drag no longer drops every row above the first throttled mousemove.
  • One keystroke inside a nested block no longer runs the pipeline once per ancestor.
• Empty-block placeholders displaced the caret — An empty paragraph painted its caret 315 px to the right.
  • A placeholder in normal flow consumes real inline advance at the start of the line box.
  • Placeholders now paint their text while claiming zero advance.
  • Media captions stay in normal flow, since a zero-width box would spill a centred caption sideways.
• A bookmark that could not be previewed — It showed an error after the paste, and an ordinary card after a reload.
  • The error state never reached saved data.
  • A failed preview now degrades to a plain link on both paths.
  • Roughly 30% of sites publish no preview data, so this is the ordinary case rather than a fault.
• Audio player card — Descenders in the title and artist lines were sliced flat.
  • text-overflow: ellipsis forces overflow: hidden, which clips at the padding box.
  • At a line height of exactly 1, that box is shorter than the font's content area.
  • Both lines now use the line-height token the file-name row already carries.

Maintenance

• Release and CI wiring — Nothing here iterates workspaces, so a package missing from a list drops out silently.
  • Both new packages are registered across all seven lists, from version lockstep to the publish gate.
  • The server's binaries and image ship from a tag-triggered workflow, not from a maintainer's laptop.
  • A compiler-API law fingerprints every type @bloklabs/presets hand-copies into its declaration.
• Docs — New /presets and /server pages, linked from the navigation and localized in both languages.
  • /server leads with the path that runs no service at all, and states its limits on the page.
  • A new page documents the dev override seam, its threat model and its opt-out.
  • SECURITY.md commits to acknowledging a report within five business days.