@zvndev/darkmown 2.6.1-next.11.g82bb8d7 → 2.7.0

package/src/compiler/forms.js

@@ -39,6 +39,49 @@ export const BIND_EXAMPLE = ':bind query placeholder="Search"';
 export const SLIDER_EXAMPLE = ":slider volume = 50 min=0 max=100 step=1";
 const INPUT_USE = `Use: :input name [type=…] [placeholder="…"] [required] — e.g. ${INPUT_EXAMPLE}`;
 
+// ---------------------------------------------------------------------------
+// A FIELD DIRECTIVE MEANS TWO DIFFERENT THINGS, AND ONLY THE FORM KNOWS WHICH.
+//
+// Inside a `:form`, `:select topic` names a FORM FIELD: the label goes in the
+// submitted payload under that name and nothing is reactive. Outside one, the
+// same line is a bound CONTROL over a declared `:state`, exactly like `:bind`
+// and `:slider` — changing it writes the state, changing the state moves it.
+//
+// The two cannot be told apart from the line alone, and inferring it from
+// "does a state of that name happen to exist?" would mean declaring an
+// unrelated `:state topic` elsewhere on the page silently rewires a form. So
+// the enclosing `:form` says so: `handleForm` flags the context it compiles its
+// body with, and `nestedCtx` spreads that flag into every nested block, so a
+// field inside a `:::` inside the form still sees it.
+//
+// The flag rides on the context object rather than the `Ctx` typedef because
+// `context.js` is the root of the module DAG and knows nothing about forms.
+// (Known limit: an `@include` compiles its target with a fresh context, so a
+// field directive inside an included partial is always the standalone form.)
+// ---------------------------------------------------------------------------
+
+/** @param {Ctx} ctx @returns {boolean} */
+const inForm = (ctx) => Boolean(/** @type {any} */ (ctx).inForm);
+
+/**
+ * Resolve a standalone field's state key, or explain how to declare it.
+ * @param {string} name
+ * @param {string} directive `:select` / `:checkbox` / `:radio`.
+ * @param {Ctx} ctx
+ * @param {number} index 0-based line index for `file:line`.
+ * @returns {string} The fully-qualified state key.
+ */
+function boundKey(name, directive, ctx, index) {
+  const key = resolveStateKey(name, ctx);
+  if (key) return key;
+  const seed = directive === ":checkbox" ? "false" : '"…"';
+  const hint = `declare the state first — :state ${name} = ${seed} — or move ${directive} inside a :form, where the name is a form field instead`;
+  throw wdError(
+    `${directive} ${name} in ${at(ctx, index)} is outside a :form and has no matching state. Use: ${hint} — e.g. ${SELECT_EXAMPLE}`,
+    { code: "WD450", file: ctx.file, line: lineOf(ctx, index), hint, example: SELECT_EXAMPLE }
+  );
+}
+
 /**
  * @param {string} line
  * @param {string[]} bodyLines
@@ -67,9 +110,30 @@ export function handleForm(line, bodyLines, ctx, index) {
     });
   }
   const action = rawAction ? validateFetchUrl(rawAction, ctx, ":form action") : undefined;
-  const inner = ctx.compileBody(bodyLines, nestedCtx(ctx, index + 1)).trim();
+  // See the `inForm` note above: the body's context carries the flag that makes
+  // a field directive a FORM FIELD rather than a bound control.
+  const bodyCtx = /** @type {any} */ (nestedCtx(ctx, index + 1));
+  bodyCtx.inForm = true;
+  const inner = ctx.compileBody(bodyLines, bodyCtx).trim();
+  // A file cannot be urlencoded, so a form carrying one has to be multipart —
+  // in the browser's native submit (this attribute) and in the runtime's
+  // round-trip (which posts the FormData itself). A GET form has no body at
+  // all, so the file would be dropped and only its NAME would travel: that is
+  // the silent kind of failure, so it is a compile error instead.
+  const hasFile = /<input[^>]*\btype="file"/i.test(inner);
+  if (hasFile && method.toLowerCase() === "get") {
+    const hint = `drop method="get" (a :form posts by default) — a GET request has no body, so the file would never be sent — e.g. ${FORM_EXAMPLE}`;
+    throw wdError(`:form in ${at(ctx, index)} has a file field and method="get". Use: ${hint}`, {
+      code: "WD452",
+      file: ctx.file,
+      line: lineOf(ctx, index),
+      hint,
+      example: FORM_EXAMPLE
+    });
+  }
+  const enctype = hasFile ? ` enctype="multipart/form-data"` : "";
   if (!into) {
-    return `<form action="${escapeHtml(action)}" method="${escapeHtml(method)}">${inner}</form>`;
+    return `<form action="${escapeHtml(action)}" method="${escapeHtml(method)}"${enctype}>${inner}</form>`;
   }
   const key = declareState(into, null, ctx);
   declareErrorState(key, ctx);
@@ -80,9 +144,9 @@ export function handleForm(line, bodyLines, ctx, index) {
     detail: `:form action="${rawAction}" into ${into}`
   });
   const actionAttrs = action
-    ? ` action="${escapeHtml(action)}" method="${escapeHtml(method)}"`
+    ? ` action="${escapeHtml(action)}" method="${escapeHtml(method)}"${enctype}`
     : "";
-  return `<script type="application/json" data-wd-state>${safeScriptJson({ [key]: null })}</script><form data-wd-form="${key}"${actionAttrs}>${inner}</form>`;
+  return `<script type="application/json" data-wd-state>${safeScriptJson({ [key]: null })}</script><form data-wd-form="${escapeHtml(key)}"${actionAttrs}>${inner}</form>`;
 }
 
