@ponchia/ui 0.6.7 → 0.6.9

package/CHANGELOG.md

@@ -5,6 +5,131 @@
 |> `^0` / `*` wildcard does **not** protect you. See README → Versioning, and
 |> the deprecation policy in CONTRIBUTING.md.
 
+## 0.6.9 — 2026-06-20
+
+### Changed
+
+- **Product doctrine and 1.0 readiness.** `CONTRIBUTING.md`, `ROADMAP.md`,
+  `docs/architecture.md`, and `docs/stability.md` now codify the
+  core-vs-opt-in surface boundary, the refusal list, registry-first gate
+  maintenance, packed-tarball proof, a gate-backed 1.0 readiness ledger, and
+  release evidence policy for public-safe downstream proof. The stability
+  matrix now includes explicit rows for every exported opt-in CSS leaf plus
+  the public machine-readable/theme subpath families.
+- **Registry-backed gate ownership.** `check:report`,
+  `check:component-matrix`, `check:exports`, and `check:consumer-surface` now
+  share internal registries for the reporting toolbox, exported CSS leaves, and
+  optional framework peers instead of carrying separate hand-maintained lists.
+  The matrix gates also share one proof-owner helper for cached file reads,
+  owner-file existence, word matching, and required text evidence.
+- **Native complexity budget.** `check:complexity` is now part of the
+  aggregate `npm run check` chain. It uses the existing TypeScript parser to
+  keep function-level cyclomatic complexity at 12 or lower and function size
+  under budget without carrying per-function exception baselines.
+- **Gate-backed annotation package boundary.** The annotation docs now make the
+  split with `@ponchia/annotations` explicit: `@ponchia/ui/annotations` remains
+  the dependency-free Bronto static-helper compatibility surface, while richer
+  placement, renderer, editing, and adapter work belongs in the sibling
+  annotation package. `check:public-metadata` now guards that doctrine,
+  `check:exports` rejects packed code or declaration references to the sibling
+  package, and no runtime or public type dependency is added to `@ponchia/ui`.
+- **Public source hygiene guard.** `check:public-hygiene` now rejects internal
+  audit-ticket markers across repository source files, and still scans the
+  packed public text files for private terms, local paths, and secret-looking
+  assignments. `check:doc-links` also rejects executable URL schemes in public
+  authoring docs. The pass also brought
+  `behaviors/inert.js` under the generated declaration emit inputs so
+  `check:dts-emit` covers its public `.d.ts` surface.
+
+### Verified
+
+- **Release evidence.** `npm run check` passed for `0.6.9`, including
+  `check:pack`, `check:consumer-surface`, `check:consumer-types`,
+  `check:examples`, `check:publint`, and `check:attw`. No default-bundle budget
+  movement; this release is gate/docs/declaration hardening rather than a
+  runtime surface expansion.
+- **Downstream proof.** The packed current tarball installed into a disposable
+  copy of a real React/Vite app consumer that imports `@ponchia/ui/classes`,
+  `@ponchia/ui/behaviors`, `@ponchia/ui/tokens/resolved.json`, and
+  `@ponchia/ui/vega`; its `typecheck` and production `build` both passed.
+
+### Fixed
+
+- **Report sidecar hash validation.** `report-claims.v1` now requires
+  `contentHash` values to use exact SHA digest lengths (`sha256`, `sha384`, or
+  `sha512`) instead of accepting any hex payload after a supported algorithm
+  prefix.
+
+## 0.6.8 — 2026-06-16
+
+Patch release for the deep UI-framework audit: broader browser/package gates,
+clean-consumer verification, and runtime fixes found while hardening the public
+surface. No breaking changes, no `MIGRATIONS.json` entry.
+
+### Added
+
+- **Tarball and clean-consumer gates.** `check:consumer-surface` now imports
+  public JS/JSON subpaths from the packed package, resolves concrete CSS/doc/
+  font subpaths without optional peers, and verifies behavior initializers stay
+  SSR-safe. `check:consumer-types` installs the tarball into a clean TypeScript
+  consumer and compiles every typed `@ponchia/ui/...` package subpath.
+- **Matrix ownership gates.** `check:component-matrix`,
+  `check:behavior-matrix`, `check:helper-matrix`, and `check:binding-matrix`
+  now require shipped CSS leaves, public behavior exports, helper modules, and
+  framework bindings to have explicit docs, type, unit, or browser ownership.
+- **Public docs and package hygiene gates.** `check:doc-links` validates local
+  links and heading anchors across shipped docs, authoring docs, and the docs
+  viewer route list. `check:schemas`, `check:visual-baselines`,
+  `check:playwright-container`, and stronger `check:contract` / `check:report`
+  coverage close stale public snippets, missing visual baselines, and invalid
+  report/schema surfaces.
