trek 2.5.0 → 2.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83354e52923bd77162639c74f5e45fcdfbeed812c4b2cbbad7c6b28c987ef8e0
-  data.tar.gz: 6a9d8038dbc513ecf9e7fdc119f874532e0c422e9aeb9fd6bb158d335542e839
+  metadata.gz: d783f048ea7c8129d6b101a8ccb10d0c33234e0d24ef08a57dc33499c88b09e4
+  data.tar.gz: 750d8fbdb051715fc9f68dc2891592f36adb79d85c2f890eabeecc142ea15e0b
 SHA512:
-  metadata.gz: c9ad87bb1b169ede12d9efce481f385aa2aaf10a76381ccb652ff048846ce7924a0d1db97eb358b0c5e968960d658683b5b4449d4304401cd387e1d9c635c257
-  data.tar.gz: 4cadf24ff3c2ff45fd419ea97100add550d6e0d6431913b2b07fb94f597eaffb861174648c8f23803056fb87b5ed09ff4426add34aba2be92b6ae772884e0264
+  metadata.gz: 3a7a0c78650fc92150bcf59a4923bc192c77759ac027ad30dd8ab3063f3097c83d1b12d397908bddb9e66ff2c3a123a5f4269333026756acd2e1bf15f7990abf
+  data.tar.gz: 010e0d3c431c219b0749ab01b98dbf224f4a63fc5d256fd62b7f7503f9a0def8140248eba61917ef5afed1ddfc86472d0ff49eb4918dc95e4edd3893a28f6c5a

data/.node-version

@@ -1 +1 @@
-24.22.0
+24.22.1

data/AGENTS.md

@@ -9,10 +9,10 @@ Trek is a customizable CMS for Ruby on Rails, shipped as a **Ruby gem** (`trek`)
 ## Tech stack
 
 - **Ruby** `>= 3.3` (RuboCop targets 3.4) · **Rails** `>= 8.0, < 8.2` (lockfile 8.1.4)
-- **Node** 24.22.0 (`.node-version`) · **Yarn** 4.18.1 with its defaults: no install scripts, no package published less than a day ago · **PostgreSQL** 12+ · **libvips** for images
+- **Node** 24.22.1 (`.node-version`) · **Yarn** 4.18.1 with its defaults: no install scripts, no package published less than a day ago · **PostgreSQL** 12+ · **libvips** for images
 - Backend: `action_policy`, `closure_tree`, `acts_as_list`, `mobility` + `i18n-tasks`, `shrine` (+ blurhash/image_processing/aws-sdk-s3), `view_component` + `slim-rails` + `lookbook`, `kaminari`, `deepl-rb`
 - Frontend: **esbuild** (`esbuild.config.js`) + **PostCSS** (`postcss.config.js`); Stimulus/Turbo, TipTap, Uppy, Tom Select, SortableJS
-- Tests: **RSpec** (`rspec-rails`, capybara, simplecov) · Docs: **VitePress** (`docs/`)
+- Tests: **RSpec** (`rspec-rails`, capybara with Cuprite, simplecov), **Vitest** (browser mode, headless Chrome through Playwright) · Docs: **VitePress** (`docs/`)
 
