# Changelog ## 0.6.0 ### Fixed - **Undo now works, in every mode.** Leaf had no history of its own and delegated to the browser's, which could not survive how the editor works. The button in markdown mode was a literal no-op (`case "undo": break;`) while Ctrl+Z still worked there, so the two disagreed. In visual and hybrid mode `document.execCommand("undo")` only ever saw edits execCommand itself made — never Leaf's own DOM work — and the native stack was discarded outright by every wholesale `innerHTML` write: markdown→visual sync, mode switches, `set_content`, and select-all-then-delete during ordinary typing. That last one was the most visible: select all, delete, Ctrl+Z, and nothing came back. - **Undo survives a mode switch.** The markdown textarea and the visual contenteditable kept separate native stacks, so undo silently meant different things per tab and could never step across a switch. - **Undo and redo buttons reflect availability.** They were always clickable, including with nothing to undo. - **The undo button no longer stays greyed out while Ctrl+Z works.** The visual editor's history listener referenced a `self` its enclosing scope never bound, so every keystroke threw inside the event handler and nothing was captured. Ctrl+Z still appeared to work — the undo path captures for itself before restoring — so a single undo jumped all the way back to the state at mount rather than stepping. - **Enter on an empty bullet only leaves the list at the end of one.** With further items below, that gesture used to delete the blank item and cut the list in two around it. Mid-list it now continues the list — the blank item stays and a fresh one opens under it — because leaving is not a sensible reading of Enter when there is still list below the cursor. At the end of a list, where exiting is the only thing it can reasonably mean, the behaviour is unchanged. - **Ordered lists no longer renumber themselves from 1.** A list can start at 19 — continuing one interrupted by a paragraph, or numbering steps on from an earlier section — and CommonMark preserves that as `
    `. The serializer counted from 1 regardless, so every trip out to markdown silently rewrote the numbering; switching modes was where it showed. The start is now read from the list, hybrid reveals the number an item actually displays rather than its position, and typing a number on the FIRST item renumbers the list. Later items are left alone: their numbers carry no meaning in markdown, and renumbering from one of them would move everything above it. - **A blank row survives at the end of a list that another list follows.** Editing produces adjacent lists more readily than it looks: deleting an item's `- ` marker breaks that item out to a paragraph and moves everything below it into a second list, and deleting the paragraph closes the two up against each other. They render as one continuous list, but a blank row at the end of the first had no next item, so it was tidied away while bullets were plainly visible underneath. A directly adjacent list now counts as a continuation; anything else between them still means the list ended. - **Deleting an empty row no longer leaves the editor tracking a removed block.** The Backspace merge detached the item without clearing `_sourceBlock`, so the editor went on believing it was editing a node that had left the document — which is why list handling misbehaved specifically after deleting a row. - **An empty bullet is visible after a page load.** The normaliser that gives an empty item a caret home was wired into the three paths that assign content after mount, and not into mount itself — so content LiveView rendered into the page arrived as bare `
  1. `: no height, nothing to click. After a reload a deliberately blank row was invisible, and a click aimed at it landed in a neighbouring item. - **Enter on an empty bullet mid-list keeps it and opens another.** Hybrid mode has its own Enter handler for source-mode blocks, which exited the list whenever the item held nothing but its `- ` marker — wherever that item sat. It now exits only as the last item of a list, matching the blur rule below. The keyboard escape from a list is unchanged where it is the only sensible reading. - **An empty bullet in the middle of a list survives the caret leaving it.** In hybrid mode, leaving a block re-renders it from its markdown source, and that path deleted an empty list item outright — reasonable for a trailing bullet somebody abandoned, wrong for a blank row deliberately left inside a list, which vanished the moment the caret moved away. The tidy-up now applies only at the end of a list, matching the Enter rule. - **A bullet made by pressing Enter at the end of a line is no longer invisible from birth.** The new item's emptiness was decided by `firstChild`, but `Range.extractContents()` hands back a fragment holding an empty text node when the caret sat at the end of a line — so the item had a child, reported itself occupied, skipped the placeholder that gives it height, and rendered as nothing. Emptiness is now measured by text. This was the actual cause of bullets appearing to clear themselves; the sync-path fix below was real but addressed a later symptom of the same missing placeholder. - **A deliberately empty list item no longer disappears.** An `