+- **Broader browser coverage.** The Playwright suite now pins docs viewer deep
+  links, cascade-layer behavior, source focusing, renderer geometry, behavior
+  cleanup/idempotency, connector transforms, annotation motion/overflow,
+  command interactions, crosshair payloads, responsive overflow, and more
+  forced-colors/reduced-motion contracts.
+- **Packed example smoke coverage.** The example runner now builds and smokes
+  the packed examples from one registry, with richer runtime assertions,
+  desktop/mobile visual health, and optional Chromium/Firefox/WebKit coverage.
+  Astro joins the packed-tarball smoke matrix.
+- **Renderer theme helper coverage.** Chart, Mermaid, D2, and Vega package
+  helpers now have type/runtime coverage that checks default exports,
+  theme-selection fallbacks, resolved colors, and `var()` leak prevention.
+
+### Fixed
+
+- **Standalone dot readouts survive `report-kit.css`.** `crosshair.css` now
+  scopes pinned readout-chip styling to `.ui-crosshair .ui-readout`, so the
+  core dot-matrix `.ui-readout` keeps its normal inline layout when a report
+  imports the full report kit.
+- **Rendered docs deep links work.** `docs/index.html` now preserves
+  `doc.md#section` routes, generates deterministic heading IDs, keeps
+  same-page anchors inside the current doc route, and drops the invalid
+  meta-CSP `frame-ancestors` directive that browsers reported as a console
+  error.
+- **Command adapter docs match the shipped matrix.** `docs/command.md`, the
+  stability matrix, package-contract provenance, and `llms.txt` now name the
+  Svelte action and Vue directive/plugin paths alongside the React/Solid/Qwik
+  bindings.
+- **CodeQL review findings.** Docs slug helpers no longer use incomplete
+  regex-based tag stripping, and wildcard package-subpath expansion replaces
+  every placeholder rather than only the first one.
+
+### Changed
+
+- `npm run check` now owns the unit suite through `check:unit`; CI, release
+  workflow validation, PR templates, release docs, and package-contract docs
+  all describe the same aggregate gate instead of duplicating `npm test`.
+- Release hygiene now verifies the aggregate check includes unit coverage and
+  prevents duplicate release-workflow unit runs from drifting out of sync.
+- `check:exports` now pins package-level CSS metadata: the top-level `style`
+  field, root export targets, `files`, and CSS-preserving `sideEffects`.
+- Type-only coverage now instantiates Svelte action and Vue directive
+  declarations from consumer-shaped code, including invalid root-shape
+  assertions.
+- The default bundle budget is recalibrated to 91 kB raw / 15.65 kB gzip after
+  the audited bundle landed below that ceiling at 87.9 kB raw / 15.0 kB gzip.
+
 ## 0.6.7 — 2026-06-15
 
 ### Added
@@ -392,7 +517,7 @@ and D2. The data-viz **palette** (`--chart-*`, `tokens/charts.json`) and the
 
 ### Fixed
 
-- **Published-type drift (code-quality audit).** `ui.meter({ tone: 'info' })` and
+- **Published-type drift.** `ui.meter({ tone: 'info' })` and
   `ui.bracketNote({ tone: 'success' })` emit real classes at runtime, but the
   generated `.d.ts` tone unions (hand-mirrored in `gen-dts.mjs`) omitted them, so
   a TS consumer got a spurious type error for a value that renders. The unions
@@ -564,16 +689,16 @@ and D2. The data-viz **palette** (`--chart-*`, `tokens/charts.json`) and the
   token source as a read-only export for foreign renderers (in-DOM ink is
   `--button-text`). `contrast.md` now prints APCA `Lc` to one decimal so an
   advisory shortfall (e.g. `Lc 44.9`) no longer rounds to a passing-looking `45`.
-- Raw bundle budget 81 → 82 kB for the component-audit accessibility/state
+- Raw bundle budget 81 → 82 kB for the accessibility/state
   blocks (gzip held ~14.1 kB — the additions are repetitive media-query and
   `:has()`/`:not()` rules that compress well).
-- **Code-quality audit (16-agent) — two new gates + targeted dedup, no churn.**
+- **Code-health pass — two new gates + targeted dedup, no churn.**
   A code-health pass (complexity / duplication / AI-slop / missing-best-practice)
   that deliberately left working, gate-protected code alone. Added:
   `check:recipe-types` (factory↔`.d.ts` option parity, above) and `check:chain`
   (every `check:*` script is wired into the aggregate `check` chain — closes the
   silent-coverage-drop class; it would have caught a forgotten gate). Reconciled
-  a latent bug — `clamp()` had silently diverged between `connectors` and
+  a latent bug — `clamp()` had drifted between `connectors` and
   `annotations`; the two now share one scalar/geometry kernel (the guarded form).
