@astryxdesign/core 0.6.3-canary.f22695a → 0.6.3

package/src/Link/useLinkComponent.ts

@@ -4,61 +4,89 @@
 
 /**
  * @file useLinkComponent.ts
- * @input Per-component override, LinkProvider context, and navigation props
- * @output Stable link component with destination checks and custom-router `to` injection
- * @position Shared native and custom link boundary; rejected destinations render
- *   as destination-less anchors without invoking a router.
+ * @input React use, useMemo, createElement, forwardRef, LinkContext, LinkComponentType
+ * @output Exports useLinkComponent hook
+ * @position Hook for resolving the link component in Astryx components
  *
- * SYNC: Link.doc.mjs and LinkProvider.doc.mjs describe this boundary.
+ * Resolution order: per-component `as` prop > LinkProvider context > native `<a>`.
+ *
+ * When the resolved component is a custom component (not native `<a>`),
+ * wraps it to pass `to={href}` alongside `href`. This enables compatibility
+ * with routers that use `to` (React Router, TanStack Router)
+ * without requiring an adapter component.
+ *
+ * SYNC: When modified, update these files to stay in sync:
+ * - /packages/core/src/Link/index.ts
+ * - /packages/core/src/Link/Link.doc.mjs
  */
 
 import {use, useMemo, createElement} from 'react';
 import {LinkContext} from './LinkContext';
-import {isSafeDestination} from '../utils/safeUrl';
 import type {LinkComponentType} from './types';
 
-function createSafeLink(Component: LinkComponentType): LinkComponentType {
-  function SafeLink({
+/**
+ * Creates a wrapper component that passes both `href` and `to` props
+ * to the underlying link component. This enables routers that use `to`
+ * (React Router, TanStack Router) to work without an adapter.
+ *
+ * The wrapper is transparent: it forwards refs and all other props unchanged.
+ * Native `<a>` elements ignore the unknown `to` prop harmlessly.
+ */
+function createLinkWithTo(
+  Component: LinkComponentType,
+): LinkComponentType {
+  function LinkWithTo({
     href,
-    to,
     ref,
     ...rest
   }: {
-    href?: unknown;
-    to?: unknown;
+    href?: string;
+    to?: string;
     ref?: React.Ref<unknown>;
   }) {
-    // An undefined destination can crash a router or resolve to the current
-    // route. Reject the whole handoff, not just one prop or a fallback value.
-    if (!isSafeDestination(href) || !isSafeDestination(to)) {
-      return createElement('a', {ref, ...rest});
-    }
-    if (Component === 'a') {
-      return createElement('a', {ref, ...rest, href});
-    }
-    return createElement(Component, {ref, ...rest, href, to: to ?? href});
+    return createElement(Component, {ref, href, to: href, ...rest});
   }
-  SafeLink.displayName = `SafeLink(${
+  LinkWithTo.displayName = `LinkWithTo(${
     typeof Component === 'string'
       ? Component
       : Component.displayName || Component.name || 'Component'
   })`;
-  return SafeLink as LinkComponentType;
+  return LinkWithTo as LinkComponentType;
 }
 
 /**
- * Resolve `as`, then LinkProvider, then a native anchor. Both destination props
- * are checked before rendering; accepted structured values retain identity.
- * Custom components receive `to={href}` unless an explicit `to` is supplied.
+ * Resolves the link component to use.
+ *
+ * Priority: `as` prop > `LinkProvider` context > native `<a>`.
+ *
+ * When the resolved component is a custom component (not the native `<a>`),
+ * it is wrapped to receive both `href` and `to` props set to the same value.
+ * This allows `to`-based routers (React Router, TanStack Router) to work
+ * out of the box without a manual adapter.
+ *
+ * @param as - Per-component override. If provided, takes highest priority.
+ * @returns The resolved link component (with `to` injection for custom components).
  *
  * @example
  * ```
- * const LinkComponent = useLinkComponent(as);
- * return <LinkComponent href="/docs">Documentation</LinkComponent>;
+ * function MyComponent({ as }: { as?: LinkComponentType }) {
+ *   const LinkComponent = useLinkComponent(as);
+ *   return <LinkComponent href="/foo">Click me</LinkComponent>;
+ * }
  * ```
  */
-export function useLinkComponent(as?: LinkComponentType): LinkComponentType {
+export function useLinkComponent(
+  as?: LinkComponentType,
+): LinkComponentType {
   const ctx = use(LinkContext);
   const resolved = as ?? ctx?.component ?? 'a';
-  return useMemo(() => createSafeLink(resolved), [resolved]);
+
+  // Memoize the wrapper to maintain referential stability.
+  // The wrapper is only created for custom components (not native <a>).
+  return useMemo(() => {
+    if (resolved === 'a') {
+      return 'a';
+    }
+    return createLinkWithTo(resolved);
+  }, [resolved]);
 }

