@cparkerwebm/webmonterey 1.0.0

package/src/includes/webmonterey/copy-defaults.ts

@@ -0,0 +1,148 @@
+/*
+ * EVERY WORD THIS PACKAGE PUTS IN FRONT OF A VISITOR, IN ONE PLACE, OVERRIDABLE.
+ *
+ * THE DEFAULTS AND THE MERGE, WITH NO IMPORTS. Kept free of `virtual:webm/site` because the email
+ * templates are unit-tested with plain `node --test`, outside Vite, where a virtual module cannot
+ * resolve - wiring them to the resolved copy directly broke both suites at once. The resolved
+ * value lives next door in ./copy.ts, which every component and action uses; anything that must
+ * stay importable outside a build takes its strings as input and falls back to these.
+ *
+ * WHY. An audit of the fleet found the package writing visitor-facing copy for six clients with
+ * no way to change any of it: a cookie banner with four category descriptions, a 404 page, six
+ * form error messages, an email footer, a "Back to top" label. All in English, all in one voice,
+ * all decided here.
+ *
+ * That is the same mistake as the structured-data component, which built nineteen node types of
+ * opinion about what a business is and could only be replaced wholesale. The lesson from it: the
+ * package owns the MECHANISM - consent state, validation order, sending mail - and the client
+ * owns what is SAID. A recording studio, a mayoral campaign and a library charity do not share a
+ * voice, and none of them necessarily works in English.
+ *
+ * ONE SEAM, NOT A PROP PER STRING. Threading `title` and `body` into the consent banner was the
+ * shape of the old fix, and the banner shows why it fails: two of its dozen strings got props,
+ * the rest did not, and Base passes neither - so even the two were unreachable. A single
+ * override merged over these defaults costs the package nothing per string added.
+ *
+ * A site overrides only what it wants, in webmonterey.json:
+ *
+ *     "copy": {
+ *       "consent": { "title": "Cookies on this site" },
+ *       "notFound": { "body": "We could not find that page." }
+ *     }
+ */
+
+export interface Copy {
+  consent: {
+    title: string;
+    body: string;
+    privacyLink: string;
+    manage: string;
+    rejectAll: string;
+    acceptAll: string;
+    save: string;
+    prefsTitle: string;
+    notice: string;
+    categories: Record<
+      'essential' | 'functional' | 'analytics' | 'marketing',
+      {
+        name: string;
+        description: string;
+      }
+    >;
+  };
+  notFound: { title: string; body: string };
+  scrollTop: { label: string };
+  form: {
+    unknownForm: string;
+    /** `{fields}` is replaced with the comma-separated labels still missing. */
+    missing: string;
+    verifyUnavailable: string;
+    verifyFailed: string;
+    noDelivery: string;
+  };
+  email: {
+    autoresponseHeading: string;
+    /** `{id}` is replaced with the submission id. */
+    reference: string;
+    /** `{domain}` is replaced with the site's domain. */
+    footerNotice: string;
+  };
+}
+
+/*
+ * The defaults are the copy the fleet shipped with, unchanged, so adopting this changes nothing
+ * for a site that overrides nothing. They are DEFAULTS, not a house style: a client is entitled
+ * to disagree with every one.
+ */
+export const DEFAULT_COPY: Copy = {
+  consent: {
+    title: 'We Value Your Privacy',
+    body: 'We use cookies for essential functions and to understand how this site is used, so we can keep making it better.',
+    privacyLink: 'Privacy policy',
+    manage: 'Manage preferences',
+    rejectAll: 'Reject all',
+    acceptAll: 'Accept all',
+    save: 'Save preferences',
+    prefsTitle: 'Privacy Preferences',
+    notice: 'Cookie notice',
+    categories: {
+      essential: {
+        name: 'Essential',
+        description:
+          'Required for the site to function — security, navigation, and your privacy choices. Always on.',
+      },
+      functional: {
+        name: 'Functional',
+        description:
+          'Remembers preferences such as language or region to personalize your experience.',
+      },
+      analytics: {
+        name: 'Analytics',
+        description:
+          'Helps us understand how visitors use the site so we can improve it. Aggregated and anonymous.',
+      },
+      marketing: {
+        name: 'Marketing',
+        description:
+          'Used to measure campaigns and show you more relevant advertising across the web.',
+      },
+    },
+  },
+  notFound: {
+    title: 'Page not found',
+    body: 'That page is not here. Try the navigation above, or get in touch.',
+  },
+  scrollTop: { label: 'Back to top' },
+  form: {
+    unknownForm: 'Unknown form.',
+    missing: 'Please complete: {fields}.',
+    verifyUnavailable: 'We could not verify your submission. Please try again shortly.',
+    verifyFailed: 'Verification failed. Please reload the page and try again.',
+    noDelivery: 'This form is not accepting messages right now. Please get in touch directly.',
+  },
+  email: {
+    autoresponseHeading: 'What you sent us',
+    reference: 'Reference: #{id}',
+    footerNotice: 'This is an automated notification for your account at the {domain} website.',
+  },
+};
+
+/** Merge the site's overrides over the defaults, key by key, at any depth. */
+export function merge<T>(base: T, over: unknown): T {
+  if (!over || typeof over !== 'object' || Array.isArray(over)) return base;
+  const out = { ...(base as Record<string, unknown>) };
+  for (const [k, v] of Object.entries(over as Record<string, unknown>)) {
+    if (v === undefined || v === null) continue;
+    const current = out[k];
+    out[k] =
+      current && typeof current === 'object' && !Array.isArray(current) ? merge(current, v) : v;
+  }
+  return out as T;
+}
+
+/** Substitute `{name}` placeholders. Missing keys are left as written rather than blanked. */
+export function fill(template: string, values: Record<string, string | number>): string {
+  return template.replace(/\{(\w+)\}/g, (whole, key) =>
+    key in values ? String(values[key]) : whole,
+  );
+}