   Dedup that removed real duplication: a shared `collectHosts()` /
   `scrollIntoViewSafe()` / `wrapIndex()` in `behaviors/internal.js` (~9 behaviors),

package/README.md

@@ -3,7 +3,7 @@
 [![npm](https://img.shields.io/npm/v/@ponchia/ui?logo=npm)](https://www.npmjs.com/package/@ponchia/ui)
 [![npm provenance](https://img.shields.io/badge/npm-provenance-blue?logo=npm)](https://www.npmjs.com/package/@ponchia/ui#provenance)
 [![runtime deps](https://img.shields.io/badge/runtime%20deps-0-brightgreen)](https://github.com/Ponchia/bronto-ui/blob/main/package.json)
-[![dist](https://img.shields.io/badge/dist-~87kB%20%2F%20~15kB%20gzip-informational)](https://github.com/Ponchia/bronto-ui/blob/main/scripts/check-dist.mjs)
+[![dist](https://img.shields.io/badge/dist-~88kB%20%2F%20~15kB%20gzip-informational)](https://github.com/Ponchia/bronto-ui/blob/main/scripts/check-dist.mjs)
 [![CI](https://github.com/Ponchia/bronto-ui/actions/workflows/ci.yml/badge.svg)](https://github.com/Ponchia/bronto-ui/actions/workflows/ci.yml)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Ponchia/bronto-ui/badge)](https://scorecard.dev/viewer/?uri=github.com/Ponchia/bronto-ui)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue)](https://github.com/Ponchia/bronto-ui/blob/main/LICENSE)
@@ -67,12 +67,12 @@ npm i @ponchia/ui
 Or drop it in with no build step, straight from a CDN:
 
 ```html
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@ponchia/ui@0.6.7/dist/bronto.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@ponchia/ui@0.6.9/dist/bronto.css">
 ```
 
 ## Quick start
 
-**1. Load the CSS.** One flattened, minified bundle — the whole standard component set, one request (~87 kB raw / ~15 kB gzip):
+**1. Load the CSS.** One flattened, minified bundle — the whole standard component set, one request (~88 kB raw / ~15 kB gzip):
 
 ```css
 @import '@ponchia/ui';            /* via a bundler */
@@ -140,7 +140,7 @@ Arrows, chevrons, check/close/plus/minus, search/menu/gear, info/warning/bell/lo
 - **Disclosure & nav** — tabs, accordion, segmented, breadcrumb, pagination, `ui-steps`, `ui-timeline`, `ui-pagehead`, `ui-kbd`.
 - **Shells** — a service/app shell (`ui-app-*`) and a content/marketing site shell (`ui-site*`, `ui-container`).
 - **Prose** — `.ui-prose` styles raw, unclassed semantic HTML (Markdown / CMS / LLM output) with zero classes.
-- **Analytical & communication primitives** _(opt-in)_ — `@ponchia/ui/css/analytical.css`: **figure** stages, SVG **annotations** (subject/connector/note), standalone **legends**/data-keys, text/evidence **marks**, leader-line **connectors** (+ a pure `@ponchia/ui/connectors` geometry kernel), a guided-focus **spotlight**, a **crosshair**/readout, a cross-cutting **selection** vocabulary, and CSS Custom Highlight API **highlights**. Each owns its visual grammar + pure geometry and refuses scales/state/hit-testing — figures that explain themselves, not a chart engine. Plus standalone **`source`/provenance** (trust), **interval**, **clamp**, and **lifecycle `state`** leaves.
+- **Analytical & communication primitives** _(opt-in)_ — `@ponchia/ui/css/analytical.css`: **figure** stages, SVG **annotations** (subject/connector/note), standalone **legends**/data-keys, text/evidence **marks**, leader-line **connectors** (+ a pure `@ponchia/ui/connectors` geometry kernel), a guided-focus **spotlight**, a **crosshair**/readout, a cross-cutting **selection** vocabulary, and CSS Custom Highlight API **highlights**. Each owns its visual grammar + pure geometry and refuses scales/state/hit-testing — figures that explain themselves, not a chart engine. The richer annotation engine lives in `@ponchia/annotations`; this package keeps only the dependency-free Bronto helper surface. Plus standalone **`source`/provenance** (trust), **interval**, **clamp**, and **lifecycle `state`** leaves.
 - **Reports** _(opt-in)_ — `@ponchia/ui/css/report-kit.css` for a complete static/PDF report vocabulary, or `@ponchia/ui/css/report.css` plus only the leaves a narrow report uses. Covers, decisions, claims, sections, severity-labelled findings, evidence packets, evidence ledgers, action registers, source-card bindings, `ui-figure` composition, intervals, bounded excerpts, chart wrappers and print utilities.
 - **Motion & dots** — the dot-matrix motif kit: dot grid, status dots, dot loaders, the orbital spinner, matrix reveal — all reduced-motion aware.
