praxis-kit 7.4.0 → 7.8.0

package/dist/preact/index.js

@@ -41,6 +41,9 @@ function dynamic(resolve) {
 }
 
 // ../../lib/primitive/src/guards/foundational/is-defined.ts
+function isDefined(value) {
+  return value !== void 0;
+}
 function isUndefined(value) {
   return value === void 0;
 }
@@ -798,21 +801,65 @@ function getImplicitRole(tag, props) {
   return void 0;
 }
 
-// ../../lib/contract/src/diagnostics/aria.ts
+// ../../lib/contract/src/diagnostics/anchor-accessibility.ts
 import { DiagnosticCategory, DiagnosticCode } from "../_shared/diagnostics.js";
+function createDiagnostic(input) {
+  return { category: DiagnosticCategory.Accessibility, ...input };
+}
+var AnchorAccessibilityDiagnostics = {
+  roleButtonWithHref() {
+    return createDiagnostic({
+      code: DiagnosticCode.A11yAnchorRoleButtonWithHref,
+      severity: "warning",
+      message: 'role="button" on an <a> with an href overrides its navigation semantics for assistive technology; use a real <button> element, or remove href, if this element should not navigate.',
+      rationale: 'Assistive technology announces role="button" as a button, not a link \u2014 but the element still follows the link when activated by mouse or keyboard, which is confusing and inconsistent with how a button is expected to behave.',
+      suggestions: [
+        {
+          title: "Use a real <button>",
+          description: "If this element should not navigate, render a <button> instead of an <a>."
+        },
+        {
+          title: 'Remove role="button"',
+          description: "If this element should navigate, keep the default link role."
+        }
+      ]
+    });
+  },
+  ariaDisabledInert() {
+    return createDiagnostic({
+      code: DiagnosticCode.A11yAnchorAriaDisabledInert,
+      severity: "warning",
+      message: "aria-disabled does not prevent an <a> from being focused, clicked, or navigated via keyboard; remove href, or prevent navigation yourself, if this link should be inert.",
+      rationale: "Unlike a native form control, an <a> has no disabled state the browser enforces \u2014 aria-disabled only changes what assistive technology announces, not what actually happens when the link is activated by mouse or keyboard.",
+      suggestions: [
+        {
+          title: "Remove href",
+          description: "If this element is temporarily unavailable, remove href until it can be activated."
+        },
+        {
+          title: "Prevent navigation when disabled",
+          description: "Prevent the click and keyboard activation when the link is disabled so it behaves consistently for all users."
+        }
+      ]
+    });
+  }
+};
+
+// ../../lib/contract/src/diagnostics/aria.ts
+import { DiagnosticCategory as DiagnosticCategory2, DiagnosticCode as DiagnosticCode2 } from "../_shared/diagnostics.js";
 var AriaDiagnostics = {
   /** Generic bridge for violations produced by external AriaRule functions. */
   fromViolation(v) {
     return {
-      code: DiagnosticCode.AriaViolation,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaViolation,
+      category: DiagnosticCategory2.ARIA,
       message: v.message
     };
   },
   attributeInvalid(key, role) {
     return {
-      code: DiagnosticCode.AriaAttributeInvalid,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaAttributeInvalid,
+      category: DiagnosticCategory2.ARIA,
       message: `"${key}" is not valid on role="${role}". It will be removed.`,
       rationale: "Invalid ARIA attributes are ignored by assistive technology and may trigger accessibility-tree warnings in browser devtools.",
       suggestions: [
@@ -825,8 +872,8 @@ var AriaDiagnostics = {
   },
   missingLiveRegion(role, impliedLive) {
     return {
-      code: DiagnosticCode.AriaMissingLiveRegion,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaMissingLiveRegion,
+      category: DiagnosticCategory2.ARIA,
       message: `role="${role}" implies aria-live="${impliedLive}" but it is missing. It has been injected.`,
       rationale: "Live-region roles announce dynamic content changes to screen readers. Without aria-live the politeness level is unspecified and announcements may be silent.",
       suggestions: [
@@ -840,8 +887,8 @@ var AriaDiagnostics = {
   },
   missingAtomic(role) {
     return {
-      code: DiagnosticCode.AriaMissingAtomic,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaMissingAtomic,
+      category: DiagnosticCategory2.ARIA,
       message: `role="${role}" is a live region. Consider setting aria-atomic="true" if the full region should be announced as a unit, or aria-atomic="false" if only changed nodes should be read.`,
       rationale: "aria-atomic controls whether assistive technology announces the entire live region or only the changed nodes. Omitting it leaves the behaviour browser-defined."
     };
@@ -849,8 +896,8 @@ var AriaDiagnostics = {
   relevantInvalidTokens(invalid) {
     const quoted = invalid.map((t) => `"${t}"`).join(", ");
     return {
-      code: DiagnosticCode.AriaRelevantInvalidToken,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaRelevantInvalidToken,
+      category: DiagnosticCategory2.ARIA,