package/src/includes/webmonterey/copy.ts

@@ -0,0 +1,13 @@
+/*
+ * THE RESOLVED COPY: package defaults with the site's overrides merged over them.
+ *
+ * Split from ./copy-defaults.ts because this half imports `virtual:webm/site`, which only exists
+ * inside a Vite build. Anything unit-tested outside one - the email templates - imports the
+ * defaults and takes overrides as input instead.
+ */
+import site from 'virtual:webm/site';
+import { DEFAULT_COPY, merge, type Copy } from './copy-defaults.ts';
+
+export { DEFAULT_COPY, fill, type Copy } from './copy-defaults.ts';
+
+export const copy: Copy = merge(DEFAULT_COPY, (site as { copy?: unknown }).copy);

package/src/includes/webmonterey/credits/Credit.astro

@@ -0,0 +1,80 @@
+---
+/*
+ * The WebMonterey agency credit. Goes in the site footer.
+ *
+ *   <Credit />   ->   Powered by WebMonterey
+ *
+ * The wording and the UTM-tagged link both come from credit.ts, which the email footer also
+ * imports — the two surfaces must say the same thing, and email cannot reuse this component
+ * (scoped CSS does not survive an email client).
+ */
+import { CREDIT_TEXT, creditUrl } from './credit.ts';
+import { domain, hasDomain } from '../site.ts';
+
+interface Props {
+  class?: string;
+}
+
+const { class: className } = Astro.props;
+
+// Fail loudly at build rather than emit a credit link pointing at a placeholder.
+if (!hasDomain) {
+  throw new Error(
+    '[webm] webmonterey.json "domain" is still CHANGEME. Set the production domain - the ' +
+      'agency credit link uses it for utm_content attribution.',
+  );
+}
+
+const href = creditUrl(domain, 'website');
+---
+
+<p class:list={['webm-credit', className]}>
+  {
+    /*
+    OPENS IN A NEW TAB, and `target` is the half that was missing.
+
+    This element carried `rel="noopener"` and no `target`, which does nothing at all - noopener
+    only means anything alongside a target - and the credit navigated away from the client's site
+    in the same tab. Verified broken on live client sites before this was fixed.
+
+    `noopener` stays: without it the opened page gets a `window.opener` handle back into this one.
+    Deliberately NOT `noreferrer` - the referrer is the attribution, and stripping it would leave
+    only the utm_content.
+
+    The visually-hidden note is not decoration. A link that moves the user to another tab without
+    saying so is a semantics bug, and semantics are correctness rather than styling. The email
+    footer deliberately does NOT carry it - the hiding technique needs a stylesheet, and email
+    clients strip those. See emails/footer.ts.
+
+    NO `title` ATTRIBUTE, and that is the correct state rather than an omission. `title` is not
+    reliably announced by screen readers, is unreachable by keyboard and touch entirely, and
+    either duplicates the link text or competes with it for the accessible name. The link text
+    plus the hidden note IS the accessible name.
+  */
+  }
+  <a href={href} target="_blank" rel="noopener">
+    {CREDIT_TEXT}<span class="webm-visually-hidden"> (opens in a new tab)</span>
+  </a>
+</p>
+
+<style>
+  @layer webm.components.core {
+    .webm-credit {
+      font-size: var(--webm-font-size-xs);
+      color: var(--webm-text-muted);
+    }
+
+    /*
+     * Underline at the text's own color. An underline in --webm-border-subtle is ~1.3:1 on
+     * white — effectively invisible, leaving nothing to mark the link as clickable.
+     */
+    .webm-credit a {
+      color: inherit;
+      text-decoration-color: currentColor;
+    }
+
+    .webm-credit a:hover {
+      color: var(--webm-link-hover);
+    }
+  }
+</style>

