@astryxdesign/core 0.6.3-canary.98a2e4e → 0.6.3-canary.9e4c545

package/dist/Citation/Citation.d.ts

@@ -1,6 +1,6 @@
 /**
  * @file Citation.tsx
- * @input Uses React, StyleX, theme tokens
+ * @input Uses React, StyleX, theme tokens, and the shared navigation policy
  * @output Exports Citation component for inline citation references
  * @position Core implementation; consumed by index.ts
  *

package/dist/Citation/Citation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Citation.d.ts","sourceRoot":"","sources":["../../src/Citation/Citation.tsx"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,OAAO,CAAC;AAarC,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAK5C,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS,CAAC,WAAW,CAAC;IAC3D,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC9B;AAiHD,wBAAgB,QAAQ,CAAC,EACvB,GAAG,EACH,MAAM,EACN,MAAM,EACN,OAAiB,EACjB,MAAM,EACN,SAAS,EACT,KAAK,EACL,aAAa,EAAE,MAAM,EACrB,GAAG,IAAI,EACR,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY,CA2FpC;yBArGe,QAAQ"}
+{"version":3,"file":"Citation.d.ts","sourceRoot":"","sources":["../../src/Citation/Citation.tsx"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,OAAO,CAAC;AAcrC,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAK5C,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS,CAAC,WAAW,CAAC;IAC3D,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC9B;AAiHD,wBAAgB,QAAQ,CAAC,EACvB,GAAG,EACH,MAAM,EACN,MAAM,EACN,OAAiB,EACjB,MAAM,EACN,SAAS,EACT,KAAK,EACL,aAAa,EAAE,MAAM,EACrB,GAAG,IAAI,EACR,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY,CA4FpC;yBAtGe,QAAQ"}

package/dist/Citation/Citation.js

@@ -4,7 +4,7 @@
 
 /**
  * @file Citation.tsx
- * @input Uses React, StyleX, theme tokens
+ * @input Uses React, StyleX, theme tokens, and the shared navigation policy
  * @output Exports Citation component for inline citation references
  * @position Core implementation; consumed by index.ts
  *
@@ -19,6 +19,7 @@ import * as stylex from '@stylexjs/stylex';
 import "../theme/tokens.stylex.js";
 import { colorVars, spacingVars, radiusVars, typeScaleVars, fontWeightVars, borderVars, durationVars, easeVars } from "../theme/tokens.stylex.js";
 import { mergeProps } from "../utils/index.js";
+import { isSafeUrl } from "../utils/safeUrl.js";
 import { themeProps } from "../utils/themeProps.js";
 import { useTranslator } from "../i18n/index.js";
 import { renderIconSlot } from "../Icon/index.js";
@@ -103,7 +104,7 @@ export function Citation({
 }) {
   const t = useTranslator();
   const title = source.title ?? String(number);
-  const href = source.url;
+  const href = source.url != null && isSafeUrl(source.url) ? source.url : undefined;
 
   // Resolve the source icon. A non-string `icon` node renders as-is (an Astryx
   // <Icon>, SVG, avatar, etc.). Otherwise fall back to an image URL: `src`, or

package/dist/CodeBlock/highlightRanges.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"highlightRanges.d.ts","sourceRoot":"","sources":["../../src/CodeBlock/highlightRanges.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAc,SAAS,EAAC,MAAM,aAAa,CAAC;AA8FxD,UAAU,UAAU;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;CACtB;AAgDD,iBAAS,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAIjD;AA4BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,SAAS,EAAE,GACtB,MAAM,IAAI,CAsHZ;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,SAAS,EAAE,EACvB,SAAS,EAAE,MAAM,GAChB,UAAU,EAAE,CAqBd;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,WAAW,EACf,UAAU,EAAE,SAAS,EAAE,GACtB,MAAM,IAAI,CA2DZ;AAeD;;GAEG;AACH,OAAO,EAAC,aAAa,EAAC,CAAC"}
+{"version":3,"file":"highlightRanges.d.ts","sourceRoot":"","sources":["../../src/CodeBlock/highlightRanges.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAc,SAAS,EAAC,MAAM,aAAa,CAAC;AAwGxD,UAAU,UAAU;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;CACtB;AAgDD,iBAAS,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAIjD;AA4BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,SAAS,EAAE,GACtB,MAAM,IAAI,CAsHZ;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,SAAS,EAAE,EACvB,SAAS,EAAE,MAAM,GAChB,UAAU,EAAE,CAqBd;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,WAAW,EACf,UAAU,EAAE,SAAS,EAAE,GACtB,MAAM,IAAI,CA2DZ;AAeD;;GAEG;AACH,OAAO,EAAC,aAAa,EAAC,CAAC"}