       message: `aria-relevant contains invalid token(s): ${quoted}. Valid tokens are: additions, removals, text, all.`,
       rationale: "aria-relevant accepts a space-separated list of change types. Unrecognised tokens are silently ignored by assistive technology, making the attribute ineffective.",
       suggestions: [
@@ -863,8 +910,8 @@ var AriaDiagnostics = {
   },
   relevantSuperseded() {
     return {
-      code: DiagnosticCode.AriaRelevantSuperseded,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaRelevantSuperseded,
+      category: DiagnosticCategory2.ARIA,
       message: 'aria-relevant includes "all" alongside other tokens. "all" supersedes additions, removals, and text \u2014 use aria-relevant="all" alone.',
       rationale: '"all" is equivalent to "additions removals text". Combining it with other tokens is redundant and may confuse readers of the markup.',
       suggestions: [
@@ -877,8 +924,8 @@ var AriaDiagnostics = {
   },
   missingAccessibleName(tag) {
     return {
-      code: DiagnosticCode.AriaMissingAccessibleName,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaMissingAccessibleName,
+      category: DiagnosticCategory2.ARIA,
       message: `<${tag}> has no accessible name. Add aria-label or aria-labelledby.`,
       rationale: "Elements with a landmark or interactive role must have an accessible name so that assistive technology can identify them when presenting the page outline.",
       suggestions: [
@@ -895,8 +942,8 @@ var AriaDiagnostics = {
   },
   attributeOnPresentational(attr, tag) {
     return {
-      code: DiagnosticCode.AriaAttributeOnPresentational,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaAttributeOnPresentational,
+      category: DiagnosticCategory2.ARIA,
       message: `"${attr}" is not allowed on a presentational <${tag}>. Presentational elements are invisible to assistive technology.`,
       rationale: 'role="none" and role="presentation" (including <img alt="">) remove an element from the accessibility tree. ARIA attributes on such elements are ignored by assistive technology.',
       suggestions: [
@@ -909,8 +956,8 @@ var AriaDiagnostics = {
   },
   ariaHiddenOnFocusable(tag) {
     return {
-      code: DiagnosticCode.AriaHiddenOnFocusable,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaHiddenOnFocusable,
+      category: DiagnosticCategory2.ARIA,
       message: `aria-hidden="true" must not be used on focusable <${tag}> elements. Screen reader users who navigate by keyboard will encounter the element but receive no information about it.`,
       rationale: 'aria-hidden removes an element from the accessibility tree while leaving it keyboard-reachable. This creates a "ghost" \u2014 a focusable element assistive technology cannot describe.',
       suggestions: [
@@ -928,8 +975,8 @@ var AriaDiagnostics = {
   invalidAttributeValue(attr, value, expected) {
     const got = value === null ? "null" : value === void 0 ? "undefined" : typeof value === "string" ? `"${value}"` : String(value);
     return {
-      code: DiagnosticCode.AriaInvalidAttributeValue,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaInvalidAttributeValue,
+      category: DiagnosticCategory2.ARIA,
       message: `"${attr}" has an invalid value (${got}). Expected: ${expected}.`,
       rationale: "ARIA attributes with invalid values are silently ignored by assistive technology, making the markup semantically inert.",
       suggestions: [
@@ -942,8 +989,8 @@ var AriaDiagnostics = {
   },
   redundantAriaLevel(tag, level) {
     return {
-      code: DiagnosticCode.AriaRedundantLevelAttribute,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaRedundantLevelAttribute,
+      category: DiagnosticCategory2.ARIA,
       message: `aria-level="${level}" is redundant on <${tag}>: the element already has an implicit heading level of ${level}. Remove the attribute.`,
       rationale: 'Restating the implicit aria-level adds noise without semantic value. Use aria-level only to override the native heading level (e.g. aria-level="3" on <h2>).',
       suggestions: [
@@ -956,8 +1003,8 @@ var AriaDiagnostics = {
   },
   requiredProperty(attr, role) {
     return {
-      code: DiagnosticCode.AriaRequiredProperty,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaRequiredProperty,
+      category: DiagnosticCategory2.ARIA,
       message: `"${attr}" is required for role="${role}" but is missing.`,
       rationale: `WAI-ARIA 1.2 specifies required states and properties for certain roles. Without "${attr}", assistive technology cannot correctly communicate the element's state to users.`,
       suggestions: [
@@ -970,8 +1017,8 @@ var AriaDiagnostics = {
   },
   invalidRole(role, tag) {
     return {
-      code: DiagnosticCode.AriaInvalidRole,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaInvalidRole,
+      category: DiagnosticCategory2.ARIA,
       message: `Invalid role "${role ?? ""}" on <${tag}>.`,
       rationale: "An unrecognised or misapplied ARIA role is ignored by assistive technology and may degrade the accessibility of the element."
     };
@@ -979,12 +1026,12 @@ var AriaDiagnostics = {
 };
 
