praxis-kit 7.5.0 → 7.8.1

package/dist/lit/index.js

@@ -33,6 +33,9 @@ function dynamic(resolve) {
 }
 
 // ../../lib/primitive/src/guards/foundational/is-defined.ts
+function isDefined(value) {
+  return value !== void 0;
+}
 function isUndefined(value) {
   return value === void 0;
 }
@@ -667,21 +670,65 @@ function getImplicitRole(tag, props) {
   return void 0;
 }
 
-// ../../lib/contract/src/diagnostics/aria.ts
+// ../../lib/contract/src/diagnostics/anchor-accessibility.ts
 import { DiagnosticCategory, DiagnosticCode } from "../_shared/diagnostics.js";
+function createDiagnostic(input) {
+  return { category: DiagnosticCategory.Accessibility, ...input };
+}
+var AnchorAccessibilityDiagnostics = {
+  roleButtonWithHref() {
+    return createDiagnostic({
+      code: DiagnosticCode.A11yAnchorRoleButtonWithHref,
+      severity: "warning",
+      message: 'role="button" on an <a> with an href overrides its navigation semantics for assistive technology; use a real <button> element, or remove href, if this element should not navigate.',
+      rationale: 'Assistive technology announces role="button" as a button, not a link \u2014 but the element still follows the link when activated by mouse or keyboard, which is confusing and inconsistent with how a button is expected to behave.',
+      suggestions: [
+        {
+          title: "Use a real <button>",
+          description: "If this element should not navigate, render a <button> instead of an <a>."
+        },
+        {
+          title: 'Remove role="button"',
+          description: "If this element should navigate, keep the default link role."
+        }
+      ]
+    });
+  },
+  ariaDisabledInert() {
+    return createDiagnostic({
+      code: DiagnosticCode.A11yAnchorAriaDisabledInert,
+      severity: "warning",
+      message: "aria-disabled does not prevent an <a> from being focused, clicked, or navigated via keyboard; remove href, or prevent navigation yourself, if this link should be inert.",
+      rationale: "Unlike a native form control, an <a> has no disabled state the browser enforces \u2014 aria-disabled only changes what assistive technology announces, not what actually happens when the link is activated by mouse or keyboard.",
+      suggestions: [
+        {
+          title: "Remove href",
+          description: "If this element is temporarily unavailable, remove href until it can be activated."
+        },
+        {
+          title: "Prevent navigation when disabled",
+          description: "Prevent the click and keyboard activation when the link is disabled so it behaves consistently for all users."
+        }
+      ]
+    });
+  }
+};
+
+// ../../lib/contract/src/diagnostics/aria.ts
+import { DiagnosticCategory as DiagnosticCategory2, DiagnosticCode as DiagnosticCode2 } from "../_shared/diagnostics.js";
 var AriaDiagnostics = {
   /** Generic bridge for violations produced by external AriaRule functions. */
   fromViolation(v) {
     return {
-      code: DiagnosticCode.AriaViolation,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaViolation,
+      category: DiagnosticCategory2.ARIA,
       message: v.message
     };
   },
   attributeInvalid(key, role) {
     return {
-      code: DiagnosticCode.AriaAttributeInvalid,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaAttributeInvalid,
+      category: DiagnosticCategory2.ARIA,
       message: `"${key}" is not valid on role="${role}". It will be removed.`,
       rationale: "Invalid ARIA attributes are ignored by assistive technology and may trigger accessibility-tree warnings in browser devtools.",
       suggestions: [
@@ -694,8 +741,8 @@ var AriaDiagnostics = {
   },
   missingLiveRegion(role, impliedLive) {
     return {
-      code: DiagnosticCode.AriaMissingLiveRegion,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaMissingLiveRegion,
+      category: DiagnosticCategory2.ARIA,
       message: `role="${role}" implies aria-live="${impliedLive}" but it is missing. It has been injected.`,
       rationale: "Live-region roles announce dynamic content changes to screen readers. Without aria-live the politeness level is unspecified and announcements may be silent.",
       suggestions: [
@@ -709,8 +756,8 @@ var AriaDiagnostics = {
   },
   missingAtomic(role) {
     return {
-      code: DiagnosticCode.AriaMissingAtomic,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaMissingAtomic,
+      category: DiagnosticCategory2.ARIA,
       message: `role="${role}" is a live region. Consider setting aria-atomic="true" if the full region should be announced as a unit, or aria-atomic="false" if only changed nodes should be read.`,
       rationale: "aria-atomic controls whether assistive technology announces the entire live region or only the changed nodes. Omitting it leaves the behaviour browser-defined."
     };
@@ -718,8 +765,8 @@ var AriaDiagnostics = {
   relevantInvalidTokens(invalid) {
     const quoted = invalid.map((t) => `"${t}"`).join(", ");
     return {
-      code: DiagnosticCode.AriaRelevantInvalidToken,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaRelevantInvalidToken,
+      category: DiagnosticCategory2.ARIA,
       message: `aria-relevant contains invalid token(s): ${quoted}. Valid tokens are: additions, removals, text, all.`,
       rationale: "aria-relevant accepts a space-separated list of change types. Unrecognised tokens are silently ignored by assistive technology, making the attribute ineffective.",
       suggestions: [
@@ -732,8 +779,8 @@ var AriaDiagnostics = {
   },
   relevantSuperseded() {
     return {
-      code: DiagnosticCode.AriaRelevantSuperseded,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaRelevantSuperseded,
+      category: DiagnosticCategory2.ARIA,
       message: 'aria-relevant includes "all" alongside other tokens. "all" supersedes additions, removals, and text \u2014 use aria-relevant="all" alone.',
       rationale: '"all" is equivalent to "additions removals text". Combining it with other tokens is redundant and may confuse readers of the markup.',
       suggestions: [
@@ -746,8 +793,8 @@ var AriaDiagnostics = {
   },
   missingAccessibleName(tag) {
     return {
-      code: DiagnosticCode.AriaMissingAccessibleName,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaMissingAccessibleName,
+      category: DiagnosticCategory2.ARIA,
       message: `<${tag}> has no accessible name. Add aria-label or aria-labelledby.`,
       rationale: "Elements with a landmark or interactive role must have an accessible name so that assistive technology can identify them when presenting the page outline.",
       suggestions: [
@@ -764,8 +811,8 @@ var AriaDiagnostics = {
   },
   attributeOnPresentational(attr, tag) {
     return {
-      code: DiagnosticCode.AriaAttributeOnPresentational,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaAttributeOnPresentational,
+      category: DiagnosticCategory2.ARIA,
       message: `"${attr}" is not allowed on a presentational <${tag}>. Presentational elements are invisible to assistive technology.`,
       rationale: 'role="none" and role="presentation" (including <img alt="">) remove an element from the accessibility tree. ARIA attributes on such elements are ignored by assistive technology.',
       suggestions: [
@@ -778,8 +825,8 @@ var AriaDiagnostics = {
   },
   ariaHiddenOnFocusable(tag) {
     return {
-      code: DiagnosticCode.AriaHiddenOnFocusable,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaHiddenOnFocusable,
+      category: DiagnosticCategory2.ARIA,
       message: `aria-hidden="true" must not be used on focusable <${tag}> elements. Screen reader users who navigate by keyboard will encounter the element but receive no information about it.`,
       rationale: 'aria-hidden removes an element from the accessibility tree while leaving it keyboard-reachable. This creates a "ghost" \u2014 a focusable element assistive technology cannot describe.',
       suggestions: [
@@ -797,8 +844,8 @@ var AriaDiagnostics = {
   invalidAttributeValue(attr, value, expected) {
     const got = value === null ? "null" : value === void 0 ? "undefined" : typeof value === "string" ? `"${value}"` : String(value);
     return {
-      code: DiagnosticCode.AriaInvalidAttributeValue,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaInvalidAttributeValue,
+      category: DiagnosticCategory2.ARIA,
       message: `"${attr}" has an invalid value (${got}). Expected: ${expected}.`,
       rationale: "ARIA attributes with invalid values are silently ignored by assistive technology, making the markup semantically inert.",
       suggestions: [
@@ -811,8 +858,8 @@ var AriaDiagnostics = {
   },
   redundantAriaLevel(tag, level) {
     return {
-      code: DiagnosticCode.AriaRedundantLevelAttribute,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaRedundantLevelAttribute,
+      category: DiagnosticCategory2.ARIA,
       message: `aria-level="${level}" is redundant on <${tag}>: the element already has an implicit heading level of ${level}. Remove the attribute.`,
       rationale: 'Restating the implicit aria-level adds noise without semantic value. Use aria-level only to override the native heading level (e.g. aria-level="3" on <h2>).',
       suggestions: [
@@ -825,8 +872,8 @@ var AriaDiagnostics = {
   },
   requiredProperty(attr, role) {
     return {
-      code: DiagnosticCode.AriaRequiredProperty,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaRequiredProperty,
+      category: DiagnosticCategory2.ARIA,
       message: `"${attr}" is required for role="${role}" but is missing.`,
       rationale: `WAI-ARIA 1.2 specifies required states and properties for certain roles. Without "${attr}", assistive technology cannot correctly communicate the element's state to users.`,
       suggestions: [
@@ -839,8 +886,8 @@ var AriaDiagnostics = {
   },
   invalidRole(role, tag) {
     return {
-      code: DiagnosticCode.AriaInvalidRole,
-      category: DiagnosticCategory.ARIA,
+      code: DiagnosticCode2.AriaInvalidRole,
+      category: DiagnosticCategory2.ARIA,
       message: `Invalid role "${role ?? ""}" on <${tag}>.`,
       rationale: "An unrecognised or misapplied ARIA role is ignored by assistive technology and may degrade the accessibility of the element."
     };
@@ -848,12 +895,12 @@ var AriaDiagnostics = {
 };
 