 /**
@@ -230,7 +294,7 @@ export function handleBind(line, ctx, index) {
   const initial = ctx.comp.state.get(key);
   const valueAttr =
     initial === undefined || initial === null ? "" : ` value="${escapeHtml(String(initial))}"`;
-  return `<input type="${escapeHtml(type)}" data-wd-bind-input="${key}"${valueAttr} ${attrs.join(" ")}>`;
+  return `<input type="${escapeHtml(type)}" data-wd-bind-input="${escapeHtml(key)}"${valueAttr} ${attrs.join(" ")}>`;
 }
 
 /**
@@ -318,7 +382,7 @@ export function handleSlider(line, ctx, index) {
         { code: "WD413", file: ctx.file, line: lineOf(ctx, index) }
       );
     key = declareState(name, value, ctx);
-    const persistAttr = persist ? ` data-wd-persist="${key}"` : "";
+    const persistAttr = persist ? ` data-wd-persist="${escapeHtml(key)}"` : "";
     seed = `<script type="application/json" data-wd-state${persistAttr}>${safeScriptJson({ [key]: value })}</script>`;
   } else {
     if (persist)
@@ -340,7 +404,7 @@ export function handleSlider(line, ctx, index) {
     initial === undefined || initial === null ? "" : ` value="${escapeHtml(String(initial))}"`;
   const ariaAttr = ` aria-label="${escapeHtml(ariaLabel || humanizeName(name))}"`;
   recordSymbol(ctx, index, { kind: "field", name, target: key, detail: `:slider ${name}` });
-  return `${seed}<input type="range" data-wd-bind-input="${key}" min="${escapeHtml(min)}" max="${escapeHtml(max)}" step="${escapeHtml(step)}"${valueAttr}${ariaAttr}>`;
+  return `${seed}<input type="range" data-wd-bind-input="${escapeHtml(key)}" min="${escapeHtml(min)}" max="${escapeHtml(max)}" step="${escapeHtml(step)}"${valueAttr}${ariaAttr}>`;
 }
 
