u2ui 1.5.15 → 1.5.17

package/el/rte/README.md

@@ -56,9 +56,6 @@ DOM edited by RTE. They should not be added as aliases or partial parsers.
 
 ## TODO
 
-- Add `el/rte` to U2's generated project catalog when the module is ready for
-  automatic loading. It currently requires the explicit module import shown
-  above because that catalog lives outside this module.
 - RTE needs a shared root-aware convention-client entry point before this
   adapter can support editors placed inside an application ShadowRoot. The
   current public convenience client owns the document root only.

package/js/rte/AGENTS.md

@@ -15,9 +15,6 @@ earlier RTE draft is not a reason to keep a weaker design.
 - Read [`README.md`](./README.md) for the architecture and requirements.
 - Read [`PLAN.md`](./PLAN.md) for implemented phases and the next responsibility.
 - Read the README beside every responsibility you change.
-- Treat `../rte0` as a read-only behavioral reference. Never modify it or any
-  other file outside `rte` while working on RTE.
-
 ## Priorities
 
 - Keep changes focused, compact, readable, and internally consistent.

package/js/rte/PLAN.md

@@ -4,12 +4,6 @@ Each phase ends with documentation, dedicated tests for every production file,
 real-browser verification, and no known failing invariant. Later phases may
 refine earlier contracts, but may not bypass their responsibility boundaries.
 
-The working `../rte0` is a behavioral reference throughout the project. Existing
-behavior, especially host-specific editing, selection handling, and browser
-fixes, is first captured as black-box tests. RTE then preserves or deliberately
-improves it through smaller responsibilities; structural weaknesses in the old
-implementation are not mistaken for behavioral failures.
-
 ## Resume work
 
 Phases 0–3 provide the core, selection/range primitives, content model, scoped

package/js/rte/README.md

@@ -13,6 +13,7 @@ import * as module from "https://cdn.jsdelivr.net/gh/u2ui/u2@main/js/rte/rte.js"
 
 ## Demos
 
+[webkit-data-image-drag.html](http://gcdn.li/u2ui/u2@main/js/rte/tests/webkit-data-image-drag.html)  
 [index.html](http://gcdn.li/u2ui/u2@main/js/rte/tests/index.html)  
 
 ## Start here
@@ -35,9 +36,6 @@ normalization interactively at `/u2/js/rte/playground/`. The runner displays
 its own test count and result. A result is cross-browser evidence only after
 that exact revision has run in current Chromium, Firefox, and WebKit.
 
-`../rte0` is a read-only behavioral reference. Reuse proven behavior and CSS
-configuration ideas, but do not copy its architecture or modify its files.
-
 ## Intended features
 
 - Native `contenteditable`, `Selection`, `Range`, `beforeinput`, and Input
@@ -329,7 +327,6 @@ transactional undo/redo.
 - Exercise the new synchronous extension lifecycle with another contextual UI
   before adding dependency, ordering, or asynchronous setup concepts.
 - Build the browser test matrix for current Chromium, Firefox, and WebKit.
-- Port only the proven ideas from `../rte0`; keep its implementation untouched.
 
 ## About
 

package/js/rte/src/sanitize/README.md

@@ -38,8 +38,13 @@ Event attributes, comments, and data attributes
 are not enabled by default. Inline `style` is: it executes nothing, and where
 foreign presentation is unwanted the Unstyle policy already removes it from what
 an import brought — a policy that must not carry it at all narrows `attributes`.
-Relative URLs use the explicit `relative` protocol token. Known URL attributes
-without a matching protocol rule are removed rather than accepted implicitly.
+A URL that resolves inside the document — `/page`, `page.html`, `#anchor`,
+`?q=1` — passes wherever the attribute has a rule at all. It reaches nowhere the
+document is not, so there is nothing for a policy to allow and nothing an
+application can forbid by forgetting to name it. `//host/x` and `\\host/x` name no
+scheme either but resolve elsewhere: they are absolute URLs in disguise, judged
+as the `http`/`https` ones they turn into. Known URL attributes without a
+matching protocol rule are removed rather than accepted implicitly.
 