 // ../../lib/contract/src/diagnostics/contract.ts
-import { DiagnosticCategory as DiagnosticCategory2, DiagnosticCode as DiagnosticCode2 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory3, DiagnosticCode as DiagnosticCode3 } from "../_shared/diagnostics.js";
 var ContractDiagnostics = {
   unexpectedChild(typeName, index, context) {
     return {
-      code: DiagnosticCode2.UnexpectedChild,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.UnexpectedChild,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: unexpected child "${typeName}" at index ${index}.`
     };
@@ -861,69 +908,69 @@ var ContractDiagnostics = {
   ambiguousChild(typeName, index, ruleNames, context) {
     const quoted = ruleNames.map((n) => `"${n}"`).join(" and ");
     return {
-      code: DiagnosticCode2.AmbiguousChild,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.AmbiguousChild,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: child "${typeName}" at index ${index} matches multiple child rules: ${quoted}.`
     };
   },
   cardinalityMin(ruleName, min, context) {
     return {
-      code: DiagnosticCode2.CardinalityMin,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.CardinalityMin,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: "${ruleName}" requires at least ${min}.`
     };
   },
   cardinalityMax(ruleName, max, context) {
     return {
-      code: DiagnosticCode2.CardinalityMax,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.CardinalityMax,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: "${ruleName}" allows at most ${max}.`
     };
   },
   positionViolation(ruleName, position, index, context) {
     return {
-      code: DiagnosticCode2.PositionViolation,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.PositionViolation,
+      category: DiagnosticCategory3.Contract,
       component: context,
       message: `${context}: "${ruleName}" must be ${position}, got index ${index}`
     };
   },
   unknownVariantDim(component, label2, dim) {
     return {
-      code: DiagnosticCode2.ContractUnknownVariantDim,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.ContractUnknownVariantDim,
+      category: DiagnosticCategory3.Contract,
       message: `${component}: ${label2} references unknown variant "${dim}".`
     };
   },
   unknownVariantValue(component, label2, dim, value, valid) {
     return {
-      code: DiagnosticCode2.ContractUnknownVariantValue,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.ContractUnknownVariantValue,
+      category: DiagnosticCategory3.Contract,
       message: `${component}: ${label2} sets "${dim}" to unknown value "${value}" (valid: ${valid.join(", ")}).`
     };
   },
   unknownRecipeKey(component, key) {
     return {
-      code: DiagnosticCode2.ContractUnknownRecipeKey,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.ContractUnknownRecipeKey,
+      category: DiagnosticCategory3.Contract,
       message: `${component} Unknown recipeKey "${key}" \u2014 no preset with that name exists.`
     };
   },
   invalidVariantValue(component, key, value) {
     return {
-      code: DiagnosticCode2.ContractInvalidVariantValue,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.ContractInvalidVariantValue,
+      category: DiagnosticCategory3.Contract,
       message: `${component} Variant "${key}=${value}" is not a defined value for the "${key}" dimension.`
     };
   },
   allowedAsViolation(tag, allowedAs, component) {
     const allowed = allowedAs.map((t) => `"${String(t)}"`).join(", ");
     return {
-      code: DiagnosticCode2.AllowedAsViolation,
-      category: DiagnosticCategory2.Contract,
+      code: DiagnosticCode3.AllowedAsViolation,
+      category: DiagnosticCategory3.Contract,
       component,
       message: `<${component}>: "as" prop received "${tag}" but only [${allowed}] are allowed.`
     };
@@ -931,68 +978,68 @@ var ContractDiagnostics = {
 };
 