package/src/includes/webmonterey/credits/credit.test.ts

@@ -0,0 +1,111 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+
+import { contentTag, CREDIT_TEXT, creditUrl } from './credit.ts';
+
+/*
+ * Credit.astro read as SOURCE, because it cannot be imported here: it pulls in ../site.ts, which
+ * imports virtual:webm/site, which only resolves inside an Astro build. A source assertion is the
+ * weaker tool and it is the one available - and the alternative in place until now was nothing.
+ *
+ * WHY IT NEEDS ONE AT ALL. This anchor once carried rel="noopener" and no target, which does
+ * nothing whatsoever - noopener only means anything alongside a target - so the credit navigated
+ * the visitor away from the client's site in the same tab. That shipped to live sites. The
+ * regression test written afterwards guards the EMAIL footer, in emails/footer.test.ts; the
+ * component where the bug actually happened had no test until this one.
+ */
+const componentSource = readFileSync(new URL('./Credit.astro', import.meta.url), 'utf8');
+/** The template with its {/* *\/} comment blocks removed, so prose about the rule is not read as the rule. */
+const template = componentSource.replace(/\{\s*\/\*[\s\S]*?\*\/\s*\}/g, '');
+const anchors: string[] = template.match(/<a\s[^>]*>/g) ?? [];
+/** The single credit anchor. Asserted to be the only one below. */
+const anchor = (): string => anchors[0] ?? '';
+
+test('creditUrl points at the main site, not a /credits page', () => {
+  const url = new URL(creditUrl('example.com'));
+  assert.equal(url.origin, 'https://webmonterey.com');
+  assert.equal(url.pathname, '/', 'the credit link must not reintroduce a /credits path');
+});
+
+test('creditUrl carries all four UTM parameters', () => {
+  const { searchParams } = new URL(creditUrl('example.com'));
+  assert.equal(searchParams.get('utm_source'), 'client');
+  assert.equal(searchParams.get('utm_campaign'), 'credits');
+  assert.equal(searchParams.get('utm_content'), 'example_com');
+});
+
+test('utm_medium separates the two surfaces', () => {
+  const site = new URL(creditUrl('example.com', 'website'));
+  const email = new URL(creditUrl('example.com', 'email'));
+  assert.equal(site.searchParams.get('utm_medium'), 'website');
+  assert.equal(email.searchParams.get('utm_medium'), 'email');
+});
+
+test('utm_medium defaults to website', () => {
+  assert.equal(new URL(creditUrl('example.com')).searchParams.get('utm_medium'), 'website');
+});
+
+test('utm_content is the production domain, with every dot as an underscore', () => {
+  // Not the host the page is served from — a preview build must not fragment attribution.
+  const url = new URL(creditUrl('sub.example.co.uk', 'email'));
+  assert.equal(url.searchParams.get('utm_content'), 'sub_example_co_uk');
+});
+
+test('both surfaces tag the same client the same way', () => {
+  const site = new URL(creditUrl('example.com', 'website'));
+  const email = new URL(creditUrl('example.com', 'email'));
+  assert.equal(site.searchParams.get('utm_content'), email.searchParams.get('utm_content'));
+});
+
+test('no dot survives into the credit URL, so nothing can linkify it', () => {
+  const url = new URL(creditUrl('example.com', 'email'));
+  assert.equal(url.searchParams.get('utm_content'), 'example_com');
+  /*
+   * Scoped to the QUERY STRING, not the whole URL: the destination host is webmonterey.com
+   * and is allowed to look like a host. It is the parameter value that must not.
+   */
+  assert.equal(url.search.includes('.'), false);
+});
+
+test('contentTag leaves a domain that has no dots alone', () => {
+  assert.equal(contentTag('localhost'), 'localhost');
+});
+
+test('contentTag changes nothing but the dots', () => {
+  // The value still has to be recognisably the site it came from in the report.
+  assert.equal(contentTag('steven-glaze.com'), 'steven-glaze_com');
+});
+
+test('CREDIT_TEXT is the shared wording', () => {
+  assert.equal(CREDIT_TEXT, 'Powered by WebMonterey');
+});
+
+/* ── the footer credit's link, mirroring emails/footer.test.ts ────────────────────────────── */
+
+test('the site credit renders exactly one link', () => {
+  assert.equal(anchors.length, 1, `expected one anchor, found ${anchors.length}`);
+});
+
+test('the site credit opens in a new tab', () => {
+  // The half that was missing. Without it the visitor leaves the client's site to read ours.
+  assert.match(anchor(), /target="_blank"/);
+});
+
+test('the new tab cannot reach back into the client page', () => {
+  assert.match(anchor(), /rel="[^"]*noopener/);
+});
+
+/*
+ * Locking a decision rather than an implementation detail: the referrer IS the attribution, so
+ * stripping it would leave only utm_content. This is the kind of thing someone adds in good faith
+ * while "hardening" a target=_blank link.
+ */
+test('the credit link deliberately does not send noreferrer', () => {
+  assert.doesNotMatch(anchor(), /noreferrer/);
+});
+
+test('the new tab is announced, not just implemented', () => {
+  // A link that moves the user to another tab without saying so is a semantics bug.
+  assert.match(template, /webm-visually-hidden[^>]*>\s*\(opens in a new tab\)/);
+});