package/src/List/ListItem.doc.mjs

@@ -67,7 +67,7 @@ export const docs = {
     {
       name: 'href',
       type: 'string',
-      description: 'Link URL; enables the invisible anchor pattern. The destination follows the shared navigation rule described on the Link `href` prop.',
+      description: 'Link URL; enables the invisible anchor pattern.',
     },
     {
       name: 'target',
@@ -174,7 +174,7 @@ export const docsDense = {
     onClick: 'Click handler; enables invisible button pattern.',
     interactiveRef:
       'Ref to a nested control that owns the item\'s keyboard access/action; row delegates surface clicks to it (useClickableContainer), no invisible button/anchor, no second tab stop (WCAG 4.1.2). Mutually exclusive with onClick/href.',
-    href: 'Link URL; enables invisible anchor pattern. Follows the shared navigation rule (see Link href).',
+    href: 'Link URL; enables invisible anchor pattern.',
     target: 'Link target attribute, only when href provided. target="_blank" auto-adds noopener noreferrer.',
     rel: 'Link relationship tokens. noopener noreferrer are merged for target="_blank".',
     isDisabled: 'Disabled state; sets aria-disabled.',

package/src/Markdown/Markdown.doc.mjs

@@ -112,7 +112,7 @@ export const docs = {
       name: 'onLinkClick',
       type: '(href: string, event: MouseEvent) => void | false',
       description:
-        'Handler for link clicks. Return false to prevent the default navigation behavior. Link destinations in the markdown follow the shared navigation rule described on the Link `href` prop: a blocked destination renders as plain text and never reaches this handler or a custom link renderer. Image URLs use a separate, stricter policy (every data: URL is rejected).',
+        'Handler for link clicks. Return false to prevent the default navigation behavior.',
     },
     {
       name: 'sources',
@@ -859,7 +859,7 @@ export const docsDense = {
     isStreaming:
       'Incremental parse + fade-in for streamed chunks. Default: false.',
     onLinkClick:
-      '(href, event) => void|false. Return false prevents navigation. Link destinations follow the shared navigation rule (see Link href); blocked ones render as text. Image URLs: separate stricter policy.',
+      '(href, event) => void|false. Return false prevents navigation.',
     sources:
       'Record<string, MarkdownSource>. Citation sources by ID. [id]/【id】 markers render as chips.',
     citationStyle:

package/src/Markdown/Markdown.spec.md

@@ -13,7 +13,6 @@ review_triggers: [api, theming]
 verified_by:
   [
     packages/core/src/Markdown/Markdown.test.tsx,
-    packages/core/src/Markdown/Markdown.renderBoundary.test.tsx,
     packages/core/src/Markdown/Markdown.public.test.ts,
     packages/core/src/Markdown/parser.test.ts,
     packages/core/src/Markdown/incremental.test.ts,
@@ -317,9 +316,7 @@ and this change preserves the existing spelling exactly.
   current with the implementation.
 - `family:navigation-destinations` owns the shared accept/block result for parsed
   links and every Astryx-owned navigation sink. `spec:AST-005/DEC-1` requires
-  Markdown parsing and link rendering to preserve the same normalized navigation
-  decision as other Core links. Rejected links remain inert and do not reach a
-  custom link renderer; accepted links retain their ordinary behavior.
+  Markdown navigation to remain conformant with Core link plumbing.
 - `spec:AST-005/DEC-2` keeps embedded-resource policy separate. Markdown may
   reject a broader set of image/resource URLs without narrowing the shared
   navigation contract.
@@ -335,21 +332,20 @@ and this change preserves the existing spelling exactly.
 