 // ../../lib/contract/src/diagnostics/html.ts
-import { DiagnosticCategory as DiagnosticCategory3, DiagnosticCode as DiagnosticCode3 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory4, DiagnosticCode as DiagnosticCode4 } from "../_shared/diagnostics.js";
 var ATTRIBUTE_IGNORED_CODES = {
-  checked: DiagnosticCode3.HtmlInputCheckedIgnoredForType,
-  multiple: DiagnosticCode3.HtmlInputMultipleIgnoredForType,
-  maxLength: DiagnosticCode3.HtmlInputMaxLengthIgnoredForType,
-  minLength: DiagnosticCode3.HtmlInputMinLengthIgnoredForType,
-  pattern: DiagnosticCode3.HtmlInputPatternIgnoredForType,
-  min: DiagnosticCode3.HtmlInputMinIgnoredForType,
-  max: DiagnosticCode3.HtmlInputMaxIgnoredForType,
-  step: DiagnosticCode3.HtmlInputStepIgnoredForType,
-  accept: DiagnosticCode3.HtmlInputAcceptIgnoredForType,
-  capture: DiagnosticCode3.HtmlInputCaptureIgnoredForType,
-  size: DiagnosticCode3.HtmlInputSizeIgnoredForType,
-  alt: DiagnosticCode3.HtmlInputAltIgnoredForType,
-  height: DiagnosticCode3.HtmlInputHeightIgnoredForType,
-  width: DiagnosticCode3.HtmlInputWidthIgnoredForType
+  checked: DiagnosticCode4.HtmlInputCheckedIgnoredForType,
+  multiple: DiagnosticCode4.HtmlInputMultipleIgnoredForType,
+  maxLength: DiagnosticCode4.HtmlInputMaxLengthIgnoredForType,
+  minLength: DiagnosticCode4.HtmlInputMinLengthIgnoredForType,
+  pattern: DiagnosticCode4.HtmlInputPatternIgnoredForType,
+  min: DiagnosticCode4.HtmlInputMinIgnoredForType,
+  max: DiagnosticCode4.HtmlInputMaxIgnoredForType,
+  step: DiagnosticCode4.HtmlInputStepIgnoredForType,
+  accept: DiagnosticCode4.HtmlInputAcceptIgnoredForType,
+  capture: DiagnosticCode4.HtmlInputCaptureIgnoredForType,
+  size: DiagnosticCode4.HtmlInputSizeIgnoredForType,
+  alt: DiagnosticCode4.HtmlInputAltIgnoredForType,
+  height: DiagnosticCode4.HtmlInputHeightIgnoredForType,
+  width: DiagnosticCode4.HtmlInputWidthIgnoredForType
 };
 var HtmlDiagnostics = {
   emptyRole(tag) {
     return {
-      code: DiagnosticCode3.HtmlEmptyRole,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlEmptyRole,
+      category: DiagnosticCategory4.HTML,
       severity: "warning",
       message: `<${tag}> has an explicit empty role="". Omit the attribute instead.`
     };
   },
   implicitRoleRedundant(tag, implicitRole) {
     return {
-      code: DiagnosticCode3.HtmlImplicitRoleRedundant,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlImplicitRoleRedundant,
+      category: DiagnosticCategory4.HTML,
       severity: "warning",
       message: `<${tag}> already has implicit role="${implicitRole}". Avoid redundant role assignment.`
     };
   },
   implicitRoleOverride(tag, implicitRole, role) {
     return {
-      code: DiagnosticCode3.HtmlImplicitRoleOverride,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlImplicitRoleOverride,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `<${tag}> should not override its implicit role="${implicitRole}" with role="${role}".`
     };
   },
   standaloneRegionOverride(tag, implicitRole) {
     return {
-      code: DiagnosticCode3.HtmlStandaloneRegionOverride,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlStandaloneRegionOverride,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `<${tag}> is a self-contained element with implicit role="${implicitRole}". Assigning role="region" has been removed.`
     };
   },
   landmarkRoleOverride(tag, implicitRole, role) {
     return {
-      code: DiagnosticCode3.HtmlLandmarkRoleOverride,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlLandmarkRoleOverride,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `<${tag}> has a fixed landmark role="${implicitRole}". role="${role}" overrides it and confuses assistive technology. The override has been removed.`
     };
   },
   invalidChild(child, parent, allowed) {
     return {
-      code: DiagnosticCode3.HtmlInvalidChild,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlInvalidChild,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `<${child}> is not a valid direct child of <${parent}>. Allowed: ${allowed}.`
     };
@@ -1000,8 +1047,8 @@ var HtmlDiagnostics = {
   roleNotPermitted(tag, role, allowedRoles) {
     const allowed = allowedRoles.length > 0 ? allowedRoles.map((r) => `"${r}"`).join(", ") : "none \u2014 no explicit role is permitted on this element";
     return {
-      code: DiagnosticCode3.HtmlRoleNotPermitted,
-      category: DiagnosticCategory3.HTML,
+      code: DiagnosticCode4.HtmlRoleNotPermitted,
+      category: DiagnosticCategory4.HTML,
       severity: "error",
       message: `role="${role}" is not permitted on <${tag}>. Allowed alternate role(s): ${allowed}.`,
       rationale: 'The WAI-ARIA "ARIA in HTML" specification restricts which explicit roles a native element may take. A role outside that set is ignored or produces undefined behavior in assistive technology.'
@@ -1012,8 +1059,8 @@ var HtmlDiagnostics = {
   input: {
     unsupportedType(type) {
       return {
-        code: DiagnosticCode3.HtmlInputUnsupportedType,
-        category: DiagnosticCategory3.HTML,
+        code: DiagnosticCode4.HtmlInputUnsupportedType,
+        category: DiagnosticCategory4.HTML,
         severity: "warning",
         message: `type="${type}" is not a value defined by the HTML specification. Browsers silently fall back to type="text".`,
         rationale: 'An unrecognized input type is not invalid markup \u2014 the spec requires the "text" fallback \u2014 but it usually means a typo, since the input keeps working while silently losing the intended type-specific behavior (validation, virtual keyboard, picker UI).',
@@ -1033,7 +1080,7 @@ var HtmlDiagnostics = {
       if (!code) throw new Error(`No DiagnosticCode registered for input attribute "${attribute}"`);
       return {
         code,
-        category: DiagnosticCategory3.HTML,
+        category: DiagnosticCategory4.HTML,
         severity: "warning",
         message: `"${attribute}" is ignored on <input type="${type}">.`,
         rationale: `"${attribute}" only has an effect when type is one of: ${allowed}. Browsers silently ignore it on other input types.`,
@@ -1045,18 +1092,30 @@ var HtmlDiagnostics = {
         ]
       };
     }
+  },
+  // Reserved for <a>-specific facts (HTML3201–3299, see codes.ts).
+  anchor: {
+    dangerousHref(href) {
+      return {
+        code: DiagnosticCode4.HtmlAnchorDangerousHref,
+        category: DiagnosticCategory4.HTML,
+        severity: "warning",
+        message: `href="${href}" uses a scheme that executes attacker-controlled content when navigated to. It has been removed.`,
+        rationale: '"javascript:", "data:", and "vbscript:" URLs are a common XSS vector when href comes from untrusted input \u2014 none of the three are needed for legitimate navigation.'
+      };
+    }
   }
 };
 