  2. ` with no content renders at zero height and gives the caret nowhere to sit, and the marker hides with it — so leaving a bullet blank and clicking away looked like the bullet had been deleted. It never was: the Enter-split path drops a zero-width placeholder into a new item for exactly this reason, but that placeholder is a client-side artifact stripped on the way out to markdown, so an item coming back from the server arrived bare. Every path that assigns content wholesale now normalises empty items the same way. ### Added - **Live editing.** Several people in one document at once, opt in with `collaboration={%{operations: true, awareness: true}}`. The editor sends what changed rather than only what the document now is, applies somebody else's edit without moving the local caret, and shows everyone else's caret and selection in their own colour under the name the host gives them. `Leaf.Collab.join/2` is the whole integration on the host side — it attaches a `handle_info` hook, so a page writes no message handling of its own: ```elixir def mount(%{"id" => id}, _session, socket) do {:ok, Leaf.Collab.join(socket, room: MyApp.Notes.room_name(id), editor_id: "note-editor", identity: %{name: socket.assigns.current_user.name} )} end ``` Edits that cross on the wire are rebased against each other, so two people typing in different places both land where they meant to and the order they arrive in does not change what anybody ends up reading. An edit that cannot be placed is refused rather than applied at an offset that means something else, and that session is put back in step from its own next snapshot — losing nothing it had typed. A session whose socket drops keeps working and is reconciled when it comes back: whichever side is behind adopts the other, decided by version rather than guessed, and the editor is replaced without dropping the writer's caret. Not a CRDT. Two people changing the same characters at the same instant converge on the same text, but somebody's keystroke loses. - **Persistence, as a callback.** `Leaf.Collab.Store` says where a document lives, with `save/2` on every change for a store cheap enough to write to constantly and `flush/2` when the writing pauses, at a bounded interval while it continues, and once more on the way down. `Leaf.Collab.Store.File` ships for a vault of markdown files: with nobody editing, the `.md` file is the document. It records the hash it read and checks it before writing, so a note edited outside the session is answered with a conflict rather than overwritten. `Leaf.Collab.Store.None` is the default and keeps nothing. A store that raises does not take the room with it. It is somebody else's code talking to somebody else's disk, and the document is still in memory with people editing it. - **`Leaf.Collab.Log`**, opt in with `debug: true`. A running account of what every session believes it is holding. Two sessions can hold the same document and still disagree about how many characters are in it — which is what misplaces a caret, and is invisible from either side alone. It notices that, asks both for the text they are counting, and names the character they stop agreeing on. Off by default: it fingerprints the whole document on every keystroke. - **Obsidian-style `[[wiki-links]]`.** Opt in with `wiki_links={%{resolve: true}}` and `[[Target]]`, `[[Target|Alias]]` and `[[Target#Heading]]` render as link tokens in the visual and hybrid surfaces while the markdown stays exactly as written. Only the host knows which notes exist, so Leaf asks: {:leaf_resolve_links, %{editor_id: id, targets: [...], seq: n}} send_update(Leaf, id: id, action: :link_targets, seq: n, targets: %{...}) Unresolved targets are styled distinctly, as Obsidian mutes them. Clicking one emits `{:leaf_link_clicked, %{editor_id, target, heading, href}}` — Leaf never navigates, because where a target lives is the host's question, and it may want a modal or a "create this note" flow. Ctrl/Cmd-click follows while editing, a plain click follows in a read-only surface. Decorating and resolving are independent: `%{resolve: false}` renders the links without ever asking the host to answer, for a viewer or a host whose targets are known to exist. `%{follow: :click}` lets a bare click follow while editing, where the default keeps it for the caret. Leaf ships no wording for an unresolved target — a label like "Not found" is the host's to write, in the host's language, and rides along in the resolution reply. Off unless configured, so a document using `[[…]]` for something else is untouched. - **Typing a bracket or quote with text selected wraps it.