package/dist/CodeBlock/highlightRanges.js

@@ -52,9 +52,20 @@ function ensureDynamicHighlightType(tokenType) {
       return;
     }
   }
-  const name = `astryx-${tokenType}`;
-  const colorVar = `var(--color-syntax-${tokenType}, currentColor)`;
-  dynamicStyleSheet.insertRule(`.astryx-code-block code::highlight(${name}), .astryx-codeeditor code::highlight(${name}) { color: ${colorVar}; }`);
+
+  // CSS.escape both generated names before they land in rule text: the
+  // registry key stays the raw string (a ::highlight() selector matches by
+  // ident VALUE, escapes and all), so dotted, non-ASCII, `_private`, and
+  // digit-led token types keep their colours — while nothing a token stream
+  // carries can step outside its ident and shape the rule.
+  const name = CSS.escape(`astryx-${tokenType}`);
+  const colorVar = `var(${CSS.escape(`--color-syntax-${tokenType}`)}, currentColor)`;
+  try {
+    dynamicStyleSheet.insertRule(`.astryx-code-block code::highlight(${name}), .astryx-codeeditor code::highlight(${name}) { color: ${colorVar}; }`);
+  } catch {
+    // An engine that still refuses the rule costs that type its colour
+    // (ranges paint with currentColor) — never the whole code block.
+  }
 }
 
 // ---------------------------------------------------------------------------

package/dist/Link/useLinkComponent.d.ts

@@ -1,23 +1,13 @@
 import type { LinkComponentType } from './types';
 /**
- * Resolves the link component to use.
- *
- * Priority: `as` prop > `LinkProvider` context > native `<a>`.
- *
- * When the resolved component is a custom component (not the native `<a>`),
- * it is wrapped to receive both `href` and `to` props set to the same value.
- * This allows `to`-based routers (React Router, TanStack Router) to work
- * out of the box without a manual adapter.
- *
- * @param as - Per-component override. If provided, takes highest priority.
- * @returns The resolved link component (with `to` injection for custom components).
+ * Resolve `as`, then LinkProvider, then a native anchor. Both destination props
+ * are checked before rendering; accepted structured values retain identity.
+ * Custom components receive `to={href}` unless an explicit `to` is supplied.
  *
  * @example
  * ```
- * function MyComponent({ as }: { as?: LinkComponentType }) {
- *   const LinkComponent = useLinkComponent(as);
- *   return <LinkComponent href="/foo">Click me</LinkComponent>;
- * }
+ * const LinkComponent = useLinkComponent(as);
+ * return <LinkComponent href="/docs">Documentation</LinkComponent>;
  * ```
  */
 export declare function useLinkComponent(as?: LinkComponentType): LinkComponentType;

package/dist/Link/useLinkComponent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useLinkComponent.d.ts","sourceRoot":"","sources":["../../src/Link/useLinkComponent.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,SAAS,CAAC;AAgC/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,CAAC,EAAE,iBAAiB,GACrB,iBAAiB,CAYnB"}
+{"version":3,"file":"useLinkComponent.d.ts","sourceRoot":"","sources":["../../src/Link/useLinkComponent.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,SAAS,CAAC;AA+B/C;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAI1E"}