 ## Verification map
 
-| Contract               | Verification                                                                  | Representative states                                                                                                                  | Failure signal                                                                                                                                        |
-| ---------------------- | ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
-| FR1–FR5                | `Markdown.test.tsx`, theme-target tests, and `scripts/check-knowledge.mjs`    | Default block/inline output and all current targets                                                                                    | Existing DOM, target, spacing, or renderer behavior changes.                                                                                          |
-| FR6–FR10               | `parser.test.ts` and `Markdown.test.tsx`                                      | Opt-out, inline/display math, escapes, currency, code, links, plugins                                                                  | A delimiter is claimed without opt-in, TeX is formatted as Markdown, or opaque contexts leak.                                                         |
-| FR11                   | `incremental.test.ts` and `Markdown.test.tsx`                                 | Every-character top-level/list/task-list/blockquote splits, CRLF, source ranges                                                        | Streaming diverges from a full parse, shows partial syntax, mistakes a nested closer for an opener, or crosses a closed container.                    |
-| FR12–FR16              | plugin, transform, adapter, performance, and Outline parser tests             | omitted/empty lists, immutable transforms, invalid outputs, live updates, one compatible Remark plugin, duplicate headings             | Empty behavior forks, input mutates, invalid structure escapes, transforms reparse, adapter loses content, budgets fail, or heading targets diverge.  |
-| FR17–FR18              | container parse/validation, ownership, and dependency tests                   | leaf/container declarations, nested containers, foreign read/remove/mint/edit, unmet/misordered dependencies                           | Plugin-built parsed children, invalid content, lost fallback children, foreign mint/edit, or generic ownership codes.                                 |
-| FR19                   | diagnostic-channel tests in development and production                        | every phase, advisory reports, rate suppression, no handler, malformed list, duplicate Core, version skew                              | A silent production failure, document content in a diagnostic, or one entrypoint throwing where another recovers.                                     |
-| FR20–FR22              | canonical/server imports, inference, streaming, preparation, theming tests    | server imports, no explicit type args, chunk boundaries, recreated lists, themed/unthemed extensions                                   | Client references, explicit-type workarounds, oscillation, per-render re-preparation, or unreachable opted-in output.                                 |
-| FR23                   | parser, renderer, nesting, and public option tests                            | task-only, plain-only, and mixed ordered/unordered lists at top level and nested; autolink omitted/enabled                             | A mixed list splits or loses order/state, a plain item becomes a checkbox, or `autolink: 'gfm'` changes non-autolink syntax.                          |
-| FR24                   | `plugins/frontmatter.test.tsx`, Storybook, and server rendering               | complete, malformed, non-leading, LF/CRLF, unfinished streaming, full plugin stack                                                     | Metadata syntax renders after completion, unfinished syntax leaks while streaming, typing is lost, or later plugins stop composing.                   |
-| FR25                   | `parser.public.test.ts`, plugin SSR tests, and package export checks          | server/RSC parsing with plugins, synchronous SSR, suspending renderer streaming boundary                                               | A server import gains `use client`, plugin execution needs serialization, SSR loses fallback, or direct RSC rendering is misrepresented as supported. |
-| Public syntax/types    | `Markdown.public.test.ts`, core typecheck, and `Markdown.doc.mjs`             | Legacy exhaustive switches, math opt-ins, inferred extension-node unions                                                               | A released union widens, an enabled union loses nodes, or docs drift from declarations.                                                               |
-| Navigation contract    | `parser.test.ts`, `Markdown.test.tsx`, and `Markdown.renderBoundary.test.tsx` | Parsed and rendered links, including transformed built-in links; accepted ordinary schemes; rejected destinations; links versus images | A blocked destination reaches navigation or a custom link renderer, or resource policy narrows accepted navigation.                                   |