 - **Glyphs** — `@ponchia/ui/glyphs`, a 71-glyph dot-matrix icon set on the `.ui-dotmatrix` primitive (display marks + crisp `solid` inline icons + one-node `.ui-icon` mask rendering).

package/annotations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["index.js"],"names":[],"mappings":"AA4RA;;;GAGG;AACH,+CAHW,OAAO,CAAC,eAAe,CAAC,GACtB,MAAM,CAIlB;AAED;;;GAGG;AACH,gFAHW,oBAAoB,GAClB,MAAM,CA0BlB;AAsCD;;;GAGG;AACH,iGAHW,oBAAoB,GAClB,aAAa,CA0DzB;AAED;;;GAGG;AACH,+CAHW,oBAAoB,GAClB,MAAM,CAIlB;AAED;;;GAGG;AACH,mEAHW,kBAAkB,GAChB,MAAM,CAYlB;AAED;;;GAGG;AACH,mDAHW,gBAAgB,GACd,MAAM,CAMlB;AAED;;;GAGG;AACH,uEAHW,oBAAoB,GAClB,MAAM,CASlB;AAED;;;GAGG;AACH,+DAHW,qBAAqB,GACnB,MAAM,CAWlB;AAED;;;GAGG;AACH,mEAHW,kBAAkB,GAChB,MAAM,CAIlB;AAED;;;GAGG;AACH,sDAHW,mBAAmB,GACjB,MAAM,CAIlB;AAED;;;GAGG;AACH,gEAHW,sBAAsB,GACpB,MAAM,CAqClB;AAED;;;GAGG;AACH,wDAHW,qBAAqB,GACnB,MAAM,CAUlB;AAED;;;GAGG;AACH,wDAHW,oBAAoB,GAClB,MAAM,CAUlB;AAED;;;GAGG;AACH,sEAHW,qBAAqB,GACnB,MAAM,CAclB;AAED;;;GAGG;AACH,mDAHW,sBAAsB,GACpB,MAAM,CAIlB;AAED;;;GAGG;AACH,qEAHW,wBAAwB,GACtB,MAAM,CAQlB;AAED;;;GAGG;AACH,qCAHW,gBAAgB,GACd,MAAM,CAWlB;AAED;;;GAGG;AACH,sCAHW,gBAAgB,GACd,MAAM,CAelB;AAED;;;GAGG;AACH,sCAHW,gBAAgB,GACd,MAAM,CAWlB;AAkBD;;;GAGG;AACH,uCAHW,sBAAsB,GACpB,eAAe,CAyB3B;AAED;;;;;;;;;;;;;;GAcG;AACH,uCAJW,kBAAkB,EAAE,SACpB,sBAAsB,GACpB,MAAM,EAAE,CA+BpB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,oCAJW,eAAe,EAAE,SACjB,mBAAmB,GACjB,WAAW,EAAE,CAgCzB;8BAjxBY;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE;+BACxB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE;sCAC1B,SAAS,GAAG,OAAO,GAAG,OAAO;8BAC7B,OAAO,GAAG,QAAQ,GAAG,KAAK;+BAC1B,KAAK,GAAG,QAAQ,GAAG,QAAQ;8BAC3B,YAAY,GAAG,UAAU;gCACzB,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO;;UAG/B,QAAQ;YACR,MAAM;;;;UAIN,MAAM;WACN,MAAM;YACN,MAAM;;;;;+BAKP,aAAa,GAAG,WAAW;+BAE3B,gBAAgB,GAAG;IAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE;;YAG9D,MAAM;;;WAGN,MAAM;YACN,MAAM;;;;;;;;QAQN,MAAM;QACN,MAAM;;;;;;SAMN,MAAM;;;QAGN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;;;;;;WAMN,MAAM;YACN,MAAM;;;;QAIN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;;;QAGN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;;;;YAIN,eAAe,EAAE;;;;;;;;;;;;;;qCAclB,eAAe,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;QAKpC,MAAM;QACN,MAAM;;;;;;;;;;;;;;;;;;;;;WAkBN,MAAM;YACN,MAAM;;;;;WAKN,MAAM;YACN,MAAM;YACN,gBAAgB;;;;;;;;;;;;QAShB,MAAM;QACN,MAAM;WACN,eAAe;YACf,gBAAgB;eAChB,MAAM;;qCAEP,CACN,aAAa,GACb,WAAW,GACX,CAAC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG,gBAAgB,CAAC,GAC1C,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,qBAAqB,CAAC,GAC7C,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,CAAC,GACvC,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,mBAAmB,CAAC,GACzC,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,sBAAsB,CAAC,GAC9C,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,qBAAqB,CAAC,GAC7C,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,CAAC,GACzC,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,oBAAoB,CAAC,GAC7C,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,qBAAqB,CAAC,CACjD;;;;;;;;;;eAWU,MAAM;aACN,MAAM;eACN,MAAM;UACN,MAAM;;;;;;SAGN,MAAM;;;;UACN,MAAM;;;;;;;;;;;;;;;;;;;;YAQN,eAAe;;;;UACf,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAYN,MAAM;OACN,MAAM;;;;YACN,eAAe;;;;;;;;OAEf,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