 ## Commands
 
@@ -21,6 +21,7 @@ bin/setup                 # bundle install + yarn install (dev setup)
 bin/console               # IRB with trek loaded
 rake                      # default: spec + rubocop
 rake spec                 # run tests (or: bundle exec rspec)
+yarn test                 # JavaScript tests (Vitest): the admin's Stimulus controllers, e.g. the content editor's
 COVERAGE=1 bundle exec rspec  # tests + SimpleCov report in coverage/ (fails under the minimum set in spec/spec_helper.rb)
 make lint                 # all linters below (make -k lint to run them all despite a failure)
 make security             # brakeman + bundler-audit
@@ -50,9 +51,11 @@ Security: `bundle exec brakeman` · `bundle exec bundle-audit check --update`
 - `config/locales/` — `trek.en.yml`, `trek.fr.yml`
 - `spec/` — RSpec suite, two kinds of spec:
   - **isolated** (`require_relative` the file under test, stub its host): concerns, helpers, simple components
-  - **Rails** (`require "rails_helper"`): boots `spec/dummy`, a minimal host app on PostgreSQL (`trek_test`, or `DATABASE_URL`). Its models, migrations, Shrine initializer and the whole admin (controllers, views, routes, policies, mailers) are not committed: `spec/dummy/lib/generated_files.rb` runs Trek's own generator steps into `tmp/dummy` on every boot, and the database is rebuilt from them. A new model or migration template must be added to its `STEPS`, or `spec/dummy/generated_files_spec.rb` fails.
+  - **Rails** (`require "rails_helper"`): boots `spec/dummy`, a minimal host app on PostgreSQL (`trek_test`, or `DATABASE_URL`). Its models, migrations, Shrine initializer and the whole admin (controllers, views, routes, policies, mailers) are not committed: `spec/dummy/lib/generated_files.rb` runs Trek's own generator steps into `tmp/dummy` on every boot, and the database is rebuilt from them. A new model or migration template must be added to its `STEPS` (and a generator taking arguments, to its `ARGUMENTS`), or `spec/dummy/generated_files_spec.rb` fails.
   - **Host-app specs**: model, admin request, policy and mailer specs and their [Oaken](https://github.com/kaspth/oaken) seeds are templates (`lib/generators/trek/templates/{spec/models,spec/requests,spec/policies,spec/mailers,db/seeds}/`), installed in host apps by `trek:install:model_specs` and run by Trek's suite from `tmp/dummy` (`spec/dummy/generated_specs_spec.rb`); test data comes from `users.create`, `pages.create` and `seed "cases/…"`, not factories. Write specs for Trek's models there, in host-app style (no `frozen_string_literal`, Ruby 3.3-compatible — no bare `it` block parameter), so host apps get them too.
   - **Generators** (`spec/trek/generators_spec.rb`): every generator runs on a copy of a real `rails new` app (`spec/support/generators.rb`, built once per run into `tmp/generator_skeleton`), then again to check it changes nothing. Shell-outs are recorded in `shell_commands`, not run. A new generator is picked up automatically; if it needs arguments, an earlier Trek step or a starting file, add it to the spec's `arguments`, `prerequisites` or `setups`.
+  - **System** (`spec/system`, `type: :system`): the admin in a headless Chrome (Cuprite), for what needs a real browser: typing, Turbo panels, uploads. `spec/support/system.rb` builds Trek's JS and CSS once per run (`node esbuild.config.js`) and serves them as the admin's `admin.js` and `admin.css`. Keep them few: they take seconds each.
+- `spec/javascript/` — Vitest tests (`yarn test`) of the admin's Stimulus controllers with their libraries, in a headless Chrome (the installed one, or `CHROME_PATH`): the content editor's controller and Tiptap, mounted on its component's markup, driven with the keyboard and the mouse (`userEvent`). Most editor behaviour is tested there: the whole file runs in about five seconds.
   - Both kinds run in one process, so an isolated spec must restore any global it changes (`I18n`, `Shrine` storages…). `spec_helper` loads Rails and Action View before Trek, as a host app does: several dependencies (ActionPolicy, Slim, ViewComponent) configure themselves from what is already loaded.
 - `docs/` — VitePress site
 
