# DrawSplatTM DrawSplatTM is a self-contained interactive whiteboard for K-16 educators and students. It runs as a static website, works in the browser, and can optionally save boards, templates, collaboration rooms, and turn-ins to Google Drive and Google Sheets — or to your own MySQL-backed server. **Free for everyone.** Software, all backends, all compliance features. Districts that want paid setup, professional learning, or compliance review can engage that as a separate service — see [pricing](pages/pricing.html). If DrawSplatTM saved you a planning period, [buy the developer a cup of coffee](https://buymeacoffee.com/drawsplat). - **Official site:** [https://drawsplat.org](https://drawsplat.org) - **Open the whiteboard:** [drawsplat.org/app/whiteboard.html](https://drawsplat.org/app/whiteboard.html) - **Source:** this repository (AGPL-3.0-or-later) - **Status:** v3.1.17, Compliance Phases 1–3 complete on the Apps Script path; Phase 4 (MySQL) scaffolded end-to-end and newly hardened (OAuth, RBAC, SSE, cron, Clever connector, parent portal, privacy packet, migration CLI, rate limits, safer CORS, admin bootstrap controls) - **Self-host bundles:** [`pages/download.html`](pages/download.html) explains the three deployment paths; [`docs/modular-selfhost.md`](docs/modular-selfhost.md) explains the drop-in module model. `./scripts/make-selfhost-bundle.sh` produces the full DrawSplatTM package, individual SplatWorksTM apps, a SplatWorksTM suite package, and DrawSplatTM Tools, Widgets, and Games modules. ## Getting started Pick the scenario that fits and skip the others: | Scenario | Setup doc | Roughly | |---|---|---| | **Browser-only** — a teacher demo, single user, no accounts, no backend. | [`docs/setup-browser.md`](docs/setup-browser.md) | 1 minute | | **Google Apps Script** — cloud saves, classroom rooms, full Compliance Console, parent request center. *The supported production path.* | [`docs/setup-google-apps-script.md`](docs/setup-google-apps-script.md) | 10–15 minutes | | **MySQL backend** — self-hosted, district-scale, true RBAC. *Scaffolded; production hardening still TODO.* | [`docs/setup-mysql.md`](docs/setup-mysql.md) | 15–30 minutes | Other docs that pair with setup: - [`docs/COMPLIANCE.md`](docs/COMPLIANCE.md) — operator guide for the Compliance Console. - [`community/Setup.md`](community/Setup.md) — stand up the `/community/` board with Google + Microsoft sign-in. - [`COMPLIANCE-ROADMAP.md`](COMPLIANCE-ROADMAP.md) — every compliance day-module with its status. - [`docs/HANDOFF-v3.1.0.md`](docs/HANDOFF-v3.1.0.md) — portable handoff for any AI assistant (Codex, Cursor, etc.) picking up the repo; covers what shipped at v3.1.0 and known gaps. ## Current build **DrawSplatTM v3.1.17 — Latest stable self-host release, with the whiteboard, Concept Map Studio, public pages, Hub/admin pages, SplatWorksTM, Tools, Widgets, and Games audited across desktop and mobile.** SplatWorksTM is the GPL-covered browser-based office suite for WriteSplatTM, ListSplatTM, ShowSplatTM, and GridSplatTM, organized under `splatworks/` with launch paths at `/splatworks/gridsplat/`, `/splatworks/showsplat/`, `/splatworks/writesplat/`, and `/splatworks/listsplat/`. DrawSplatTM keeps the whiteboard, standalone tools, widgets, and games under its own package and menu. Pinned stable release: [v3.1.17](https://github.com/mguhlin/drawsplat/releases/tag/v3.1.17). Previous milestones: [v3.1.16](https://github.com/mguhlin/drawsplat/releases/tag/v3.1.16) (ListSplatTM package, SplatWorksTM suite package, and modular DrawSplatTM downloads), [v3.1.15](https://github.com/mguhlin/drawsplat/releases/tag/v3.1.15) (WriteSplatTM package, ShowSplatTM fixes, and refreshed SplatWorksTM downloads), [v3.1.14](https://github.com/mguhlin/drawsplat/releases/tag/v3.1.14) (SplatWorksTM folder layout and ShowSplatTM editor updates), [v3.1.13](https://github.com/mguhlin/drawsplat/releases/tag/v3.1.13) (ShowSplatTM starts and app-split zips), [v3.1.12](https://github.com/mguhlin/drawsplat/releases/tag/v3.1.12) (separate DrawSplatTM and GridSplatTM downloads), [v3.1.11](https://github.com/mguhlin/drawsplat/releases/tag/v3.1.11) (GridSplatTM integrated into SplatWorksTM, separated DrawSplat/SplatWorks navigation, dedicated Games and Tools pages). ## Recent improvements (v3.1.17) - **DrawSplatTM whiteboard polish.