** Select `hello`, press `(`, get `(hello)` with `hello` still selected so the wrap can be stacked. Handles `(`, `[`, `{`, `"`, `'`, `` ` ``, `*` and `_`, in every mode — the last two wrap into markdown emphasis, and stacking `*` twice gives bold. Only openers: a closing character stays typeable, and pressing one after a wrap does not nest again. The characters are inserted AROUND the selection rather than replacing its text, so formatting inside it survives. ### Changed - **`phoenix_pubsub` is now a declared dependency.** Leaf calls it directly for live editing. It arrived transitively through `phoenix_live_view` before, which was luck rather than a contract. - **Toolbar actions no longer die on an empty row.** Measuring the caret recursed without end whenever it sat ON an element rather than in text — which is every empty block. The resulting "too much recursion" was thrown by the history capture that runs before each toolbar action, so the action never ran: on an empty row the buttons did nothing, while the same click on a row with text worked, because a caret in text returned before reaching that branch. - **The Task List toolbar button works without selecting text first.** It appeared to do nothing on an empty line. The item WAS created — and then removed the instant the caret left it, by the tidy-up that clears an abandoned trailing bullet. An empty checkbox is not residue: it renders as a tickable box and is exactly what the button is for, so task items are now exempt from that tidy-up. Converting an empty line also leaves the item with somewhere to type, which it previously did not. Enter continues the checklist and, on an empty item, finishes it — as with bullets. - **A completed task item is struck through, not just faded.** Checking one off now reads as done at a glance, the way Obsidian renders it. The line is drawn by the item and skips the checkbox — CSS does not propagate text-decoration into atomic inline-level boxes, and the box is `display: inline-block` — so the tick stays readable. It is suppressed while the item is being edited in hybrid mode, where the block under the cursor shows its markdown source and a line through `- [x] label` would only get in the way. ### Added - DOM-level tests for the editor (`test/js/*_dom.test.cjs`), driving keydown handlers, `Range` splitting and `htmlToMarkdown` against jsdom. jsdom is a test-only dependency and is not required to use leaf; without it those tests skip rather than fail. Added because several list and undo defects in this release shipped past a green stubbed suite — a stub cannot tell "has a child node" from "has text", and cannot run a keydown handler at all. - Leaf owns an undo stack: snapshots of the active surface plus caret, one array with a cursor so redo falls out of the same structure. Typing is coalesced on a 350 ms debounce so one undo removes a word rather than a character, and structural actions snapshot immediately so they are always a single step. `Ctrl/Cmd+Z`, `Ctrl/Cmd+Shift+Z` and `Ctrl+Y` are handled on every surface. The stack is capped at 200 entries; `set_content` starts a new one, since a replaced document's history is not reachable from it. ## 0.5.1 > `0.5.0` was tagged but never published to Hex — its atomic-block preview > still read as an attribute dump. Everything below is the whole release. ### Upgrading - **Re-copy the JS bundle.** Almost everything below is a server↔client contract. A vendored copy of `priv/static/assets/leaf.js`, or a CDN pin, must move with the dependency — pin `@v0.5.1`. A bundle left behind is otherwise silent: the editor renders identically and just stops implementing things the server now expects (no `{:leaf_flushed, …}` reply, no dirty re-baseline, atomic blocks with no styling for their preview). Leaf now warns in the console when the two disagree. - **The fallback for a denied mode changed** from a hardcoded `:visual` to the first allowed mode. Only reachable when `mode:` names a mode the same editor denies. - **Hosts that persist the `html` from `{:leaf_changed, …}`** (rather than the markdown) and configure a `#` suggestion trigger will see `` in that HTML. The markdown is unchanged. ### Added - **Atomic preserved blocks read as a preview, not as source.** A `preserve_tags` block used to render as an opaque `⧉ Hero` chip, hiding the text, links and images the tag wrapped — most of the reason to look at a document at all. Known attribute names are now mapped to typographic roles and typeset in the editor's own prose voice: `title`/`heading`/`headline` as a title, `subtitle`/`tagline`/`description`/`alt` as supporting text, `kicker`/`eyebrow`/`category` as an eyebrow, `image`/`cover`/`poster` (or an image-shaped `src`) as a banner, and `label` + `href` as a call-to-action with its destination. Children render as formatted text, so bold and links inside `
    …