@@ -62,7 +65,7 @@ Security: `bundle exec brakeman` · `bundle exec bundle-audit check --update`
 - **Slim** linted via slim_lint; **JS/CSS** via ESLint + Stylelint + Prettier 2.8.8
 - **i18n**: keep English + French locales in sync (`config/locales/trek.*.yml`); DeepL auto-translation via `DEEPL_AUTH_KEY`
 - **Versioning**: version lives in both `lib/trek/version.rb` and `package.json` — keep in sync via `make release`
-- **CHANGELOG.md**: Keep-a-Changelog format. **Every MR must add an `[Unreleased]` entry**, except one that only changes specs. Keep entries short: one or two sentences on what changed for host apps, not how it was found or fixed — the MR description holds the details. When the change requires action in the host app on upgrade, end the entry with a bold `**Upgrade note:**` label followed by what to do. Use the same label when the change lets host apps remove or simplify existing patches or custom implementations (e.g. "**Upgrade note:** you can now drop your custom …") — never as an unlabelled trailing sentence.
+- **CHANGELOG.md**: Keep-a-Changelog format. **Every MR must add an `[Unreleased]` entry**, except one that only changes specs or the repository's own tooling (`Makefile`, CI, Renovate config), which host apps never see. Keep entries short: one or two sentences on what changed for host apps, not how it was found or fixed — the MR description holds the details. When the change requires action in the host app on upgrade, end the entry with a bold `**Upgrade note:**` label followed by what to do. Use the same label when the change lets host apps remove or simplify existing patches or custom implementations (e.g. "**Upgrade note:** you can now drop your custom …") — never as an unlabelled trailing sentence.
 - **Generated model names**: a new model template belonging to another model is nested under it, in `models/<owner>/` (`User::Session`, `User::PreviousPassword`), not prefixed (`UserSession`). Nested in an Active Record model, it keeps the prefixed table name (`user_sessions`) and its owner's `has_many` finds it without `class_name:`. The older `PagePath`, `PageVersion` and `TagCategory` move in Trek 3 (#248).
 - **Generators' npm packages**: the install generators' `NPM_DEPENDENCIES` (`lib/generators/trek/install/*_generator.rb`) add to host apps the packages needed by the config files they copy from Trek's root (`esbuild.config.js`, `postcss.config.js`, `.eslintrc.json`, `.stylelintrc.json`, `lefthook.yml`). When a package is bumped in Trek's `package.json` — by hand or by Renovate, which doesn't touch the generators — bump its range in the generator in the same MR, or new apps get a version the copied config may not work with (as esbuild 0.15 did). List only packages those configs or the generated scripts use.
 - **Public code**: Trek ships publicly (gem, npm, docs), so nothing committed may mention a client or project name, nor a client's domain models or business logic — not in code, comments, specs, templates, docs, CHANGELOG or commit messages. Use neutral examples (`Page`, `Shop::Product`, an engine's `Blog::Post`). Client context belongs in GitLab issues and MR descriptions only.

data/CHANGELOG.md

@@ -1,5 +1,42 @@
 ## [Unreleased]
 
