@makolabs/ripple 3.8.1 → 3.9.2

package/dist/elements/text-viewer/TextViewer.svelte

@@ -0,0 +1,141 @@
+<script lang="ts">
+	import { onDestroy } from 'svelte';
+	import { cn } from '../../helper/cls.js';
+	import { buildTestId } from '../../helper/testid.js';
+	import { isSafeHttpUrl, redactUrl } from '../../helper/is-safe-http-url.js';
+	import { MAX_TEXT_BYTES } from '../../helper/resource-limits.js';
+	import Spinner from '../spinner/Spinner.svelte';
+	import UnsupportedPreview from '../viewer-shared/UnsupportedPreview.svelte';
+	import { Color, Size } from '../../variants.js';
+	import type { TextViewerProps } from './text-viewer-types.js';
+
+	let {
+		url,
+		maxBytes = MAX_TEXT_BYTES,
+		loadingLabel = 'Loading file...',
+		errorTitle = 'Unable to display file',
+		errorActionLabel = 'Open in new tab',
+		class: className = '',
+		testId
+	}: TextViewerProps = $props();
+
+	// Allow same-origin (incl. dev localhost) OR a public cross-origin host.
+	// Block cross-origin private/loopback/metadata hosts (SSRF read-exfil).
+	const urlAllowed = $derived(
+		isSafeHttpUrl(url, { sameOrigin: true, allowPrivateHosts: true }) ||
+			isSafeHttpUrl(url, { allowPrivateHosts: false })
+	);
+
+	let status = $state<'loading' | 'ready' | 'error'>('loading');
+	let content = $state('');
+	let truncated = $state(false);
+	let controller: AbortController | null = null;
+
+	async function load(active: AbortController) {
+		if (!urlAllowed) {
+			status = 'error';
+			return;
+		}
+
+		try {
+			const res = await fetch(url, {
+				signal: active.signal,
+				redirect: 'error',
+				credentials: 'same-origin'
+			});
+			if (!res.ok || !res.body) throw new Error('bad response');
+
+			const reader = res.body.getReader();
+			const chunks: Uint8Array[] = [];
+			let received = 0;
+			let didTruncate = false;
+
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (!value) continue;
+				chunks.push(value);
+				received += value.byteLength;
+				if (received > maxBytes) {
+					await reader.cancel();
+					didTruncate = true;
+					break;
+				}
+			}
+
+			const total = chunks.reduce((n, c) => n + c.byteLength, 0);
+			const buffer = new Uint8Array(total);
+			let offset = 0;
+			for (const chunk of chunks) {
+				buffer.set(chunk, offset);
+				offset += chunk.byteLength;
+			}
+
+			// A newer load() may have superseded this one while we were reading;
+			// never write state for a stale (aborted) request.
+			if (active.signal.aborted) return;
+			content = new TextDecoder().decode(buffer.subarray(0, maxBytes));
+			truncated = didTruncate;
+			status = 'ready';
+		} catch (err) {
+			if (err instanceof Error && err.name === 'AbortError') return;
+			if (active.signal.aborted) return;
+			console.error(
+				'Error loading text:',
+				redactUrl(url),
+				err instanceof Error ? err.name : 'unknown'
+			);
+			status = 'error';
+		}
+	}
+
+	$effect(() => {
+		// re-run when url changes
+		void url;
+		// Abort any in-flight load before starting a new one so a late-resolving
+		// previous request can't write content for the wrong file.
+		controller?.abort();
+		status = 'loading';
+		content = '';
+		truncated = false;
+		const active = new AbortController();
+		controller = active;
+		load(active);
+		return () => active.abort();
+	});
+
+	onDestroy(() => {
+		controller?.abort();
+	});
+</script>
+
+<div
+	class={cn('bg-default-100 flex h-full flex-col', className)}
+	data-testid={buildTestId('text-viewer', undefined, testId)}
+>
+	{#if status === 'error'}
+		<UnsupportedPreview
+			url={urlAllowed ? url : undefined}
+			title={errorTitle}
+			actionLabel={errorActionLabel}
+			variant="error"
+			{testId}
+		/>
+	{:else if status === 'loading'}
+		<div class="flex flex-1 items-center justify-center">
+			<Spinner size={Size.LG} color={Color.PRIMARY} label={loadingLabel} />
+		</div>
+	{:else}
+		{#if truncated}
+			<div
+				class="border-default-200 bg-default-50 text-default-700 border-b px-4 py-2 text-sm"
+				data-testid={buildTestId('text-viewer', 'truncated', testId)}
+			>
+				Showing the first {Math.round(maxBytes / 1024)} KB of this file.
+			</div>
+		{/if}
+		<pre
+			class="text-default-900 flex-1 overflow-auto p-4 font-mono text-sm [overflow-wrap:anywhere] whitespace-pre-wrap"
+			data-testid={buildTestId('text-viewer', 'content', testId)}>{content}</pre>
+	{/if}
+</div>