** Tightened the whiteboard shell with CSP/version stamp fixes, responsive layout improvements, onboarding sequencing, offline cache refreshes, and a repaired Concept Map launch path. - **Concept Map Studio usability.** Bubble labels can be clicked and edited in place, bubbles can be resized with width handles, the canvas has internal scrolling, and the start screen now offers a template chooser with a cleaner quick toolbar and contextual bubble controls. - **Desktop/mobile audit fixes.** Cleaned public pages, language whiteboards, community sign-in preview behavior, Hub/admin OAuth/CSP edges, mobile overflow, SplatWorks development-template fallbacks, games, tools, widgets, and 130 static HTML entry points. - **Self-host bundle refresh.** Rebuilt the DrawSplatTM full package, SplatWorksTM suite/app packages, Tools, Widgets, Games modules, and checksums as v3.1.17 artifacts. ## Recent improvements (v3.1.16) - **ListSplatTM classroom database app.** Added `splatworks/listsplat/`, a SplatWorksTM-styled browser database workspace for student-friendly tables, forms, cards, galleries, labels, reports, CSV import/export, `.listsplat.json` save/open, templates, image fields with upload/paste, language switching, relationship basics, calculation fields, lookup formulas, teacher notes, project packets, per-layout visibility, and data-quality checks. - **SplatWorksTM suite package.** `./scripts/make-selfhost-bundle.sh` creates `splatworks-suite-selfhost-.zip`, a browser-based office suite module containing GridSplatTM, ShowSplatTM, WriteSplatTM, and ListSplatTM. - **Drop-in DrawSplatTM modules.** The bundle script now also creates `drawsplat-tools-selfhost-.zip`, `drawsplat-widgets-selfhost-.zip`, and `drawsplat-games-selfhost-.zip`. These modules keep normal `/solutions/`, `/games/`, `/pages/`, and `/assets/` paths so they connect when unzipped into the same web root. ## Recent improvements (v3.1.15) - **ShowSplatTM import/export menus.** File Import and Export now group WebDeck HTML, Markdown, PDF, ODP, and PowerPoint/PPTX options under clear submenus. PDF export uses the browser print/save-as-PDF flow; PDF import creates image-based slide pages. - **PowerPoint and ODP first-pass support.** ShowSplatTM can import and export PPTX and ODP files with best-effort text, image, shape, background, and template preservation. Complex masks, grouped transforms, theme fonts, and master-page details are still active improvement areas. - **PDF import.** PDFs can be imported as full-slide image pages, including password-protected PDFs after a password prompt. This preserves visual appearance but does not make PDF text editable yet. - **Editable slide controls.** Text boxes can toggle bullets on/off, selected boxes have font size decrease/increase buttons, view zoom uses a slider, and deleting the last slide automatically creates a blank title slide. - **Presentation polish.** WebDeck presenter controls auto-hide after a few seconds and return on hover; speaker notes can pop out into a movable window for another monitor. - **Import behavior cleanup.** Imported WebDeck slides resize text to fit the slide better, keep the grid outside the slide surface, and preserve or omit the ShowSplatTM footer bar based on the source deck. - **ShowSplatTM task-focused Help.** The Help menu now opens in-app guidance for deck building, object editing, Markdown Studio, presenting, save/export/import choices, privacy, and keyboard shortcuts while keeping technical docs available for maintainers. - **WriteSplatTM classroom writing app.** Added `splatworks/writesplat/`, a SplatWorksTM-styled browser word processor with ProseMirror editing, offline local autosave, native `.writesplat.json`, kid-friendly readability cards, export options, classroom templates, cloze, citations, teacher-only content, read-aloud controls, sentence scrambling, vocabulary highlights, and browser tests. - **Separate WriteSplatTM package path.