+## [2.6.0] - 2026-10-28
+
+### Added
+
+- The content editor's link, image and prompt panels give hints under their fields: what to write in an image's alternative text, credit and caption, that a link goes to a page or a URL, and what a prompt's title is for. **Upgrade note:** you can now drop your own `helpers.hint.trek/content_editor/*` translations.
+- The content editor's link panel asks for the link's title, shown when hovering it, as its prompt panel does: Tiptap 3 keeps it on the link, where Tiptap 2 dropped it, and the site renders it.
+- CSP violations reported to AppSignal (`Trek::CspReportsController`) tell what was blocked: they're tagged with the browser's user agent, where it happened (the source file and line) and, for an inline script, its first 40 characters, which the generated policy now asks for with `'report-sample'`. The log line gives the source and sample too. Tags are cut to 255 characters, as AppSignal silently drops longer ones. **Upgrade note:** add `:report_sample` to `policy.script_src` in `config/initializers/content_security_policy.rb` to get the samples.
+- `rails g trek:install:good_job`, a new installer step (also runnable alone) making [GoodJob](https://github.com/bensheldon/good_job) the Active Job backend, as every Trek app was doing by hand: it swaps `solid_queue` for `good_job` in the Gemfile (Solid Cache stays), removes the Solid Queue setup `rails new` leaves behind (`config/queue.yml`, `config/recurring.yml`, `db/queue_schema.rb`, `bin/jobs`, the Puma plugin, the `queue:` database and Kamal's `SOLID_QUEUE_IN_PUMA`/`JOB_CONCURRENCY` variables), and configures the adapter (Active Job' test adapter in `config/environments/test.rb`, so specs can check what is enqueued), `:async` execution in production, the queues, cron and error reporting in `config/initializers/good_job.rb`. The dashboard is mounted at `/admin/good_job` with a menu entry in the admin, guarded by the Trek session: anyone who is not an administrator gets a 404 rather than a redirect. Two specs come with it (dashboard access per role, and the mail delivery job). Because GoodJob discards a failed job, every `deliver_later` email now goes through an installed `MailDeliveryJob` that retries five times with a growing delay, and `config/database.yml` reserves connections for the job threads on top of the web threads (`GOOD_JOB_MAX_THREADS`, which GoodJob defaults to `RAILS_MAX_THREADS`). See [Background jobs](https://trek.etamin.studio/background-jobs). **Upgrade note:** apps installed before this version can run `rails g trek:install:good_job` — it is idempotent and skips what is already in place — then add the dashboard entry to `app/views/layouts/admin.html.slim` (an item with `text: t("admin.jobs")`, `href: "/admin/good_job"`, `allowed_to: Current.user.admin?` in the settings section) and run the migration it generates. Apps already on GoodJob only need the Gemfile left alone and their `config/initializers/good_job.rb` compared with the generated one; apps still on Solid Queue must drop the `queue` database from their deploy target as well.
+- Dashboard tiles (`Trek::Dashboard::TileComponent`) opening in a new tab (`target: "_blank"`) show an external link icon after their text, and a tile's color is the accent of what it holds (`data-accent-color`), which can use `var(--accent-*)`.
+- Public accounts: `rails g trek:public_accounts Customer` gives the site's or the mobile app's users (customers, members…) a model of their own, apart from the admin's `User`, with its own table, sessions and sign-in, so nothing public can reach a staff account. They sign in either with a code emailed to them, which creates the account the first time, or with `--sign-in=password` with a password, the email confirmed and the password reset by a link; a website gets pages and a cookie, `--api` JSON endpoints and a JWT naming a session, so it can be revoked, and `--model-only` neither, for an app whose sign-in is its own. See [Public accounts](https://trek.etamin.studio/reference/generators/public-accounts).
+- `Trek::Users::SignInLockout` sends its email through `sign_in_lockout_mailer` (`"AdminMailer"` by default), and `Trek::PurgeExpiredSessionsJob` takes the session model to purge (`User::Session` by default), for public accounts.
+
+### Changed
+
+- Trek requires the `prosemirror` gem 1.0 or later (was 0.7.1), and works with 1.1: rendering content (`formatted_content`) raised `ArgumentError` with it. `Trek::Content::Document#to_html` takes 1.1's `heading_ids: true`.
+- `rails g trek:install` ends by listing the generators it doesn't run, to run as the app needs them: `trek:scaffold`, `trek:taxonomies`, `trek:audit_log`, `trek:public_accounts` and `trek:scalingo`.
+- `trek:install:audit_log` and `trek:install:scalingo` are now `trek:audit_log` and `trek:scalingo`, as `trek:install` doesn't run them: `trek:install:*` is left to its own steps. The former names still work, with a deprecation warning, until Trek 3. **Upgrade note:** update the generator names in your docs and scripts.
+- `trek:install:ruby` now pins **Ruby 4.0.9** (was 4.0.7), and the CI images (repo + generated `.gitlab-ci.yml` template) use the matching `4.0.9` tag. **Upgrade note:** existing apps can set `4.0.9` in `.ruby-version` and bump the `ci-ruby` image tag in `.gitlab-ci.yml`.
+- Asking every user for a new password goes through its own controller, `Admin::PasswordRenewalsController#create` (`POST /admin/password_renewal`), instead of a `require_password_renewal` action of `Admin::UsersController`. **Upgrade note:** copy `app/controllers/admin/password_renewals_controller.rb` from Trek's templates (`lib/generators/trek/templates/controllers/admin/`), add `resource :password_renewal, only: :create` to the `admin` namespace of `config/routes.rb`, remove `post :require_password_renewal, on: :collection` from `resources :users` and the `require_password_renewal` action from `Admin::UsersController`, and point the button of `app/views/admin/users/index.html.slim` to `[:admin, :password_renewal]`.