-| Security/accessibility | `parser.test.ts`, `Markdown.test.tsx`, and renderer guidance                  | Inert expression strings and renderer-owned semantics                                                                                  | Astryx executes math as HTML or silently claims renderer-owned accessibility.                                                                         |
+| Contract               | Verification                                                               | Representative states                                                                                                      | Failure signal                                                                                                                                        |
+| ---------------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
+| FR1–FR5                | `Markdown.test.tsx`, theme-target tests, and `scripts/check-knowledge.mjs` | Default block/inline output and all current targets                                                                        | Existing DOM, target, spacing, or renderer behavior changes.                                                                                          |
+| FR6–FR10               | `parser.test.ts` and `Markdown.test.tsx`                                   | Opt-out, inline/display math, escapes, currency, code, links, plugins                                                      | A delimiter is claimed without opt-in, TeX is formatted as Markdown, or opaque contexts leak.                                                         |
+| FR11                   | `incremental.test.ts` and `Markdown.test.tsx`                              | Every-character top-level/list/task-list/blockquote splits, CRLF, source ranges                                            | Streaming diverges from a full parse, shows partial syntax, mistakes a nested closer for an opener, or crosses a closed container.                    |
+| FR12–FR16              | plugin, transform, adapter, performance, and Outline parser tests          | omitted/empty lists, immutable transforms, invalid outputs, live updates, one compatible Remark plugin, duplicate headings | Empty behavior forks, input mutates, invalid structure escapes, transforms reparse, adapter loses content, budgets fail, or heading targets diverge.  |
+| FR17–FR18              | container parse/validation, ownership, and dependency tests                | leaf/container declarations, nested containers, foreign read/remove/mint/edit, unmet/misordered dependencies               | Plugin-built parsed children, invalid content, lost fallback children, foreign mint/edit, or generic ownership codes.                                 |
+| FR19                   | diagnostic-channel tests in development and production                     | every phase, advisory reports, rate suppression, no handler, malformed list, duplicate Core, version skew                  | A silent production failure, document content in a diagnostic, or one entrypoint throwing where another recovers.                                     |
+| FR20–FR22              | canonical/server imports, inference, streaming, preparation, theming tests | server imports, no explicit type args, chunk boundaries, recreated lists, themed/unthemed extensions                       | Client references, explicit-type workarounds, oscillation, per-render re-preparation, or unreachable opted-in output.                                 |
+| FR23                   | parser, renderer, nesting, and public option tests                         | task-only, plain-only, and mixed ordered/unordered lists at top level and nested; autolink omitted/enabled                 | A mixed list splits or loses order/state, a plain item becomes a checkbox, or `autolink: 'gfm'` changes non-autolink syntax.                          |
+| FR24                   | `plugins/frontmatter.test.tsx`, Storybook, and server rendering            | complete, malformed, non-leading, LF/CRLF, unfinished streaming, full plugin stack                                         | Metadata syntax renders after completion, unfinished syntax leaks while streaming, typing is lost, or later plugins stop composing.                   |
+| FR25                   | `parser.public.test.ts`, plugin SSR tests, and package export checks       | server/RSC parsing with plugins, synchronous SSR, suspending renderer streaming boundary                                   | A server import gains `use client`, plugin execution needs serialization, SSR loses fallback, or direct RSC rendering is misrepresented as supported. |
+| Public syntax/types    | `Markdown.public.test.ts`, core typecheck, and `Markdown.doc.mjs`          | Legacy exhaustive switches, math opt-ins, inferred extension-node unions                                                   | A released union widens, an enabled union loses nodes, or docs drift from declarations.                                                               |
+| Security/accessibility | `parser.test.ts`, `Markdown.test.tsx`, and renderer guidance               | Inert expression strings and renderer-owned semantics                                                                      | Astryx executes math as HTML or silently claims renderer-owned accessibility.                                                                         |
 
