@barefootjs/erb 0.18.4 → 0.18.5

package/dist/index.js

@@ -187371,7 +187371,7 @@ function isExplicitStringCall(expr) {
 }
 
 // src/adapter/erb-adapter.ts
-import { BF_SLOT, BF_COND, BF_REGION } from "@barefootjs/shared";
+import { BF_SLOT, BF_COND, BF_REGION, escapeHtml } from "@barefootjs/shared";
 
 // src/adapter/lib/constants.ts
 var ERB_TEMPLATE_PRIMITIVES = {
@@ -187380,7 +187380,10 @@ var ERB_TEMPLATE_PRIMITIVES = {
   Number: { arity: 1, emit: (args) => `bf.number(${args[0]})` },
   "Math.floor": { arity: 1, emit: (args) => `bf.floor(${args[0]})` },
   "Math.ceil": { arity: 1, emit: (args) => `bf.ceil(${args[0]})` },
-  "Math.round": { arity: 1, emit: (args) => `bf.round(${args[0]})` }
+  "Math.round": { arity: 1, emit: (args) => `bf.round(${args[0]})` },
+  "Math.min": { arity: 2, emit: (args) => `bf.min(${args[0]}, ${args[1]})` },
+  "Math.max": { arity: 2, emit: (args) => `bf.max(${args[0]}, ${args[1]})` },
+  "Math.abs": { arity: 1, emit: (args) => `bf.abs(${args[0]})` }
 };
 var ERB_PRIMITIVE_EMIT_MAP = Object.fromEntries(Object.entries(ERB_TEMPLATE_PRIMITIVES).map(([k, v]) => [k, v.emit]));
 