package/dist/elements/text-viewer/TextViewer.svelte.d.ts

@@ -0,0 +1,4 @@
+import type { TextViewerProps } from './text-viewer-types.js';
+declare const TextViewer: import("svelte").Component<TextViewerProps, {}, "">;
+type TextViewer = ReturnType<typeof TextViewer>;
+export default TextViewer;

package/dist/elements/text-viewer/text-viewer-types.d.ts

@@ -0,0 +1,10 @@
+import type { ClassValue } from 'tailwind-variants';
+export type TextViewerProps = {
+    url: string;
+    maxBytes?: number;
+    loadingLabel?: string;
+    errorTitle?: string;
+    errorActionLabel?: string;
+    class?: ClassValue;
+    testId?: string;
+};

package/dist/elements/text-viewer/text-viewer-types.js

@@ -0,0 +1 @@
+export {};

package/dist/elements/viewer-shared/UnsupportedPreview.svelte

@@ -0,0 +1,84 @@
+<script lang="ts">
+	import { cn } from '../../helper/cls.js';
+	import { buildTestId } from '../../helper/testid.js';
+	import Button from '../../button/Button.svelte';
+	import { Color, Size } from '../../variants.js';
+	import type { UnsupportedPreviewProps } from './unsupported-preview-types.js';
+
+	let {
+		url,
+		fileName,
+		title = 'Preview not available',
+		message,
+		actionLabel = 'Open in new tab',
+		variant = 'info',
+		class: className = '',
+		testId
+	}: UnsupportedPreviewProps = $props();
+</script>
+
+<div
+	class={cn('flex h-full w-full items-center justify-center p-6', className)}
+	data-testid={buildTestId('unsupported-preview', undefined, testId)}
+>
+	<div class="ring-default-200 max-w-md rounded-xl bg-white p-6 text-center shadow-sm ring-1">
+		<div
+			class={cn(
+				'mx-auto mb-3 flex size-10 items-center justify-center rounded-full',
+				variant === 'error' ? 'bg-danger-50 text-danger-600' : 'bg-default-100 text-default-600'
+			)}
+			aria-hidden="true"
+		>
+			{#if variant === 'error'}
+				<svg
+					xmlns="http://www.w3.org/2000/svg"
+					class="h-5 w-5"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2"
+					stroke-linecap="round"
+					stroke-linejoin="round"
+				>
+					<circle cx="12" cy="12" r="10" />
+					<line x1="12" y1="8" x2="12" y2="12" />
+					<line x1="12" y1="16" x2="12.01" y2="16" />
+				</svg>
+			{:else}
+				<svg
+					xmlns="http://www.w3.org/2000/svg"
+					class="h-5 w-5"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2"
+					stroke-linecap="round"
+					stroke-linejoin="round"
+				>
+					<path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z" />
+					<polyline points="14 2 14 8 20 8" />
+				</svg>
+			{/if}
+		</div>
+
+		<p class="text-default-900 mb-1 text-base font-semibold">{title}</p>
+		{#if fileName}
+			<p class="text-default-700 mb-1 text-sm break-all">{fileName}</p>
+		{/if}
+		{#if message}
+			<p class="text-default-600 mb-4 text-sm">{message}</p>
+		{/if}
+
+		{#if url}
+			<Button
+				color={Color.PRIMARY}
+				size={Size.SM}
+				href={url}
+				target="_blank"
+				rel="noopener noreferrer"
+			>
+				{actionLabel}
+			</Button>
+		{/if}
+	</div>
+</div>