package/dist/Link/useLinkComponent.js

@@ -4,79 +4,62 @@
 
 /**
  * @file useLinkComponent.ts
- * @input React use, useMemo, createElement, forwardRef, LinkContext, LinkComponentType
- * @output Exports useLinkComponent hook
- * @position Hook for resolving the link component in Astryx components
+ * @input Per-component override, LinkProvider context, and navigation props
+ * @output Stable link component with destination checks and custom-router `to` injection
+ * @position Shared native and custom link boundary; rejected destinations render
+ *   as destination-less anchors without invoking a router.
  *
- * Resolution order: per-component `as` prop > LinkProvider context > native `<a>`.
- *
- * When the resolved component is a custom component (not native `<a>`),
- * wraps it to pass `to={href}` alongside `href`. This enables compatibility
- * with routers that use `to` (React Router, TanStack Router)
- * without requiring an adapter component.
- *
- * SYNC: When modified, update these files to stay in sync:
- * - /packages/core/src/Link/index.ts
- * - /packages/core/src/Link/Link.doc.mjs
+ * SYNC: Link.doc.mjs and LinkProvider.doc.mjs describe this boundary.
  */
 import { use, useMemo, createElement } from 'react';
 import { LinkContext } from "./LinkContext.js";
-/**
- * Creates a wrapper component that passes both `href` and `to` props
- * to the underlying link component. This enables routers that use `to`
- * (React Router, TanStack Router) to work without an adapter.
- *
- * The wrapper is transparent: it forwards refs and all other props unchanged.
- * Native `<a>` elements ignore the unknown `to` prop harmlessly.
- */
-function createLinkWithTo(Component) {
-  function LinkWithTo({
+import { isSafeDestination } from "../utils/safeUrl.js";
+function createSafeLink(Component) {
+  function SafeLink({
     href,
+    to,
     ref,
     ...rest
   }) {
+    // An undefined destination can crash a router or resolve to the current
+    // route. Reject the whole handoff, not just one prop or a fallback value.
+    if (!isSafeDestination(href) || !isSafeDestination(to)) {
+      return /*#__PURE__*/createElement('a', {
+        ref,
+        ...rest
+      });
+    }
+    if (Component === 'a') {
+      return /*#__PURE__*/createElement('a', {
+        ref,
+        ...rest,
+        href
+      });
+    }
     return /*#__PURE__*/createElement(Component, {
       ref,
+      ...rest,
       href,
-      to: href,
-      ...rest
+      to: to ?? href
     });
   }
-  LinkWithTo.displayName = `LinkWithTo(${typeof Component === 'string' ? Component : Component.displayName || Component.name || 'Component'})`;
-  return LinkWithTo;
+  SafeLink.displayName = `SafeLink(${typeof Component === 'string' ? Component : Component.displayName || Component.name || 'Component'})`;
+  return SafeLink;
 }
 
 /**
- * Resolves the link component to use.
- *
- * Priority: `as` prop > `LinkProvider` context > native `<a>`.
- *
- * When the resolved component is a custom component (not the native `<a>`),
- * it is wrapped to receive both `href` and `to` props set to the same value.
- * This allows `to`-based routers (React Router, TanStack Router) to work
- * out of the box without a manual adapter.
- *
- * @param as - Per-component override. If provided, takes highest priority.
- * @returns The resolved link component (with `to` injection for custom components).
+ * Resolve `as`, then LinkProvider, then a native anchor. Both destination props
+ * are checked before rendering; accepted structured values retain identity.
+ * Custom components receive `to={href}` unless an explicit `to` is supplied.
  *
  * @example
  * ```
- * function MyComponent({ as }: { as?: LinkComponentType }) {
- *   const LinkComponent = useLinkComponent(as);
- *   return <LinkComponent href="/foo">Click me</LinkComponent>;
- * }
+ * const LinkComponent = useLinkComponent(as);
+ * return <LinkComponent href="/docs">Documentation</LinkComponent>;
  * ```
  */
 export function useLinkComponent(as) {
   const ctx = use(LinkContext);
   const resolved = as ?? ctx?.component ?? 'a';
-
-  // Memoize the wrapper to maintain referential stability.
-  // The wrapper is only created for custom components (not native <a>).
-  return useMemo(() => {
-    if (resolved === 'a') {
-      return 'a';
-    }
-    return createLinkWithTo(resolved);
-  }, [resolved]);
+  return useMemo(() => createSafeLink(resolved), [resolved]);
 }

package/dist/Markdown/Markdown.js

@@ -35,7 +35,7 @@ import { parseInlineAst, parseMarkdownAst, parseMarkdownAstIncremental, createIn
 import { getMarkdownAstLegacyCodeLanguage, markdownAstText } from "./ast.js";
 import { applyMarkdownTransforms, getMarkdownExtensionRenderer, markdownExtensionText, prepareMarkdownPlugins, reportMarkdownPluginFailure } from "./plugins/protocol.js";
 import { getMarkdownFenceProposal } from "./plugins/semanticFence.js";
-import { sanitizeMarkdownUrl } from "./url.js";
+import { sanitizeMarkdownLinkUrl, sanitizeMarkdownUrl } from "./url.js";
 import { themeProps } from "../utils/themeProps.js";
 import { useTranslator } from "../i18n/index.js";
 