@@ -187548,6 +187551,12 @@ function renderArrayMethod(method, object, args, emit) {
       const recv = emit(object);
       return `bf.trim(${recv})`;
     }
+    case "trimStart":
+    case "trimEnd": {
+      const fn = method === "trimStart" ? "trim_start" : "trim_end";
+      const recv = emit(object);
+      return `bf.${fn}(${recv})`;
+    }
     case "toFixed": {
       const recv = emit(object);
       const digits = args.length >= 1 ? emit(args[0]) : "0";
@@ -187581,6 +187590,12 @@ function renderArrayMethod(method, object, args, emit) {
       const newS = emit(args[1]);
       return `bf.replace(${recv}, ${oldS}, ${newS})`;
     }
+    case "replaceAll": {
+      const recv = emit(object);
+      const oldS = emit(args[0]);
+      const newS = emit(args[1]);
+      return `bf.replace_all(${recv}, ${oldS}, ${newS})`;
+    }
     case "repeat": {
       const recv = emit(object);
       const count = args.length === 0 ? "0" : emit(args[0]);
@@ -187749,9 +187764,11 @@ class ErbFilterEmitter {
       return "nil";
     return String(value);
   }
-  member(object, property, _computed, emit) {
+  member(object, property, _computed, optional, emit) {
     if (property === "length")
       return `${emit(object)}.length`;
+    if (optional)
+      return `${emit(object)}&.[](${rubySymbolLiteral(property)})`;
     return `${emit(object)}[${rubySymbolLiteral(property)}]`;
   }
   indexAccess(object, index, emit) {
@@ -187873,7 +187890,7 @@ class ErbTopLevelEmitter {
       return "nil";
     return String(value);
   }
-  member(object, property, _computed, emit) {
+  member(object, property, _computed, optional, emit) {
     if (object.kind === "identifier" && object.name === "props") {
       return `v[${rubySymbolLiteral(property)}]`;
     }
@@ -187885,6 +187902,8 @@ class ErbTopLevelEmitter {
     const obj = emit(object);
     if (property === "length")
       return `${obj}.length`;
+    if (optional)
+      return `${obj}&.[](${rubySymbolLiteral(property)})`;
     return `${obj}[${rubySymbolLiteral(property)}]`;
   }
   indexAccess(object, index, emit) {
@@ -188316,6 +188335,7 @@ class ErbAdapter extends BaseAdapter {
   options;
   errors = [];
   inLoop = false;
+  currentLoopKeyDepth = 0;
   propsObjectName = null;
   propsParams = [];
   booleanTypedProps = new Set;
@@ -188456,7 +188476,7 @@ class ErbAdapter extends BaseAdapter {
     return this.renderElement(node);
   }
   emitText(node) {
-    return node.value;
+    return escapeHtml(node.value);
   }
   emitExpression(node) {
     return this.renderExpression(node);
@@ -188697,13 +188717,16 @@ ${whenTrue}
     }
     const param = loop.param;
     const indexVar = loop.iterationShape === "keys" ? rubyLocal(param) : rubyLocal(loop.index ?? "_i");
-    const loopBound = loop.iterationShape === "keys" ? [param] : supportableDestructure ? ["__bf_item", ...(loop.paramBindings ?? []).map((b) => b.name), loop.index ?? "_i"] : [param, loop.index ?? "_i"];
+    const loopBound = loop.objectIteration === "entries" ? [param, loop.index ?? "_k"] : loop.objectIteration === "keys" || loop.objectIteration === "values" || loop.iterationShape === "keys" ? [param] : supportableDestructure ? ["__bf_item", ...(loop.paramBindings ?? []).map((b) => b.name), loop.index ?? "_i"] : [param, loop.index ?? "_i"];
     for (const n of loopBound) {
       this.loopBoundNames.set(n, (this.loopBoundNames.get(n) ?? 0) + 1);
     }
     const prevInLoop = this.inLoop;
     this.inLoop = true;
+    const prevLoopKeyDepth = this.currentLoopKeyDepth;
+    this.currentLoopKeyDepth = loop.depth;
     const renderedChildren = this.renderChildren(loop.children);
+    this.currentLoopKeyDepth = prevLoopKeyDepth;
     this.inLoop = prevInLoop;
     const children = loop.bodyIsItemConditional && loop.key ? `<%= bf.comment("loop-i:" + bf.string(${this.convertExpressionToRuby(loop.key)})) %>
 ${renderedChildren}` : renderedChildren;
@@ -188737,23 +188760,29 @@ ${renderedChildren}` : renderedChildren;
       }
       lines.push(`<%- ${sortedHoist} = ${sorted} -%>`);
     }
-    lines.push(`<%- (0...${array}.length).each do |${indexVar}| -%>`);
-    if (loop.iterationShape !== "keys") {
-      if (supportableDestructure) {
-        lines.push(`<%- __bf_item = ${array}[${indexVar}] -%>`);
-        for (const b of loop.paramBindings ?? []) {
-          const accessor = rubyAccessorFromSegments("__bf_item", b.segments ?? []);
-          if (b.rest?.kind === "array") {
-            lines.push(`<%- ${rubyLocal(b.name)} = bf.slice(${accessor}, ${b.rest.from}) -%>`);
-          } else if (b.rest?.kind === "object") {
-            const excludeSyms = b.rest.exclude.map((k) => rubySymbolLiteral(k.key)).join(", ");
-            lines.push(`<%- ${rubyLocal(b.name)} = ${accessor}.except(${excludeSyms}) -%>`);
-          } else {
-            lines.push(`<%- ${rubyLocal(b.name)} = ${accessor} -%>`);
+    if (loop.objectIteration) {
+      const method = loop.objectIteration === "entries" ? "each_pair" : loop.objectIteration === "keys" ? "each_key" : "each_value";
+      const blockParams = loop.objectIteration === "entries" ? `${rubyLocal(loop.index ?? param)}, ${rubyLocal(param)}` : rubyLocal(param);
+      lines.push(`<%- ${array}.${method} do |${blockParams}| -%>`);
+    } else {
+      lines.push(`<%- (0...${array}.length).each do |${indexVar}| -%>`);
+      if (loop.iterationShape !== "keys") {
+        if (supportableDestructure) {
+          lines.push(`<%- __bf_item = ${array}[${indexVar}] -%>`);
+          for (const b of loop.paramBindings ?? []) {