** `./scripts/make-selfhost-bundle.sh` creates `splatworks-writesplat-selfhost-.zip` alongside the DrawSplatTM, GridSplatTM, and ShowSplatTM zips. ## Recent improvements (v3.1.14) - **SplatWorksTM folder hub.** Moved GridSplatTM and ShowSplatTM under `splatworks/`, added `pages/splatworks.html`, and updated launch/navigation paths. - **ShowSplatTM editor polish.** Added purple templates, graph/concept-map layouts, slide and deck audio, JSON save/load labeling, richer thumbnails, no-scroll text boxes, fit/autofit text, four-corner resize handles, rotation, and image crop mode. - **Privacy and licensing copy.** Updated SplatWorksTM legal references and added Terms/Privacy and GDPR links from the SplatWorks surfaces. ## Recent improvements (v3.1.13) - **ShowSplatTM starts.** Added `splatworks/showsplat/`, a browser-native slide deck and WebDeck authoring app with slide thumbnails, a central canvas, dropdown menus, icon toolbar, notes, templates, themes, drag/resize editing, media insertion, Markdown Studio, slideshow preview, and WebDeck export. - **ShowSplatTM public page and navigation.** Added `pages/showsplat.html` and linked ShowSplatTM from SplatWorksTM menus across the site. - **WebDeck export path.** Exported decks are single HTML files with slide data, notes, navigation, progress, hash links, fullscreen controls, and an optional frontend password prompt backed by a SHA-256 hash. - **Separate ShowSplatTM package.** `./scripts/make-selfhost-bundle.sh` now creates `splatworks-showsplat-selfhost-.zip` in addition to DrawSplatTM and GridSplatTM zips. ## Recent improvements (v3.1.12) - **Separate self-host packages.** `./scripts/make-selfhost-bundle.sh` now creates `drawsplat-selfhost-.zip` and `splatworks-gridsplat-selfhost-.zip`. - **Cleaner licensing boundary.** The DrawSplatTM package excludes `splatworks/gridsplat/`; the GridSplatTM package carries the GPL-3.0-only spreadsheet app, source, built static assets, docs, tests, and license files. - **Download page refresh.** The self-host download page now shows both packages on the same page with separate sizes, SHA-256 hashes, and guidance about when to download each one. - **GridSplat-only update path.** Future GridSplatTM changes can ship as a SplatWorksTM download without requiring schools to redownload the full DrawSplatTM whiteboard/tools/widgets/games package. ## Recent improvements (v3.1.11) - **GridSplatTM integration.** Added the GridSplatTM spreadsheet as a built static app at `splatworks/gridsplat/`, with a dedicated public page at `pages/gridsplat.html`. - **SplatWorksTM app family.** Standardized the GPL-covered suite language around SplatWorksTM, WriteSplatTM, ListSplatTM, ShowSplatTM, and GridSplatTM across the site and documentation. - **Navigation refresh.** Separated SplatWorksTM into its own menu and grouped Tools, Widgets, and Games under DrawSplatTM, plus dedicated Games and Tools collection pages. - **DrawSplatTM classroom tools.** Big Link, Concept Map, Markdown Studio, Rubric Builder, SplatImage Studio, and Word Search Maker now stay under DrawSplatTM Tools instead of SplatWorksTM. - **Self-host bundle refresh.** Updated README, release notes, download metadata, and the self-host bundle for the integrated DrawSplat Studio build. ## Recent improvements (v3.1.10) - **Super Star Trek browser edition.** Added `games/super-star-trek/` to DrawSplat Games, the Games dropdown, the Features games grid, Teacher Admin Game Access, and the self-host bundle. - **Squirrel Run feedback polish.** Added low-volume movement sounds, a splat sound on life loss, a classroom-friendly sound toggle, squirrel-point-of-view speech bubbles after collisions, and a short congratulatory dance when the squirrel reaches the tree. - **Mobile smoke test.** Verified Squirrel Run in a phone-sized Playwright run: start, touch movement, sound toggle, pause/resume, and no browser console/page errors. - **Blog RSS refresh.