    ` are visible. Attributes with no role fall through to a small, faint source line — for those there is nothing better to say. A tag with nothing to show collapses to its nameplate instead of opening an empty box. The scale stays close to prose deliberately: this is a placeholder that reads like a document, not an imitation of the published component. Leaf has never seen the host's ``, and a document with four of them still has to be readable. The serialized form is unchanged — `data-leaf-raw` still carries the verbatim source, so the round trip stays byte-for-byte identical. - **Editing an atomic block in place.** Double-click one to open a raw source editor for just that block; ⌘/Ctrl+Enter or Save commits, Escape cancels. Previously the only way to change a `` was to switch to markdown mode and hunt for it by hand, which made the visual surfaces useless for component-heavy documents. - **A flush you can await.** `send_update(Leaf, action: :flush, ref: "…")` now answers with `{:leaf_flushed, %{editor_id, ref, markdown, html}}` after the matching `{:leaf_changed, …}`. A bare flush produced a reply indistinguishable from the debounce firing, so save-before-navigate (version switch, language switch, translation enqueue) had nothing to wait for. Omitting `ref` sends no `{:leaf_flushed, …}` at all, so existing hosts are untouched. - **`deny: [:visual_mode]` / `[:hybrid_mode]`.** The other two modes were already deniable; these complete the set. A denied mode loses its tab in every switcher and its `:set_mode` command is ignored, so the deny list is one rule rather than a default a stray click can talk its way past. Denying every mode raises; when only one survives, the switcher is hidden rather than rendered as a single dead tab. - **A warning for undeclared custom tags.** Content holding `` tags that are not in `preserve_tags` now logs a one-off `Logger.warning` naming them and showing the declaration to paste. The visual surfaces flatten undeclared tags into loose paragraphs and autosave writes that back over the original — this turns silent, irreversible content loss into a one-line diagnosis. Silence with `config :leaf, warn_unpreserved_tags: false`. - **Bundle-presence and staleness checks.** Leaf does not bundle its JS into the host, and an editor whose hook never attached is indistinguishable from a working one at a glance. A small inline script now logs a console error naming the likely causes when the hook has not attached shortly after paint, and `window.LeafHooks.version` (plus `Leaf.js_version/0`) catches a vendored or CDN-pinned copy that stayed behind. `bundle_check={false}` turns the inline script off for hosts under a CSP that allows neither it nor a `script_nonce`. - **`priv/gettext/leaf.pot`.** `gettext_backend` worked, but Leaf shipped no catalogs and a host's `mix gettext.extract` cannot see msgids living in a dependency's source — so it was wired but untranslatable in practice. Copy the template in and `mix gettext.merge`. Lookups try the `"leaf"` domain first and fall back to `"default"`. `mix leaf.gettext.extract` regenerates it; a test fails when it drifts. - **Hashtag styling.** Configuring a `#` suggestion trigger also tells Leaf that `#` means "tag" here, so hashtags render as tinted, slightly-italic tokens in the visual and hybrid surfaces instead of reading as ordinary prose. Purely a decoration — the markdown stays `#tag`. An editor with no `#` trigger is left alone, so a document using `#` for issue numbers is unaffected. - **`boundary: :not_line_start`.** For `#`, where the first column is already spoken for: `# ` opens a heading and `#tag` mid-line opens the popup, with no keystroke where both are live. - **`toolbar_extra` buttons can refuse to collapse.** `collapse: false` pins a button to the main toolbar row instead of letting it fold into the "More" menu, which at a two-column editor layout was essentially always. `toolbar_extra` is the only way a host adds a primary action, and buried under "More" those are barely more discoverable than typing the tag by hand — the problem they existed to solve. ### Changed - **`set_content` re-baselines the dirty snapshot.** Replacing content programmatically — loading a different version, a collaborative sync, a reload — is not a user edit, but the old baseline stayed put, so with `protect_navigation` the writer got a prompt accusing them of unsaved work they never did. Pass `mark_saved: false` for the rare case where the new content really is a draft. - **A denied mode falls back to the first allowed one** (`:hybrid`, `:visual`, `:markdown`, `:html` order) rather than to a hardcoded `:visual`, which stopped being a safe default once `:visual` itself became deniable. - **`toolbar_extra`'s `:icon` is documented as trusted markup.** It goes through `raw/1` so an inline `` works, which means a host passing anything user-influenced there has an XSS. Use `:glyph` for a built-in icon when custom artwork isn't needed. ### Fixed - **The compact and mobile mode switchers ignored the deny list.