 /**
@@ -437,7 +501,13 @@ export function handleTextarea(line, ctx, index) {
 /**
  * `:select name [required]` followed by `- Label` list lines → a `<select>` with
  * one `<option>` per label (value === label). Derives an aria-label from the
- * humanized name when none is given. Captured by FormData like the other fields.
+ * humanized name when none is given.
+ *
+ * Inside a `:form` it is a form field captured by FormData, exactly as before.
+ * Outside one it is a control two-way bound to a declared `:state` of that name
+ * (see the `inForm` note at the top of this file): the seed selects the matching
+ * option, changing the control writes the state, and changing the state moves
+ * the control.
  * @param {string} line
  * @param {string[]} optionLines The following `- Label` lines consumed by dispatch.
  * @param {Ctx} ctx
@@ -456,8 +526,17 @@ export function handleSelect(line, optionLines, ctx, index) {
       example: SELECT_EXAMPLE
     });
   }
-  const attrs = [`name="${escapeHtml(match[1])}"`];
-  recordSymbol(ctx, index, { kind: "field", name: match[1], detail: `:select ${match[1]}` });
+  const bound = inForm(ctx) ? null : boundKey(match[1], ":select", ctx, index);
+  const attrs = bound
+    ? [`data-wd-bind-input="${escapeHtml(bound)}"`]
+    : [`name="${escapeHtml(match[1])}"`];
+  if (bound) ctx.comp.assets.runtime = true;
+  recordSymbol(ctx, index, {
+    kind: "field",
+    name: match[1],
+    ...(bound ? { target: bound } : {}),
+    detail: `:select ${match[1]}`
+  });
   let hasAria = false;
   const re = /([A-Za-z-]+)=("[^"]*"|\S+)|([A-Za-z-]+)/g;
   for (const token of (match[2] || "").matchAll(re)) {
@@ -493,8 +572,14 @@ export function handleSelect(line, optionLines, ctx, index) {
       { code: "WD423", file: ctx.file, line: lineOf(ctx, index) }
     );
   }
+  // A bound select opens on the state's current value, so the first paint agrees
+  // with what the runtime will reflect a moment later.
+  const selected = bound ? String(ctx.comp.state.get(bound) ?? "") : null;
   const opts = options
-    .map((o) => `<option value="${escapeHtml(o)}">${escapeHtml(o)}</option>`)
+    .map(
+      (o) =>
+        `<option value="${escapeHtml(o)}"${o === selected ? " selected" : ""}>${escapeHtml(o)}</option>`
+    )
     .join("");
   return `<select ${attrs.join(" ")}>${opts}</select>`;
 }
@@ -509,6 +594,11 @@ export function handleSelect(line, optionLines, ctx, index) {
  * groups capture a single value like `:input`. Flags: `required` (radio → the
  * group; not emitted on checkboxes, where "at least one" has no native HTML form),
  * `disabled` (whole group), `autofocus` (first control).
+ *
+ * OUTSIDE a `:form` (see the `inForm` note at the top of this file) both bind to
+ * a declared `:state` of that name instead: a `:radio` group binds the STRING of
+ * the chosen option, and a `:checkbox` binds a BOOLEAN, so it takes exactly one
+ * option — the label to show beside it.
  * @param {string} line
  * @param {string[]} optionLines The following `- Label` lines consumed by dispatch.
  * @param {Ctx} ctx
@@ -535,7 +625,14 @@ export function handleChoiceGroup(line, optionLines, ctx, kind, index) {
     });
   }
   const name = match[1];
-  recordSymbol(ctx, index, { kind: "field", name, detail: `:${kind} ${name}` });
+  const bound = inForm(ctx) ? null : boundKey(name, directive, ctx, index);
+  if (bound) ctx.comp.assets.runtime = true;
+  recordSymbol(ctx, index, {
+    kind: "field",
+    name,
+    ...(bound ? { target: bound } : {}),
+    detail: `:${kind} ${name}`
+  });
   const flags = [];
   let ariaLabel = null;
   let ariaDescribedby = null;
@@ -570,19 +667,41 @@ export function handleChoiceGroup(line, optionLines, ctx, kind, index) {
     );
   }
   const isCheckbox = kind === "checkbox";
+  // A bound checkbox is one boolean, so a list of options has no meaning: the
+  // author is reaching for a multi-value control that would need every box to
+  // write the same key.
+  if (bound && isCheckbox && options.length > 1) {
+    const hint = `a bound :checkbox is a single true/false, so give it one "- Label" line. For a list of choices, use a :radio group (one value) or drive an array with :button "…" -> ${name} toggle "Label"`;
+    throw wdError(
+      `:checkbox ${name} in ${at(ctx, index)} is bound to state and has ${options.length} options. Use: ${hint} — e.g. ${CHECKBOX_EXAMPLE}`,
+      { code: "WD451", file: ctx.file, line: lineOf(ctx, index), hint, example: CHECKBOX_EXAMPLE }
+    );
+  }
   const groupAttrs = [
     `class="wd-${isCheckbox ? "checkboxes" : "radios"}"`,
     `role="${isCheckbox ? "group" : "radiogroup"}"`
   ];
-  if (isCheckbox) groupAttrs.push(`data-wd-multi="${escapeHtml(name)}"`);
+  // `data-wd-multi` tells the form submit handler to collect every checked box
+  // into an array. A bound checkbox is not in a form and is not an array.
+  if (isCheckbox && !bound) groupAttrs.push(`data-wd-multi="${escapeHtml(name)}"`);
   groupAttrs.push(`aria-label="${escapeHtml(ariaLabel || humanizeName(name))}"`);
   if (ariaDescribedby) groupAttrs.push(`aria-describedby="${escapeHtml(ariaDescribedby)}"`);
   const disabled = flags.includes("disabled");
   const required = flags.includes("required");
   const autofocus = flags.includes("autofocus");
+  const current = bound ? ctx.comp.state.get(bound) : undefined;
   const controls = options
     .map((opt, idx) => {
-      const a = [`type="${kind}"`, `name="${escapeHtml(name)}"`, `value="${escapeHtml(opt)}"`];
+      const a = [
+        `type="${kind}"`,
+        `name="${escapeHtml(bound || name)}"`,
+        `value="${escapeHtml(opt)}"`
+      ];
+      // A radio group still needs its shared `name` to be mutually exclusive in
+      // the browser, so the bound form keys it by the state key.
+      if (bound) a.push(`data-wd-bind-input="${escapeHtml(bound)}"`);
+      if (bound && (isCheckbox ? Boolean(current) : String(current ?? "") === opt))
+        a.push("checked");
       if (disabled) a.push("disabled");
       if (required && !isCheckbox) a.push("required");
       if (autofocus && idx === 0) a.push("autofocus");