** Checked Raindrop and added the new Squirrel Run and SketchSpace VR posts, kept the newer SplatImage Studio post, and added a local Super Star Trek update item. - **Self-host bundle refresh.** Updated README, release notes, blog RSS, download metadata, admin game access, and the self-host bundle for the latest DrawSplat Games build. ## Recent improvements (v3.1.9) - **SketchSpace VR.** Added `solutions/sketchspace-VR/`, a standalone DrawSplat Tool for printing a flat 4x3 room template, drawing six active panels, photographing the page, uploading it, and exploring the result as a virtual room in the browser. - **SketchSpace VR teaching materials.** Added a Teacher Guide, Play examples page, image prompt pattern, curriculum starter guidance, full-screen starter links, corrected process visual, and six image-backed curriculum starters for citizenship, ecosystems and adaptations, geography, history, life cycles, and weather and water cycle. - **SplatImage Studio text workflow.** Replaced the simple text-label flow with a richer text dialog that supports adjustable font size, bold, italic, underline, alignment, and live preview before insertion. - **SplatImage Studio background cutout.** Added Smart background cutout and Remove edge background actions, kept the interface free of AI labeling, and added a visible Working dialog during longer cutout processing. - **SplatImage Studio clipboard and export polish.** Improved image paste/import for copied images from tools such as Canva and kept selected-object PNG copy/export focused on the selected object bounds. - **Blog RSS refresh.** Updated the bundled blog RSS snapshot with the latest DrawSplat release/update items for self-hosted copies. ## Recent improvements (v3.1.8) - **SplatImage Studio.** Added `solutions/splatimage-studio/`, a standalone browser-only image editor in the Tools dropdown for quick resize, crop, shape masks, layer duplication, opacity, text alignment, and art-effect work before images move into classroom materials. - **SplatImage handles.** Added resize and crop handles so students and teachers can adjust images visually instead of relying on numeric-only controls. - **SplatImage selected-copy fix.** Copy PNG now copies the selected object bounds when one or more objects are selected, instead of bringing along the full white canvas. - **DrawSplat Hub instance scaffold.** Added the DrawSplat Hub splash page at `hub/index.html`, protected Instances Admin at `hub/admin.html`, plus `hub/hubcampus/` as the first school-specific instance example, with classroom-teacher, campus, and district grouping support, Google OAuth admin access for approved accounts, the new Hub banner, guided admin setup, teacher folder/config creation in Drive, and an Apps Script instance registry starter. - **Teacher setup guides.** Added a Teacher Options quick start and Apps Script Web App URL setup guide, both linked from public support surfaces and Teacher Admin. - **Teacher Admin cleanup.** Teacher Admin now starts with Google Apps Script + Sheets/Drive setup, separates the MySQL section, and moves the Compliance Console to `admin/compliance.html` as an unlinked internal operator page. - **HTML release notes.** Added `pages/release-notes.html` so public release notes render as a styled site page instead of raw Markdown. - **Concept Map Studio Markdown import.** Added Markdown import support for turning heading/bullet outlines into concept-map structures. - **Concept Map Studio text controls.** Added text controls and moved selected-node edits into menus for a cleaner workspace. - **Concept Map Studio control polish.** Added dropdown menus and improved import collision layout so generated or imported maps land with less overlap. - **Quiz & Flashcard Studio science samples.** Added selectable Grade 3 Science TEKS, Grade 5 Science TEKS, and Grade 10 Biology TEKS sample data sets for fast classroom demos. - **Blog RSS refresh.