 // ../../lib/contract/src/diagnostics/contract.ts
-import { DiagnosticCategory as DiagnosticCategory2, DiagnosticCode as DiagnosticCode2 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory3, DiagnosticCode as DiagnosticCode3 } from "../_shared/diagnostics.js";
 var ContractDiagnostics = {
   unexpectedChild(typeName, index, context) {
     return {
-      code: DiagnosticCode2.UnexpectedChild,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.UnexpectedChild,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: unexpected child "${typeName}" at index ${index}.`
     };
@@ -992,69 +1039,69 @@ var ContractDiagnostics = {
   ambiguousChild(typeName, index, ruleNames, context) {
     const quoted = ruleNames.map((n) => `"${n}"`).join(" and ");
     return {
-      code: DiagnosticCode2.AmbiguousChild,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.AmbiguousChild,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: child "${typeName}" at index ${index} matches multiple child rules: ${quoted}.`
     };
   },
   cardinalityMin(ruleName, min, context) {
     return {
-      code: DiagnosticCode2.CardinalityMin,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.CardinalityMin,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: "${ruleName}" requires at least ${min}.`
     };
   },
   cardinalityMax(ruleName, max, context) {
     return {
-      code: DiagnosticCode2.CardinalityMax,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.CardinalityMax,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: "${ruleName}" allows at most ${max}.`
     };
   },
   positionViolation(ruleName, position, index, context) {
     return {
-      code: DiagnosticCode2.PositionViolation,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.PositionViolation,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: "${ruleName}" must be ${position}, got index ${index}`
     };
   },
   unknownVariantDim(component, label2, dim) {
     return {
-      code: DiagnosticCode2.ContractUnknownVariantDim,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.ContractUnknownVariantDim,
+      category: DiagnosticCategory3.Contract,
       message: `${component}: ${label2} references unknown variant "${dim}".`
     };
   },
   unknownVariantValue(component, label2, dim, value, valid) {
     return {
-      code: DiagnosticCode2.ContractUnknownVariantValue,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.ContractUnknownVariantValue,
+      category: DiagnosticCategory3.Contract,
       message: `${component}: ${label2} sets "${dim}" to unknown value "${value}" (valid: ${valid.join(", ")}).`
     };
   },
   unknownRecipeKey(component, key) {
     return {
-      code: DiagnosticCode2.ContractUnknownRecipeKey,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.ContractUnknownRecipeKey,
+      category: DiagnosticCategory3.Contract,
       message: `${component} Unknown recipeKey "${key}" \u2014 no preset with that name exists.`
     };
   },
   invalidVariantValue(component, key, value) {
     return {
-      code: DiagnosticCode2.ContractInvalidVariantValue,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.ContractInvalidVariantValue,
+      category: DiagnosticCategory3.Contract,
       message: `${component} Variant "${key}=${value}" is not a defined value for the "${key}" dimension.`
     };
   },
   allowedAsViolation(tag, allowedAs, component) {
     const allowed = allowedAs.map((t) => `"${String(t)}"`).join(", ");
     return {
-      code: DiagnosticCode2.AllowedAsViolation,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.AllowedAsViolation,
+      category: DiagnosticCategory3.Contract,
       component,
       message: `<${component}>: "as" prop received "${tag}" but only [${allowed}] are allowed.`
     };
@@ -1062,68 +1109,68 @@ var ContractDiagnostics = {
 };
 