@@ -668,7 +668,7 @@ function renderInline(node, index, onLinkClick, cursor, citationCtx, linkCompone
       }
     case 'link':
       {
-        const safeHref = sanitizeMarkdownUrl(node.url);
+        const safeHref = sanitizeMarkdownLinkUrl(node.url);
         if (safeHref == null) {
           // Unsafe URL — render as plain text
           return /*#__PURE__*/_jsx("span", {

package/dist/Markdown/url.d.ts

@@ -1,4 +1,6 @@
 /** Preserve the released parser policy for no-plugin output compatibility. */
 export declare function isSafeMarkdownParserUrl(url: string): boolean;
+/** Navigation and image rendering deliberately have different policies. */
+export declare function sanitizeMarkdownLinkUrl(url: string): string | null;
 export declare function sanitizeMarkdownUrl(url: string): string | null;
 //# sourceMappingURL=url.d.ts.map

package/dist/Markdown/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/Markdown/url.ts"],"names":[],"mappings":"AAmBA,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9D"}
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/Markdown/url.ts"],"names":[],"mappings":"AAmBA,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9D"}

package/dist/Markdown/url.js

@@ -7,7 +7,7 @@
  * @position Shared URL policy for parser, transforms, and renderer
  */
 
-const PARSER_DANGEROUS_URL_PATTERN = /^(?:javascript:|data:text\/html|vbscript:)/i;
+import { isSafeUrl, sanitizeUrl } from "../utils/safeUrl.js";
 const RENDER_DANGEROUS_URL_PATTERN = /^(?:javascript:|data:|vbscript:)/i;
 function normalizeMarkdownUrl(url) {
   // Browsers ignore embedded controls in schemes, so normalize before checking.
@@ -17,7 +17,13 @@ function normalizeMarkdownUrl(url) {
 
 /** Preserve the released parser policy for no-plugin output compatibility. */
 export function isSafeMarkdownParserUrl(url) {
-  return !PARSER_DANGEROUS_URL_PATTERN.test(normalizeMarkdownUrl(url));
+  return isSafeUrl(url);
+}
+
+/** Navigation and image rendering deliberately have different policies. */
+export function sanitizeMarkdownLinkUrl(url) {
+  const normalized = sanitizeUrl(url);
+  return normalized === '' ? null : normalized;
 }
 export function sanitizeMarkdownUrl(url) {
   const normalized = normalizeMarkdownUrl(url);

package/dist/TopNav/TopNavMenu.d.ts

@@ -1,7 +1,7 @@
 /**
  * @file TopNavMenu.tsx
  * @input Uses React, StyleX, usePopover, useMenuHover, useListFocus,
- *   useTypeahead, TopNavItem tokens
+ *   useTypeahead, TopNavItem tokens, and the shared navigation policy
  * @output Exports TopNavMenu component and related types
  * @position Navigation item with hover-triggered overflow menu for TopNav
  *