** Updated the bundled blog RSS snapshot from Raindrop so self-hosted copies carry the latest included feed item. ## Recent improvements (v3.1.7) - **MySQL backend security hardening.** Added `server/mysql-backend/security.js` with reusable security headers, CORS allowlist support, lightweight in-memory rate limiting, maintenance-route auth, admin bootstrap controls, email/room-key validation, and safe string helpers. - **Safer self-host defaults.** Docker and `.env.example` no longer document wildcard CORS as the default. Public registration creates teacher/parent accounts only unless `ALLOW_ADMIN_SELF_REGISTRATION=true` and `BOOTSTRAP_ADMIN_EMAILS` explicitly allow the first admin bootstrap. - **Protected sensitive routes.** `/maintenance/delete-expired` now requires either `MAINTENANCE_TOKEN` or a district/campus admin bearer token. Auth, OAuth, and parent request routes have rate limits. SSE board subscriptions are limited to valid room keys and capped per connection. - **Reduced information leakage.** Backend 500 responses no longer echo raw exception messages to clients. OAuth failures return a generic invalid-token response. - **Input and payload hardening.** Room keys must be short URL-safe IDs, board/template JSON saves have configurable byte caps, and user-facing string fields are normalized/truncated before storage. - **Markdown Studio XSS fix.** Markdown preview now allowlists URL schemes for links/images and escapes generated `href`, `src`, `alt`, and code-language attributes. - **Concept Map Studio full-width workspace.** The old left rail has been replaced with template buttons above the canvas and editing/export controls below it, giving the concept-map canvas the full page width and more vertical working room. - **Concept Map Studio T-Chart template.** Added a T-Chart organizer with localized template names, column labels, starter points, and relationship text across all supported Studio languages (`en`, `es`, `vi`, `ar`, `zh`, `uh`). - **Quiz & Flashcard Studio.** Added a standalone browser-only quiz builder and flashcard maker at `solutions/quiz-flashcard-studio/`. It imports CSV/TSV/TXT/JSON/XLSX/ODS/ODT question banks, exports JSON/CSV/XLSX/report CSV, creates student/team quiz play links, transfers question content into printable flashcards, and includes versioned AI-import templates: `drawsplat-quiz-flashcard_v1.csv` and `drawsplat-quiz-flashcard_v1.json`. - **Tool-specific AI assistant reference removed.** The handoff doc now uses generic AI-assistant wording. ## Recent improvements (v3.1.6) - **Animated GIF Maker: real LZW compression.** Replaced the previous degenerate LZW (CLEAR every 240 codes, no dictionary) with a proper GIF-spec encoder that builds a (prefix-code, byte) dictionary and grows the code size from 9 to 12 bits as the table fills. Typical content compresses 3–10× smaller. Smoke test: 200×200 single-frame gradient dropped from ~46 KB to 2.7–6.9 KB. - **Animated GIF Maker: palette-size option.** New Best-mode dropdown (256 / 128 / 64 / 32 colors). Smaller palette = smaller per-frame LCT bytes + smaller LZW codes. For most classroom diagrams, 128 or 64 colors comfortably gets you under 100 KB. - **Animated GIF Maker: MP4 / WebM video export.** New "Export as Video" button. Uses native WebCodecs `VideoEncoder` + a hand-rolled MP4 ISO BMFF muxer (assets/js/mp4-muxer.js, ~400 lines) for cross-browser MP4 in Chrome / Edge 94+, Firefox 130+, Safari 16.4+. Falls back to MediaRecorder (WebM/MP4 real-time) on older browsers. Forces AVCC bitstream format (`avc.format: 'avc'`) so the muxer's sample table walks correctly — previously caused dropped final frames. - **Concept Map: traditional outline formatter.** Outline view now emits academic-style hierarchy (`# I.` Roman numerals → `## A.` letters → `1.` numbers → ` a.` blank-padded sub-letters) with an always-emitted "Next Steps and Action Items" section sourced from nodes tagged `section: "Action Items"` / `"Next Steps"` / etc. - **Blog page: thumbnails from RSS feed.