 Focused tests continue to pin all nine current target names and default block
 placement. Math intentionally adds no target and no default anatomy.

package/src/Markdown/Markdown.test.tsx

@@ -636,58 +636,6 @@ describe('Markdown', () => {
     expect(links[1].getAttribute('href')).toBe('/page');
   });
 
-  describe('link destinations follow the shared navigation rule', () => {
-    // The same matrix Core's link plumbing and imperative navigation apply
-    // (utils/safeUrl.ts): only executable document schemes are blocked.
-    const blocked = [
-      'javascript:alert(1)',
-      'JaVaScRiPt:alert(1)',
-      'vbscript:MsgBox(1)',
-      'data:text/html,<script>alert(1)</script>',
-      'java\nscript:alert(1)',
-    ];
-    const accepted = [
-      'https://example.com',
-      '/page',
-      '#section',
-      '//example.com/x',
-      'mailto:a@example.com',
-      'tel:+15555550100',
-      'data:image/png;base64,iVBORw0KGgo=',
-    ];
-
-    it.each(blocked)('renders %s as text, not a link', destination => {
-      const {container} = render(
-        <Markdown>{`[click](${destination})`}</Markdown>,
-      );
-      expect(container.querySelector('a')).toBeNull();
-      expect(container.textContent).toContain('click');
-    });
-
-    it.each(accepted)('renders %s as a link', destination => {
-      const {container} = render(
-        <Markdown>{`[click](${destination})`}</Markdown>,
-      );
-      const link = container.querySelector('a');
-      expect(link).not.toBeNull();
-      expect(link?.getAttribute('href')).toBe(destination);
-    });
-
-    it('a data:image link is navigation and is accepted, while a data:image image stays rejected by the resource policy', () => {
-      const {container} = render(
-        <Markdown>
-          {
-            '[view](data:image/png;base64,iVBORw0KGgo=)\n\n![pic](data:image/png;base64,iVBORw0KGgo=)'
-          }
-        </Markdown>,
-      );
-      expect(container.querySelector('a')?.getAttribute('href')).toBe(
-        'data:image/png;base64,iVBORw0KGgo=',
-      );
-      expect(container.querySelector('img')).toBeNull();
-    });
-  });
-
   it('preserves dollar-delimited text when no math renderer is supplied', () => {
     const {container} = render(
       <Markdown>{'Total $5 and formula $x_1 + *y*$.'}</Markdown>,

package/src/Markdown/Markdown.tsx

@@ -76,7 +76,7 @@ import type {
   MarkdownPluginEntry,
   PreparedMarkdownPlugins,
 } from './plugins/protocol';
-import {sanitizeMarkdownLinkUrl, sanitizeMarkdownUrl} from './url';
+import {sanitizeMarkdownUrl} from './url';
 import {themeProps} from '../utils/themeProps';
 import {useTranslator, type TranslatorFn} from '../i18n';
 
@@ -961,7 +961,7 @@ function renderInline(
       return <MathComp key={index} value={node.value} display="inline" />;
     }
     case 'link': {
-      const safeHref = sanitizeMarkdownLinkUrl(node.url);
+      const safeHref = sanitizeMarkdownUrl(node.url);
       if (safeHref == null) {
         // Unsafe URL — render as plain text
         return (

package/src/Markdown/parser.test.ts

@@ -165,26 +165,6 @@ describe('parseInline', () => {
     }
   });
 
-  it('decides link destinations with the shared navigation rule', () => {
-    const destinations: [string, boolean][] = [
-      ['https://example.com', true],
-      ['/page', true],
-      ['#section', true],
-      ['mailto:a@example.com', true],
-      ['tel:+1234567890', true],
-      ['custom:document', true],
-      ['data:image/png;base64,iVBORw0KGgo=', true],
-      ['javascript:alert(1)', false],
-      ['vbscript:MsgBox(1)', false],
-      ['data:text/html,<b>x</b>', false],
-      ['java\u0000script:alert(1)', false],
-    ];
-    for (const [destination, accepted] of destinations) {
-      const [node] = parseInline(`[t](${destination})`);
-      expect(node.type === 'link').toBe(accepted);
-    }
-  });
-
   it('parses strikethrough', () => {
     const result = parseInline('~~deleted~~');
     expect(result[0].type).toBe('strikethrough');

package/src/Markdown/url.ts

@@ -7,8 +7,8 @@
  * @position Shared URL policy for parser, transforms, and renderer
  */
 