package/dist/TopNav/TopNavMenu.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TopNavMenu.d.ts","sourceRoot":"","sources":["../../src/TopNav/TopNavMenu.tsx"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,EAKZ,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AASf,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAqM5C;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAMD,MAAM,WAAW,eAAgB,SAAQ,SAAS,CAAC,iBAAiB,CAAC;IACnE,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAE5B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,wBAAgB,UAAU,CAAC,EACzB,GAAG,EACH,KAAK,EACL,KAAK,EACL,KAAW,EACX,SAAe,EACf,MAAM,EACN,SAAS,EACT,KAAK,EACL,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,gBAAgB,EAC9B,YAAY,EAAE,gBAAgB,EAC9B,GAAG,IAAI,EACR,EAAE,eAAe,4BAqQjB;yBAlRe,UAAU"}
+{"version":3,"file":"TopNavMenu.d.ts","sourceRoot":"","sources":["../../src/TopNav/TopNavMenu.tsx"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,EAKZ,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AASf,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAsM5C;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAMD,MAAM,WAAW,eAAgB,SAAQ,SAAS,CAAC,iBAAiB,CAAC;IACnE,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAE5B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,wBAAgB,UAAU,CAAC,EACzB,GAAG,EACH,KAAK,EACL,KAAK,EACL,KAAW,EACX,SAAe,EACf,MAAM,EACN,SAAS,EACT,KAAK,EACL,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,gBAAgB,EAC9B,YAAY,EAAE,gBAAgB,EAC9B,GAAG,IAAI,EACR,EAAE,eAAe,4BAyQjB;yBAtRe,UAAU"}

package/dist/TopNav/TopNavMenu.js

@@ -5,7 +5,7 @@
 /**
  * @file TopNavMenu.tsx
  * @input Uses React, StyleX, usePopover, useMenuHover, useListFocus,
- *   useTypeahead, TopNavItem tokens
+ *   useTypeahead, TopNavItem tokens, and the shared navigation policy
  * @output Exports TopNavMenu component and related types
  * @position Navigation item with hover-triggered overflow menu for TopNav
  *
@@ -29,6 +29,7 @@ import { useTopNavSlot } from "./TopNavContext.js";
 import { useTopNavRenderMode } from "./TopNavRenderContext.js";
 import { useAppShellMobile } from "../AppShell/AppShellMobileContext.js";
 import { useLinkComponent } from "../Link/useLinkComponent.js";
+import { isSafeUrl } from "../utils/safeUrl.js";
 import { themeProps } from "../utils/themeProps.js";
 import { focusOutlineProps } from "../utils/focusOutline.stylex.js";
 import { interactionOverlayStyles } from "../utils/interactionOverlay.stylex.js";
@@ -378,7 +379,7 @@ export function TopNavMenu({
           // promotes exactly one item to 0.
           ,
           tabIndex: -1,
-          href: item.href,
+          href: item.href != null && isSafeUrl(item.href) ? item.href : undefined,
           onClick: item.onClick,
           ...focusOutlineProps.focusVisible(styles.menuItem),
           children: [/*#__PURE__*/_jsx("div", {

package/dist/hooks/useClickableContainer.d.ts

@@ -7,6 +7,11 @@
  * Solves the "nested interactive elements" problem: when a card is clickable
  * but contains buttons/links, clicking those should NOT trigger the card's action.
  *
+ * Every navigation exit here (window.open, location.href, and the delegated
+ * click on the interactive ref) runs after the shared navigation-destination
+ * rule in utils/safeUrl.ts; a blocked href does not navigate by any
+ * activation method.
+ *
  * SYNC: When modified, update:
  * - /packages/core/src/hooks/index.ts (export)
  */
@@ -30,7 +35,11 @@ export interface UseClickableContainerOptions {
     interactiveRef?: RefObject<HTMLElement | null>;
     /** Click handler */
     onClick?: (event: MouseEvent<HTMLElement>) => void;
-    /** Navigation URL — when provided, clicking the container navigates */
+    /**
+     * Navigation URL — when provided, clicking the container navigates. Checked
+     * with the shared navigation rule (utils/safeUrl.ts) before any activation
+     * method (plain, new-tab, Cmd/Ctrl-click, middle-click, delegated click).
+     */
     href?: string;
     /** Link target */
     target?: string;