package/dist/elements/viewer-shared/UnsupportedPreview.svelte.d.ts

@@ -0,0 +1,4 @@
+import type { UnsupportedPreviewProps } from './unsupported-preview-types.js';
+declare const UnsupportedPreview: import("svelte").Component<UnsupportedPreviewProps, {}, "">;
+type UnsupportedPreview = ReturnType<typeof UnsupportedPreview>;
+export default UnsupportedPreview;

package/dist/elements/viewer-shared/ViewerToolbar.svelte

@@ -0,0 +1,128 @@
+<script lang="ts">
+	import { buildTestId } from '../../helper/testid.js';
+	import type { ViewerToolbarProps } from './viewer-toolbar-types.js';
+
+	let {
+		component = 'viewer',
+		scale,
+		minScale,
+		maxScale,
+		disabled = false,
+		leftLabel = '',
+		onzoomin: onZoomIn,
+		onzoomout: onZoomOut,
+		onfittowidth: onFitToWidth,
+		testId
+	}: ViewerToolbarProps = $props();
+
+	function handleZoomIn() {
+		onZoomIn?.();
+	}
+	function handleZoomOut() {
+		onZoomOut?.();
+	}
+	function handleFitToWidth() {
+		onFitToWidth?.();
+	}
+
+	const btnClass =
+		'text-default-700 hover:bg-default-100 focus-visible:ring-primary-400 rounded-md p-1.5 transition-colors focus-visible:ring-2 focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-40';
+</script>
+
+<div
+	class="border-default-200 bg-default-50 flex items-center justify-between border-b px-4 py-2"
+	data-testid={buildTestId(component, 'toolbar', testId)}
+>
+	<div class="flex items-center gap-2">
+		<span class="text-default-700 text-sm" aria-live="polite">{leftLabel}</span>
+	</div>
+
+	<div class="flex items-center gap-1">
+		<button
+			type="button"
+			onclick={handleZoomOut}
+			disabled={disabled || scale <= minScale}
+			class={btnClass}
+			aria-label="Zoom out"
+			title="Zoom out"
+			data-testid={buildTestId(component, 'zoom-out', testId)}
+		>
+			<svg
+				xmlns="http://www.w3.org/2000/svg"
+				class="h-5 w-5"
+				viewBox="0 0 24 24"
+				fill="none"
+				stroke="currentColor"
+				stroke-width="2"
+				stroke-linecap="round"
+				stroke-linejoin="round"
+				aria-hidden="true"
+			>
+				<circle cx="11" cy="11" r="8" />
+				<line x1="21" y1="21" x2="16.65" y2="16.65" />
+				<line x1="8" y1="11" x2="14" y2="11" />
+			</svg>
+		</button>
+
+		<span
+			class="text-default-700 min-w-[3.5rem] text-center text-sm tabular-nums"
+			aria-live="polite"
+			data-testid={buildTestId(component, 'scale', testId)}
+		>
+			{Math.round(scale * 100)}%
+		</span>
+
+		<button
+			type="button"
+			onclick={handleZoomIn}
+			disabled={disabled || scale >= maxScale}
+			class={btnClass}
+			aria-label="Zoom in"
+			title="Zoom in"
+			data-testid={buildTestId(component, 'zoom-in', testId)}
+		>
+			<svg
+				xmlns="http://www.w3.org/2000/svg"
+				class="h-5 w-5"
+				viewBox="0 0 24 24"
+				fill="none"
+				stroke="currentColor"
+				stroke-width="2"
+				stroke-linecap="round"
+				stroke-linejoin="round"
+				aria-hidden="true"
+			>
+				<circle cx="11" cy="11" r="8" />
+				<line x1="11" y1="8" x2="11" y2="14" />
+				<line x1="8" y1="11" x2="14" y2="11" />
+			</svg>
+		</button>
+
+		<button
+			type="button"
+			onclick={handleFitToWidth}
+			{disabled}
+			class={btnClass}
+			aria-label="Fit to width"
+			title="Fit to width"
+			data-testid={buildTestId(component, 'fit-to-width', testId)}
+		>
+			<svg
+				xmlns="http://www.w3.org/2000/svg"
+				class="h-5 w-5"
+				viewBox="0 0 24 24"
+				fill="none"
+				stroke="currentColor"
+				stroke-width="2"
+				stroke-linecap="round"
+				stroke-linejoin="round"
+				aria-hidden="true"
+			>
+				<polyline points="15 3 21 3 21 9" />
+				<polyline points="9 21 3 21 3 15" />
+				<line x1="21" y1="3" x2="14" y2="10" />
+				<line x1="3" y1="21" x2="10" y2="14" />
+			</svg>
+		</button>
+	</div>
+</div>