+            const accessor = rubyAccessorFromSegments("__bf_item", b.segments ?? []);
+            if (b.rest?.kind === "array") {
+              lines.push(`<%- ${rubyLocal(b.name)} = bf.slice(${accessor}, ${b.rest.from}) -%>`);
+            } else if (b.rest?.kind === "object") {
+              const excludeSyms = b.rest.exclude.map((k) => rubySymbolLiteral(k.key)).join(", ");
+              lines.push(`<%- ${rubyLocal(b.name)} = ${accessor}.except(${excludeSyms}) -%>`);
+            } else {
+              lines.push(`<%- ${rubyLocal(b.name)} = ${accessor} -%>`);
+            }
           }
+        } else {
+          lines.push(`<%- ${rubyLocal(param)} = ${array}[${indexVar}] -%>`);
         }
-      } else {
-        lines.push(`<%- ${rubyLocal(param)} = ${array}[${indexVar}] -%>`);
       }
     }
     if (loop.filterPredicate) {
@@ -188805,9 +188834,23 @@ ${renderedChildren}` : renderedChildren;
   };
   renderComponent(comp) {
     const propParts = [];
+    const namedSlotCaptures = [];
     for (const p of comp.props) {
       if ((p.name.match(/^on[A-Z]/) || p.name === "ref") && p.value.kind === "expression")
         continue;
+      if (p.value.kind === "jsx-children" && p.name !== "children") {
+        const prevInLoop = this.inLoop;
+        this.inLoop = false;
+        const slotBody = this.renderChildren(p.value.children);
+        this.inLoop = prevInLoop;
+        const suffix = `${this.childrenCaptureCounter++}`;
+        const lenVar = `__bf_len_${suffix}`;
+        const rawVar = `__bf_praw_${suffix}`;
+        const capVar = `__bf_prop_${suffix}`;
+        namedSlotCaptures.push(`<% ${lenVar} = _erbout.length %>${slotBody}<% ${rawVar} = _erbout.slice!(${lenVar}..); ${capVar} = bf.backend.mark_raw(${rawVar}) %>`);
+        propParts.push(`${rubySymbolKey(p.name)} ${capVar}`);
+        continue;
+      }
       const lowered = emitAttrValue(p.value, this.componentPropEmitter, p.name);
       if (lowered)
         propParts.push(lowered);
@@ -188826,10 +188869,10 @@ ${renderedChildren}` : renderedChildren;
       const lenVar = `__bf_len_${suffix}`;
       const capVar = `__bf_children_${suffix}`;
       const propsHash2 = `{ ${[...propParts, `children: ${capVar}`].join(", ")} }`;
-      return `<% ${lenVar} = _erbout.length %>${childrenBody}<% ${capVar} = _erbout.slice!(${lenVar}..) %><%= bf.render_child('${tplName}', ${propsHash2}) %>`;
+      return `${namedSlotCaptures.join("")}<% ${lenVar} = _erbout.length %>${childrenBody}<% ${capVar} = _erbout.slice!(${lenVar}..) %><%= bf.render_child('${tplName}', ${propsHash2}) %>`;
     }
     const propsHash = propParts.length > 0 ? `{ ${propParts.join(", ")} }` : "{}";
-    return `<%= bf.render_child('${tplName}', ${propsHash}) %>`;
+    return `${namedSlotCaptures.join("")}<%= bf.render_child('${tplName}', ${propsHash}) %>`;
   }
   childrenCaptureCounter = 0;
   toTemplateName(componentName) {
@@ -188874,7 +188917,7 @@ ${alternate}
 ${children}`;
   }
   elementAttrEmitter = {
-    emitLiteral: (value, name) => `${name}="${value.value}"`,
+    emitLiteral: (value, name) => `${name}="${escapeHtml(value.value)}"`,
     emitExpression: (value, name) => {
       if (name === "style") {
         const css = this.tryLowerStyleObject(value.expr);
@@ -188969,9 +189012,10 @@ ${children}`;
       let attrName;
       if (attr.name === "className")
         attrName = "class";
-      else if (attr.name === "key")
-        attrName = "data-key";
-      else
+      else if (attr.name === "key") {
+        const depth = this.currentLoopKeyDepth;
+        attrName = depth > 0 ? `data-key-${depth}` : "data-key";
+      } else
         attrName = attr.name;
       const lowered = emitAttrValue(attr.value, this.elementAttrEmitter, attrName);
       if (lowered)
@@ -189164,21 +189208,10 @@ var conformancePins = {
     { code: "BF101", severity: "error", issue: "https://github.com/piconic-ai/barefootjs/issues/2038" }
   ],
   "array-map-function-reference": [{ code: "BF101", severity: "error" }],
-  "dangerous-inner-html": [{ code: "BF101", severity: "error" }],
-  "string-replaceall": [{ code: "BF101", severity: "error" }]
+  "dangerous-inner-html": [{ code: "BF101", severity: "error" }]
 };
 // src/render-divergences.ts
-var renderDivergences = {
-  "html-entity-text": "`&copy;` in JSX literal text: Hono decodes to `©`, this adapter re-emits the raw entity — same DOM, different bytes",
-  "optional-chaining-prop": "`user?.name ?? …` on an object prop: the Ruby render exits 1 (optional chaining into a Hash prop has no lowering)",
-  "math-methods": "Math.min/max/abs over a signal render empty (only Math.floor is in the template-primitive registry)",
-  "static-attr-escape": 'static attribute values are not HTML-escaped (`title="Fish & Chips"` emitted raw; Hono escapes)',
-  "object-entries-map": "`Object.entries(prop).map(([k, v]) => …)` renders but its loop item keys diverge from the reference serialisation",
-  "nested-loop-outer-binding": "nested-loop inner items carry `data-key` where the reference emits the depth-suffixed `data-key-1`",
-  "jsx-element-prop": "a JSX element passed as a NON-children prop renders an empty slot — the element value is silently dropped",
-  "string-slice": '`.slice()` on a STRING lowers through the array slice helper and renders "[]" instead of the substring',
-  "string-trim-sided": "`.trimStart()` / `.trimEnd()` render empty (no lowering; only both-sides `.trim` is wired)"
-};
+var renderDivergences = {};
 export {
   renderDivergences,
   erbAdapter,