package/dist/hooks/useClickableContainer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useClickableContainer.d.ts","sourceRoot":"","sources":["../../src/hooks/useClickableContainer.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAyB,KAAK,SAAS,EAAE,KAAK,UAAU,EAAC,MAAM,OAAO,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,QAmBvB,CAAC;AAmCZ,MAAM,WAAW,4BAA4B;IAC3C,yCAAyC;IACzC,YAAY,EAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5C,mEAAmE;IACnE,cAAc,CAAC,EAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/C,oBAAoB;IACpB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACnD,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IAClD,SAAS,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,YAAY,EACZ,cAAc,EACd,OAAO,EAAE,WAAW,EACpB,IAAI,EACJ,MAAM,EACN,QAAgB,GACjB,EAAE,4BAA4B,GAAG,wBAAwB,CA6GzD"}
+{"version":3,"file":"useClickableContainer.d.ts","sourceRoot":"","sources":["../../src/hooks/useClickableContainer.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAyB,KAAK,SAAS,EAAE,KAAK,UAAU,EAAC,MAAM,OAAO,CAAC;AAG9E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,QAmBvB,CAAC;AAmCZ,MAAM,WAAW,4BAA4B;IAC3C,yCAAyC;IACzC,YAAY,EAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5C,mEAAmE;IACnE,cAAc,CAAC,EAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/C,oBAAoB;IACpB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACnD;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IAClD,SAAS,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,YAAY,EACZ,cAAc,EACd,OAAO,EAAE,WAAW,EACpB,IAAI,EACJ,MAAM,EACN,QAAgB,GACjB,EAAE,4BAA4B,GAAG,wBAAwB,CAmHzD"}

package/dist/hooks/useClickableContainer.js

@@ -11,10 +11,16 @@
  * Solves the "nested interactive elements" problem: when a card is clickable
  * but contains buttons/links, clicking those should NOT trigger the card's action.
  *
+ * Every navigation exit here (window.open, location.href, and the delegated
+ * click on the interactive ref) runs after the shared navigation-destination
+ * rule in utils/safeUrl.ts; a blocked href does not navigate by any
+ * activation method.
+ *
  * SYNC: When modified, update:
  * - /packages/core/src/hooks/index.ts (export)
  */
 import { useCallback, useEffect } from 'react';
+import { isSafeUrl } from "../utils/safeUrl.js";
 
 /**
  * Canonical list of interactive element selectors — native controls plus
@@ -128,8 +134,12 @@ export function useClickableContainer({
       return;
     }
 
-    // Navigate if href is provided
-    if (href != null) {
+    // Navigate if href is provided. React DOM vets the hrefs it writes as
+    // attributes; nothing below passes through React, so the shared
+    // navigation rule decides once, before target, modifier key, or the
+    // delegated anchor can select a sink. A blocked href simply does not
+    // navigate — the click handler above still ran.
+    if (href != null && isSafeUrl(href)) {
       const shouldOpenNewTab = target === '_blank' || event.ctrlKey || event.metaKey;
       if (shouldOpenNewTab) {
         window.open(href, '_blank', 'noopener');
@@ -171,9 +181,10 @@ export function useClickableContainer({
       return;
     }
 
-    // Middle-click on href opens in new tab
+    // Middle-click on href opens in new tab (same scheme rule as onClick —
+    // this navigation never passes through React either).
     const isMiddleClick = event.button === 1;
-    if (isMiddleClick && href != null && (eventTarget === event.currentTarget || !hasInteractiveAncestor(eventTarget, containerEl))) {
+    if (isMiddleClick && href != null && isSafeUrl(href) && (eventTarget === event.currentTarget || !hasInteractiveAncestor(eventTarget, containerEl))) {
       window.open(href, '_blank', 'noopener');
     }
   }, [containerRef, href, disabled]);

package/dist/utils/safeUrl.d.ts

@@ -0,0 +1,11 @@
+/** Return a normalized navigation URL, or null for a blocked scheme. */
+export declare function sanitizeUrl(url: string): string | null;
+/** Inspect a navigation string without changing the value used by its sink. */
+export declare function isSafeUrl(url: string): boolean;
+/**
+ * Inspect React Router paths, Next.js URL objects, and URL instances without
+ * serializing or replacing the object handed to the router. Search/query/hash
+ * are route-relative data, not schemes. Absent destinations remain absent.
+ */
+export declare function isSafeDestination(destination: unknown): boolean;
+//# sourceMappingURL=safeUrl.d.ts.map

package/dist/utils/safeUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeUrl.d.ts","sourceRoot":"","sources":["../../src/utils/safeUrl.ts"],"names":[],"mappings":"AAcA,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtD;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CA8C/D"}