+- The new sign-in email (`AdminMailer#new_sign_in`) gives the IP address's host name next to it, as the active sessions do, looked up when the email is sent. **Upgrade note:** to get it, copy `new_sign_in` from Trek's `lib/generators/trek/templates/mailers/admin_mailer.rb`, and replace `@ip` with `@address` in `app/views/admin_mailer/new_sign_in.*`.
+- Content is cleaned before it's saved (`Trek::Contentable`): empty paragraphs, empty list items and lists left empty are removed, as rendering already skipped them, so the stored JSON, `content_text` and searches no longer carry them. The document stays one the content editor opens, and node types or attributes the schema doesn't know are kept. The editor's JSON string is now stored as a document, which `Fragment.search` can search. **Upgrade note:** existing content is cleaned the next time it's saved; empty paragraphs authors used for spacing are removed for good. Apps that pruned empty paragraphs before saving can drop that code.
+- The content editor's panels label their fields more explicitly: « Largeur d'affichage », « Légende de l'image », « Lien vers », « Ouvrir ce lien dans… », « Texte du lien », « Texte du bouton », and « Dépasse sur les côtés » for the wider image size (in English: "Display width", "Image caption", "Link to", "Open this link in…", "Link text", "Button text", "Extends past the sides").
+- Trek is now developed and tested against **prosemirror 1.0**, its first stable release, which imports HTML and Markdown about a quarter faster. Trek already accepted it (`>= 0.7.1, < 2`), and doesn't use what 1.0 renames. **Upgrade note:** an app calling `Schema#parse_html`, `#parse_markdown` or `#parse_text`, or `Prosemirror::TextAlign`, renames them `#from_html`, `#from_markdown`, `#from_text` and `Prosemirror::Extensions::TextAlign` when it runs `bundle update prosemirror` (see [its changelog](https://github.com/etaminstudio/prosemirror/blob/main/CHANGELOG.md)).
+- Failed form submissions answer with `:unprocessable_content` (422), Rack's name for it since 3.1, instead of the deprecated `:unprocessable_entity`, in `Trek::ResourceController`, the sign-in controller and the generated specs, which printed a deprecation warning in every run. **Upgrade note:** replace `:unprocessable_entity` with `:unprocessable_content` in the app's own controllers and specs to silence the warning.
+- **Security:** the content editor runs on **Tiptap 3** (was 2), which fixes `mergeAttributes()` turning an own `__proto__` key into DOM attributes ([GHSA-cp6q-959q-f8rh](https://github.com/advisories/GHSA-cp6q-959q-f8rh)). Its floating menu uses Floating UI instead of Tippy. The editor behaves as before: no underline, and no empty paragraph added after a final block. **Upgrade note:** run `yarn up trek`, and update the app's own Tiptap extensions, if any, to Tiptap 3 (see [Upgrade from Tiptap v2](https://tiptap.dev/docs/guides/upgrade-tiptap-v2)).
+- `Trek::Form::ImageFieldComponent` (`f.image_field`) shows two icons over its thumbnail, on hover and focus, opening the original image in a new tab or downloading it, instead of a « See original » button under « Replace » and « Remove », which wrapped onto two lines in French.
+
+### Fixed
+
+- `Trek::TypographyFormatter` broke content saved from the content editor: given the editor's JSON string, it formatted it as plain text, and the non-breaking spaces it added before colons made the JSON invalid. It now parses the document, and formats its text nodes. **Upgrade note:** an app that added `:content` to `format_attributes` may hold records whose content no longer parses (`formatted_content` raises `JSON::ParserError`), which the editor can't open either: restore them from a backup.
+- `Trek::TypographyFormatter` no longer adds a space before a colon, semicolon, `!`, `?`, `%`, `€` or `$` inside a word: times (`10:30`), URLs (`https://…?a=1`) and ratios (`3:1`) are left alone, and one space goes before a group of signs (`Quoi ?!`). Apostrophes and the space after `«` now work next to accented letters (`l’été`, `« Été »`). Spaces earlier versions put inside a word (`10 :30`, `https ://`) are removed. **Upgrade note:** formatted titles and content are repaired the next time they're saved.
+- `content_text` ran the content's paragraphs and lines together (`Line oneLine two`), which shows in the excerpts of the admin's fragments index: it now separates blocks with a blank line, and hard breaks with a newline (`Prosemirror::Document#to_text`).
+- Reordering a list in the admin (`Trek::Reorderable`) could leave records out of place: it saved them one at a time while acts_as_list, and closure_tree for the trees ordered with `numeric_order`, renumbered the other records at each save. A list numbered from 1, acts_as_list's default, lost a record on most moves, as the list posts positions from 0. The posted order is now applied as a whole: in an `acts_as_list_no_update` block, from the list's `top_of_list`, or with closure_tree's `prepend_sibling` and `append_sibling` for a tree. Records missing from the list (deleted meanwhile, or left out by `reorderable_objects`) are skipped. **Upgrade note:** you can now drop your own `reorder` actions written to work around it.
+- Adding a call to action from the content editor failed with `NoMethodError: undefined method 'color'`: the prompt panel's response read a `color` that `Trek::ContentEditor::Prompt` never had, and the panel has no field for. Prompts no longer have a color: the editor's block, the panel and `Trek::Content::PromptsBlock` drop it, and the site's link loses its `data-color`. A color already stored in content stays in the JSON, unrendered. **Upgrade note:** an app styling prompts with `[data-color]`, or reading `@color` in its own `PromptsBlock`, can drop that code.
+- **Security:** the content editor showed image and call-to-action blocks by writing their attributes into HTML: an alternative text, caption or button text containing `"` or `<` broke the block, or injected markup into the admin. They are now built as DOM nodes, their texts as text.
+- The content editor's toolbar buttons show the styles and the block where the cursor is right after a click: the bold, italic and heading buttons marked their icon instead of the button until the cursor moved.
+
 ## [2.5.0] - 2026-10-25
 