** Each card now shows a real thumbnail extracted from the post's lead `` in the RSS ``. Two-column card layout (thumb | body) on desktop, stacked on mobile. Lazy-loaded, no-referrer. CSP relaxed only on img-src to allow `https:` external image hosts. - **Firefox WebM export fix.** Switched the MediaRecorder pipeline from `captureStream(0)` + manual `requestFrame()` to fixed-rate `captureStream(30)` — Firefox couldn't reliably push frames the manual way, ending with zero samples. Chrome / Edge / Safari unaffected. ## Recent improvements (v3.1.5) - **Concept Map: overlap resolver rewritten as sequential phases.** Previous resolver could cascade nodes thousands of units away on dense maps with overlapping groups. Now runs A→within-group → B→loose-vs-loose → C→rigid group-vs-group (skipping shared-member pairs) → D→loose-out-of-foreign-group → E→final cleanup. Per-axis push clamped to 220 units. Real-world test file (37 nodes / 5 groups) lays out cleanly. - **Concept Map: connector-label avoidance.** Connector labels shift along the perpendicular axis when they'd land inside a node, so pills no longer get covered by boxes. - **Concept Map: Outline view.** Collapsible markdown mirror of the map's hierarchy under the canvas. Live-updates on every render. "Copy Markdown" + "Open in Markdown Studio →" buttons. - **Concept Map: optional `section` field + viewer filter.** Tag nodes with a section string (e.g. "Inputs", "Process", "Outputs"); a pill row above the canvas appears and clicking a section fades the rest. Big maps stop being overwhelming. - **Concept Map: backward-compat migration on import.** Loader auto-migrates older / sloppy JSON shapes — missing `type`, v1 nodes-as-object format, v1 `{from, to}` connectors, missing arrays — no more red-bar errors when loading old saves. - **Concept Map ⇄ Markdown Studio bidirectional handoff.** localStorage-based (URL-hash transfer kept failing due to caching). Outline → Markdown Studio uses the existing outline; Markdown → Concept Map parses headings + bullets into a level-1/2/3 hierarchy with radial auto-layout. - **Concept Map: versioned schema filename.** `drawsplat-concept-map-schema-v2.json` (matches `SAVE_VERSION=2`). Old filename kept as a backward-compat alias. Hint reads "format spec (v2)" so LLMs know which schema they're prompting against. - **GDPR Compliance Summary** at `legal/gdpr-compliance.html`. Full plain-language posture: controller/processor roles per deployment, lawful basis, subject rights mapped to features, data residency, localStorage inventory, security, Art. 8, DPIA guidance, breach notification, RoPA, gaps, rollout checklist. Linked in the Privacy & Terms dropdown. - **Compliance Gap List** at `legal/compliance-gaps.html`. Honest section-by-section list of what each legal regime (COPPA, FERPA, CIPA, Texas SCOPE, TEC 32.151+, NDPA, GDPR, UK GDPR) requires that DrawSplat does NOT provide out of the box, and why. Linked above the divider in Privacy & Terms so DPOs / procurement reviewers find it without digging. - **Site-wide localStorage consent banner.** New `assets/js/consent-banner.js` loaded on every public page. Single dismiss; persisted in localStorage. Links to GDPR doc's storage inventory anchor. - **Blog page** now shows a "Loading posts…" status while the RSS fetches. ## Recent improvements (v3.1.4) - **Admin viewer mode (zero-config).** The admin login page now has a **Preview as Viewer** button next to Unlock Admin. Clicking it enters a read-only tour of the admin layout — every Save / Load / Edit control is disabled (CSS + a capturing event listener for defense in depth) and no backend data is loaded. Safe for anyone to click, including drawsplat.org visitors who don't have the admin password. Self-hosters can remove the button from `admin/admin.html` if they don't want public preview. (Earlier viewer-password design is now retired.) - **Whiteboard sidebar gains an Audio On/Off toggle.** Next to Undo/Redo. Persists in `localStorage.drawsplat.audioMuted`. Mutes DrawSplat sound effects (TNT today, future game/UI cues); user-recorded audio notes are intentionally exempt. - **Admin Game Access panel.