 // ../../lib/contract/src/diagnostics/input-accessibility.ts
-import { DiagnosticCategory as DiagnosticCategory4, DiagnosticCode as DiagnosticCode4 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory5, DiagnosticCode as DiagnosticCode5 } from "../_shared/diagnostics.js";
 function accessibilityFact(input) {
-  return { category: DiagnosticCategory4.Accessibility, ...input };
+  return { category: DiagnosticCategory5.Accessibility, ...input };
 }
 var InputAccessibilityDiagnostics = {
   missingAccessibleName() {
     return accessibilityFact({
-      code: DiagnosticCode4.A11yInputMissingAccessibleName,
+      code: DiagnosticCode5.A11yInputMissingAccessibleName,
       severity: "warning",
       message: "This input has no accessible name. Add an associated <label>, aria-label, or aria-labelledby.",
       rationale: "Assistive technology announces a form field by its accessible name; without one, users of screen readers cannot tell what the field is for.",
@@ -1071,7 +1130,7 @@ var InputAccessibilityDiagnostics = {
   },
   placeholderIsNotLabel() {
     return accessibilityFact({
-      code: DiagnosticCode4.A11yInputPlaceholderNotLabel,
+      code: DiagnosticCode5.A11yInputPlaceholderNotLabel,
       severity: "warning",
       message: "Placeholder text does not provide an accessible name. Add an associated <label>, aria-label, or aria-labelledby.",
       rationale: "Placeholder text disappears as users interact with the field and is not treated as the control's accessible name by many assistive technologies.",
@@ -1086,7 +1145,7 @@ var InputAccessibilityDiagnostics = {
   },
   passwordMissingAutocomplete() {
     return accessibilityFact({
-      code: DiagnosticCode4.A11yInputPasswordAutocomplete,
+      code: DiagnosticCode5.A11yInputPasswordAutocomplete,
       severity: "warning",
       message: "Password inputs should specify an autoComplete value.",
       rationale: "Without an explicit autocomplete hint, password managers and browsers cannot reliably tell a sign-in field apart from a password-creation field.",
@@ -1104,7 +1163,7 @@ var InputAccessibilityDiagnostics = {
   },
   requiredReadOnlyConflict() {
     return accessibilityFact({
-      code: DiagnosticCode4.A11yInputRequiredReadOnlyConflict,
+      code: DiagnosticCode5.A11yInputRequiredReadOnlyConflict,
       severity: "warning",
       message: "The required and readOnly attributes are both present. A read-only field cannot satisfy required validation through user interaction.",
       rationale: "This combination is valid HTML but usually indicates an unintended state. Consider using disabled instead of readOnly, or only applying required when the field is editable."
@@ -1371,7 +1430,7 @@ var AriaPolicyEngine = class _AriaPolicyEngine extends InvariantBase {
     const next = _AriaPolicyEngine.#applyFixes(narrowedTag, implicitRole, workingProps, fixes);
     return { props: next, violations: [...preExistingViolations, ...violations] };
   }
-  static #evaluateWithRules(tag, props, extraRules) {
+  static #evaluateWithRules(tag, props, extraRules, extraProps) {
     const derived = _AriaPolicyEngine.#deriveContext(tag, props);
     if (!derived.proceed) return derived.result;
     const {
@@ -1381,8 +1440,12 @@ var AriaPolicyEngine = class _AriaPolicyEngine extends InvariantBase {
       props: workingProps,
       preExistingViolations
     } = derived;
-    const rules = derived.hasRole ? [..._AriaPolicyEngine.#getRules(context), ...extraRules] : extraRules;
-    const { violations, fixes } = _AriaPolicyEngine.#runRules(rules, context);
+    const builtinRules = derived.hasRole ? _AriaPolicyEngine.#getRules(context) : [];
+    const builtin = _AriaPolicyEngine.#runRules(builtinRules, context);
+    const extraContext = extraProps === void 0 ? context : { ...context, props: extraProps };
+    const extra = _AriaPolicyEngine.#runRules(extraRules, extraContext);
+    const violations = [...builtin.violations, ...extra.violations];
+    const fixes = [...builtin.fixes, ...extra.fixes];
     const next = _AriaPolicyEngine.#applyFixes(narrowedTag, implicitRole, workingProps, fixes);
     return { props: next, violations: [...preExistingViolations, ...violations] };
   }
@@ -1453,11 +1516,17 @@ var AriaPolicyEngine = class _AriaPolicyEngine extends InvariantBase {
     Object.assign(next, updates);
     return next;
   }
-  validate(tag, props) {
+  // `extraProps`, when supplied, is the pre-variant-filter props object (the same one
+  // `normalize()` receives) — used only as the evaluation context for this engine's own
+  // #extraRules (a consumer's `enforcement.aria`/`enforcement.rules`), never for the built-in
+  // role-semantic pipeline or for the props a fix can apply to. Defaults to `props` so callers
+  // that don't have a separate pre-filter object (or don't need one) see unchanged behavior.
+  validate(tag, props, extraProps) {
+    const ruleProps = extraProps ?? props;
     const baseKey = _AriaPolicyEngine.#createPlanKey(tag, props);
     let key = baseKey;
     if (this.#extraRules.length > 0) {
-      const suffix = _AriaPolicyEngine.#extraRulesKeySuffix(this.#extraRules, props);
+      const suffix = _AriaPolicyEngine.#extraRulesKeySuffix(this.#extraRules, ruleProps);
       key = isNonNull(baseKey) && isNonNull(suffix) ? `${baseKey}|${suffix}` : null;
     }
     if (!isNull(key)) {
@@ -1470,7 +1539,7 @@ var AriaPolicyEngine = class _AriaPolicyEngine extends InvariantBase {
         };
       }
     }
-    const result = this.#extraRules.length ? _AriaPolicyEngine.#evaluateWithRules(tag, props, this.#extraRules) : _AriaPolicyEngine.evaluate(tag, props);
+    const result = this.#extraRules.length ? _AriaPolicyEngine.#evaluateWithRules(tag, props, this.#extraRules, extraProps) : _AriaPolicyEngine.evaluate(tag, props);
     if (result.violations.length > 0) this.report(result.violations);
     if (!isNull(key)) {
       const { removals, updates } = _AriaPolicyEngine.#computePlan(
@@ -1851,6 +1920,27 @@ var AriaPolicyEngine = class _AriaPolicyEngine extends InvariantBase {
 };
 