 ### Changed

data/Gemfile

@@ -24,8 +24,13 @@ end
 group :test do
   gem "bcrypt", "~> 3.1"
   gem "capybara", "~> 3.38"
+  # System specs: a headless Chrome driven through its DevTools protocol, and the server it browses
+  gem "cuprite", "~> 0.19"
+  # The dummy app's API accounts (trek:public_accounts --api)
+  gem "jwt", "~> 3.1"
   gem "oaken", "~> 1.0"
   gem "pg", "~> 1.5"
+  gem "puma", "~> 8.0"
   gem "simplecov", "~> 0.22.0"
   gem "simplecov-cobertura", "~> 3.0"
 end

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    trek (2.5.0)
+    trek (2.6.0)
       action_policy (~> 0.6)
       actioncable
       acts_as_list (~> 1.1)
@@ -22,7 +22,7 @@ PATH
       mobility (~> 1.3.2)
       phonelib (~> 0.8)
       postmark-rails
-      prosemirror (>= 0.7.1, < 2)
+      prosemirror (>= 1.0, < 2)
       rails (>= 8.0, < 8.2)
       rails-healthcheck
       rails-i18n (>= 6.0)
@@ -180,6 +180,9 @@ GEM
       addressable
       base64
       ssrf_filter (~> 1.5)
+    cuprite (0.19)
+      capybara (~> 3.0)
+      ferrum (~> 0.19.1)
     date (3.6.0)
     deepl-rb (3.9.0)
     diff-lcs (1.6.2)
@@ -222,6 +225,11 @@ GEM
     erb (6.0.7)
     erubi (1.13.1)
     fastimage (2.4.1)
+    ferrum (0.19.1)
+      addressable (~> 2.5)
+      base64 (~> 0.2)
+      concurrent-ruby (~> 1.1)
+      websocket-driver (~> 0.7)
     ffi (1.17.4-arm64-darwin)
     ffi (1.17.4-x86_64-darwin)
     ffi (1.17.4-x86_64-linux-gnu)
@@ -352,11 +360,13 @@ GEM
       prettyprint
     prettyprint (0.2.1)
     prism (1.9.0)
-    prosemirror (0.7.1)
+    prosemirror (1.1.0)
       literal (~> 1.9)
       phlex (~> 2.4)
       zeitwerk (~> 2.6)
     public_suffix (7.0.5)
+    puma (8.0.2)
+      nio4r (~> 2.0)
     racc (1.8.1)
     rack (3.2.7)
     rack-session (2.1.2)
@@ -603,8 +613,11 @@ DEPENDENCIES
   brakeman (~> 7.0)
   bundler-audit (~> 0.9)
   capybara (~> 3.38)
+  cuprite (~> 0.19)
+  jwt (~> 3.1)
   oaken (~> 1.0)
   pg (~> 1.5)
+  puma (~> 8.0)
   rake (~> 13.0)
   reek (~> 6.1)
   rspec-html-matchers (~> 0.10)