package/dist/elements/viewer-shared/ViewerToolbar.svelte.d.ts

@@ -0,0 +1,4 @@
+import type { ViewerToolbarProps } from './viewer-toolbar-types.js';
+declare const ViewerToolbar: import("svelte").Component<ViewerToolbarProps, {}, "">;
+type ViewerToolbar = ReturnType<typeof ViewerToolbar>;
+export default ViewerToolbar;

package/dist/elements/viewer-shared/unsupported-preview-types.d.ts

@@ -0,0 +1,17 @@
+import type { ClassValue } from 'tailwind-variants';
+export type UnsupportedPreviewProps = {
+    /** When set, an "open/download" link is shown (scheme-guarded by Button). */
+    url?: string;
+    /** File name shown above the message (rendered as text). */
+    fileName?: string;
+    /** Card heading. @default 'Preview not available' */
+    title?: string;
+    /** Supporting line under the heading. */
+    message?: string;
+    /** Label of the open/download link. @default 'Open in new tab' */
+    actionLabel?: string;
+    /** Visual treatment. @default 'info' */
+    variant?: 'info' | 'error';
+    class?: ClassValue;
+    testId?: string;
+};

package/dist/elements/viewer-shared/unsupported-preview-types.js

@@ -0,0 +1 @@
+export {};

package/dist/elements/viewer-shared/viewer-toolbar-types.d.ts

@@ -0,0 +1,14 @@
+export type ViewerToolbarProps = {
+    /** testid namespace, e.g. 'image-viewer'. @default 'viewer' */
+    component?: string;
+    scale: number;
+    minScale: number;
+    maxScale: number;
+    disabled?: boolean;
+    /** Optional left-aligned label (e.g. a page or dimension hint). */
+    leftLabel?: string;
+    onzoomin?: () => void;
+    onzoomout?: () => void;
+    onfittowidth?: () => void;
+    testId?: string;
+};

package/dist/elements/viewer-shared/viewer-toolbar-types.js

@@ -0,0 +1 @@
+export {};

package/dist/helper/is-safe-http-url.d.ts

@@ -0,0 +1,33 @@
+/**
+ * URL safety helpers for the file-preview viewers. See spec §4 / threat
+ * register T0.1, T1.3, T1.4. `isSafeHttpUrl` is a strict allowlist; do not
+ * convert it to a denylist.
+ */
+/** True for loopback / link-local / private / metadata / encoded-IP hosts. */
+export declare function isBlockedHost(hostname: string): boolean;
+export type SafeUrlOptions = {
+    /** Base for resolving relative URLs. Defaults to document.baseURI in a browser. */
+    base?: string;
+    /** Allow same-origin blob: URLs. */
+    allowBlob?: boolean;
+    /** Require the resolved origin to be the base origin (or in allowedOrigins). */
+    sameOrigin?: boolean;
+    /** Extra origins permitted when sameOrigin is set. */
+    allowedOrigins?: string[];
+    /**
+     * Waive private/loopback/metadata host blocking, but ONLY for the base
+     * (same-origin) origin or an entry in `allowedOrigins`. This is not a blanket
+     * SSRF bypass: cross-origin private hosts stay blocked even when set. Intended
+     * for same-origin dev fetches (e.g. a localhost PDF served by the app itself).
+     */
+    allowPrivateHosts?: boolean;
+};
+/** Strict allowlist: http/https (+ same-origin blob when allowBlob). */
+export declare function isSafeHttpUrl(url: string, opts?: SafeUrlOptions): boolean;
+/** Strip query string + hash for safe logging (signed-URL tokens live there). */
+export declare function redactUrl(url: string, base?: string): string;
+/**
+ * Link-href guard for navigation (`<a href>`). Broader than isSafeHttpUrl:
+ * allows http/https/mailto/tel/relative/hash, blocks only executable schemes.
+ */
+export declare function isSafeLinkHref(href: string, base?: string): boolean;