** Both rendered the markdown and HTML tabs unconditionally, so denying a mode only hid its inline tab — a narrow viewport was a way straight back into it. - **Escape from the image alt-text popover left the caret nowhere.** Opening the popover moves focus into its alt-text input; dismissing it did not hand focus back, so keystrokes went to a detached input and typing appeared to do nothing. Focus now returns to the editing surface with the caret placed after the image. - **A chip thumbnail that fails to load removes itself** rather than leaving a broken-image icon in the document — the thumbnail is a guess from an attribute name, and a wrong guess should cost nothing. ## 0.4.1 ### Fixed - **Toolbar icons that didn't match their tool.** Task List used a chevron-left-plus-bar (an outdent glyph, nothing to do with checkboxes); Remove Formatting used a bare ✕, which reads as "close this" rather than "strip the styling"; Code Block was near-identical to Inline Code at 14px; Details/Accordion used the same bare chevron as the image-options dropdown; and Blockquote used a `bars-3` that was hard to tell apart from the list and indent glyphs. Spoiler moved from a filled bar to an eye-slash. - **Dropdown menus could run off the screen.** They were plain `position: absolute` with no clamping, so near a right edge or the bottom of the viewport they overflowed — worst on a phone, where the tools menu is twenty rows tall. Menus now clamp horizontally and flip above their trigger when there's more room there, capping their height so they scroll instead of overflowing. - **The mobile menus had no way to dismiss them.** Both are `
    ` elements and stayed open until the summary was tapped again, leaving a full-height menu covering the text. They now close on Escape, on an outside tap, and when an item is picked. ### Changed - **Every dropdown row has an icon, and they line up.** The desktop "More formatting" menu had icons on 7 of its 25 rows and the mobile tools menu had none at all, so labels started at a different x on almost every row — most visible exactly when the responsive toolbar pushed the most items into the menu. All rows now render through a shared icon component with a fixed-width slot, so a row whose glyph is text (X², Ω, H) or absent still aligns with the rest. - **Menus size to their content** (`min-w-max`) instead of the fixed `w-28`/`w-36`/`w-40`/`w-44` that truncated longer labels such as "Details / Accordion" once they gained a leading icon. Width is clamped to the viewport on small screens. - **Larger touch targets on coarse pointers.** Menu rows and mobile toolbar buttons go to 44px under `@media (pointer: coarse)`; desktop keeps its compact rows. ## 0.4.0 ### Added - **Inline suggestions (`suggestions` assign).** The editor can offer a popup as the writer types a trigger character — `#` for tags, `@` for people, `/` for components, `:` for emoji. It knows nothing about any of those: it detects a configured trigger, asks the host what matches via `{:leaf_suggest, %{editor_id, trigger, query, seq}}`, and the host replies with `send_update(Leaf, action: :suggestions, ...)`. Works in all four modes. Per-trigger config covers `:boundary`, `:token`, `:first_char`, `:min_chars`, `:max_length`, `:debounce`, `:max_results`, `:allow_create`, `:keep_trigger`, `:insert_suffix`, `:label` and `:exclude`; several triggers can run in one editor, nearest-to-caret wins. Omitting `suggestions` adds no markup, no listeners and no event registration. Stale replies are dropped by matching trigger + query + seq, because keystrokes routinely outrun a round trip. Typing is never blocked: a host that never answers gets a short spinner and then the popup closes on its own. The popup is portaled to `
    `, anchored to the caret (hidden mirror for the textareas, `Range` rects for the contenteditable), flips above when there is no room below, and never fires mid-IME-composition. ↑/↓ wrap, Enter and Tab accept, Escape dismisses; while it is open Enter neither inserts a newline, nor continues a list, nor submits the surrounding form. Full ARIA combobox wiring with a polite live region, applied only while the popup is open. By default it stays shut inside fenced and inline code, inside a markdown link destination, and after a non-space character. ### Fixed - **Toolbar and programmatic edits no longer destroy the browser's undo stack.** The markdown-mode helpers assigned `textarea.value` directly, which clears undo history wholesale — after any toolbar action, Ctrl/Cmd+Z restored neither the action nor the typing that preceded it. They now go through `document.execCommand("insertText")` over a selected range, with the old assignment plus a synthetic `input` event as a fallback. Type, apply a toolbar action, undo: the action is reverted and the typed text survives. - **`#hashtag` at the start of a line is no longer eaten by heading detection.** The hybrid engine treated the space after `#` as optional, so `#elixir` previewed as `