data/Makefile

@@ -51,6 +51,8 @@ i18n-check: i18n-normalize
 	git diff --exit-code config/locales
 
 release:
+	@# Before bumping anything: with a missing or expired token, npm publish fails with a misleading 404
+	@npm whoami >/dev/null 2>&1 || { echo "Not signed in to npm, or the token expired: run npm login first."; exit 1; }
 	@read -p "New version (current: $$(sed -n 's/.*VERSION = "\(.*\)"/\1/p' lib/trek/version.rb)): " version; \
 	if [ -z "$$version" ]; then echo "Version cannot be empty"; exit 1; fi && \
 	sed -i '' "s/VERSION = \".*\"/VERSION = \"$$version\"/" lib/trek/version.rb && \

data/app/components/trek/dashboard/tile_component/tile_component.css

@@ -46,6 +46,15 @@
   transition: transform 0.2s ease-in-out;
 }
 
+/* A tile opening in a new tab: the icon follows the text, on its last line */
+.external {
+  --icon-size: 1.4rem;
+
+  display: inline-block;
+  margin-left: 0.6rem;
+  vertical-align: -0.1rem;
+}
+
 .root.color-amber {
   --icon-color: var(--amber-11);
 

data/app/components/trek/dashboard/tile_component/tile_component.html.slim

@@ -4,9 +4,11 @@
       span(class=class_for("title")) = title
     - if icon
       = render Trek::IconComponent.new(icon, classnames: class_for("icon"))
-    span(class=class_for("text")) = formatted_text
+    span(class=class_for("text"))
+      = formatted_text
+      = external_icon
 - else
-  div(class=classes)
+  div(class=classes data-accent-color=color)
     - if title
       span(class=class_for("title")) = title
     - if icon

data/app/components/trek/dashboard/tile_component.rb

@@ -31,12 +31,22 @@ module Trek
       )
     end
 
+    # The tile's color is the accent (`data-accent-color`) of what it holds, which can use `var(--accent-*)`
     def link_data
-      data.merge(turbo_method: method).compact
+      { accent_color: color }.merge(data, turbo_method: method).compact
     end
 
     def link_rel
-      rel || ("noopener" if target == "_blank")
+      rel || ("noopener" if new_tab?)
+    end
+
+    def new_tab?
+      target == "_blank"
+    end
+
+    # After the text of a link opening in a new tab
+    def external_icon
+      render Trek::IconComponent.new("trek/external", classnames: class_for("external"), aria_hidden: true) if new_tab?
     end
 
     def formatted_text

data/app/components/trek/form/content_editor_component/content_editor_component.css

@@ -39,6 +39,11 @@
   display: none;
 }
 
+.floating-menu {
+  /* Above the editor's content: Floating UI positions it, with no z-index of its own */
+  z-index: 1;
+}
+
 .floating-menu .button {
   padding: 0.7rem 1.2rem;
 }

data/app/components/trek/form/content_editor_component/content_editor_component.html.slim

@@ -8,34 +8,22 @@ div(
         button.bold(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("toggleBold")
+          data=command_data("toggleBold", active: "bold")
         ) = render Trek::IconComponent.new("trek/bold", title: t(".bold"))
 
         button.italic(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("toggleItalic")
+          data=command_data("toggleItalic", active: "italic")
         ) = render Trek::IconComponent.new("trek/italic", title: t(".italic"))
 
-        / button.strike(
-        /   class=class_for("button")
-        /   type="button"
-        /   data-action=stimulus_action("toggleStrike")
-        / ) strike
-
-        / button.code(
-        /   class=class_for("button")
-        /   type="button"
-        /   data-action=stimulus_action("toggleCode")
-        / ) code
-
         / The panel opening is handled by the hidden button's
           openStackedPanelWhenLoaded action — a direct openPanel here would
           pop the (possibly empty) primary panel alongside the stacked one.
         button.link(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("toggleLink")
+          data={ action: stimulus_action("toggleLink"), **state_data("link") }
         ) = render Trek::IconComponent.new("trek/link", title: t(".link"))
 