 // ../../lib/contract/src/aria/factories.ts
+function invalidWithoutFix(input) {
+  return {
+    valid: false,
+    fixable: false,
+    severity: input.severity,
+    ...isDefined(input.attribute) && { attribute: input.attribute },
+    ...isDefined(input.message) && { message: input.message },
+    ...isDefined(input.diagnostic) && { diagnostic: input.diagnostic }
+  };
+}
+function invalidWithFix(input) {
+  return {
+    valid: false,
+    fixable: true,
+    severity: input.severity,
+    ...isDefined(input.attribute) && { attribute: input.attribute },
+    ...isDefined(input.message) && { message: input.message },
+    ...isDefined(input.diagnostic) && { diagnostic: input.diagnostic },
+    fix: input.fix
+  };
+}
 function removeProp(props, key) {
   const next = { ...props };
   delete next[key];
@@ -1866,6 +1956,34 @@ function removeAttributeFix(attribute) {
     }
   });
 }
+function defineRuleMetadata(rule, metadata2) {
+  const descriptors = {};
+  for (const key of Object.keys(metadata2)) {
+    descriptors[key] = { value: metadata2[key], enumerable: false };
+  }
+  Object.defineProperties(rule, descriptors);
+  return rule;
+}
+function createRemoveAttributeRule(attribute, options) {
+  const { when, severity = "warning", message, diagnostic, readsProps, tags } = options;
+  const fix = removeAttributeFix(attribute);
+  const rule = (context) => {
+    if (!when(context)) return [];
+    return [
+      invalidWithFix({
+        severity,
+        attribute,
+        ...isDefined(message) && { message },
+        ...isDefined(diagnostic) && { diagnostic: diagnostic(context) },
+        fix
+      })
+    ];
+  };
+  return defineRuleMetadata(rule, {
+    ...isDefined(readsProps) && { readsProps },
+    ...isDefined(tags) && { tags }
+  });
+}
 
