[Toolkit] Generalize AttributesDefaultsChecker forbidden-key detection

Match any data-*/aria-* key in attributes.defaults() except
data-controller/data-action, instead of an enumerated state-attr
denylist, so new state attributes are caught automatically.

Author: Kocal

src/Toolkit/src/Kit/Lint/Checker/AttributesDefaultsChecker.php

@@ -27,9 +27,10 @@
  * present and can neither be silently dropped nor overridden:
  *
  *  - `data-slot` is a structural marker (Shadcn) consumers must never override (checked in every kit);
- *  - `aria-*`, Stimulus value attributes (`data-<controller>-<key>-value`) and state `data-*`
- *    (`data-state`, `data-open`, `data-active`, `data-size`, ...) must always be emitted with an
- *    explicit value (checked only in Tailwind kits, detected by the `tailwind_merge` idiom).
+ *  - every other `data-*`/`aria-*` attribute — ARIA, Stimulus value attributes (`data-<controller>-<key>-value`)
+ *    and state `data-*` (`data-state`, `data-open`, `data-size`, ...) — must be a literal attribute so it is
+ *    always present; only `data-controller`/`data-action` may stay in `defaults()` (checked only in Tailwind
+ *    kits, detected by the `tailwind_merge` idiom).
  *
  * Non-Tailwind kits (Bootstrap, Common) keep their own idiom (`class` merged inside `defaults()`,
  * no `data-slot`) and are therefore only checked against the universal `data-slot` rule.
@@ -45,15 +46,19 @@ final class AttributesDefaultsChecker implements KitCheckerInterface
     private const RE_DATA_SLOT_KEY = '/([\'"])data-slot\1\s*:/';
 
     /**
-     * Keys forbidden inside `defaults()` for Tailwind kits, each capturing the offending key name.
+     * Captures every `data-*`/`aria-*` key of a `defaults()` dict literal; forbidden ones are those
+     * not in {@see self::ALLOWED_IN_DEFAULTS}. Keeping this a category match (rather than an
+     * enumerated list of state attributes) means new state attributes are caught automatically.
+     */
+    private const RE_TAILWIND_KEY = '/([\'"])(?<key>(?:data|aria)-[a-z0-9-]+)\1\s*:/';
+
+    /**
+     * Keys allowed inside `defaults()` for Tailwind kits. `data-slot` is allowed here because it is
+     * already reported by Rule A, so it is not flagged twice.
      *
      * @var list<string>
      */
-    private const RE_STATE_KEYS = [
-        '/([\'"])(?<key>aria-[a-z-]+)\1\s*:/',
-        '/([\'"])(?<key>data-[a-z0-9-]+-value)\1\s*:/',
-        '/([\'"])(?<key>data-(?:state|open|closed|active|disabled|orientation|size|variant|side|selected|checked))\1\s*:/',
-    ];
+    private const ALLOWED_IN_DEFAULTS = ['data-controller', 'data-action', 'data-slot'];
 
     public function check(Kit $kit): iterable
     {
@@ -102,11 +107,11 @@ private function checkFile(string $recipe, string $file, string $contents): iter
 
             // Rule B (Tailwind kits only): identity/state attributes must be rendered directly.
             if ($isTailwind) {
-                foreach ($this->findStateKeys($args) as $key) {
+                foreach ($this->findForbiddenKeys($args) as $key) {
                     yield new LintIssue(
                         severity: LintSeverity::Error,
                         category: 'component.attributes.state-in-defaults',
-                        message: \sprintf('`%s` must not be defined inside `attributes.defaults()` (line %d): ARIA, Stimulus value (`data-*-value`) and state `data-*` attributes must be rendered directly so they are always present. Keep only `data-controller`/`data-action` (and overridable HTML defaults such as `type`) in `defaults()`.', $key, $line),
+                        message: \sprintf('`%s` must not be defined inside `attributes.defaults()` (line %d): only `data-controller` and `data-action` may live in `defaults()`. Render ARIA, Stimulus value (`data-*-value`) and state `data-*` attributes directly so they are always present.', $key, $line),
                         recipe: $recipe,
                         file: $file,
                     );
@@ -118,17 +123,14 @@ private function checkFile(string $recipe, string $file, string $contents): iter
     /**
      * @return list<string>
      */
-    private function findStateKeys(string $args): array
+    private function findForbiddenKeys(string $args): array
     {
-        $keys = [];
-        foreach (self::RE_STATE_KEYS as $pattern) {
-            if (preg_match_all($pattern, $args, $matches)) {
-                foreach ($matches['key'] as $key) {
-                    $keys[] = $key;
-                }
-            }
+        if (!preg_match_all(self::RE_TAILWIND_KEY, $args, $matches)) {
+            return [];
         }
 
+        $keys = array_filter($matches['key'], static fn (string $key): bool => !\in_array($key, self::ALLOWED_IN_DEFAULTS, true));
+
         return array_values(array_unique($keys));
     }