["index.js"],"names":[],"mappings":"AA6SA;;;GAGG;AACH,+CAHW,OAAO,CAAC,eAAe,CAAC,GACtB,MAAM,CAIlB;AAED;;;GAGG;AACH,gFAHW,oBAAoB,GAClB,MAAM,CA0BlB;AAsCD;;;GAGG;AACH,iGAHW,oBAAoB,GAClB,aAAa,CA0DzB;AAED;;;GAGG;AACH,+CAHW,oBAAoB,GAClB,MAAM,CAIlB;AAED;;;GAGG;AACH,mEAHW,kBAAkB,GAChB,MAAM,CAYlB;AAED;;;GAGG;AACH,mDAHW,gBAAgB,GACd,MAAM,CAMlB;AAED;;;GAGG;AACH,uEAHW,oBAAoB,GAClB,MAAM,CASlB;AAED;;;GAGG;AACH,+DAHW,qBAAqB,GACnB,MAAM,CAWlB;AAED;;;GAGG;AACH,mEAHW,kBAAkB,GAChB,MAAM,CAIlB;AAED;;;GAGG;AACH,sDAHW,mBAAmB,GACjB,MAAM,CAIlB;AAED;;;GAGG;AACH,gEAHW,sBAAsB,GACpB,MAAM,CAqClB;AAED;;;GAGG;AACH,wDAHW,qBAAqB,GACnB,MAAM,CAUlB;AAED;;;GAGG;AACH,wDAHW,oBAAoB,GAClB,MAAM,CAUlB;AAED;;;GAGG;AACH,sEAHW,qBAAqB,GACnB,MAAM,CAclB;AAED;;;GAGG;AACH,mDAHW,sBAAsB,GACpB,MAAM,CAIlB;AAED;;;GAGG;AACH,qEAHW,wBAAwB,GACtB,MAAM,CAQlB;AAED;;;GAGG;AACH,qCAHW,gBAAgB,GACd,MAAM,CAWlB;AAED;;;GAGG;AACH,sCAHW,gBAAgB,GACd,MAAM,CAelB;AAED;;;GAGG;AACH,sCAHW,gBAAgB,GACd,MAAM,CAWlB;AAkBD;;;GAGG;AACH,uCAHW,sBAAsB,GACpB,eAAe,CAyB3B;AAED;;;;;;;;;;;;;;GAcG;AACH,uCAJW,kBAAkB,EAAE,SACpB,sBAAsB,GACpB,MAAM,EAAE,CA+BpB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,oCAJW,eAAe,EAAE,SACjB,mBAAmB,GACjB,WAAW,EAAE,CAgCzB;8BAlyBY;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE;+BACxB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE;sCAC1B,SAAS,GAAG,OAAO,GAAG,OAAO;8BAC7B,OAAO,GAAG,QAAQ,GAAG,KAAK;+BAC1B,KAAK,GAAG,QAAQ,GAAG,QAAQ;8BAC3B,YAAY,GAAG,UAAU;gCACzB,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO;;UAG/B,QAAQ;YACR,MAAM;;;;UAIN,MAAM;WACN,MAAM;YACN,MAAM;;;;;+BAKP,aAAa,GAAG,WAAW;+BAE3B,gBAAgB,GAAG;IAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE;;YAG9D,MAAM;;;WAGN,MAAM;YACN,MAAM;;;;;;;;QAQN,MAAM;QACN,MAAM;;;;;;SAMN,MAAM;;;QAGN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;;;;;;WAMN,MAAM;YACN,MAAM;;;;QAIN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;;;QAGN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;;;;YAIN,eAAe,EAAE;;;;;;;;;;;;;;qCAclB,eAAe,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;QAKpC,MAAM;QACN,MAAM;;;;;;;;;;;;;;;;;;;;;WAkBN,MAAM;YACN,MAAM;;;;;WAKN,MAAM;YACN,MAAM;YACN,gBAAgB;;;;;;;;;;;;QAShB,MAAM;QACN,MAAM;WACN,eAAe;YACf,gBAAgB;eAChB,MAAM;;qCAEP,CACN,aAAa,GACb,WAAW,GACX,CAAC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG,gBAAgB,CAAC,GAC1C,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,qBAAqB,CAAC,GAC7C,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,CAAC,GACvC,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,mBAAmB,CAAC,GACzC,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,sBAAsB,CAAC,GAC9C,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,qBAAqB,CAAC,GAC7C,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,CAAC,GACzC,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,oBAAoB,CAAC,GAC7C,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,qBAAqB,CAAC,CACjD;;;;;;;;;;eAWU,MAAM;aACN,MAAM;eACN,MAAM;UACN,MAAM;;;;;;SAGN,MAAM;;;;UACN,MAAM;;;;;;;;;;;;;;;;;;;;YAQN,eAAe;;;;UACf,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAYN,MAAM;OACN,MAAM;;;;YACN,eAAe;;;;;;;;OAEf,MAAM"}

package/annotations/index.js

@@ -209,8 +209,7 @@ import {
   arrowHead,
   dotMark,
   angleBetween,
-  // Shared scalar/geometry kernel — single source of truth (was copy-pasted,
-  // and the local clamp had silently diverged from the connectors one).