 // ../../lib/contract/src/diagnostics/html.ts
-import { DiagnosticCategory as DiagnosticCategory3, DiagnosticCode as DiagnosticCode3 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory4, DiagnosticCode as DiagnosticCode4 } from "../_shared/diagnostics.js";
 var ATTRIBUTE_IGNORED_CODES = {
-  checked: DiagnosticCode3.HtmlInputCheckedIgnoredForType,
-  multiple: DiagnosticCode3.HtmlInputMultipleIgnoredForType,
-  maxLength: DiagnosticCode3.HtmlInputMaxLengthIgnoredForType,
-  minLength: DiagnosticCode3.HtmlInputMinLengthIgnoredForType,
-  pattern: DiagnosticCode3.HtmlInputPatternIgnoredForType,
-  min: DiagnosticCode3.HtmlInputMinIgnoredForType,
-  max: DiagnosticCode3.HtmlInputMaxIgnoredForType,
-  step: DiagnosticCode3.HtmlInputStepIgnoredForType,
-  accept: DiagnosticCode3.HtmlInputAcceptIgnoredForType,
-  capture: DiagnosticCode3.HtmlInputCaptureIgnoredForType,
-  size: DiagnosticCode3.HtmlInputSizeIgnoredForType,
-  alt: DiagnosticCode3.HtmlInputAltIgnoredForType,
-  height: DiagnosticCode3.HtmlInputHeightIgnoredForType,
-  width: DiagnosticCode3.HtmlInputWidthIgnoredForType
+  checked: DiagnosticCode4.HtmlInputCheckedIgnoredForType,
+  multiple: DiagnosticCode4.HtmlInputMultipleIgnoredForType,
+  maxLength: DiagnosticCode4.HtmlInputMaxLengthIgnoredForType,
+  minLength: DiagnosticCode4.HtmlInputMinLengthIgnoredForType,
+  pattern: DiagnosticCode4.HtmlInputPatternIgnoredForType,
+  min: DiagnosticCode4.HtmlInputMinIgnoredForType,
+  max: DiagnosticCode4.HtmlInputMaxIgnoredForType,
+  step: DiagnosticCode4.HtmlInputStepIgnoredForType,
+  accept: DiagnosticCode4.HtmlInputAcceptIgnoredForType,
+  capture: DiagnosticCode4.HtmlInputCaptureIgnoredForType,
+  size: DiagnosticCode4.HtmlInputSizeIgnoredForType,
+  alt: DiagnosticCode4.HtmlInputAltIgnoredForType,
+  height: DiagnosticCode4.HtmlInputHeightIgnoredForType,
+  width: DiagnosticCode4.HtmlInputWidthIgnoredForType
 };
 var HtmlDiagnostics = {
   emptyRole(tag) {
     return {
-      code: DiagnosticCode3.HtmlEmptyRole,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlEmptyRole,
+      category: DiagnosticCategory4.HTML,
       severity: "warning",
       message: `<${tag}> has an explicit empty role="". Omit the attribute instead.`
     };
   },
   implicitRoleRedundant(tag, implicitRole) {
     return {
-      code: DiagnosticCode3.HtmlImplicitRoleRedundant,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlImplicitRoleRedundant,
+      category: DiagnosticCategory4.HTML,
       severity: "warning",
       message: `<${tag}> already has implicit role="${implicitRole}". Avoid redundant role assignment.`
     };
   },
   implicitRoleOverride(tag, implicitRole, role) {
     return {
-      code: DiagnosticCode3.HtmlImplicitRoleOverride,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlImplicitRoleOverride,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `<${tag}> should not override its implicit role="${implicitRole}" with role="${role}".`
     };
   },
   standaloneRegionOverride(tag, implicitRole) {
     return {
-      code: DiagnosticCode3.HtmlStandaloneRegionOverride,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlStandaloneRegionOverride,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `<${tag}> is a self-contained element with implicit role="${implicitRole}". Assigning role="region" has been removed.`
     };
   },
   landmarkRoleOverride(tag, implicitRole, role) {
     return {
-      code: DiagnosticCode3.HtmlLandmarkRoleOverride,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlLandmarkRoleOverride,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `<${tag}> has a fixed landmark role="${implicitRole}". role="${role}" overrides it and confuses assistive technology. The override has been removed.`
     };
   },
   invalidChild(child, parent, allowed) {
     return {
-      code: DiagnosticCode3.HtmlInvalidChild,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlInvalidChild,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `<${child}> is not a valid direct child of <${parent}>. Allowed: ${allowed}.`
     };
@@ -1131,8 +1178,8 @@ var HtmlDiagnostics = {
   roleNotPermitted(tag, role, allowedRoles) {
     const allowed = allowedRoles.length > 0 ? allowedRoles.map((r) => `"${r}"`).join(", ") : "none \u2014 no explicit role is permitted on this element";
     return {
-      code: DiagnosticCode3.HtmlRoleNotPermitted,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlRoleNotPermitted,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `role="${role}" is not permitted on <${tag}>. Allowed alternate role(s): ${allowed}.`,
       rationale: 'The WAI-ARIA "ARIA in HTML" specification restricts which explicit roles a native element may take. A role outside that set is ignored or produces undefined behavior in assistive technology.'
@@ -1143,8 +1190,8 @@ var HtmlDiagnostics = {
   input: {
     unsupportedType(type) {
       return {
-        code: DiagnosticCode3.HtmlInputUnsupportedType,
-        category: DiagnosticCategory3.HTML,
+        code: DiagnosticCode4.HtmlInputUnsupportedType,
+        category: DiagnosticCategory4.HTML,
         severity: "warning",
         message: `type="${type}" is not a value defined by the HTML specification. Browsers silently fall back to type="text".`,
         rationale: 'An unrecognized input type is not invalid markup \u2014 the spec requires the "text" fallback \u2014 but it usually means a typo, since the input keeps working while silently losing the intended type-specific behavior (validation, virtual keyboard, picker UI).',
@@ -1164,7 +1211,7 @@ var HtmlDiagnostics = {
       if (!code) throw new Error(`No DiagnosticCode registered for input attribute "${attribute}"`);
       return {
         code,
-        category: DiagnosticCategory3.HTML,
+        category: DiagnosticCategory4.HTML,
         severity: "warning",
         message: `"${attribute}" is ignored on <input type="${type}">.`,
         rationale: `"${attribute}" only has an effect when type is one of: ${allowed}. Browsers silently ignore it on other input types.`,
@@ -1176,18 +1223,30 @@ var HtmlDiagnostics = {
         ]
       };
     }
+  },
+  // Reserved for <a>-specific facts (HTML3201–3299, see codes.ts).
+  anchor: {
+    dangerousHref(href) {
+      return {
+        code: DiagnosticCode4.HtmlAnchorDangerousHref,
+        category: DiagnosticCategory4.HTML,
+        severity: "warning",
+        message: `href="${href}" uses a scheme that executes attacker-controlled content when navigated to. It has been removed.`,
+        rationale: '"javascript:", "data:", and "vbscript:" URLs are a common XSS vector when href comes from untrusted input \u2014 none of the three are needed for legitimate navigation.'
+      };
+    }
   }
 };
 