** Per-game checkboxes that hide individual games from the landing and Features pages. Setting is per-browser (localStorage); `assets/js/games-filter.js` runs on those pages and hides the matching cards. - **Animated GIF Maker standalone widget** at `solutions/animated-gif/`. Multi-frame editor, per-frame delay, loop count, max-width control, preview, download. Six locales. Uses the shared GIF encoder. - **Shared GIF encoder with quality upgrades** at `assets/js/gif-encoder.js`. Two modes: *Fast* (256-color fixed cube palette — original behavior) and *Best* (per-frame median-cut palette, optional Floyd-Steinberg dithering). Both the Animated GIF Maker and the whiteboard's Create GIF dialog now expose Quality + Dither controls. - **Concept Map Studio: JSON Schema spec** at `solutions/concept-map/drawsplat-concept-map-schema.json`. Full JSON Schema (draft 2020-12) documenting every field the Studio reads. A new sidebar hint links it for users prompting an LLM to generate a map. Hand the file to ChatGPT / Claude / Gemini and the resulting JSON loads directly via Load .json. - **Concept Map Studio: word-wrap labels + visual hierarchy.** Long labels wrap onto multiple lines via SVG ``s; nodes auto-grow vertically. New optional `level` field per node (1 = main idea, 2 = directly connected, 3 = supporting detail) drives box dimensions and font size in three tiers. Defaults from `isRoot` when omitted, so existing maps load unchanged. - **Concept Map Studio: Space + drag to pan.** Universal design-tool shortcut. Plus middle-click drag and the existing Pan toggle still work. Hint text in the sidebar and live status line mention all three (six locales). - **Concept Map Studio: overlap separator on import.** Three-pass resolver fires after loading a `.drawsplat-cmap.json`: node-vs-node, group-vs-group (translates members of both groups by half the overlap each so the shared seam tears apart while shared nodes hold), and free-node-vs-foreign-group. LLM-generated maps no longer pile nodes on top of each other. - **Concept Map Studio: embeddable in Google Sites and WordPress.** New `?embed=1` mode hides the editor chrome and renders pan/zoom/clickable-link viewer; map data rides in the URL hash so no backend is needed. New **Copy Embed Code** and **Copy Embed Link** buttons in the Studio actions row generate the iframe HTML / URL. - **Concept Map Studio: readable PNG/SVG exports.** Export mode bumps node labels (15→18pt, root 18→22), group labels (14→18), connector labels (13→16). PNG canvas raised from 1800→3200px minimum, 2×→3× scaling so the rasterized image opens at a useful zoom in any image viewer. - **Dicebreakers Creator: canonical header chrome.** Header now matches Mermaid / Storywheel / Concept Map: page wrapper centered at max 1280px, title-block with eyebrow + big purple H1 + subtitle, header-actions with i18n picker, "All Tools" secondary link, and Home primary button. Preview canvas capped at `min(540px, 58vh)` on screen so the dice tiles don't dominate; the underlying canvas stays 1600×1200 so every export still uses the full-resolution bitmap. ## Recent improvements (v3.1.3) - **Image upload approval queue (Compliance Roadmap Days 1.3 / 1.4).** Student image uploads now land in a new `ImageQueue` Sheet tab as `pending` and stay hidden on the student board until a teacher approves them in the Compliance Console. Apps Script (`Code.gs` v1.9.0) gains `uploadImage_`, `imageQueueResolve_`, `imageQueueList_`, `imageQueueThumbResponse_`, and `setImageStatus_`. The whiteboard inserts a "Pending teacher approval" SVG placeholder + a `pendingImageId` on the board object and polls every 8 seconds; the placeholder swaps in the real bytes (or a rejection placeholder) as soon as the teacher decides. Reject trashes the Drive file. Approve / reject decisions log `IMAGE_APPROVED` / `IMAGE_REJECTED` audit events. - **CIPA support statement** added to `legal/texas-compliance.html` (section 11). Explicit "supports CIPA, does not replace district filtering" framing, plus