 // ../../lib/contract/src/children/get-type-name.ts
 function getTypeName(value) {
@@ -2254,6 +2372,52 @@ var P_BLOCKED_TAGS = [
   "ul"
 ];
 
+// ../core/src/html/anchor-rules.ts
+var DANGEROUS_URL_SCHEMES = ["javascript:", "data:", "vbscript:"];
+function normalizeForSchemeCheck(href) {
+  return href.replace(/[\x00-\x20]/g, "").toLowerCase();
+}
+function isDangerousUrl(href) {
+  if (!isString(href)) return false;
+  const normalized = normalizeForSchemeCheck(href);
+  return DANGEROUS_URL_SCHEMES.some((scheme) => normalized.startsWith(scheme));
+}
+var dangerousHrefRule = createRemoveAttributeRule("href", {
+  when: ({ props }) => isDangerousUrl(props.href),
+  severity: "warning",
+  diagnostic: ({ props }) => HtmlDiagnostics.anchor.dangerousHref(props.href),
+  readsProps: ["href"],
+  tags: ["a"]
+});
+var roleButtonWithHrefRule = Object.assign(
+  ({ props }) => {
+    if (props.role !== "button" || !isString(props.href) || props.href.length === 0) {
+      return [];
+    }
+    const diagnostic = AnchorAccessibilityDiagnostics.roleButtonWithHref();
+    return [invalidWithoutFix({ severity: diagnostic.severity, attribute: "role", diagnostic })];
+  },
+  { readsProps: ["role", "href"], tags: ["a"] }
+);
+var ariaDisabledInertRule = Object.assign(
+  ({ props }) => {
+    const ariaDisabled = props["aria-disabled"];
+    const isDisabled = ariaDisabled === true || ariaDisabled === "true";
+    const hasHref = isString(props.href) && props.href.length > 0;
+    if (!isDisabled || !hasHref) return [];
+    const diagnostic = AnchorAccessibilityDiagnostics.ariaDisabledInert();
+    return [
+      invalidWithoutFix({ severity: diagnostic.severity, attribute: "aria-disabled", diagnostic })
+    ];
+  },
+  { readsProps: ["aria-disabled", "href"], tags: ["a"] }
+);
+var ANCHOR_RULES = [
+  dangerousHrefRule,
+  roleButtonWithHrefRule,
+  ariaDisabledInertRule
+];
+
 // ../core/src/html/spec/vocabulary/input.ts
 var TEXT_INPUT_TYPES = ["text", "search", "url", "tel", "email", "password"];
 var NUMERIC_INPUT_TYPES = [
@@ -2333,12 +2497,12 @@ function createInputAttributeTypeRule({
 // ../core/src/html/spec/validators/mutually-exclusive-validator.ts
 function createMutuallyExclusiveRule({
   props: conflictingProps,
-  diagnostic: createDiagnostic
+  diagnostic: createDiagnostic2
 }) {
   const [first, second] = conflictingProps;
   const rule = ({ tag, props }) => {
     if (tag !== "input" || !props[first] || !props[second]) return [];
-    const diagnostic = createDiagnostic();
+    const diagnostic = createDiagnostic2();
     return [{ valid: false, fixable: false, severity: diagnostic.severity, diagnostic }];
   };
   return Object.assign(rule, { readsProps: conflictingProps, tags: ["input"] });
@@ -2718,7 +2882,8 @@ var HTML_ARIA_RULES = [
   landmarkRoleRule,
   landmarkAccessibleNameRule,
   roleNotPermittedRule,
-  ...INPUT_RULES
+  ...INPUT_RULES,
+  ...ANCHOR_RULES
 ];
 