package/src/compiler/frontmatter.js

@@ -16,9 +16,15 @@ import { stripQuotes } from "./interpolation.js";
  * Split a raw file into its frontmatter `meta` and `body`. `bodyLine` is the
  * 0-based file line index the body starts on (the number of lines the
  * frontmatter block consumed) so compile errors can report true file lines.
+ *
+ * `quotedKeys` names the fields the author wrote with quotes. Quotes are syntax,
+ * not content, so `meta` never carries them — but "the author quoted it" is the
+ * only signal that `sku: "007"` is the TEXT 007 and not the number 7, and the
+ * typed-collection coercion needs it. Additive: existing destructuring of
+ * `{ meta, body, bodyLine }` is unaffected.
  * @param {string} raw Full file contents.
  * @param {string} [file] Source path, used only for error messages.
- * @returns {{ meta: Meta, body: string, bodyLine: number }}
+ * @returns {{ meta: Meta, body: string, bodyLine: number, quotedKeys: Set<string> }}
  */
 export function parseFrontmatter(raw, file) {
   // A file authored on Windows (or checked out with git's autocrlf) arrives
@@ -28,7 +34,7 @@ export function parseFrontmatter(raw, file) {
   // in the reader keeps the direct callers (builder.js reads route frontmatter
   // straight off disk for feeds) on the same footing. Idempotent on LF input.
   raw = normalizeNewlines(raw);
-  if (!raw.startsWith("---\n")) return { meta: {}, body: raw, bodyLine: 0 };
+  if (!raw.startsWith("---\n")) return { meta: {}, body: raw, bodyLine: 0, quotedKeys: new Set() };
   const end = raw.indexOf("\n---", 3);
   if (end === -1) {
     const where = file ? ` in ${file}` : "";
@@ -44,11 +50,16 @@ export function parseFrontmatter(raw, file) {
   const bodyLine = raw.slice(0, bodyStart).split("\n").length - 1;
   /** @type {Meta} */
   const meta = {};
+  /** @type {Set<string>} */
+  const quotedKeys = new Set();
   for (const line of front.split("\n")) {
     const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-    if (match) meta[match[1]] = parseFrontmatterValue(match[2]);
+    if (!match) continue;
+    const parsed = parseFrontmatterValue(match[2]);
+    meta[match[1]] = parsed.value;
+    if (parsed.quoted) quotedKeys.add(match[1]);
   }
-  return { meta, body, bodyLine };
+  return { meta, body, bodyLine, quotedKeys };
 }
 