package/dist/render-divergences.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-divergences.d.ts","sourceRoot":"","sources":["../src/render-divergences.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAExD,eAAO,MAAM,iBAAiB,EAAE,iBAmB/B,CAAA"}
+{"version":3,"file":"render-divergences.d.ts","sourceRoot":"","sources":["../src/render-divergences.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAExD,eAAO,MAAM,iBAAiB,EAAE,iBAAsB,CAAA"}

package/lib/barefoot_js/backend/erb.rb

@@ -13,15 +13,25 @@ module BarefootJS
     # operations the runtime delegates to, targeting Ruby stdlib ERB:
     #
     #   encode_json(data)            -> JSON string (injectable encoder)
-    #   mark_raw(str)                -> identity (ERB has no "safe string"
-    #                                    wrapper type -- ERB's own `<%=` is
-    #                                    NOT auto-escaping, so the compiled
-    #                                    templates that need escaping call
-    #                                    `bf.h(...)` explicitly; `mark_raw`
-    #                                    only exists so runtime helpers that
-    #                                    already produce finished HTML --
-    #                                    e.g. spread_attrs -- share one
-    #                                    interface with the Kolon/EP ports)
+    #   mark_raw(str)                -> wraps in BarefootJS::SafeString --
+    #                                    ERB's own `<%=` is NOT auto-escaping,
+    #                                    so most compiled templates call
+    #                                    `bf.h(...)` explicitly instead of
+    #                                    relying on a safe-string bypass; the
+    #                                    wrapper exists for the one path that
+    #                                    DOES need one -- a named-slot /
+    #                                    children value captured in a parent
+    #                                    template and forwarded into a
+    #                                    child's vars Hash, where the child
+    #                                    reads it back through the generic
+    #                                    `bf.h(...)` text-expression path
+    #                                    (`Context#h` unwraps SafeString to
+    #                                    skip re-escaping) -- and so that
+    #                                    runtime helpers which already
+    #                                    produce finished HTML (e.g.
+    #                                    spread_attrs) share one
+    #                                    `backend.mark_raw(...)` interface
+    #                                    with the Kolon/EP ports
     #   materialize(value)           -> resolve a captured-children value
     #                                    to a string
     #   render_named(name, bf, vars) -> render `<name>.erb` with `bf` and
@@ -58,13 +68,12 @@ module BarefootJS
         @json_encoder.call(data)
       end
 