 // ../core/src/html/contracts/helpers.ts
@@ -3128,19 +3293,6 @@ function createClassPipeline(resolved) {
   };
 }
 
-// ../../lib/pipeline-kit/src/factory/define-pipeline.ts
-function definePipeline(factory) {
-  const cache = /* @__PURE__ */ new WeakMap();
-  return (resolved) => {
-    let pipeline = cache.get(resolved);
-    if (!pipeline) {
-      pipeline = factory(resolved);
-      cache.set(resolved, pipeline);
-    }
-    return pipeline;
-  };
-}
-
 // ../core/src/options/resolve-factory-options.ts
 import { resolveDiagnostics, silentDiagnostics } from "../_shared/diagnostics.js";
 var EMPTY_VARIANT_KEYS = /* @__PURE__ */ new Set();
@@ -3244,25 +3396,66 @@ function validateRenderProps(diagnostics, options, props, recipeKey) {
   }
 }
 
+// ../../lib/pipeline-kit/src/factory/define-pipeline.ts
+function definePipeline(factory) {
+  const cache = /* @__PURE__ */ new WeakMap();
+  return (resolved) => {
+    let pipeline = cache.get(resolved);
+    if (!pipeline) {
+      pipeline = factory(resolved);
+      cache.set(resolved, pipeline);
+    }
+    return pipeline;
+  };
+}
+
+// ../core/src/factory/pipelines/generic.ts
+var createTagPipeline = (resolved) => makeResolveTag(resolved.defaultTag);
+var createPropsPipeline = (resolved) => (props) => mergeProps(resolved.defaultProps, props);
+var createHtmlPropNormalizersPipeline = () => getHtmlPropNormalizers;
+var createHtmlChildrenEvaluatorPipeline = () => getHtmlChildrenEvaluator;
+var createStylingClassPipeline = (resolved) => createClassPipeline(resolved);
+var memoizedTagPipeline = definePipeline(createTagPipeline);
+var memoizedPropsPipeline = definePipeline(createPropsPipeline);
+var memoizedHtmlPropNormalizersPipeline = definePipeline(createHtmlPropNormalizersPipeline);
+var memoizedHtmlChildrenEvaluatorPipeline = definePipeline(
+  createHtmlChildrenEvaluatorPipeline
+);
+var memoizedClassPipeline = definePipeline(createStylingClassPipeline);
+
+// ../core/src/factory/pipelines/aria.ts
+function resolveAriaRules(resolved) {
+  return [.../* @__PURE__ */ new Set([...HTML_ARIA_RULES, ...resolved.ariaRules ?? []])];
+}
+var createAriaPipeline = (resolved) => {
+  const rules = resolveAriaRules(resolved);
+  const engine = new AriaPolicyEngine(resolved.diagnostics, rules.length ? { rules } : void 0);
+  return (tag, props, extraProps) => engine.validate(tag, props, extraProps);
+};
+var memoizedAriaPipeline = definePipeline(createAriaPipeline);
+function resolveAriaPassthrough(_tag, props, _extraProps) {
+  return { props };
+}
+
 // ../core/src/factory/plugin-invariants.ts
 import { throwDiagnostics } from "../_shared/diagnostics.js";
 
 // ../core/src/factory/plugin-diagnostics.ts
-import { DiagnosticCategory as DiagnosticCategory5, DiagnosticCode as DiagnosticCode5 } from "../_shared/diagnostics.js";
+import { DiagnosticCategory as DiagnosticCategory6, DiagnosticCode as DiagnosticCode6 } from "../_shared/diagnostics.js";
 var PluginDiagnostics = {
   invalidShape(received) {
-    const got = received === null ? "null" : typeof received;
+    const got = isNull(received) ? "null" : typeof received;
     return {
-      code: DiagnosticCode5.PluginInvalidShape,
-      category: DiagnosticCategory5.Internal,
+      code: DiagnosticCode6.PluginInvalidShape,
+      category: DiagnosticCategory6.Internal,
       message: `[praxis-kit] Plugin factory must return an object with a 'pipeline' function. Got: ${got}.`
     };
   },
   pipelineReturnType(received) {
-    const got = received === null ? "null" : Array.isArray(received) ? "array" : typeof received;
+    const got = isNull(received) ? "null" : Array.isArray(received) ? "array" : typeof received;
     return {
-      code: DiagnosticCode5.PluginPipelineReturnType,
-      category: DiagnosticCategory5.Internal,
+      code: DiagnosticCode6.PluginPipelineReturnType,
+      category: DiagnosticCategory6.Internal,
       message: `[praxis-kit] Plugin pipeline must return a string. Got: ${got}.`
     };
   }
@@ -3270,60 +3463,41 @@ var PluginDiagnostics = {
 