 /**
@@ -86,13 +97,23 @@ export function warnLikelyFrontmatter(raw, file, comp) {
 // Block sequences (`- item` on following lines) are intentionally out of scope —
 // the parser stays single-pass and line-based.
 /**
+ * Parse one frontmatter value, reporting whether the author QUOTED it.
+ *
+ * The inline-array branch tracks `quoted` per item already (an item is a string
+ * either way, so the flag only guards whitespace trimming); the scalar branch
+ * did not, and downstream that made `sku: "007"` indistinguishable from
+ * `sku: 007`. Both are `"007"` here, but only the first is text the author
+ * pinned, so only the second is a candidate for numeric coercion.
  * @param {string} raw
- * @returns {FrontmatterValue}
+ * @returns {{ value: FrontmatterValue, quoted: boolean }}
  */
 function parseFrontmatterValue(raw) {
   const value = raw.trim();
-  if (value.startsWith("[") && value.endsWith("]")) return parseInlineArray(value);
-  return stripQuotes(value);
+  if (value.startsWith("[") && value.endsWith("]"))
+    return { value: parseInlineArray(value), quoted: false };
+  const quote = value[0];
+  const quoted = value.length >= 2 && (quote === '"' || quote === "'") && value.endsWith(quote);
+  return { value: stripQuotes(value), quoted };
 }
 
 /**

package/src/compiler/includes.js

@@ -180,14 +180,23 @@ export function resolveInclude(spec, fromFile, context, allowAny, loc, reader) {
   }
   for (const candidate of candidates) {
     const resolved = path.resolve(candidate);
-    if (!isAllowedInclude(resolved, context)) {
+    const refuse = () => {
       throw wdError(`Include "${spec}" from ${loc} resolves outside site/pages or site/_`, {
         code: "WD601",
         file: fromFile
       });
-    }
+    };
+    // Lexical containment first: it is the only check available for a path that
+    // does not exist yet, and it is what rejects `../` traversal and a
+    // sibling-prefix directory (`site/pages-secret/`).
+    if (!isAllowedInclude(resolved, context)) refuse();
     if (!reader.exists(resolved)) continue;
     if (!allowAny && !pageIncludeExtensions.includes(path.extname(resolved))) continue;
+    // CANONICAL containment second: the lexical check reads the path as WRITTEN,
+    // so a symlink sitting inside `site/pages` and pointing anywhere on the disk
+    // passed it and leaked the target's bytes into the built page. Only reachable
+    // once the file exists, which is why it cannot replace the lexical check.
+    if (!isAllowedInclude(resolved, context, reader)) refuse();
     return resolved;
   }
   throw wdError(
@@ -197,13 +206,42 @@ export function resolveInclude(spec, fromFile, context, allowAny, loc, reader) {
 }
 
 /**
- * @param {string} file
+ * Whether an absolute path is inside the `site/pages` / `site/_` sandbox.
+ *
+ * Two modes, both used by {@link resolveInclude}. Without a `reader` the check is
+ * LEXICAL — the path exactly as written — which is what rejects `../` traversal
+ * and a sibling directory that merely shares the root's prefix
+ * (`site/pages-secret/` is not inside `site/pages/`, hence the `path.sep`
+ * boundary). With a `reader` it re-runs against the CANONICAL paths, closing the
+ * symlink hole: a link inside `site/pages` pointing at `../../secret.md` is
+ * lexically fine and still escapes the sandbox. Both sides are canonicalized,
+ * because a project root can itself live under a symlinked parent (macOS
+ * `/tmp` → `/private/tmp`), where realpathing only the file would reject every
+ * legitimate include.
+ * @param {string} file Absolute path to the include target.
  * @param {Paths} context
+ * @param {import("./reader.js").Reader} [reader] When given, also check the
+ *   canonical (symlink-resolved) path. Requires `file` to exist.
  * @returns {boolean}
  */
-export function isAllowedInclude(file, context) {
+export function isAllowedInclude(file, context, reader) {
   const roots = [context.routesRoot, context.shelfRoot].map((root) => path.resolve(root));
-  return roots.some((root) => file === root || file.startsWith(`${root}${path.sep}`));
+  /** @param {string} target @param {string[]} within */
+  const contains = (target, within) =>
+    within.some((root) => target === root || target.startsWith(`${root}${path.sep}`));
+  if (!contains(path.resolve(file), roots)) return false;
+  if (!reader) return true;
+  // A root that does not exist (a project with no `site/_`) has no canonical
+  // form; keep it as written rather than failing the whole check.
+  /** @param {string} target */
+  const canonical = (target) => {
+    try {
+      return reader.realpath(target);
+    } catch {
+      return target;
+    }
+  };
+  return contains(canonical(path.resolve(file)), roots.map(canonical));
 }
 