+  // Shared scalar/geometry kernel for annotation and connector path output.
   roundNumber,
   finite,
   dimension,
@@ -220,8 +219,8 @@ import {
   rectPath,
 } from '../connectors/index.js';
 
-// A circle subject is just a filled dot at (x, y) — delegate to the kernel's
-// dotMark so the arc geometry/precision can't diverge. (code-quality audit Q5.)
+// A circle subject is just a filled dot at (x, y); delegate to the connector
+// kernel so arc geometry and numeric precision stay aligned.
 function circlePathAt(x, y, radius) {
   return dotMark({ x, y }, radius);
 }
@@ -237,6 +236,24 @@ function validateOffset(opts) {
   };
 }
 
+function annotationConnectorType(value) {
+  const type = value ?? 'callout';
+  if (type === 'callout' || type === 'elbow' || type === 'curve') return type;
+  throw new TypeError('type must be "callout", "elbow" or "curve"');
+}
+
+function directLabelAxis(value) {
+  const axis = value ?? 'y';
+  if (axis === 'x' || axis === 'y') return axis;
+  throw new TypeError('axis must be "x" or "y"');
+}
+
+function directLabelShape(value) {
+  const shape = value ?? 'straight';
+  if (shape === 'straight' || shape === 'elbow' || shape === 'curve') return shape;
+  throw new TypeError('shape must be "straight", "elbow" or "curve"');
+}
+
 function trimForCircle(dx, dy, subject) {
   const len = Math.hypot(dx, dy);
   const radius = dimension('subject.radius', subject.radius);
@@ -652,8 +669,8 @@ export function connectorCurve(opts = {}) {
   return curvePath(start, end, { curvature: 0.35 });
 }
 
-// subject.type → its path builder. A flat dispatch table (replaces an 11-arm
-// if/else) keyed by the SubjectType union; an unknown type throws below. (Q10.)
+// subject.type → its path builder. A flat dispatch table keyed by the
+// SubjectType union; an unknown type throws below.
 const SUBJECT_BUILDERS = {
   circle: circleSubjectPath,
   rect: rectSubjectPath,
@@ -673,7 +690,7 @@ const SUBJECT_BUILDERS = {
  * @returns {AnnotationParts}
  */
 export function annotationParts(opts = {}) {
-  const type = opts.type ?? 'callout';
+  const type = annotationConnectorType(opts.type);
   const transform = annotationTransform({ x: opts.x ?? 0, y: opts.y ?? 0 });
   const dx = finite('dx', opts.dx, 0);
   const dy = finite('dy', opts.dy, 0);
@@ -764,9 +781,9 @@ export function declutterLabels(items, opts = {}) {
  */
 export function directLabels(items, opts = {}) {
   if (!Array.isArray(items)) throw new TypeError('items must be an array');
-  const axis = opts.axis === 'x' ? 'x' : 'y';
+  const axis = directLabelAxis(opts.axis);
   const cross = finite('cross', opts.cross, 0);
-  const shape = opts.shape === 'elbow' || opts.shape === 'curve' ? opts.shape : 'straight';
+  const shape = directLabelShape(opts.shape);
 
   const anchors = items.map((it) => ({
     anchor: { x: finite('anchor.x', it?.anchor?.x), y: finite('anchor.y', it?.anchor?.y) },

package/behaviors/carousel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"carousel.d.ts","sourceRoot":"","sources":["carousel.js"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wCAHW,OAAO,eAAe,EAAE,YAAY,GAClC,OAAO,eAAe,EAAE,OAAO,CA0K3C"}
+{"version":3,"file":"carousel.d.ts","sourceRoot":"","sources":["carousel.js"],"names":[],"mappings":"AA6HA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wCAHW,OAAO,eAAe,EAAE,YAAY,GAClC,OAAO,eAAe,EAAE,OAAO,CAsJ3C"}

package/behaviors/carousel.js

@@ -5,8 +5,124 @@ import {
   bindOnce,
   scrollIntoViewSafe,
   collectHosts,
+  closestSafe,
 } from './internal.js';
 
+const snapshotAttrs = (el) =>
+  Array.from(el.attributes, ({ name, value }) => ({
+    name,
+    value,
+  }));
+
+const restoreAttrs = (el, attrs) => {
+  for (const { name } of Array.from(el.attributes)) el.removeAttribute(name);
+  for (const { name, value } of attrs) el.setAttribute(name, value);
+};
+
+const snapshotNode = (el, { html = false } = {}) =>
+  el
+    ? {
+        el,
+        attrs: snapshotAttrs(el),
