v1.6.0

Features

• Font size — config.style.fontSize now carries one entry per text scenario in every text-bearing block (paragraph, headings, quote, callout, code, toggle, list, checklist, table cells, captions, bookmark cards). Each entry writes that block's --blok-*-font-size custom property, so the same knob is reachable through style.tokens, editor.tokens.set() and plain CSS. An unconfigured editor renders byte-identically to before.
• API — beginTransaction/endTransaction group operations spanning a pointer gesture into a single undo entry, for cases where the synchronous transact(fn) cannot reach across async boundaries.
• Table corner drag — The bottom-right corner now behaves the way Notion documents it: the grid tracks the pointer through live geometry instead of a unit frozen at pointerdown, a Notion-style grip replaces the old 8px dot, hovering it explains the gesture, appended columns are full width, and the whole gesture commits as one undo entry.
• Table auto-scroll — Holding the corner at the scroll container's edge or in the viewport's top/bottom band scrolls and grows the table as it goes. Growth follows the pointer — 8px/s for every pixel held past the edge — rather than a fixed clock.
• Table selection — Dragging a row or column grip paints the entire dragged range instead of boxing only the focused cell.
• Playground — A text-size slider (80%–150%) scales every style.fontSize scenario from its own CSS default.

Bug Fixes

• Table — An inward corner drag stops at the first trailing row or column that holds content instead of deleting typed cells; the handle is anchored to the grid rather than the wrapper, so it no longer drifts inside the table as it grows; a caret click no longer leaves the corner handle and "+" buttons dead until the user clicks outside; clicking inside a merged cell boxes only that cell, and expanding a selection reaches merge origins, not just spans; a stale pointercancel listener no longer accumulates per completed drag.
• Styles — Callout emoji and list markers stay aligned with their text as the font size scales, and the bookmark card's padding, line boxes, gaps and favicon scale with the card's own type. fontSize.callout now wins over fontSize.paragraph in the callout body.
• Types — The public Blok class exposes its full API surface.

Features

• View renderer — @bloklabs/core/view now reaches visual parity with the read-only editor: every core block (paragraph, header, quote, list, checklist, code, callout, toggle, divider, spacer) renders from single-sourced class modules shared with the editor, view.css is generated from those modules, and a soft isolation root plus reproduced block scaffolding keep the output pixel-equal. A class-parity gate and a view↔read-only visual parity gate now run in CI, and the playground gains a side-by-side Blok View comparison panel.
• Paste — Google Docs layout tables are now recognized: multi-row two-column tables carrying photos convert into column blocks, and single-column layout tables unwrap into their content instead of arriving as one-cell tables.
• Inline toolbar — The convert menu now opens sideways with its trigger marked selected, and the convert row is styled as the card's header.
• Callout — A newly picked emoji jumps into the old one's place, and the emoji picker opens instantly without waiting on its dataset to download.
• Tools — data-blok-tool is now stamped on code, callout, divider and spacer roots.
• Docs — The docs site advertises its markdown mirrors and declares Content-Signal; the published @bloklabs/core/icons subpath is documented; the README is restructured around benefits, facts and a runnable example.

Bug Fixes

• Security — Stored javascript: XSS closed on two sinks: media download hrefs are scheme-gated, and stored embed renders are gated on the provider registry rather than a bare https: check.
• Drag & Drop — Drops on the seam between two blocks now resolve instead of dead-ending; the drop indicator no longer promises a nesting the drop would refuse; side-drops are gated on the columns tool actually being registered.
• Columns — The drop animation no longer balloons the row while a block lands.
• Code — In read-only mode the language label renders as plain text and the language dropdown toggle is hidden; the copy button keeps the same height in its "Copied!" state.
• Toolbar — Multiple editors on one page now show one set of block controls instead of stacking duplicates; the slash-search caret is sized to the input, not the block.
• Tooltip — A bubble is never parked in the viewport corner when its anchor stops rendering.
• List — The checklist checkbox is centred on its text at any font size.
• Embed — Provider popups (e.g. "open in app") can escape the iframe sandbox again.
• Audio — Cover art uploads are routed to the image pipeline instead of the audio endpoint.
• Shortcuts — BACKSLASH/SLASH render as \ and / in shortcut hints.
• Dependencies — All 40 open Dependabot alerts remediated at their root causes.