 // ../core/src/factory/plugin-invariants.ts
 function assertPluginShape(result) {
-  if (result === null || typeof result !== "object")
+  if (isNull(result) || !isObject(result))
     throwDiagnostics.error(PluginDiagnostics.invalidShape(result));
   const plugin = result;
-  if (typeof plugin.pipeline !== "function")
-    throwDiagnostics.error(PluginDiagnostics.invalidShape(result));
+  if (!isFunction(plugin.pipeline)) throwDiagnostics.error(PluginDiagnostics.invalidShape(result));
 }
 function guardPipeline(pipeline) {
   if (process.env.NODE_ENV === "production") return pipeline;
   return function guardedPipeline(tag, props, className, recipe) {
     const result = pipeline(tag, props, className, recipe);
-    if (typeof result !== "string")
-      throwDiagnostics.error(PluginDiagnostics.pipelineReturnType(result));
+    if (!isString(result)) throwDiagnostics.error(PluginDiagnostics.pipelineReturnType(result));
     return result;
   };
 }
 
-// ../core/src/factory/create-polymorphic2.ts
-var createTagPipeline = (resolved) => makeResolveTag(resolved.defaultTag);
-var createPropsPipeline = (resolved) => (props) => mergeProps(resolved.defaultProps, props);
-var createHtmlPropNormalizersPipeline = () => getHtmlPropNormalizers;
-var createHtmlChildrenEvaluatorPipeline = () => getHtmlChildrenEvaluator;
-var createStylingClassPipeline = (resolved) => createClassPipeline(resolved);
-function resolveAriaRules(resolved) {
-  return [.../* @__PURE__ */ new Set([...HTML_ARIA_RULES, ...resolved.ariaRules ?? []])];
-}
-var createAriaPipeline = (resolved) => {
-  const rules = resolveAriaRules(resolved);
-  const engine = new AriaPolicyEngine(resolved.diagnostics, rules.length ? { rules } : void 0);
-  return (tag, props) => engine.validate(tag, props);
-};
-var memoizedTagPipeline = definePipeline(createTagPipeline);
-var memoizedPropsPipeline = definePipeline(createPropsPipeline);
-var memoizedHtmlPropNormalizersPipeline = definePipeline(createHtmlPropNormalizersPipeline);
-var memoizedHtmlChildrenEvaluatorPipeline = definePipeline(createHtmlChildrenEvaluatorPipeline);
-var memoizedClassPipeline = definePipeline(createStylingClassPipeline);
-var memoizedAriaPipeline = definePipeline(createAriaPipeline);
-function resolveAriaPassthrough(_tag, props) {
-  return { props };
-}
+// ../core/src/factory/pipelines/styling.ts
 function resolveClassPlugin(factory, resolved, diagnostics) {
   if (!factory) return { pluginResult: void 0, classPipeline: memoizedClassPipeline(resolved) };
   const pluginResult = factory(resolved, diagnostics);
   assertPluginShape(pluginResult);
   return { pluginResult, classPipeline: guardPipeline(pluginResult.pipeline) };
 }
-function createPolymorphic2(options = {}) {
+
+// ../core/src/factory/create-polymorphic.ts
+function eraseResolvedShape(resolved) {
+  return resolved;
+}
+function createPolymorphic(options = {}) {
   const baseResolved = resolveFactoryOptions(options);
-  const anyBaseResolved = baseResolved;
+  const anyBaseResolved = eraseResolvedShape(baseResolved);
   const resolved = Object.freeze({
     ...baseResolved,
     htmlPropNormalizersFn: memoizedHtmlPropNormalizersPipeline(anyBaseResolved),
     htmlChildrenEvaluatorFn: memoizedHtmlChildrenEvaluatorPipeline(anyBaseResolved)
   });
-  const anyResolved = resolved;
+  const anyResolved = eraseResolvedShape(resolved);
   if (process.env.NODE_ENV !== "production") {
     validateFactoryOptions(resolved, resolved.diagnostics);
   }
@@ -3344,8 +3518,8 @@ function createPolymorphic2(options = {}) {
       }
       return classPipeline(tag, props, className, recipe) || void 0;
     },
-    resolveAria(tag, props) {
-      return resolveAriaFn(tag, props);
+    resolveAria(tag, props, extraProps) {
+      return resolveAriaFn(tag, props, extraProps);
     }
   };
   const runtimeObject = pluginResult ? { ...methods, options: resolved, hasStyling: true, classPlugin: pluginResult } : { ...methods, options: resolved };
@@ -3364,7 +3538,7 @@ function enforceAllowedAs(tag, allowedAs, diagnostics, displayName) {
 // ../../lib/adapter-utils/src/runtime/build-core-runtime.ts
 var EMPTY_SET = /* @__PURE__ */ new Set();
 function buildCoreRuntime(normalized) {
-  const runtime = createPolymorphic2(normalized);
+  const runtime = createPolymorphic(normalized);
   const ownedKeys = "classPlugin" in runtime ? runtime.classPlugin.ownedKeys ?? EMPTY_SET : EMPTY_SET;
   return { runtime, ownedKeys };
 }