 `policy.with(options)` copies a policy with single axes replaced, and
 `policyFor(config, base)` is what a host gets: its own `--u2-rte-elements`,
@@ -52,7 +57,7 @@ returns the base itself.
 const policy = new SanitizePolicy({
     elements: ['p', 'a', 'strong'],
     attributes: {'*': ['class'], a: ['href', 'rel']},
-    protocols: {a: {href: ['https', 'relative']}},
+    protocols: {a: {href: ['https']}},
 });
 ```
 
@@ -127,6 +132,20 @@ through `--u2-rte-classes`; external HTML then cannot smuggle in classes the
 host does not know, and the same list drives the style control and presentation
 cleanup.
 
+## Possible extensions
+
+Neither is planned; both are written down because the protocol list invites them
+and answers neither.
+
+- **A host allowlist.** A protocol list says `https` is fine and cannot say
+  *whose* `https`. An application that wants its own images and no foreign
+  tracking pixel has no way to state it here, and stating it as a protocol —
+  which an earlier `relative` token tried — describes the wrong axis.
+- **Reading the document's CSP.** `img-src`, `media-src` and `frame-src` already
+  declare what the page will load at all. An editor that read them would stop
+  offering what the browser is about to refuse, without a second list to keep in
+  step.
+
 ## TODO
 
 - Add contextual parsing for table and list insertion sites.

package/js/rte/src/sanitize/policy.js

@@ -20,14 +20,14 @@ const DEFAULT_ATTRIBUTES = Object.freeze({
     time: Object.freeze(['datetime']),
 });
 const DEFAULT_PROTOCOLS = Object.freeze({
-    a: Object.freeze({href: Object.freeze(['http', 'https', 'mailto', 'relative', 'tel'])}),
-    blockquote: Object.freeze({cite: Object.freeze(['http', 'https', 'relative'])}),
+    a: Object.freeze({href: Object.freeze(['http', 'https', 'mailto', 'tel'])}),
+    blockquote: Object.freeze({cite: Object.freeze(['http', 'https'])}),
     // `data:` belongs to an image and to nothing else here: an image executes
     // nothing, not even an SVG one, which browsers draw in a script-free
     // context. In a navigating attribute the same protocol is a page, so `a`
     // and the citations keep it out.
-    img: Object.freeze({src: Object.freeze(['data', 'http', 'https', 'relative'])}),
-    q: Object.freeze({cite: Object.freeze(['http', 'https', 'relative'])}),
+    img: Object.freeze({src: Object.freeze(['data', 'http', 'https'])}),
+    q: Object.freeze({cite: Object.freeze(['http', 'https'])}),
 });
 
 // Elements a browser never renders the children of. Unwrapping one turns source — a stylesheet, a
@@ -84,8 +84,7 @@ export class SanitizePolicy {
         const protocols = this.#protocols[element.localName.toLowerCase()]?.[attributeName]
             || this.#protocols['*']?.[attributeName];
         if (!protocols) return false;
-        const protocol = urlProtocol(value, base);
-        return protocol !== null && protocols.includes(protocol);
+        return allowedUrl(value, base, protocols);
     }
 
     // Reduces a subtree to the elements this policy allows, keeping the content
@@ -217,14 +216,17 @@ function protocolGroups(value) {
     return Object.freeze(result);
 }
 
-function urlProtocol(value, base) {
-    const input = String(value).trim();
-    const compact = input.replace(/[\u0000-\u0020]/g, '');
-    if (!/^[a-z][a-z\d+.-]*:/i.test(compact)) return 'relative';
+// A url naming no scheme that lands on the document's own origin — `/page`, `#anchor`, `?q=1` —
+// reaches nowhere the document is not: nothing to allow, and nothing to forbid by forgetting to
+// name it. `//host` and `\\host` name none either but go elsewhere, so their real scheme decides.
+function allowedUrl(value, base, protocols) {
+    const input = String(value).trim().replace(/[\u0000-\u0020]/g, '');
+    const own = !/^([a-z][a-z\d+.-]*:|[/\\]{2})/i.test(input);