 // ../../lib/contract/src/diagnostics/input-accessibility.ts
-import { DiagnosticCategory as DiagnosticCategory4, DiagnosticCode as DiagnosticCode4 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory5, DiagnosticCode as DiagnosticCode5 } from "../_shared/diagnostics.js";
 function accessibilityFact(input) {
-  return { category: DiagnosticCategory4.Accessibility, ...input };
+  return { category: DiagnosticCategory5.Accessibility, ...input };
 }
 var InputAccessibilityDiagnostics = {
   missingAccessibleName() {
     return accessibilityFact({
-      code: DiagnosticCode4.A11yInputMissingAccessibleName,
+      code: DiagnosticCode5.A11yInputMissingAccessibleName,
       severity: "warning",
       message: "This input has no accessible name. Add an associated <label>, aria-label, or aria-labelledby.",
       rationale: "Assistive technology announces a form field by its accessible name; without one, users of screen readers cannot tell what the field is for.",
@@ -1202,7 +1261,7 @@ var InputAccessibilityDiagnostics = {
   },
   placeholderIsNotLabel() {
     return accessibilityFact({
-      code: DiagnosticCode4.A11yInputPlaceholderNotLabel,
+      code: DiagnosticCode5.A11yInputPlaceholderNotLabel,
       severity: "warning",
       message: "Placeholder text does not provide an accessible name. Add an associated <label>, aria-label, or aria-labelledby.",
       rationale: "Placeholder text disappears as users interact with the field and is not treated as the control's accessible name by many assistive technologies.",
@@ -1217,7 +1276,7 @@ var InputAccessibilityDiagnostics = {
   },
   passwordMissingAutocomplete() {
     return accessibilityFact({
-      code: DiagnosticCode4.A11yInputPasswordAutocomplete,
+      code: DiagnosticCode5.A11yInputPasswordAutocomplete,
       severity: "warning",
       message: "Password inputs should specify an autoComplete value.",
       rationale: "Without an explicit autocomplete hint, password managers and browsers cannot reliably tell a sign-in field apart from a password-creation field.",
@@ -1235,7 +1294,7 @@ var InputAccessibilityDiagnostics = {
   },
   requiredReadOnlyConflict() {
     return accessibilityFact({
-      code: DiagnosticCode4.A11yInputRequiredReadOnlyConflict,
+      code: DiagnosticCode5.A11yInputRequiredReadOnlyConflict,
       severity: "warning",
       message: "The required and readOnly attributes are both present. A read-only field cannot satisfy required validation through user interaction.",
       rationale: "This combination is valid HTML but usually indicates an unintended state. Consider using disabled instead of readOnly, or only applying required when the field is editable."
@@ -1244,28 +1303,28 @@ var InputAccessibilityDiagnostics = {
 };
 
 // ../../lib/contract/src/diagnostics/slot.ts
-import { DiagnosticCategory as DiagnosticCategory5, DiagnosticCode as DiagnosticCode5 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory6, DiagnosticCode as DiagnosticCode6 } from "../_shared/diagnostics.js";
 var SlotDiagnostics = {
   exclusive(name) {
     return {
-      code: DiagnosticCode5.SlotExclusive,
-      category: DiagnosticCategory5.Contract,
+      code: DiagnosticCode6.SlotExclusive,
+      category: DiagnosticCategory6.Contract,
       component: name,
       message: `${name}: "as" and "asChild" are mutually exclusive`
     };
   },
   singleChildRequired(name, elementTerm) {
     return {
-      code: DiagnosticCode5.SlotSingleChild,
-      category: DiagnosticCategory5.Contract,
+      code: DiagnosticCode6.SlotSingleChild,
+      category: DiagnosticCategory6.Contract,
       component: name,
       message: `${name}: asChild requires a ${elementTerm} child`
     };
   },
   singleChildExceeded(name, elementTerm, count) {
     return {
-      code: DiagnosticCode5.SlotSingleChild,
-      category: DiagnosticCategory5.Contract,
+      code: DiagnosticCode6.SlotSingleChild,
+      category: DiagnosticCategory6.Contract,
       component: name,
       message: `${name}: asChild requires exactly one ${elementTerm} child, got ${count}`
     };
@@ -1273,16 +1332,16 @@ var SlotDiagnostics = {
   discardedChildren(name, elementTerm, count) {
     const suffix = count === 1 ? "" : "ren";
     return {
-      code: DiagnosticCode5.SlotDiscardedChildren,
-      category: DiagnosticCategory5.Contract,
+      code: DiagnosticCode6.SlotDiscardedChildren,
+      category: DiagnosticCategory6.Contract,
       component: name,
       message: `${name}: asChild discarded ${count} non-element child${suffix} \u2014 only ${elementTerm}s are valid asChild children.`
     };
   },
   renderFnRequired(name, received) {
     return {
-      code: DiagnosticCode5.SlotRenderFn,
-      category: DiagnosticCategory5.Contract,
+      code: DiagnosticCode6.SlotRenderFn,
+      category: DiagnosticCategory6.Contract,
       component: name,
       message: `${name}: asChild requires a render function as children, got ${received}`
     };
@@ -2028,6 +2087,27 @@ var AriaPolicyEngine = class _AriaPolicyEngine extends InvariantBase {
 };
 
