Move plugin-contract.md into README's Building plugins section; remove docs/, repoint all references

2026-06-26 23:12:40 +02:00
parent 2b88bf1c0d
commit d8cf257940
11 changed files with 403 additions and 475 deletions
@@ -3,7 +3,7 @@
 //   safeUrl(value)  — sanitise an untrusted URL before rendering it in an href/src attribute.
 //                     Partials escape *text*, but a URL field is emitted verbatim, so a
 //                     `javascript:`/`data:` URL from upstream/user data would be live XSS. The
-//                     contract (docs/plugin-contract.md) is: a relative or http(s) URL is allowed,
+//                     contract (README.md → Routes & handlers) is: a relative or http(s) URL is allowed,
 //                     anything else collapses to "#". Exported to plugins via plugin-api.ts.
 //
 //   localPath(value) — validate a redirect target is a *same-origin* path (the redirect-URI