Run-time paths: unsafeHref

navigate, <A to>, href and redirect() take registered page patterns. A path that a check has already validated at run time (a redirect_url read from the request, a return path stored by the app) is passed through unsafeHref:

import { unsafeHref } from "@shadow-js/router";

const back = unsafeHref(safeReturnTo(searchParams.get("redirect_url")));
navigate(back);

unsafeHref returns a branded RuntimeHref. In development it throws a TypeError for anything that is not a same-origin path: another origin (https://evil.example), a script URL, or a protocol-relative //host. Production returns the path unchecked, so the validation belongs where the input arrives. Do not use it for user input that has not been validated; use the registered routes for everything else.