 // ---------------------------------------------------------------------------
@@ -231,7 +269,9 @@ export function scanMarkdownHints(body, file, comp) {
       continue;
     }
     const hit = line.match(
-      /^(@include|@loop|@repeat|:state|:button|:if|:for|:try|:note|:sprint|:::)(\s|$)/
+      // `:note`/`:sprint` are gone from the `.wd` directive set, so naming them
+      // here would tell a `.md` author to rename a file to activate nothing.
+      /^(@include|@loop|@repeat|:state|:button|:if|:for|:try|:::)(\s|$)/
     );
     if (hit) {
       comp.warnings.push(

package/src/compiler/interpolation.js

@@ -22,7 +22,14 @@ export function lookupVar(scope, name) {
   /** @type {Scope | null} */
   let current = scope;
   for (; current; current = current.parent) {
-    if (name in current.vars) return { found: true, value: current.vars[name] };
+    // `Object.hasOwn`, never `in`: a scope frame is a plain object, so `in` also
+    // answers true for every Object.prototype member. With it, `{ toString }`
+    // resolved to the inherited function and rendered
+    // "function toString() { [native code] }" into the page, and
+    // `@include /p.wd with v={ constructor }` leaked the Object constructor into
+    // the value pipeline. Own keys only — the scope holds exactly what the
+    // author put there.
+    if (Object.hasOwn(current.vars, name)) return { found: true, value: current.vars[name] };
   }
   return { found: false };
 }
@@ -112,6 +119,26 @@ export function interpolateLeaf(value, expr, ctx) {
   return String(value);
 }
 
+/**
+ * Render the INITIAL value of a reactive binding (`data-wd-bind` /
+ * `data-wd-each`) as text.
+ *
+ * Identical to {@link interpolateLeaf} except for arrays: the runtime paints a
+ * bind by assigning to `textContent`, which coerces `["a", "b"]` with `String()`
+ * to `"a,b"`, and the loop row-template fill already agrees (it escapes through
+ * `String()` too). `interpolateLeaf`'s `", "` join is the STATIC contract — the
+ * documented `{ meta.tags }` behavior for a value nothing will ever repaint — so
+ * the two cannot share one rule. Painting the static form here made the first
+ * reactive render silently rewrite `"a, b"` to `"a,b"`.
+ * @param {unknown} value
+ * @param {string} expr
+ * @param {Ctx} ctx
+ * @returns {string}
+ */
+export function interpolateBound(value, expr, ctx) {
+  return Array.isArray(value) ? String(value) : interpolateLeaf(value, expr, ctx);
+}
+
 // ---------------------------------------------------------------------------
 // Literals
 // ---------------------------------------------------------------------------
@@ -201,6 +228,34 @@ export function humanizeName(name) {
   return words ? words.charAt(0).toUpperCase() + words.slice(1) : name;
 }
 
+// ---------------------------------------------------------------------------
+// A BOUND href/src CARRIES A VALUE THE COMPILER NEVER SEES.
+//
+// `validateFetchUrl` and markdown-it's `validateLink` both vet a URL the AUTHOR
+// wrote. A reactive attribute binding (`[go]({ url })`) is different: the
+// compiler only sees the seed, and every later value arrives at runtime from
+// state, a form field, or a fetched payload. So the scheme check has to run
+// where the value lands, and it has to run in BOTH places — here for the
+// build-time paint, and again in `src/runtime.js` for every repaint.
+//
+// Control characters are stripped before the test because browsers strip tab,
+// newline and carriage return out of a URL attribute before resolving it, so
+// `java\tscript:alert(1)` is a live `javascript:` URL to the browser and must be
+// one to this guard too. Whitespace is stripped along with them, which only
+// makes the test stricter. `tests/attr-binding.test.js` runs the same table
+// through the compiler and the runtime so the two cannot drift.
+// ---------------------------------------------------------------------------
+
+/**
+ * True for a value that must never be applied to a bound `href`/`src`.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function unsafeUrlValue(value) {
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional — browsers strip these out of a URL, so the guard must too.
+  return /^(javascript|data|vbscript):/i.test(String(value).replace(/[\u0000-\u0020\u007F]+/g, ""));
+}
+
 /**
  * Escape a value for safe inclusion in HTML text and attribute contexts.
  * @param {unknown} value