    elixir

    ` while the server stored a plain paragraph — and leaving the block serialized it back out as a real `# elixir` heading, silently destroying the tag. ### Changed - **Heading formatting now appears only once the space is typed.** `# Notes` is a heading; `#`, `##` and `#notes` are paragraphs. Previously a bare hash run retagged the block immediately, which made every hashtag flash into h1 styling on its first keystroke and back out on the second. One consequence: a line holding nothing but hashes previews as a paragraph while MDEx still renders it as an (empty, invisible) heading. ## 0.3.2 ### Fixed - **Hybrid mode: Shift+Enter soft line breaks survive source mode.** Clicking into a formatted run inside a multi-line paragraph flattened it to one long line: the source view rendered "\n" as collapsing whitespace, Earmark's pretty-print text node after each `
    ` doubled the break into a paragraph-splitting "\n\n", and exiting source mode left "\n" as collapsed text instead of restoring `
    `s — so the breaks were gone and new Shift+Enters showed up as "just a space". Source blocks now render `white-space: pre-wrap`, the block serializer skips the post-`
    ` pretty-print newline, and source→rendered conversion turns "\n" back into real `
    ` elements. Breaks survive enter/exit round-trips and new Shift+Enter breaks work inside source mode. - **Hybrid mode: drag-selecting across formatted text no longer resets the selection.** When a selection endpoint entered a `**bold**` / `*italic*` / other formatted run, the source-mode markers popped in, and the DOM mutation collapsed the selection mid-drag. Source-mode transitions and delimiter decorations are now frozen while a non-collapsed selection is active — markers reveal only for a caret — so selecting, and applying toolbar formatting to the selection, work across any mix of formatted runs. ## 0.3.1 ### Fixed - **List indent no longer loses items.** Indent/outdent on a list item now builds valid `li > ol/ul` nesting instead of Chrome's `execCommand` structures (nested list as a sibling of the `li`, or a bare `

    ` inside the list) — and the markdown serializer handles all three shapes, emitting properly indented nested-list markdown instead of silently dropping the nested item. - **Hybrid mode no longer emits corrupted markdown while the caret is inside a formatted run.** Serialization respects source-mode marker spans on bold/italic/strike/inline-code/spoiler wrappers (previously only links), so `{:leaf_changed}` payloads no longer double delimiters (`****bold****`, `~~~~str~~~~`, `||||spoil||||`) or duplicate list markers (`2. 2.`) when an autosave fires mid-edit. - **Superscript/subscript survive saves.** ``/`` serialize to inline HTML in the markdown instead of being dropped. - **Details/Accordion inserts correctly.** The `

    ` is created inside the `
    ` element (previously Chrome's `insertHTML` stranded the "Summary" text in the adjacent paragraph and the block serialized without its summary). - **Block inserts no longer split the current paragraph mid-word.** Task List converts the current line (matching the bullet/numbered list buttons); Callout and Details insert after the current block. Code Block with the caret in a list item converts the whole item — no more orphaned task checkbox. - **Select-all + Delete fully clears the editor.** Previously empty shells of preserved custom-tag elements survived the deletion and polluted later edits. - **`window.prompt` is gone.** Link insert/edit (visual, markdown, and selection toolbar), image URL edit, and code-block language now use a small inline dialog instead of the page-blocking native prompt. Link selections survive the dialog's focus steal, including across hybrid source-mode re-renders. - **Emoji/symbol inserts can no longer replace unrelated content.** The saved selection is only captured when it lives inside the editor and is validated before restoring; a stale range falls back to a caret at the end instead of overwriting whatever the range used to cover. - The floating code-block CODE/Copy bar rebuilds itself if a LiveView DOM patch wipes its buttons. - **Drag-reorder indicator no longer suggests no-op drops.** Dragging a block slightly up or down used to move the drop line to the slot directly adjacent to the block — a drop there changes nothing. Adjacent slots now keep the line parked on the block's current position; it only jumps once the pointer crosses another block's midline (a drop that actually moves the block). ## 0.3.0 ### Added - **Deny-list controls — `:deny` attr (#1):** opt out of specific editor capabilities by passing a list of atoms: `:links`, `:images`, `:video`, `:markdown_mode`, `:html_mode`. Denied controls are hidden from every toolbar (advanced / simple / compact-overflow), the Ctrl/Cmd+K link shortcut is blocked, and a denied mode falls back to `:visual`. Denied content is stripped at both layers: server-side before every `{:leaf_changed}` payload and on the `:set_content` action (the security boundary), and client-side as paste-time DOM cleanup (UX). The regex/DOM sanitization is a UX-level guard, not a substitute for an allowlist HTML sanitizer at your persistence boundary. Thanks to @zoten. ### Changed - **Markdown parser swapped from Earmark to MDEx (comrak).