 // ../../lib/contract/src/aria/factories.ts
+function invalidWithoutFix(input) {
+  return {
+    valid: false,
+    fixable: false,
+    severity: input.severity,
+    ...isDefined(input.attribute) && { attribute: input.attribute },
+    ...isDefined(input.message) && { message: input.message },
+    ...isDefined(input.diagnostic) && { diagnostic: input.diagnostic }
+  };
+}
+function invalidWithFix(input) {
+  return {
+    valid: false,
+    fixable: true,
+    severity: input.severity,
+    ...isDefined(input.attribute) && { attribute: input.attribute },
+    ...isDefined(input.message) && { message: input.message },
+    ...isDefined(input.diagnostic) && { diagnostic: input.diagnostic },
+    fix: input.fix
+  };
+}
 function removeProp(props, key) {
   const next = { ...props };
   delete next[key];
@@ -2043,6 +2123,34 @@ function removeAttributeFix(attribute) {
     }
   });
 }
+function defineRuleMetadata(rule, metadata2) {
+  const descriptors = {};
+  for (const key of Object.keys(metadata2)) {
+    descriptors[key] = { value: metadata2[key], enumerable: false };
+  }
+  Object.defineProperties(rule, descriptors);
+  return rule;
+}
+function createRemoveAttributeRule(attribute, options) {
+  const { when, severity = "warning", message, diagnostic, readsProps, tags } = options;
+  const fix = removeAttributeFix(attribute);
+  const rule = (context) => {
+    if (!when(context)) return [];
+    return [
+      invalidWithFix({
+        severity,
+        attribute,
+        ...isDefined(message) && { message },
+        ...isDefined(diagnostic) && { diagnostic: diagnostic(context) },
+        fix
+      })
+    ];
+  };
+  return defineRuleMetadata(rule, {
+    ...isDefined(readsProps) && { readsProps },
+    ...isDefined(tags) && { tags }
+  });
+}
 
 // ../../lib/contract/src/children/get-type-name.ts
 function getTypeName(value) {
@@ -2431,6 +2539,52 @@ var P_BLOCKED_TAGS = [
   "ul"
 ];
 
+// ../core/src/html/anchor-rules.ts
+var DANGEROUS_URL_SCHEMES = ["javascript:", "data:", "vbscript:"];
+function normalizeForSchemeCheck(href) {
+  return href.replace(/[\x00-\x20]/g, "").toLowerCase();
+}
+function isDangerousUrl(href) {
+  if (!isString(href)) return false;
+  const normalized = normalizeForSchemeCheck(href);
+  return DANGEROUS_URL_SCHEMES.some((scheme) => normalized.startsWith(scheme));
+}
+var dangerousHrefRule = createRemoveAttributeRule("href", {
+  when: ({ props }) => isDangerousUrl(props.href),
+  severity: "warning",
+  diagnostic: ({ props }) => HtmlDiagnostics.anchor.dangerousHref(props.href),
+  readsProps: ["href"],
+  tags: ["a"]
+});
+var roleButtonWithHrefRule = Object.assign(
+  ({ props }) => {
+    if (props.role !== "button" || !isString(props.href) || props.href.length === 0) {
+      return [];
+    }
+    const diagnostic = AnchorAccessibilityDiagnostics.roleButtonWithHref();
+    return [invalidWithoutFix({ severity: diagnostic.severity, attribute: "role", diagnostic })];
+  },
+  { readsProps: ["role", "href"], tags: ["a"] }
+);
+var ariaDisabledInertRule = Object.assign(
+  ({ props }) => {
+    const ariaDisabled = props["aria-disabled"];
+    const isDisabled = ariaDisabled === true || ariaDisabled === "true";
+    const hasHref = isString(props.href) && props.href.length > 0;
+    if (!isDisabled || !hasHref) return [];
+    const diagnostic = AnchorAccessibilityDiagnostics.ariaDisabledInert();
+    return [
+      invalidWithoutFix({ severity: diagnostic.severity, attribute: "aria-disabled", diagnostic })
+    ];
+  },
+  { readsProps: ["aria-disabled", "href"], tags: ["a"] }
+);
+var ANCHOR_RULES = [
+  dangerousHrefRule,
+  roleButtonWithHrefRule,
+  ariaDisabledInertRule
+];
+
 // ../core/src/html/spec/vocabulary/input.ts
 var TEXT_INPUT_TYPES = ["text", "search", "url", "tel", "email", "password"];
 var NUMERIC_INPUT_TYPES = [
@@ -2510,12 +2664,12 @@ function createInputAttributeTypeRule({
 // ../core/src/html/spec/validators/mutually-exclusive-validator.ts
 function createMutuallyExclusiveRule({
   props: conflictingProps,
-  diagnostic: createDiagnostic
+  diagnostic: createDiagnostic2
 }) {
   const [first, second] = conflictingProps;
   const rule = ({ tag, props }) => {
     if (tag !== "input" || !props[first] || !props[second]) return [];
-    const diagnostic = createDiagnostic();
+    const diagnostic = createDiagnostic2();
     return [{ valid: false, fixable: false, severity: diagnostic.severity, diagnostic }];
   };
   return Object.assign(rule, { readsProps: conflictingProps, tags: ["input"] });
@@ -2895,7 +3049,8 @@ var HTML_ARIA_RULES = [
   landmarkRoleRule,
   landmarkAccessibleNameRule,
   roleNotPermittedRule,
-  ...INPUT_RULES
+  ...INPUT_RULES,
+  ...ANCHOR_RULES
 ];
 
