v0.5.1

Changed

• Stop shipping sourcemaps. dist/*.js.map were ~340KB of the published tarball and served no purpose for consumers. Dropping them roughly halves the package (packed 128.6 kB → 52 kB, unpacked 542KB → 202KB) and avoids leaking local build paths.

v0.5.0 — traditional-content coverage & inline-SVG crash fix

The layer between generated content and WordPress just got much broader coverage — and stopped crashing on inline SVG.

Fixed

• Inline SVG (and any foreign element) no longer crashes conversion. An <svg>/MathML node anywhere threw className.split is not a function and aborted the whole run with no output. Foreign elements now route to Custom HTML, and a per-rule error boundary guarantees no single node can abort a run.

Added

• Native-block coverage for traditional content: <table> → core/table (colspan/rowspan/scope + <caption>), <blockquote> → core/quote, <pre><code>/<pre> → core/code/core/preformatted, <hr> → core/separator, <video>/<audio> → core/video/core/audio (+<track>), <details> → core/details, YouTube/Vimeo <iframe> → core/embed, multi-image <figure> → core/gallery, with a <figure> dispatcher for captions.
• Atomic enclosing-unit fallback. When a block's rich text holds content the editor can't keep (inline SVG/iframe, block-level markup), the whole enclosing block falls back to Custom HTML with a warning at the offending node. Decorative empty inline hooks are stripped so blocks stay native; empty semantic elements (id/href/datetime/aria-*) fall back instead of being lost.

Security

• Hardened URL sanitization: control-char/whitespace-obfuscated javascript:/vbscript: and executable <iframe srcdoc> are stripped.
• Exact-hostname embed matching over HTTPS, so lookalike domains (notyoutube.com) can't be rewritten into a trusted core/embed.

---

Codex Review

2 review passes. Final: all actionable findings resolved.

• ✅ Addressed: embed lookalike-domain trust-boundary bypass — exact-hostname URL parsing.
• ✅ Addressed: data:/control-char URL schemes in rich text — normalized + rejected.
• ✅ Addressed: silent loss of gallery images / table captions / video tracks / mixed-figure content — all carried or preserved via group.
• ✅ Addressed: semantic empty inline elements stripped — now fall back to Custom HTML.
• ✋ By design: presentational attributes (class/style/preload) are shed for clean native blocks, consistent with every existing rule; content-bearing attributes are carried.

Full transcript: .git/codex-review-main.log (local).

0.4.1

0.4.1 — cut unused media WASM (~155MB)

Headless convert/validate never uses Gutenberg’s editor media pipeline, but
@wordpress/block-library still pulled in @wordpress/vips + wasm-vips.

Changes

• Override those packages to empty stubs when block-runner is the install root
• postinstall prune removes them when block-runner is a nested dependency
  (npm ignores nested overrides)

Measured consumer install

	Size
0.4.0	~501 MB
0.4.1	~346 MB

npm install block-runner@0.4.1

0.4.0

0.4.0 — dependency refresh & zero audit findings

Dependencies

• @wordpress/blocks 14.15 → 15.23, @wordpress/block-library 9.26 → 10.1
• jsdom 24 → 29, commander 12 → 15
• Dev: vitest 2 → 4, tsup 8.5, tsx 4.23, typescript 5.9
• Overrides: uuid@11.1.1, esbuild@0.28.1

Security

• npm audit → 0 vulnerabilities (was 18: 1 critical, 1 high, 16 moderate)

Notes

• Requires Node ≥20 (unchanged from 0.3.x)
• Full test suite green against the new Gutenberg headless stack

npm install block-runner@0.4.0

0.3.3

0.3.3

• README hero + benchmark images use jsDelivr so they render on npmjs.com/package/block-runner (raw.githubusercontent.com was returning 429).

npm install block-runner@0.3.3

0.3.2

0.3.2

Release-blocking fixes (0.3.0 / 0.3.1 never published to npm):

• check:private supports npm ≤11 and npm ≥12 pack --json shapes.
• CI and release pin npm@11 (not floating latest — npm 12 requires newer Node and broke the gate).

Included from 0.3.0 / 0.3.1

• Token repair resolvers + block-runner context (wesper@0.0.2)
• README absolute image URLs (npm-renderable)
• Lockfile fixed for npm ci
• Node ≥20, CI matrix 20 / 22 / 24

npm install block-runner@0.3.2

0.3.1

0.3.1

Release-blocking fixes on top of 0.3.0 (which never published to npm):

• Fix package-lock sync so npm ci works under npm 10 (GitHub Actions Node images).
• Harden check:private JSON extraction for npm 11 (release workflow was failing after green tests).
• CI installs npm@latest before npm ci for matrix consistency.

0.3.0 (included)

Features

• Token repair — map raw colors/fonts/spacing to theme presets via noop / file / wpcli / rest / context resolvers.
• block-runner context — collect a wesper site.context.json manifest over WP-CLI.
• Depend on published wesper@0.0.2.

Process

• README images use absolute GitHub URLs (render on npm).
• Package hygiene: author, publishConfig, top-level types.
• engines.node ≥20; CI matrix 20 / 22 / 24.

Requires Node 20+.

npm install block-runner@0.3.1

0.3.0

0.3.0

Features

• Token repair — map raw colors/fonts/spacing to theme presets via noop / file / wpcli / rest / context resolvers (--token-resolver, --theme-json, --context, --token-match).
• block-runner context — collect a wesper site.context.json manifest over WP-CLI (library: collectSiteContext).
• Depend on published wesper@0.0.2 for site context collection.

Fixes & process

• README hero + benchmark images use absolute GitHub URLs so they render on npm.
• Harden check:private against npm pack stdout pollution (CI was red on main).
• CLI --version reads from package.json (no more hardcoded version).
• Package hygiene: author, publishConfig, top-level types.
• engines.node raised to >=20 (Node 18 EOL); CI matrix is 20 / 22 / 24.
• Build target is node20; pack:check skips lifecycle scripts.

Requires Node 20+.

npm: npm install block-runner@0.3.0

v0.2.0

First feature release since the initial publish.

Added

• Run it anywhere — pre-commit hook (.pre-commit-hooks.yaml) plus README guidance for running the gate via pre-commit, GitHub Actions, or any CI.
• prepare script so dist/ builds automatically on git installs and npm publish.

Fixed

• gate: Gutenberg validation issues now render as readable, human-friendly messages (util.format over the raw LoggerItem args) instead of dumping the block type definition.
• release: the private-reference pack check no longer crashes when npm pack runs the prepare build (--ignore-scripts), unblocking npm run verify in CI.

Docs

• New Benchmark section with the fidelity chart; consolidated benchmark presentation and principles copy.

Published to npm with provenance via Trusted Publishing.