package/src/includes/webmonterey/credits/credit.ts

@@ -0,0 +1,59 @@
+/*
+ * The agency credit's wording and link, in ONE place.
+ *
+ * Two surfaces render this credit and they cannot share a component: the site footer is an
+ * .astro component with scoped CSS, and transactional email is a string with inline styles
+ * (email clients strip <style> blocks). Without this module the wording exists twice, and the
+ * next time it changes one copy gets missed — which is exactly how "a WebMonterey website"
+ * would have survived in email after the footer moved to "Powered by WebMonterey".
+ *
+ * utm_content is ALWAYS the production domain from webmonterey.json, never the host the page
+ * happens to be served from. A preview build at `feature-x-webm-example-com.workers.dev`
+ * still reports the client's own domain, so staging traffic does not fragment the attribution.
+ *
+ * IT IS WRITTEN WITH UNDERSCORES — `example_com`, not `example.com`. A dot makes the value look
+ * like a hostname, and analytics UIs read it as one rather than as the label it is. Underscores
+ * keep it a label. Every dot goes, subdomains included: `sub.example.co.uk` is `sub_example_co_uk`.
+ *
+ * This comment used to also claim a mail client would linkify `example.com` inside the query
+ * string and truncate the URL there. That does not apply: auto-linkification acts on plain text,
+ * and here the URL only ever appears inside an href. Corrected rather than deleted, because a
+ * justification that does not survive scrutiny invites someone to reverse the decision it
+ * defends — and the analytics reason on its own is enough.
+ *
+ * The link points at the WebMonterey home page, not a /credits landing page. The UTM
+ * parameters carry the whole story, so the destination stays the main site and there is no
+ * separate page to keep alive. utm_medium is what separates the two surfaces: `website` from
+ * the footer, `email` from a transactional template.
+ */
+
+/** The credit wording. Rendered verbatim on the site and in email. */
+export const CREDIT_TEXT = 'Powered by WebMonterey';
+
+/**
+ * Which surface the click came from. Kept separate from utm_content so the report can tell
+ * a footer click from an email click without splitting it per client.
+ */
+export type CreditMedium = 'website' | 'email';
+
+/**
+ * The client's domain as a UTM label rather than as a domain. Dots only — the value is
+ * otherwise left exactly as webmonterey.json wrote it, so what lands in the report is still
+ * recognisably the site it came from.
+ */
+export function contentTag(domain: string): string {
+  return domain.replace(/\./g, '_');
+}
+
+/** The attributed credit link for one client site. */
+export function creditUrl(domain: string, medium: CreditMedium = 'website'): string {
+  const params = new URLSearchParams({
+    utm_source: 'client',
+    utm_medium: medium,
+    utm_campaign: 'credits',
+    /* See the note above: a dot here is a link waiting to be made out of the query string. */
+    utm_content: contentTag(domain),
+  });
+
+  return `https://webmonterey.com/?${params}`;
+}