-import {isSafeUrl, sanitizeUrl} from '../utils/safeUrl';
-
+const PARSER_DANGEROUS_URL_PATTERN =
+  /^(?:javascript:|data:text\/html|vbscript:)/i;
 const RENDER_DANGEROUS_URL_PATTERN = /^(?:javascript:|data:|vbscript:)/i;
 
 function normalizeMarkdownUrl(url: string): string {
@@ -19,13 +19,7 @@ function normalizeMarkdownUrl(url: string): string {
 
 /** Preserve the released parser policy for no-plugin output compatibility. */
 export function isSafeMarkdownParserUrl(url: string): boolean {
-  return isSafeUrl(url);
-}
-
-/** Navigation and image rendering deliberately have different policies. */
-export function sanitizeMarkdownLinkUrl(url: string): string | null {
-  const normalized = sanitizeUrl(url);
-  return normalized === '' ? null : normalized;
+  return !PARSER_DANGEROUS_URL_PATTERN.test(normalizeMarkdownUrl(url));
 }
 
 export function sanitizeMarkdownUrl(url: string): string | null {

package/src/PowerSearch/PowerSearchValueEditor.test.tsx

@@ -630,54 +630,3 @@ describe('maxMenuItems', () => {
     await expectCapped({type: 'entity_list', searchSource: source});
   });
 });
-
-// =============================================================================
-// EnumListEditor shows the whole closed vocabulary
-// =============================================================================
-
-describe('EnumListEditor', () => {
-  const values = Array.from({length: 12}, (_, index) => ({
-    value: `option-${index}`,
-    label: `Option ${index}`,
-  }));
-
-  it('shows every value on focus instead of the typeahead default of 10', async () => {
-    render(
-      <PowerSearchValueEditor
-        operatorValue={{type: 'enum_list', values}}
-        filterValue={undefined}
-        onChange={vi.fn()}
-        config={stubConfig}
-      />,
-    );
-
-    fireEvent.focus(screen.getByRole('combobox'));
-    await act(async () => {
-      await new Promise(resolve => setTimeout(resolve, 50));
-    });
-
-    expect(screen.getAllByRole('option', {hidden: true})).toHaveLength(12);
-    expect(screen.getByText('Option 11')).toBeInTheDocument();
-  });
-
-  it('shows every matching value when searching', async () => {
-    render(
-      <PowerSearchValueEditor
-        operatorValue={{type: 'enum_list', values}}
-        filterValue={undefined}
-        onChange={vi.fn()}
-        config={stubConfig}
-      />,
-    );
-
-    await act(async () => {
-      fireEvent.change(screen.getByRole('combobox'), {
-        target: {value: 'Option'},
-      });
-      await new Promise(resolve => setTimeout(resolve, 200));
-    });
-
-    expect(screen.getAllByRole('option', {hidden: true})).toHaveLength(12);
-    expect(screen.getByText('Option 11')).toBeInTheDocument();
-  });
-});

package/src/PowerSearch/PowerSearchValueEditor.tsx

@@ -619,10 +619,6 @@ function EnumListEditor({
       placeholder={t('@astryx.powersearch.valueEditor.selectValuesPlaceholder')}
       hasEntriesOnFocus
       debounceMs={0}
-      // A closed vocabulary: every value is a valid choice, so the menu shows
-      // all of them instead of BaseTypeahead's 10-suggestion default, which
-      // would silently drop valid choices with no way to reach them.
-      maxMenuItems={items.length}
     />
   );
 }