package/dist/helper/is-safe-http-url.js

@@ -0,0 +1,214 @@
+/**
+ * URL safety helpers for the file-preview viewers. See spec §4 / threat
+ * register T0.1, T1.3, T1.4. `isSafeHttpUrl` is a strict allowlist; do not
+ * convert it to a denylist.
+ */
+/** Parse a hostname into a 32-bit IPv4 int, or null if it is not an IPv4 form. */
+function toIpv4Int(hostname) {
+    const host = hostname.toLowerCase();
+    // Dotted forms: a, a.b, a.b.c, a.b.c.d where each part may be dec/hex/octal.
+    const parts = host.split('.');
+    if (parts.length >= 1 && parts.length <= 4 && parts.every((p) => p.length > 0)) {
+        const nums = [];
+        for (const part of parts) {
+            let n;
+            if (/^0x[0-9a-f]+$/.test(part))
+                n = parseInt(part, 16);
+            else if (/^0[0-7]+$/.test(part))
+                n = parseInt(part, 8);
+            else if (/^[0-9]+$/.test(part))
+                n = parseInt(part, 10);
+            else
+                return null;
+            if (!Number.isFinite(n) || n < 0)
+                return null;
+            nums.push(n);
+        }
+        // Single number (e.g. 2130706433) => whole 32-bit address.
+        if (nums.length === 1) {
+            const n = nums[0];
+            return n <= 0xffffffff ? n >>> 0 : null;
+        }
+        // Last part fills remaining bytes; leading parts must be single bytes.
+        const last = nums[nums.length - 1];
+        const lead = nums.slice(0, -1);
+        if (lead.some((n) => n > 255))
+            return null;
+        const remaining = 4 - lead.length;
+        if (last > 0xffffffff || last >= 256 ** remaining)
+            return null;
+        let value = 0;
+        for (const n of lead)
+            value = (value << 8) | n;
+        value = (value * 256 ** remaining + last) >>> 0;
+        return value;
+    }
+    return null;
+}
+function ipv4IntInBlockedRange(ip) {
+    const a = (ip >>> 24) & 0xff;
+    const b = (ip >>> 16) & 0xff;
+    if (a === 0)
+        return true; // 0.0.0.0/8
+    if (a === 10)
+        return true; // 10/8
+    if (a === 127)
+        return true; // 127/8 loopback
+    if (a === 169 && b === 254)
+        return true; // 169.254/16 link-local
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16/12
+    if (a === 192 && b === 168)
+        return true; // 192.168/16
+    return false;
+}
+/** True for loopback / link-local / private / metadata / encoded-IP hosts. */
+export function isBlockedHost(hostname) {
+    if (!hostname)
+        return true;
+    let host = hostname.toLowerCase().trim();
+    // Strip IPv6 brackets if present.
+    if (host.startsWith('[') && host.endsWith(']'))
+        host = host.slice(1, -1);
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host.endsWith('.internal') || host.startsWith('metadata.'))
+        return true;
+    // IPv6 loopback + unique-local (fc00::/7 => fc.. or fd..) + link-local (fe80).
+    if (host === '::1')
+        return true;
+    if (host.includes(':')) {
+        // IPv4-mapped IPv6 (::ffff:127.0.0.1, normalized by URL parser to
+        // ::ffff:7f00:1) tunnels a v4 address through a v6 host — unwrap and
+        // re-check against the v4 ranges so mapped loopback/private stays blocked.
+        const mapped = /^::ffff:(.+)$/.exec(host);
+        if (mapped) {
+            const tail = mapped[1];
+            const dotted = toIpv4Int(tail);
+            if (dotted !== null)
+                return ipv4IntInBlockedRange(dotted);
+            const groups = tail.split(':');
+            if (groups.length === 2 && groups.every((g) => /^[0-9a-f]{1,4}$/.test(g))) {
+                const v4 = ((parseInt(groups[0], 16) << 16) | parseInt(groups[1], 16)) >>> 0;
+                return ipv4IntInBlockedRange(v4);
+            }
+        }
+        if (host.startsWith('fc') || host.startsWith('fd'))
+            return true;
+        if (host.startsWith('fe80'))
+            return true;
+        return false;
+    }
+    const ip = toIpv4Int(host);
+    if (ip !== null)