package/src/includes/webmonterey/forms/honeypot.test.ts

@@ -0,0 +1,40 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { HONEYPOT_FIELD, honeypotAttributes, isHoneypotFilled } from './honeypot.ts';
+
+const form = (entries: Record<string, string>) => {
+  const data = new FormData();
+  for (const [k, v] of Object.entries(entries)) data.append(k, v);
+  return data;
+};
+
+test('an empty or absent honeypot is a human', () => {
+  assert.equal(isHoneypotFilled(form({})), false);
+  assert.equal(isHoneypotFilled(form({ website: '' })), false);
+  assert.equal(isHoneypotFilled(form({ website: '   ' })), false, 'whitespace is not a fill');
+});
+
+test('any real value is a bot', () => {
+  assert.equal(isHoneypotFilled(form({ website: 'http://spam.example' })), true);
+});
+
+test('the field name is configurable, so a real "website" field is possible', () => {
+  /*
+   * Reserving one name across a whole fleet means the first client whose form genuinely asks for
+   * a website has every submission silently treated as spam.
+   */
+  const data = form({ website: 'https://a-real-clients-site.com', hp_url: '' });
+  assert.equal(isHoneypotFilled(data, 'hp_url'), false, 'the real field is not the trap');
+  assert.equal(isHoneypotFilled(data), true, 'and the default would have caught it wrongly');
+});
+
+test('the rendering contract carries all four parts', () => {
+  // Get any one wrong and it catches real people, whose submission vanishes with a cheerful
+  // confirmation - the worst failure a contact form has.
+  const attrs = honeypotAttributes();
+  assert.equal(attrs.name, HONEYPOT_FIELD);
+  assert.equal(attrs['aria-hidden'], 'true');
+  assert.equal(attrs.tabindex, '-1');
+  assert.equal(attrs.autocomplete, 'off');
+  assert.match(attrs.class, /honeypot/);
+});

package/src/includes/webmonterey/forms/honeypot.ts

@@ -0,0 +1,66 @@
+/*
+ * HONEYPOT - a field no human ever fills in.
+ *
+ * The cheapest bot filter there is: a real text input, rendered off-screen and out of the tab
+ * order, that a person never sees and therefore never types into. Naive form spammers fill every
+ * input they find, so a non-empty value here is a bot with near-certainty.
+ *
+ * WHY THIS RATHER THAN A CHALLENGE WIDGET, for a small form: no third-party script, so nothing to
+ * consent-gate, no request to another origin, no cost, and nothing for a real visitor to solve.
+ * It stops the crude majority and does NOT stop a targeted bot that reads the CSS - Turnstile is
+ * the answer to that. The two compose and neither replaces the other, which matters most for a
+ * form too small to justify a widget: a newsletter box that mints no Turnstile token has 100% of
+ * its sign-ups rejected while looking completely normal.
+ *
+ * Built independently on two client sites before it was in the package, which is the argument for
+ * it being here.
+ *
+ * EXPORTED FROM THE PACKAGE at `@cparkerwebm/webmonterey/webmonterey/forms`, because the trap is
+ * rendered by the site's own form COMPONENT and checked by the package's handler - two halves
+ * that must agree on one name. It was unexported until mikeformarina.com's rebuild could not
+ * resolve it: without the export a site copies the constant, and the day the default changes the
+ * component renders one name while the server checks another. A honeypot that catches nothing is
+ * silent, and so is one that catches everyone.
+ *
+ * THE FIELD NAME IS CONFIGURABLE, and that is not decoration. Bots weight recognisable names, so
+ * a URL-shaped one is caught most often - but reserving a single name across a whole fleet means
+ * the first client whose form genuinely asks for a website silently has every submission treated
+ * as spam. Per-form, defaulting to the name that works.
+ */
+
+/** The default. Bots fill a field called `website` reliably; no real form may then use that name. */
+export const HONEYPOT_FIELD = 'website';
+
+/**
+ * The rendering contract, as a data attribute set. ALL FOUR PARTS MATTER:
+ *
+ *   the class      off-screen, NOT `display: none` - some bots skip undisplayed inputs
+ *   aria-hidden    a screen reader must not announce it
+ *   tabindex="-1"  a keyboard user must not land on it
+ *   autocomplete   a browser must not helpfully fill it in for someone
+ *
+ * Get any one of them wrong and it starts catching real people, whose submission then vanishes
+ * with a cheerful confirmation - the worst possible failure for a contact form.
+ */
+export const honeypotAttributes = (name: string = HONEYPOT_FIELD) =>
+  ({
+    type: 'text',
+    name,
+    class: 'webm-honeypot',
+    'aria-hidden': 'true',
+    tabindex: '-1',
+    autocomplete: 'off',
+    value: '',
+  }) as const;
+
+/**
+ * True when the honeypot caught something.
+ *
+ * The caller should answer as though the submission SUCCEEDED rather than showing an error:
+ * telling a bot which check it failed is how the next attempt gets past it. That also means a
+ * false positive is invisible to the visitor, which is why the rendering contract above is
+ * strict.
+ */
+export function isHoneypotFilled(formData: FormData, name: string = HONEYPOT_FIELD): boolean {
+  return String(formData.get(name) ?? '').trim().length > 0;
+}