     try {
-        return new URL(input, base).protocol.slice(0, -1).toLowerCase();
+        const url = new URL(input, base);
+        return own ? url.origin === new URL(base).origin : protocols.includes(url.protocol.slice(0, -1));
     } catch {
-        return null;
+        return own; // nothing to resolve against — an opaque document keeps its own urls
     }
 }
 

package/js/rte/src/ui/README.md

@@ -4,12 +4,11 @@
 the currently active surface. It provides the roaming behavior; it does not
 create buttons, inject styles, choose icons, or define editor commands.
 
-The useful interaction model comes from the original `../rte0` toolbar: one
-shared toolbar follows the active editor, its items reflect the current
+One shared toolbar follows the active editor, its items reflect the current
 selection, pointer interaction keeps the editor selection, and keyboard
-shortcuts invoke the same actions. RTE replaces the old global item registry,
-`execCommand()`, delayed focus repair, and automatic style injection with the
-existing core, surface, and command contracts.
+shortcuts invoke the same actions. The core, surface, and command contracts
+replace global item registries, `execCommand()`, delayed focus repair, and
+automatic style injection.
 
 ## Contract
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u2ui",
-  "version": "1.5.15",
+  "version": "1.5.17",
   "description": "HTML Advanced: More Capabilities, Same Feel, Same Simplicity",
   "keywords": ["web-components","pattern-library","component-library","ui-toolkit","design-system"],
   "author": "Tobias Buschor",

package/u2/projects.json

@@ -196,14 +196,6 @@
     }
   },
   "el": {
-    "rte0": {
-      "name": "rte0",
-      "description": "\"Rich\" Rich Text Editor (alpha)",
-      "beta": false,
-      "deprecated": false,
-      "css": true,
-      "js": true
-    },
     "tabs": {
       "name": "tabs",
       "description": "Turns HTML structures with headings into an interactive, tabbed interface, using the content between headings as each tab’s content.",
@@ -568,14 +560,6 @@
     }
   },
   "js": {
-    "rte0": {
-      "name": "rte0",
-      "description": "Easily Make Elements Editable with Intuitive Controls",
-      "beta": false,
-      "deprecated": false,
-      "css": false,
-      "js": false
-    },
     "serviceWorker": {
       "name": "serviceWorker",
       "description": "",

package/u2/tools/update.repos.json.js

@@ -1,6 +1,7 @@
 // deno run -A --no-lock ./u2/tools/update.repos.json.js
 
 const repos = {};
+const HIDDEN = new Set(['rte0']);
 
 import * as fs from 'https://deno.land/std@0.100.0/fs/mod.ts';
 
@@ -13,6 +14,7 @@ base = base.replace(/file:\/\/\//, '/');
     for await (const entry of Deno.readDir(base+category)) {
         if (!entry.isDirectory) continue;
         const name = entry.name;
+        if (HIDDEN.has(name)) continue;
         const data = await writeReadMe(category, entry);
 
         const css = fs.existsSync(`${base}${category}/${name}/${name}.css`);

package/u2/tools/update.skill.js

@@ -6,6 +6,7 @@ let base = import.meta.resolve('../../');
 base = base.replace(/file:\/\/\//, '/');
 
 const categories = ['attr', 'class', 'el', 'css', 'js'];
+const HIDDEN = new Set(['rte0']);
 
 async function generateSkillMd() {
     const repos = {};
@@ -16,6 +17,7 @@ async function generateSkillMd() {
             for await (const entry of Deno.readDir(base + category)) {
                 if (!entry.isDirectory) continue;
                 const name = entry.name;
+                if (HIDDEN.has(name)) continue;
                 
                 const readmePath = `${base}${category}/${name}/README.md`;
                 let description = '';
@@ -177,4 +179,4 @@ function trimLines(text) {
     return lines.join('\n');
 }
 
-generateSkillMd();
+generateSkillMd();