-      # ERB has no "already-safe" string wrapper the way Kolon's `mark_raw`
-      # or Mojo::ByteStream do -- stdlib ERB's `<%=` never auto-escapes, so
-      # there is nothing to opt out of. Identity, kept only so runtime
-      # helpers (`spread_attrs`) share one `backend.mark_raw(...)` call
-      # shape across every BarefootJS backend port.
+      # See the class docstring's `mark_raw` entry: wraps in
+      # `BarefootJS::SafeString` so `Context#h` recognises and skips
+      # re-escaping already-finished HTML forwarded across a
+      # parent/child template boundary.
       def mark_raw(str)
-        str
+        BarefootJS::SafeString.new(str.to_s)
       end
 
       # JSX children captured by the adapter's buffer-slice capture

package/lib/barefoot_js/evaluator.rb

@@ -188,7 +188,20 @@ module BarefootJS
       return Float::INFINITY if t == 'Infinity' || t == '+Infinity'
       return -Float::INFINITY if t == '-Infinity'
       return Integer(t, 16) if t =~ HEX_STRING_RE
-      return Float(t) if t =~ NUMERIC_STRING_RE
+
+      if t =~ NUMERIC_STRING_RE
+        # Ruby's Float() rejects a trailing decimal point ("5.", "5.e3"),
+        # while JS's Number() accepts it (treating the fractional part as
+        # empty). Strip a "." that isn't followed by a digit before
+        # converting, so the accepted grammar stays identical to JS but the
+        # conversion itself never raises.
+        normalized = t.sub(/\.(?=\z|[eE])/, '')
+        begin
+          return Float(normalized)
+        rescue ArgumentError, TypeError
+          return Float::NAN
+        end
+      end
 
       Float::NAN
     end

package/lib/barefoot_js.rb

@@ -25,6 +25,18 @@ require 'barefoot_js/search_params'
 # runtime carries -- a Ruby `true`/`false` IS a boolean, distinguishable
 # from `0`/`1` for free.
 module BarefootJS
+  # Marker wrapper for a string that is ALREADY finished HTML and must not
+  # be re-escaped by `Context#h` -- e.g. a named-slot / children capture
+  # (`renderComponent`'s output-buffer slice) forwarded from a parent
+  # template into a child's vars Hash. Stdlib ERB's `<%=` has no built-in
+  # "safe string" concept the way Twig's `Markup` or Kolon's `mark_raw`
+  # do, so the escape decision that elsewhere falls out of the template
+  # engine has to be carried on the VALUE itself here; see
+  # `Backend::Erb#mark_raw`, which is what actually wraps a string in this
+  # class.
+  class SafeString < String
+  end
+
   # Context is the `bf` object every compiled `.erb` template receives as a
   # local. One instance per render (root or child); `render_child` /
   # `register_components_from_manifest` construct a fresh child instance
@@ -391,8 +403,13 @@ module BarefootJS
     # HTML-escaping helper for text interpolation (`<%= bf.h(expr) %>` --
     # stdlib ERB does not auto-escape). JS-style stringification via
     # `string` (numbers per JS Number#toString, nil -> "", booleans ->
-    # "true"/"false"), then HTML-escaped.
+    # "true"/"false"), then HTML-escaped. A `SafeString` (already-finished
+    # HTML forwarded from a parent's capture -- see that class's docstring)
+    # passes through unescaped, matching Twig/Blade/Kolon's safe-string
+    # bypass on their own auto-escaping `{{ }}`/`<: :>` output tags.
     def h(value)
+      return value if value.is_a?(SafeString)
+
       html_escape(string(value))
     end
 