+        ...(html ? { innerHTML: el.innerHTML } : {}),
+      }
+    : null;
+
+const restoreNode = (state) => {
+  if (!state) return;
+  restoreAttrs(state.el, state.attrs);
+  if ('innerHTML' in state) state.el.innerHTML = state.innerHTML;
+};
+
+const clampIndex = (value, max) => Math.max(0, Math.min(max, value));
+
+const renderedStatusIndex = (status) => {
+  const match = /^(\d+)\s*\/\s*\d+$/.exec(status?.textContent?.trim() ?? '');
+  if (!match) return -1;
+  const value = Number(match[1]);
+  return Number.isInteger(value) ? value - 1 : -1;
+};
+
+const snapshotCarouselState = ({ viewport, slides, status, prevBtn, nextBtn, thumbs }) => ({
+  viewport: snapshotNode(viewport),
+  slides: slides.map((slide) => snapshotNode(slide)),
+  status: snapshotNode(status, { html: true }),
+  controls: [prevBtn, nextBtn, ...thumbs].filter(Boolean).map((control) => snapshotNode(control)),
+});
+
+function restoreCarouselState(state) {
+  restoreNode(state.viewport);
+  state.slides.forEach(restoreNode);
+  restoreNode(state.status);
+  state.controls.forEach(restoreNode);
+}
+
+function setDefaultButtonType(button) {
+  if (button?.tagName === 'BUTTON' && !button.hasAttribute('type')) button.type = 'button';
+}
+
+function applyCarouselA11y({ box, viewport, slides, status, prevBtn, nextBtn, thumbs, n }) {
+  // ARIA scaffolding — pragmatic carousel semantics (not the full APG
+  // tablist), the same restraint initMenu takes.
+  viewport.setAttribute('role', 'group');
+  viewport.setAttribute('aria-roledescription', 'carousel');
+  if (!viewport.hasAttribute('aria-label')) {
+    viewport.setAttribute(
+      'aria-label',
+      box.getAttribute('data-bronto-carousel-label') || 'Carousel',
+    );
+  }
+  if (!viewport.hasAttribute('tabindex')) viewport.tabIndex = 0;
+  slides.forEach((slide, i) => {
+    slide.setAttribute('role', 'group');
+    slide.setAttribute('aria-roledescription', 'slide');
+    if (!slide.hasAttribute('aria-label')) slide.setAttribute('aria-label', `${i + 1} of ${n}`);
+  });
+  if (status) status.setAttribute('aria-live', 'polite');
+  [prevBtn, nextBtn, ...thumbs].forEach(setDefaultButtonType);
+  if (prevBtn && !prevBtn.hasAttribute('aria-label'))
+    prevBtn.setAttribute('aria-label', 'Previous');
+  if (nextBtn && !nextBtn.hasAttribute('aria-label')) nextBtn.setAttribute('aria-label', 'Next');
+}
+
+function bindCarouselLifecycle({
+  box,
+  viewport,
+  slides,
+  status,
+  prevBtn,
+  nextBtn,
+  thumbs,
+  n,
+  render,
+  onKey,
+  onClick,
+  io,
+  holdProgrammatic,
+  clearProgrammaticTimer,
+}) {
+  const state = snapshotCarouselState({ viewport, slides, status, prevBtn, nextBtn, thumbs });
+  applyCarouselA11y({ box, viewport, slides, status, prevBtn, nextBtn, thumbs, n });
+  render();
+  viewport.addEventListener('keydown', onKey);
+  box.addEventListener('click', onClick);
+  // Observe inside the add callback so observe/disconnect pair with the
+  // binding lifecycle: a re-init tears down the prior binding (which
+  // disconnects the old observer) before this starts, so two observers
+  // never watch the same slides — even for one tick.
+  if (io) {
+    holdProgrammatic();
+    slides.forEach((slide) => io.observe(slide));
+  }
+  return () => {
+    viewport.removeEventListener('keydown', onKey);
+    box.removeEventListener('click', onClick);
+    io?.disconnect();
+    clearProgrammaticTimer();
+    restoreCarouselState(state);
+  };
+}
+
 /**
  * Image carousel / gallery, built on CSS scroll-snap so touch + trackpad
  * swipe (and momentum) are the browser's, not hand-rolled. This wires the
@@ -54,36 +170,12 @@ export function initCarousel({ root } = {}) {
     const nextBtn = box.querySelector('[data-bronto-carousel-next]');
     const loop = box.hasAttribute('data-bronto-carousel-loop');
 
-    // ARIA scaffolding — pragmatic carousel semantics (not the full APG
-    // tablist), the same restraint initMenu takes.