 // ../core/src/html/contracts/helpers.ts
@@ -3305,19 +3460,6 @@ function createClassPipeline(resolved) {
   };
 }
 
-// ../../lib/pipeline-kit/src/factory/define-pipeline.ts
-function definePipeline(factory) {
-  const cache = /* @__PURE__ */ new WeakMap();
-  return (resolved) => {
-    let pipeline = cache.get(resolved);
-    if (!pipeline) {
-      pipeline = factory(resolved);
-      cache.set(resolved, pipeline);
-    }
-    return pipeline;
-  };
-}
-
 // ../core/src/options/resolve-factory-options.ts
 import { resolveDiagnostics, silentDiagnostics } from "../_shared/diagnostics.js";
 var EMPTY_VARIANT_KEYS = /* @__PURE__ */ new Set();
@@ -3421,25 +3563,66 @@ function validateRenderProps(diagnostics, options, props, recipeKey) {
   }
 }
 
+// ../../lib/pipeline-kit/src/factory/define-pipeline.ts
+function definePipeline(factory) {
+  const cache = /* @__PURE__ */ new WeakMap();
+  return (resolved) => {
+    let pipeline = cache.get(resolved);
+    if (!pipeline) {
+      pipeline = factory(resolved);
+      cache.set(resolved, pipeline);
+    }
+    return pipeline;
+  };
+}
+
+// ../core/src/factory/pipelines/generic.ts
+var createTagPipeline = (resolved) => makeResolveTag(resolved.defaultTag);
+var createPropsPipeline = (resolved) => (props) => mergeProps(resolved.defaultProps, props);
+var createHtmlPropNormalizersPipeline = () => getHtmlPropNormalizers;
+var createHtmlChildrenEvaluatorPipeline = () => getHtmlChildrenEvaluator;
+var createStylingClassPipeline = (resolved) => createClassPipeline(resolved);
+var memoizedTagPipeline = definePipeline(createTagPipeline);
+var memoizedPropsPipeline = definePipeline(createPropsPipeline);
+var memoizedHtmlPropNormalizersPipeline = definePipeline(createHtmlPropNormalizersPipeline);
+var memoizedHtmlChildrenEvaluatorPipeline = definePipeline(
+  createHtmlChildrenEvaluatorPipeline
+);
+var memoizedClassPipeline = definePipeline(createStylingClassPipeline);
+
+// ../core/src/factory/pipelines/aria.ts
+function resolveAriaRules(resolved) {
+  return [.../* @__PURE__ */ new Set([...HTML_ARIA_RULES, ...resolved.ariaRules ?? []])];
+}
+var createAriaPipeline = (resolved) => {
+  const rules = resolveAriaRules(resolved);
+  const engine = new AriaPolicyEngine(resolved.diagnostics, rules.length ? { rules } : void 0);
+  return (tag, props) => engine.validate(tag, props);
+};
+var memoizedAriaPipeline = definePipeline(createAriaPipeline);
+function resolveAriaPassthrough(_tag, props) {
+  return { props };
+}
+
 // ../core/src/factory/plugin-invariants.ts
 import { throwDiagnostics } from "../_shared/diagnostics.js";
 
 // ../core/src/factory/plugin-diagnostics.ts
-import { DiagnosticCategory as DiagnosticCategory6, DiagnosticCode as DiagnosticCode6 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory7, DiagnosticCode as DiagnosticCode7 } from "../_shared/diagnostics.js";
 var PluginDiagnostics = {
   invalidShape(received) {
-    const got = received === null ? "null" : typeof received;
+    const got = isNull(received) ? "null" : typeof received;
     return {
-      code: DiagnosticCode6.PluginInvalidShape,
-      category: DiagnosticCategory6.Internal,
+      code: DiagnosticCode7.PluginInvalidShape,
+      category: DiagnosticCategory7.Internal,
       message: `[praxis-kit] Plugin factory must return an object with a 'pipeline' function. Got: ${got}.`
     };
   },
   pipelineReturnType(received) {
-    const got = received === null ? "null" : Array.isArray(received) ? "array" : typeof received;
+    const got = isNull(received) ? "null" : Array.isArray(received) ? "array" : typeof received;
     return {
-      code: DiagnosticCode6.PluginPipelineReturnType,
-      category: DiagnosticCategory6.Internal,
+      code: DiagnosticCode7.PluginPipelineReturnType,
+      category: DiagnosticCategory7.Internal,
       message: `[praxis-kit] Plugin pipeline must return a string. Got: ${got}.`
     };
   }
@@ -3447,60 +3630,41 @@ var PluginDiagnostics = {
 