package/dist/utils/safeUrl.js

@@ -0,0 +1,78 @@
+// Copyright (c) Meta Platforms, Inc. and affiliates.
+
+/**
+ * @file safeUrl.ts
+ * @input Navigation strings or supported structured router destinations
+ * @output The shared blocked-scheme decision, without rewriting accepted inputs
+ * @position Core navigation policy; embedded-resource policy is separate
+ */
+
+function normalizeUrl(url) {
+  // eslint-disable-next-line no-control-regex -- inspect schemes without browser-ignored controls
+  return url.replace(/[\x00-\x1f\x7f]/g, '').trim();
+}
+
+/** Return a normalized navigation URL, or null for a blocked scheme. */
+export function sanitizeUrl(url) {
+  const normalized = normalizeUrl(url);
+  const lower = normalized.toLowerCase();
+  if (lower.startsWith('javascript:') || lower.startsWith('vbscript:') || lower.startsWith('data:text/html')) {
+    return null;
+  }
+  return normalized;
+}
+
+/** Inspect a navigation string without changing the value used by its sink. */
+export function isSafeUrl(url) {
+  return sanitizeUrl(url) !== null;
+}
+
+/**
+ * Inspect React Router paths, Next.js URL objects, and URL instances without
+ * serializing or replacing the object handed to the router. Search/query/hash
+ * are route-relative data, not schemes. Absent destinations remain absent.
+ */
+export function isSafeDestination(destination) {
+  if (destination == null) {
+    return true;
+  }
+  if (typeof destination === 'string') {
+    return isSafeUrl(destination);
+  }
+  if (typeof destination !== 'object') {
+    return false;
+  }
+  const {
+    pathname,
+    href,
+    protocol,
+    host,
+    hostname
+  } = destination;
+  for (const field of [pathname, href, protocol, host, hostname]) {
+    if (field != null && typeof field !== 'string') {
+      return false;
+    }
+  }
+  if (typeof pathname === 'string' && !isSafeUrl(pathname)) {
+    return false;
+  }
+  if (typeof href === 'string' && !isSafeUrl(href)) {
+    return false;
+  }
+  if (typeof protocol === 'string' && protocol !== '') {
+    // URL-object formatters accept a protocol with or without its colon and
+    // can assemble a data media type from the host and pathname fields.
+    const normalizedProtocol = normalizeUrl(protocol);
+    const prefix = normalizedProtocol.endsWith(':') ? normalizedProtocol : `${normalizedProtocol}:`;
+    if (!isSafeUrl(prefix)) {
+      return false;
+    }
+    const body = host || hostname || '';
+    const path = typeof pathname === 'string' ? pathname : '';
+    if (!isSafeUrl(`${prefix}${body}${path}`)) {
+      return false;
+    }
+  }
+  return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astryxdesign/core",
-  "version": "0.6.3-canary.98a2e4e",
+  "version": "0.6.3-canary.9e4c545",
   "displayName": "Astryx Core",
   "description": "The component library. Accessible, themeable React components with built-in spacing, dark mode, and StyleX styling.",
   "author": "Meta Open Source",
@@ -692,8 +692,8 @@
     "react-dom": ">=19.0.0"
   },
   "devDependencies": {
-    "@astryxdesign/a11y-spec": "0.6.3-canary.98a2e4e",
-    "@astryxdesign/cli": "0.6.3-canary.98a2e4e",
+    "@astryxdesign/a11y-spec": "0.6.3-canary.9e4c545",
+    "@astryxdesign/cli": "0.6.3-canary.9e4c545",
     "@babel/cli": "^7.29.7",
     "@babel/core": "^7.29.7",
     "@babel/preset-react": "^7.29.7",

package/src/Button/Button.doc.mjs

@@ -210,7 +210,7 @@ export const docs = {
       name: 'href',
       type: 'string',
       description:
-        'When provided, renders the button as a link element (<a> or custom link component).',
+        'When provided, renders the button as a link element (<a> or custom link component). The destination follows the shared navigation rule described on the Link `href` prop.',
     },
     {
       name: 'as',