package/src/includes/webmonterey/prose/inline.test.ts

@@ -0,0 +1,94 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { escapeHtml, renderInline } from './inline.ts';
+
+/*
+ * This module is the sanitiser for everything passed to `set:html` in a prose block, so the
+ * escaping tests below are the load-bearing ones. Page JSON is trusted content, but "trusted"
+ * is a property of today's workflow, not of the code.
+ */
+
+test('escapeHtml covers the five characters that break out', () => {
+  assert.equal(escapeHtml(`<>&"'`), '&lt;&gt;&amp;&quot;&#39;');
+});
+
+test('markup in page JSON is rendered inert', () => {
+  assert.equal(renderInline('<script>alert(1)</script>'), '&lt;script&gt;alert(1)&lt;/script&gt;');
+});
+
+test('an img onerror payload cannot escape', () => {
+  const out = renderInline('<img src=x onerror=alert(1)>');
+  assert.ok(!out.includes('<img'));
+  assert.ok(out.startsWith('&lt;img'));
+});
+
+test('bold becomes strong', () => {
+  assert.equal(renderInline('**Essential** — always on'), '<strong>Essential</strong> — always on');
+});
+
+test('italic becomes em', () => {
+  assert.equal(renderInline('it is _essential_ here'), 'it is <em>essential</em> here');
+});
+
+test('underscores inside a word are left alone', () => {
+  assert.equal(renderInline('snake_case_name stays'), 'snake_case_name stays');
+});
+
+test('a relative link is kept', () => {
+  assert.equal(renderInline('[policy](/privacy)'), '<a href="/privacy">policy</a>');
+});
+
+test('an anchor and a mailto are kept', () => {
+  assert.equal(renderInline('[top](#top)'), '<a href="#top">top</a>');
+  assert.equal(renderInline('[mail](mailto:a@b.com)'), '<a href="mailto:a@b.com">mail</a>');
+});
+
+test('an https link is kept', () => {
+  assert.equal(
+    renderInline('[cf](https://cloudflare.com)'),
+    '<a href="https://cloudflare.com">cf</a>',
+  );
+});
+
+test('a javascript: link degrades to its own text', () => {
+  // The words the author wrote survive; the link does not.
+  const out = renderInline('[click](javascript:alert%281%29)');
+  assert.ok(!out.includes('<a '));
+  assert.ok(!out.includes('javascript:'));
+  assert.ok(out.includes('click'));
+});
+
+test('a data: link degrades to its own text', () => {
+  const out = renderInline('[x](data:text/html;base64,PHNjcmlwdD4=)');
+  assert.ok(!out.includes('<a '));
+  assert.ok(!out.includes('data:'));
+});
+
+test('an unknown scheme is refused — allowlist, not blocklist', () => {
+  assert.ok(!renderInline('[x](vbscript:msgbox)').includes('<a '));
+});
+
+test('a quote in a URL cannot break out of the href attribute', () => {
+  const out = renderInline('[x](/a"onmouseover="alert(1))');
+  assert.ok(!out.includes('onmouseover="alert'));
+  assert.ok(out.includes('&quot;'));
+});
+
+test('underscores in a URL are not treated as emphasis', () => {
+  assert.equal(
+    renderInline('[link](https://x.com/a_b_c)'),
+    '<a href="https://x.com/a_b_c">link</a>',
+  );
+});
+
+test('bold and a link compose in one string', () => {
+  assert.equal(
+    renderInline('**Cloudflare** — see [docs](https://cf.com).'),
+    '<strong>Cloudflare</strong> — see <a href="https://cf.com">docs</a>.',
+  );
+});
+
+test('plain text passes through unchanged', () => {
+  assert.equal(renderInline('Just a sentence.'), 'Just a sentence.');
+});