a CIPA entry in "laws this page covers". - **NDPA / DPA Review Packet** (`legal/ndpa-packet.html`) flips the image-queue row from "not yet shipped" to a description of the live flow and adds a section 12 "Evidence gallery" with six labelled `
` placeholders for the captures a district reviewer expects. - **Operator capture guide** at `docs/CAPTURE.md` — six entries (Compliance Console overview, Image Approval Queue, Family Access Tools queue, Activity Records, District Privacy Packet download, Per-student Export / Delete) describing where to find each screen, what state to put the app in, what file name to use, and where to drop the PNG. - **`docs/COMPLIANCE.md`** gains an "Image Approval Queue (Days 1.3 / 1.4)" section explaining the six-step flow plus the four `safety.images.*` config knobs. ## Recent improvements (v3.1.2) - **Advanced-view icon overhaul.** Every flat SVG in the Advanced view's Insert, Edit (Arrange), and sync rows now renders a colour PNG or cleaner-stroke SVG. Twenty-one new `adv-*.svg` files in `assets/icons/tools/` cover Insert / Arrange targets (image, library, graph, picture graph, mosaic, collage, emoji-as-star, GIF-as-play, mermaid, word cloud, concept, ScratchArt eraser, set/clear background, magic wand, duplicate, ungroup, group, sticker stamp, custom-sticker share, plus a chart variant). Six PNGs (`adv-front.png`, `adv-back.png`, `adv-lock.png`, `adv-unlock.png`, `adv-sync.png`, `adv-cloud-sync.png`, `adv-stop.png`, `adv-cloud-down.png`) cover Edit-menu stacking + selection-toolbar lock state + the four sync-row buttons. Simple-view `simple*` buttons still use their existing `pop_*` PNGs so the popover look is untouched. - Eighteen Advanced-view auxiliary buttons that already had a Simple-view PNG (TNT, all delete variants, the Insert-dialog launchers, Concept Map, etc.) were also rewired to reuse those PNGs in commit `7df14a4` so both views share a single colour vocabulary. ## Recent improvements (v3.1.1) - **Community board polish.** Markdown rendering in posts and replies (`**bold**`, `` `inline code` ``, ```` ```code blocks``` ````, links, lists, blockquotes — escape-first, no third-party deps). Authors edit their own posts/replies directly from the board view (server-enforced via session token); admins continue to edit any item from `Admin.html`. Each post card shows a two-line excerpt with markdown stripped, and posts created since the visitor's previous session display a small `NEW` badge. - **Community speed.** Client-side stale-while-revalidate cache paints the board instantly on repeat visits, then revalidates against `/exec` in the background and reconciles. Apps Script `CacheService` caches the public list response for 30 seconds server-side and is explicitly invalidated by every mutation endpoint (createPost, createReply, setStatus, updateItem, deleteItem, setModeration). Preconnect hints (`script.google.com`, `script.googleusercontent.com`, fonts hosts) plus lazy-loaded MSAL trim ~100–300 ms off cold loads and skip the ~70 KB Microsoft auth library entirely for visitors who never click Microsoft sign-in. Apps Script's own runtime overhead is the remaining floor (~1.3 s warm). ## Recent improvements (v3.1.0) - **Phase 4 MySQL backend closed end-to-end.** New modules in `server/mysql-backend/`: `oauth-routes.js` (Google + Microsoft token verification), `rbac.js` (five-role permission matrix), `safety.js` (shared board safety scan), `realtime.js` (SSE channel for `session-lock` + `board.updated`), `sis-clever.js` (district token + roster sync), `cron-jobs.js` (retention + per-minute time-limit enforcement), `privacy-packet.js` (hand-rolled ZIP generator with zero new dependencies). `server.js` rewires the room/board endpoints with freeze + safety gates and a `board.updated` SSE broadcast. `compliance-routes.js` gains age-band lock, parent-code issuance, freeze/unfreeze, full data delete, student data export, and a parent's own request list. - **Self-host bundle.** `scripts/make-selfhost-bundle.sh` produces `dist/drawsplat-selfhost-