+        return ipv4IntInBlockedRange(ip);
+    return false;
+}
+// Control chars + space; WHATWG URL strips \t\n\r, so reject before parsing.
+// Matches U+0000–U+0020 (includes tab, newline, CR, space) and U+007F (DEL).
+// eslint-disable-next-line no-control-regex -- detecting control chars is the point
+const CONTROL_OR_SPACE = /[\u0000-\u0020\u007f]/;
+function defaultBase(opts) {
+    if (opts.base)
+        return opts.base;
+    if (typeof document !== 'undefined')
+        return document.baseURI;
+    return undefined;
+}
+function originOf(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Strict allowlist: http/https (+ same-origin blob when allowBlob). */
+export function isSafeHttpUrl(url, opts = {}) {
+    if (typeof url !== 'string' || url.length === 0)
+        return false;
+    if (CONTROL_OR_SPACE.test(url))
+        return false;
+    const base = defaultBase(opts);
+    let parsed;
+    try {
+        parsed = new URL(url, base);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.username || parsed.password)
+        return false;
+    const proto = parsed.protocol;
+    if (proto === 'blob:') {
+        if (!opts.allowBlob)
+            return false;
+        // blob: origin is embedded in the URL; require it to match the base origin.
+        const baseOrigin = base ? originOf(base) : undefined;
+        if (!baseOrigin || parsed.origin !== baseOrigin)
+            return false;
+        return true;
+    }
+    if (proto !== 'http:' && proto !== 'https:')
+        return false;
+    const baseOrigin = base
+        ? originOf(base)
+        : typeof location !== 'undefined'
+            ? location.origin
+            : undefined;
+    if (isBlockedHost(parsed.hostname)) {
+        // allowPrivateHosts only waives host-blocking for the base (same-origin)
+        // origin or an explicitly allowed origin — never a blanket SSRF bypass to
+        // arbitrary loopback/LAN/metadata hosts.
+        const privateOk = !!opts.allowPrivateHosts &&
+            ((!!baseOrigin && parsed.origin === baseOrigin) ||
+                (opts.allowedOrigins?.includes(parsed.origin) ?? false));
+        if (!privateOk)
+            return false;
+    }
+    if (opts.sameOrigin || opts.allowedOrigins) {
+        const allowed = new Set(opts.allowedOrigins ?? []);
+        if (opts.sameOrigin && baseOrigin)
+            allowed.add(baseOrigin);
+        // Fail closed: a same-origin / allowlist requirement with no resolvable
+        // allowed origin (e.g. sameOrigin in a non-browser with no base) must not
+        // silently permit every origin.
+        if (allowed.size === 0)
+            return false;
+        if (!allowed.has(parsed.origin))
+            return false;
+    }
+    return true;
+}
+/** Strip query string + hash for safe logging (signed-URL tokens live there). */
+export function redactUrl(url, base) {
+    try {
+        const resolved = base ?? (typeof document !== 'undefined' ? document.baseURI : undefined);
+        const u = new URL(url, resolved);
+        return u.origin + u.pathname;
+    }
+    catch {
+        return '[unparseable url]';
+    }
+}
+/** Schemes that can execute script or read local files — never valid for a link. */
+const DANGEROUS_LINK_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:', 'file:']);
+/**
+ * Link-href guard for navigation (`<a href>`). Broader than isSafeHttpUrl:
+ * allows http/https/mailto/tel/relative/hash, blocks only executable schemes.
+ */
+export function isSafeLinkHref(href, base) {
+    if (typeof href !== 'string' || href.length === 0)
+        return false;
+    if (CONTROL_OR_SPACE.test(href))
+        return false;
+    const resolved = base ?? (typeof document !== 'undefined' ? document.baseURI : undefined);
+    try {
+        const parsed = new URL(href, resolved);
+        return !DANGEROUS_LINK_SCHEMES.has(parsed.protocol);
+    }
+    catch {
+        // No usable base + relative href: safe only if it carries no scheme.
+        return !/^[a-z][a-z0-9+.-]*:/i.test(href);
+    }
+}