package/src/Token/Token.doc.mjs

@@ -55,7 +55,7 @@ export const docs = {
       name: 'href',
       type: 'string',
       description:
-        'Link URL. When provided, the token renders as an <a> element. The destination follows the shared navigation rule described on the Link `href` prop.',
+        'Link URL. When provided, the token renders as an <a> element.',
     },
     {
       name: 'description',
@@ -241,7 +241,7 @@ export const docsDense = {
     isDisabled: 'Reduces opacity, blocks interactions.',
     onRemove: 'Fired on remove button click. Renders X button when provided.',
     onClick: 'Click handler. Renders <span> w/ invisible <button> inside for a11y.',
-    href: 'Link URL. Renders as <a> element. Follows the shared navigation rule (see Link href).',
+    href: 'Link URL. Renders as <a> element.',
     description: 'A11y description via aria-description on root.',
     endContent: 'Content after label, before remove button.',
     isLabelHidden: 'Visually hides label w/ screen-reader-only clip; stays accessible.',

package/src/TopNav/TopNavMenu.doc.mjs

@@ -27,7 +27,7 @@ export const docs = {
     {
       name: 'items',
       type: 'TopNavMenuItemData[]',
-      description: 'Menu items to display in the hover popover. Item href values follow the shared navigation rule described on Link; rejected destinations remain visible without navigation.',
+      description: 'Menu items to display in the hover popover.',
       required: true,
     },
     {
@@ -83,7 +83,7 @@ export const docsDense = {
   description: 'Nav item w/ hover-triggered popover menu containing rich items w/ icon, title, optional description.',
   propDescriptions: {
     label: 'Trigger button visible label.',
-    items: 'Menu items in hover popover. href follows the Link navigation rule; rejected destinations do not navigate.',
+    items: 'Menu items in hover popover.',
     delay: 'Show delay ms on hover.',
     hideDelay: 'Hide delay ms after mouse leaves.',
   },

package/src/TopNav/TopNavMenu.test.tsx

@@ -31,36 +31,6 @@ const mockItems = [
 ];
 
 describe('TopNavMenu', () => {
-  it.each([
-    'javascript:alert(1)',
-    'vbscript:MsgBox(1)',
-    'data:text/html,<b>x</b>',
-  ])('does not expose rejected menu destination %s', href => {
-    const onClick = vi.fn();
-    render(
-      <TopNavMenu
-        label="Menu"
-        items={[{title: 'Destination', href, onClick}]}
-      />,
-    );
-    const item = screen.getByRole('menuitem', {hidden: true});
-    expect(item).not.toHaveAttribute('href');
-    fireEvent.click(item);
-    expect(onClick).toHaveBeenCalledOnce();
-  });
-
-  it('preserves an accepted native menu destination', () => {
-    render(
-      <TopNavMenu
-        label="Menu"
-        items={[{title: 'Destination', href: '/docs'}]}
-      />,
-    );
-    expect(screen.getByRole('menuitem', {hidden: true})).toHaveAttribute(
-      'href',
-      '/docs',
-    );
-  });
   it('renders the trigger button with label', () => {
     render(<TopNavMenu label="Products" items={mockItems} />);
     expect(screen.getByRole('button', {name: 'Products'})).toBeInTheDocument();

package/src/TopNav/TopNavMenu.tsx

@@ -5,7 +5,7 @@
 /**
  * @file TopNavMenu.tsx
  * @input Uses React, StyleX, usePopover, useMenuHover, useListFocus,
- *   useTypeahead, TopNavItem tokens, and the shared navigation policy
+ *   useTypeahead, TopNavItem tokens
  * @output Exports TopNavMenu component and related types
  * @position Navigation item with hover-triggered overflow menu for TopNav
  *
@@ -37,7 +37,6 @@ import {useTopNavSlot} from './TopNavContext';
 import {useTopNavRenderMode} from './TopNavRenderContext';
 import {useAppShellMobile} from '../AppShell/AppShellMobileContext';
 import {useLinkComponent} from '../Link/useLinkComponent';
-import {isSafeUrl} from '../utils/safeUrl';
 import {themeProps} from '../utils/themeProps';
 import {focusOutlineProps} from '../utils/focusOutline.stylex';
 import {interactionOverlayStyles} from '../utils/interactionOverlay.stylex';
@@ -576,11 +575,7 @@ export function TopNavMenu({
                 // Single tab stop: useListFocus owns the roving tabindex and
                 // promotes exactly one item to 0.
                 tabIndex={-1}
-                href={
-                  item.href != null && isSafeUrl(item.href)
-                    ? item.href
-                    : undefined
-                }
+                href={item.href}
                 onClick={item.onClick}
                 {...focusOutlineProps.focusVisible(styles.menuItem)}>
                 <div {...stylex.props(styles.menuItemIcon)}>{item.icon}</div>