package/src/Citation/Citation.doc.mjs

@@ -71,7 +71,7 @@ export const docs = {
       name: 'source',
       type: 'CitationSource',
       description:
-        'The citation source object containing title, url, an optional image src, and an optional icon node.',
+        'The citation source object containing title, url, an optional image src, and an optional icon node. The url follows the shared navigation rule described on the Link `href` prop; rejected destinations leave the citation visible without navigation. Image src uses separate resource handling.',
       required: true,
     },
     {
@@ -122,7 +122,7 @@ export const docsDense = {
   },
   propDescriptions: {
     source:
-      'citation source object with title, url, optional image src, and optional icon node.',
+      'citation source with title, url, optional image src, and optional icon. url follows the Link href navigation rule; rejected destinations stay visible without navigation. Image src handling is separate.',
     number: 'display index for this citation.',
     variant: 'display style: label chip with source title or compact numbered badge.',
   },

package/src/Citation/Citation.test.tsx

@@ -36,6 +36,23 @@ function atomicClasses(style: (typeof probe)[keyof typeof probe]): string[] {
 describe('Citation', () => {
   const source = {title: 'Example Source', url: 'https://example.com'};
 
+  it.each([
+    'javascript:alert(1)',
+    'vbscript:MsgBox(1)',
+    'data:text/html,<b>x</b>',
+    'java\nscript:alert(1)',
+  ])('renders rejected citation URL %s without navigation', url => {
+    const {container} = render(
+      <>
+        <Citation source={{title: 'Source', url}} number={1} />
+        <Citation source={{title: 'Source', url}} number={1} variant="number" />
+      </>,
+    );
+    expect(container.querySelector('a')).toBeNull();
+    expect(container.querySelector('[href]')).toBeNull();
+    expect(container.textContent).toBe('Source1');
+  });
+
   it('renders the source title as a link in the label variant', () => {
     render(<Citation source={source} number={1} data-testid="citation" />);
     const el = screen.getByTestId('citation');

package/src/Citation/Citation.tsx

@@ -4,7 +4,7 @@
 
 /**
  * @file Citation.tsx
- * @input Uses React, StyleX, theme tokens
+ * @input Uses React, StyleX, theme tokens, and the shared navigation policy
  * @output Exports Citation component for inline citation references
  * @position Core implementation; consumed by index.ts
  *
@@ -30,6 +30,7 @@ import {
   easeVars,
 } from '../theme/tokens.stylex';
 import {mergeProps} from '../utils';
+import {isSafeUrl} from '../utils/safeUrl';
 import type {BaseProps} from '../BaseProps';
 import {themeProps} from '../utils/themeProps';
 import {useTranslator} from '../i18n';
@@ -189,7 +190,8 @@ export function Citation({
 }: CitationProps): React.ReactElement {
   const t = useTranslator();
   const title = source.title ?? String(number);
-  const href = source.url;
+  const href =
+    source.url != null && isSafeUrl(source.url) ? source.url : undefined;
 
   // Resolve the source icon. A non-string `icon` node renders as-is (an Astryx
   // <Icon>, SVG, avatar, etc.). Otherwise fall back to an image URL: `src`, or

package/src/ClickableCard/ClickableCard.doc.mjs

@@ -22,7 +22,7 @@ export const docs = {
   props: [
     {name: 'label', type: 'string', description: 'Accessibility label.', required: true},
     {name: 'onClick', type: '(event: MouseEvent) => void', description: 'Click handler: fires on card surface only.'},
-    {name: 'href', type: 'string', description: 'Navigation URL.'},
+    {name: 'href', type: 'string', description: 'Navigation URL. Plain, new-tab, Cmd/Ctrl-click, and middle-click activation all follow the shared navigation rule described on the Link `href` prop.'},
     {name: 'target', type: 'string', description: 'Link target.', default: "'_self'"},
     {name: 'isDisabled', type: 'boolean', description: 'Disables the card.', default: 'false'},
     {name: 'children', type: 'ReactNode', description: 'Card content.'},
@@ -69,7 +69,7 @@ export const docsDense = {
   propDescriptions: {
     label: 'accessibility label',
     onClick: 'click handler: fires on card surface only',
-    href: 'navigation URL',
+    href: 'navigation URL; every activation follows the shared navigation rule (see Link href)',
     target: 'link target',
     isDisabled: 'disables card',
     padding: 'inner padding',