** `markdown_to_html/1,2` now renders via `MDEx.to_html/2`. Callout, task-list, custom-tag preservation, and link/image round-trips are unchanged. Consumers gain a precompiled Rust NIF dependency (`mdex` → `mdex_native` via `rustler_precompiled`); no application code changes are required. ### Fixed - `<.live_component module={Leaf}>` invocations no longer crash with `KeyError: key :class not found` when the caller omits `class=` (see 0.2.24 below for the full account). Rolled into this release. ## 0.2.24 ### Fixed - `<.live_component module={Leaf}>` invocations no longer crash with `KeyError: key :class not found` when the caller omits `class=`. 0.2.23 added the `:class` attr and referenced `@class` in `render/1`, but the matching `mount/1` `assign_new` was missed, so the default only worked for function-component callers (`<.leaf_editor ... />`). Hosts that forward assigns through `live_component/1` (e.g. wrapping Leaf in their own LiveComponent) crashed on first render. Adding the seed in `mount/1` restores the documented default for both invocation forms. ## 0.2.23 A large feature release: GFM task lists & callouts, custom-tag round-trip preservation, a host-integration/authoring API, RTL + symbol/date inserts, and a full Obsidian-style hybrid live preview for list markers and checkboxes. All additions are opt-in or default-preserving — stored markdown and existing hosts are unchanged. ### Features - **GFM task lists (#14):** `- [ ] ` / `- [x] ` render as clickable checkboxes (toolbar + markdown action, click-to-toggle) and round-trip via a server `apply_task_lists/1` transform + client `
  3. ` serializer. Loose checklists (a blank line between items makes CommonMark wrap each item's text in a `

    `, breaking the checkbox match) are unwrapped back to `

  4. [ ] x
    5. ` on both the server and the client, so they no longer round-trip as literal `[ ] ` text. - **GFM callouts (#16):** `> [!NOTE|TIP|IMPORTANT|WARNING|CAUTION]` blockquotes render as colored admonition blocks with a derived, non-editable title and round-trip via `apply_callouts/1` + a `data-callout` serializer. - **Custom / unknown tag preservation (#3):** a new `preserve_tags` attr (default `[]`). Listed tags (e.g. ``, ``) are pulled out before Earmark, rendered in visual/hybrid as atomic, non-editable chips, and restored byte-for-byte; the client serializes the chip's `data-leaf-raw` straight back to source, so custom XML round-trips exactly. A single preserved tag inserted live via `:insert_markdown` becomes a chip on the spot. - **Host-integration & authoring API (all backward-compatible):** `send_update` actions `:insert_markdown`, `:flush`, `:mark_saved`; new attrs `toolbar_extra` (+ `{:leaf_toolbar_action}`), `toolbar_layout`, `min_height`/`max_height` + `height="auto"`, `maxlength`, `smart_typography`, `export`, `protect_navigation`, `save_status`, per-instance `gettext_backend`, `class` (now actually applied), `emit_events`, `flush_on_blur`. `{:leaf_changed}` gains a `dirty` boolean. Lifecycle events (`{:leaf_focus}`, `{:leaf_blur}`, `{:leaf_selection_changed}`, `{:leaf_paste_image}`) are gated behind `emit_events` (default `false`) so existing hosts can't crash on an unhandled message. Authoring: autolink on URL paste, image caption/alignment, paste image→upload (with inline fallback) and paste-as-plain-text (Ctrl/Cmd+Shift+V), TSV/CSV→table, and code blocks with a language tag + copy button (` ```lang ` round-trip). - **Symbols / date picker (#31)** in the insert menu (symbol grid + insert date/time), and **RTL support (#46)** via a new `dir` attr (`"ltr"|"rtl"|"auto"`, default `"ltr"`). - **Spellcheck toggle (#55):** new `spellcheck` attr (default `true`). - **Obsidian-style hybrid live preview for lists & checkboxes:** a list item's `- ` / `N. ` / `- [ ] ` marker now reveals as editable source *only while the cursor is on it* — exactly like the inline `**` / `*` markers — and shows the bullet / checkbox otherwise, instead of the whole row switching to source. The revealed marker is seated in the bullet/checkbox gutter so it lines up with sibling items; ArrowLeft from the body start steps into the hidden marker; deleting the marker breaks the item out to a paragraph immediately; and typing `- ` leaves a blinking caret at the end of the new item, ready to type. ### Fixes - Hybrid: list editing no longer breaks after a markdown↔hybrid round-trip. The server's pretty-printed HTML left whitespace-only text nodes between block children — a cursor trap that resolved `_getCurrentBlock` to the `