package/src/hooks/useClickableContainer.ts

@@ -11,17 +11,11 @@
  * Solves the "nested interactive elements" problem: when a card is clickable
  * but contains buttons/links, clicking those should NOT trigger the card's action.
  *
- * Every navigation exit here (window.open, location.href, and the delegated
- * click on the interactive ref) runs after the shared navigation-destination
- * rule in utils/safeUrl.ts; a blocked href does not navigate by any
- * activation method.
- *
  * SYNC: When modified, update:
  * - /packages/core/src/hooks/index.ts (export)
  */
 
 import {useCallback, useEffect, type RefObject, type MouseEvent} from 'react';
-import {isSafeUrl} from '../utils/safeUrl';
 
 /**
  * Canonical list of interactive element selectors — native controls plus
@@ -95,11 +89,7 @@ export interface UseClickableContainerOptions {
   interactiveRef?: RefObject<HTMLElement | null>;
   /** Click handler */
   onClick?: (event: MouseEvent<HTMLElement>) => void;
-  /**
-   * Navigation URL — when provided, clicking the container navigates. Checked
-   * with the shared navigation rule (utils/safeUrl.ts) before any activation
-   * method (plain, new-tab, Cmd/Ctrl-click, middle-click, delegated click).
-   */
+  /** Navigation URL — when provided, clicking the container navigates */
   href?: string;
   /** Link target */
   target?: string;
@@ -190,12 +180,8 @@ export function useClickableContainer({
         return;
       }
 
-      // Navigate if href is provided. React DOM vets the hrefs it writes as
-      // attributes; nothing below passes through React, so the shared
-      // navigation rule decides once, before target, modifier key, or the
-      // delegated anchor can select a sink. A blocked href simply does not
-      // navigate — the click handler above still ran.
-      if (href != null && isSafeUrl(href)) {
+      // Navigate if href is provided
+      if (href != null) {
         const shouldOpenNewTab =
           target === '_blank' || event.ctrlKey || event.metaKey;
         if (shouldOpenNewTab) {
@@ -244,13 +230,11 @@ export function useClickableContainer({
         return;
       }
 
-      // Middle-click on href opens in new tab (same scheme rule as onClick —
-      // this navigation never passes through React either).
+      // Middle-click on href opens in new tab
       const isMiddleClick = event.button === 1;
       if (
         isMiddleClick &&
         href != null &&
-        isSafeUrl(href) &&
         (eventTarget === event.currentTarget ||
           !hasInteractiveAncestor(eventTarget, containerEl))
       ) {

package/src/index.ts

@@ -161,9 +161,6 @@ export * from './Spinner';
 // Timestamp display
 export * from './Timestamp';
 
-// Elapsed timer display
-export * from './Timer';
-
 // Overlay
 export * from './Overlay';
 export * from './Outline';

package/src/tailwind-theme.css

@@ -182,6 +182,12 @@
   --text-4xl: var(--font-size-4xl);
   --text-5xl: var(--font-size-5xl);
 
+  /* --- Font weights --- */
+  --font-weight-normal: var(--font-weight-normal);
+  --font-weight-medium: var(--font-weight-medium);
+  --font-weight-semibold: var(--font-weight-semibold);
+  --font-weight-bold: var(--font-weight-bold);
+
   /* =========================================================================
    * Border radius
    *