 // ../core/src/factory/plugin-invariants.ts
 function assertPluginShape(result) {
-  if (result === null || typeof result !== "object")
+  if (isNull(result) || !isObject(result))
     throwDiagnostics.error(PluginDiagnostics.invalidShape(result));
   const plugin = result;
-  if (typeof plugin.pipeline !== "function")
-    throwDiagnostics.error(PluginDiagnostics.invalidShape(result));
+  if (!isFunction(plugin.pipeline)) throwDiagnostics.error(PluginDiagnostics.invalidShape(result));
 }
 function guardPipeline(pipeline) {
   if (process.env.NODE_ENV === "production") return pipeline;
   return function guardedPipeline(tag, props, className, recipe) {
     const result = pipeline(tag, props, className, recipe);
-    if (typeof result !== "string")
-      throwDiagnostics.error(PluginDiagnostics.pipelineReturnType(result));
+    if (!isString(result)) throwDiagnostics.error(PluginDiagnostics.pipelineReturnType(result));
     return result;
   };
 }
 
-// ../core/src/factory/create-polymorphic2.ts
-var createTagPipeline = (resolved) => makeResolveTag(resolved.defaultTag);
-var createPropsPipeline = (resolved) => (props) => mergeProps(resolved.defaultProps, props);
-var createHtmlPropNormalizersPipeline = () => getHtmlPropNormalizers;
-var createHtmlChildrenEvaluatorPipeline = () => getHtmlChildrenEvaluator;
-var createStylingClassPipeline = (resolved) => createClassPipeline(resolved);
-function resolveAriaRules(resolved) {
-  return [.../* @__PURE__ */ new Set([...HTML_ARIA_RULES, ...resolved.ariaRules ?? []])];
-}
-var createAriaPipeline = (resolved) => {
-  const rules = resolveAriaRules(resolved);
-  const engine = new AriaPolicyEngine(resolved.diagnostics, rules.length ? { rules } : void 0);
-  return (tag, props) => engine.validate(tag, props);
-};
-var memoizedTagPipeline = definePipeline(createTagPipeline);
-var memoizedPropsPipeline = definePipeline(createPropsPipeline);
-var memoizedHtmlPropNormalizersPipeline = definePipeline(createHtmlPropNormalizersPipeline);
-var memoizedHtmlChildrenEvaluatorPipeline = definePipeline(createHtmlChildrenEvaluatorPipeline);
-var memoizedClassPipeline = definePipeline(createStylingClassPipeline);
-var memoizedAriaPipeline = definePipeline(createAriaPipeline);
-function resolveAriaPassthrough(_tag, props) {
-  return { props };
-}
+// ../core/src/factory/pipelines/styling.ts
 function resolveClassPlugin(factory, resolved, diagnostics) {
   if (!factory) return { pluginResult: void 0, classPipeline: memoizedClassPipeline(resolved) };
   const pluginResult = factory(resolved, diagnostics);
   assertPluginShape(pluginResult);
   return { pluginResult, classPipeline: guardPipeline(pluginResult.pipeline) };
 }
-function createPolymorphic2(options = {}) {
+
+// ../core/src/factory/create-polymorphic.ts
+function eraseResolvedShape(resolved) {
+  return resolved;
+}
+function createPolymorphic(options = {}) {
   const baseResolved = resolveFactoryOptions(options);
-  const anyBaseResolved = baseResolved;
+  const anyBaseResolved = eraseResolvedShape(baseResolved);
   const resolved = Object.freeze({
     ...baseResolved,
     htmlPropNormalizersFn: memoizedHtmlPropNormalizersPipeline(anyBaseResolved),
     htmlChildrenEvaluatorFn: memoizedHtmlChildrenEvaluatorPipeline(anyBaseResolved)
   });
-  const anyResolved = resolved;
+  const anyResolved = eraseResolvedShape(resolved);
   if (process.env.NODE_ENV !== "production") {
     validateFactoryOptions(resolved, resolved.diagnostics);
   }
@@ -3541,7 +3705,7 @@ function enforceAllowedAs(tag, allowedAs, diagnostics, displayName) {
 // ../../lib/adapter-utils/src/runtime/build-core-runtime.ts
 var EMPTY_SET = /* @__PURE__ */ new Set();
 function buildCoreRuntime(normalized) {
-  const runtime = createPolymorphic2(normalized);
+  const runtime = createPolymorphic(normalized);
   const ownedKeys = "classPlugin" in runtime ? runtime.classPlugin.ownedKeys ?? EMPTY_SET : EMPTY_SET;
   return { runtime, ownedKeys };
 }
@@ -3946,7 +4110,11 @@ function createContractComponent(options) {
     const onElementRef = useCallback((el) => {
       if (!onElement) return;
       if (el) {
-        cleanupRef.current = onElement(el, () => propsRef.current) ?? void 0;
+        cleanupRef.current?.();
+        cleanupRef.current = onElement(
+          el,
+          () => propsRef.current
+        ) ?? void 0;
       } else {
         cleanupRef.current?.();
         cleanupRef.current = void 0;