-    viewport.setAttribute('role', 'group');
-    viewport.setAttribute('aria-roledescription', 'carousel');
-    if (!viewport.hasAttribute('aria-label'))
-      viewport.setAttribute(
-        'aria-label',
-        box.getAttribute('data-bronto-carousel-label') || 'Carousel',
-      );
-    if (!viewport.hasAttribute('tabindex')) viewport.tabIndex = 0;
-    slides.forEach((s, i) => {
-      s.setAttribute('role', 'group');
-      s.setAttribute('aria-roledescription', 'slide');
-      if (!s.hasAttribute('aria-label')) s.setAttribute('aria-label', `${i + 1} of ${n}`);
-    });
-    if (status) status.setAttribute('aria-live', 'polite');
-    for (const b of [prevBtn, nextBtn]) {
-      if (!b) continue;
-      if (b.tagName === 'BUTTON' && !b.hasAttribute('type')) b.type = 'button';
-    }
-    for (const b of thumbs) {
-      if (b.tagName === 'BUTTON' && !b.hasAttribute('type')) b.type = 'button';
-    }
-    if (prevBtn && !prevBtn.hasAttribute('aria-label'))
-      prevBtn.setAttribute('aria-label', 'Previous');
-    if (nextBtn && !nextBtn.hasAttribute('aria-label')) nextBtn.setAttribute('aria-label', 'Next');
-
-    let index = Math.max(
-      0,
-      slides.findIndex((s) => s.hasAttribute('data-bronto-carousel-current')),
+    const authoredIndex = slides.findIndex((s) => s.hasAttribute('data-bronto-carousel-current'));
+    const renderedThumbIndex = thumbs.findIndex((t) => t.getAttribute('aria-current') === 'true');
+    const statusIndex = renderedStatusIndex(status);
+    let index = clampIndex(
+      renderedThumbIndex >= 0 ? renderedThumbIndex : statusIndex >= 0 ? statusIndex : authoredIndex,
+      n - 1,
     );
 
     // While a button/keyboard nav is smooth-scrolling, the IntersectionObserver
@@ -139,15 +231,15 @@ export function initCarousel({ root } = {}) {
       goTo(target);
     };
     const onClick = (e) => {
-      if (prevBtn && e.target.closest('[data-bronto-carousel-prev]')) {
+      if (prevBtn && closestSafe(e.target, '[data-bronto-carousel-prev]')) {
         goTo(index - 1);
         return;
       }
-      if (nextBtn && e.target.closest('[data-bronto-carousel-next]')) {
+      if (nextBtn && closestSafe(e.target, '[data-bronto-carousel-next]')) {
         goTo(index + 1);
         return;
       }
-      const thumb = e.target.closest('.ui-carousel__thumb');
+      const thumb = closestSafe(e.target, '.ui-carousel__thumb');
       if (thumb) {
         const i = thumbs.indexOf(thumb);
         if (i >= 0) goTo(i);
@@ -181,22 +273,26 @@ export function initCarousel({ root } = {}) {
       );
     }
 
-    render();
-    const bound = bindOnce(box, 'carousel', () => {
-      viewport.addEventListener('keydown', onKey);
-      box.addEventListener('click', onClick);
-      // Observe inside the add callback so observe/disconnect pair with the
-      // binding lifecycle: a re-init tears down the prior binding (which
-      // disconnects the old observer) before this starts, so two observers
-      // never watch the same slides — even for one tick.
-      slides.forEach((s) => io?.observe(s));
-      return () => {
-        viewport.removeEventListener('keydown', onKey);
-        box.removeEventListener('click', onClick);
-        io?.disconnect();
-        if (progTimer) clearTimeout(progTimer);
-      };
-    });
+    const bound = bindOnce(box, 'carousel', () =>
+      bindCarouselLifecycle({
+        box,
+        viewport,
+        slides,
+        status,
+        prevBtn,
+        nextBtn,
+        thumbs,
+        n,
+        render,
+        onKey,
+        onClick,
+        io,
+        holdProgrammatic,
+        clearProgrammaticTimer: () => {
+          if (progTimer) clearTimeout(progTimer);
+        },
+      }),
+    );
     cleanups.push(bound);
   }
 

package/behaviors/combobox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"combobox.d.ts","sourceRoot":"","sources":["combobox.js"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wCAHW,OAAO,eAAe,EAAE,YAAY,GAClC,OAAO,eAAe,EAAE,OAAO,CAqO3C"}
+{"version":3,"file":"combobox.d.ts","sourceRoot":"","sources":["combobox.js"],"names":[],"mappings":"AAmIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wCAHW,OAAO,eAAe,EAAE,YAAY,GAClC,OAAO,eAAe,EAAE,OAAO,CA6O3C"}