         = link_to "",
@@ -51,7 +39,7 @@ div(
         button(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("unsetAllMarks")
+          data=command_data("unsetAllMarks")
         )
           = render Trek::IconComponent.new(\
               "trek/eraser",
@@ -61,7 +49,7 @@ div(
         button(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("setHardBreak")
+          data=command_data("setHardBreak")
         )
           = render Trek::IconComponent.new(\
             "trek/return",
@@ -74,86 +62,36 @@ div(
         button.paragraph(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("setParagraph")
+          data=command_data("setParagraph", active: "paragraph")
         )
           = render Trek::IconComponent.new(\
             "trek/paragraph",
             title: t(".paragraph"),
           )
 
-        / button.h1(
-        /   class=class_for("button")
-        /   type="button"
-        /   data-action=stimulus_action("toggleHeading")
-        /   data-level=1
-        / ) h1
-
-        button.h2(
-          class=class_for("button")
-          type="button"
-          data-action=stimulus_action("toggleHeading")
-          data-level=2
-          title=t(".h2")
-        ) h2
-
-        button.h3(
-          class=class_for("button")
-          type="button"
-          data-action=stimulus_action("toggleHeading")
-          data-level=3
-          title=t(".h3")
-        ) h3
-
-        button.h4(
-          class=class_for("button")
-          type="button"
-          data-action=stimulus_action("toggleHeading")
-          data-level=4
-          title=t(".h4")
-        ) h4
-
-        / button.h5(
-        /   class=class_for("button")
-        /   type="button"
-        /   data-action=stimulus_action("toggleHeading")
-        /   data-level=5
-        /   title=t(".h5")
-        / ) h5
-
-        / button.h6(
-        /   class=class_for("button")
-        /   type="button"
-        /   data-action=stimulus_action("toggleHeading")
-        /   data-level=6
-        /   title=t(".h6")
-        / ) h6
+        - [2, 3, 4].each do |level|
+          button(
+            class=class_for("button")
+            class="h#{level}"
+            type="button"
+            data=command_data("toggleHeading", active: "heading", level:)
+            title=t(".h#{level}")
+          ) = "h#{level}"
 
         button.bulletList(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("toggleBulletList")
+          data=command_data("toggleBulletList", active: "bulletList")
         )
           = render Trek::IconComponent.new( \
               "trek/list-bullets",
               title: t(".bullet_list"),
             )
 
-        / button.orderedList(
-        /   class=class_for("button")
-        /   type="button"
-        /   data-action=stimulus_action("toggleOrderedList")
-        / ) ordered list
-
-        / button.codeBlock(
-        /   class=class_for("button")
-        /   type="button"
-        /   data-action=stimulus_action("toggleCodeBlock")
-        / ) code block
-
         button.blockquote(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("toggleBlockquote")
+          data=command_data("toggleBlockquote", active: "blockquote")
         )
           = render Trek::IconComponent.new( \
               "trek/quotation",
@@ -163,37 +101,25 @@ div(
         button(
           class=class_for("button")
           type="button"
-          data-action=stimulus_action("setHorizontalRule")
+          data=command_data("setHorizontalRule")
         )
           = render Trek::IconComponent.new( \
               "trek/hr",
               title: t(".horizontal_rule"),
             )
 
-      / button(
-      /   class=class_for("button")
-      /   type="button"
-      /   data-action=stimulus_action("clearNodes")
-      / ) clear nodes
-
       button(
         class=class_names_for("button", "button-end", map_args: true)
         type="button"
-        data-action=stimulus_action("undo")
+        data=command_data("undo")
       ) = render Trek::IconComponent.new("trek/undo", title: t(".undo"))
 
       button(
         class=class_for("button")
         type="button"
-        data-action=stimulus_action("redo")
+        data=command_data("redo")
       ) = render Trek::IconComponent.new("trek/redo", title: t(".redo"))
 
-      / button(
-      /   class=class_for("button")
-      /   type="button"
-      /   data-action=stimulus_action("insertFrame")
-      / ) frame
-
     div(
       class=class_for("content")
       data=content_data_attributes