@@ -430,6 +447,34 @@ module BarefootJS
       finite_number?(n) ? (n + 0.5).floor : n
     end
 
+    # `Math.min(a, b)` / `Math.max(a, b)` -- two-arg forms only (#2168
+    # math-methods). JS returns NaN if either operand is NaN. `number()`
+    # may return a plain Integer (no `#nan?`), so guard like
+    # `finite_number?` above rather than calling `#nan?` unconditionally.
+    def min(a, b)
+      x = number(a)
+      y = number(b)
+      return x if nan_number?(x)
+      return y if nan_number?(y)
+
+      x < y ? x : y
+    end
+
+    def max(a, b)
+      x = number(a)
+      y = number(b)
+      return x if nan_number?(x)
+      return y if nan_number?(y)
+
+      x > y ? x : y
+    end
+
+    # `Math.abs()` (#2168 math-methods).
+    def abs(value)
+      n = number(value)
+      nan_number?(n) ? n : n.abs
+    end
+
     # -----------------------------------------------------------------
     # Array / String method helpers
     # -----------------------------------------------------------------
@@ -563,13 +608,22 @@ module BarefootJS
       out
     end
 
-    # `Array.prototype.slice(start, end?)`. Mirrors the Go/Perl `bf_slice` /
-    # `slice` arithmetic so adapter output stays symmetric.
+    # `Array.prototype.slice(start, end?)` AND `String.prototype.slice`
+    # (the `string-slice` divergence) -- the adapter emits the same
+    # `bf_slice` call for both receiver shapes (it can't disambiguate
+    # string vs. array at compile time), so this dispatches on Ruby
+    # class, mirroring `includes` above. Mirrors the Go/Perl `bf_slice`
+    # / `slice` arithmetic so adapter output stays symmetric.
+    # `String#length` / `#[]` already index by character (not byte) for
+    # a UTF-8-encoded string, matching JS except for astral-plane input
+    # (the same divergence boundary every other adapter's pad/trim
+    # helpers already accept).
     def slice(recv, start, end_ = nil)
-      return [] unless recv.is_a?(Array)
+      return [] unless recv.is_a?(Array) || recv.is_a?(String)
 
+      empty = recv.is_a?(String) ? '' : []
       len = recv.length
-      return [] if len.zero?
+      return empty if len.zero?
 
       s = start.nil? ? 0 : start.to_i
       s = len + s if s.negative?
@@ -581,7 +635,7 @@ module BarefootJS
       e = 0 if e.negative?
       e = len if e > len
 
-      return [] if s >= e
+      return empty if s >= e
 
       recv[s...e]
     end
@@ -663,6 +717,21 @@ module BarefootJS
       string(recv).gsub(/\A\p{Space}+|\p{Space}+\z/, '')
     end
 
+    # `String.prototype.trimStart()` / `.trimEnd()` -- the one-sided
+    # siblings of `trim` above (#2183 follow-up), same `\p{Space}` regex
+    # restricted to one side.
+    def trim_start(recv)
+      return '' if recv.nil? || recv.is_a?(Array) || recv.is_a?(Hash)
+
+      string(recv).sub(/\A\p{Space}+/, '')
+    end
+
+    def trim_end(recv)
+      return '' if recv.nil? || recv.is_a?(Array) || recv.is_a?(Hash)
+
+      string(recv).sub(/\p{Space}+\z/, '')
+    end
+
     # `Number.prototype.toFixed(digits)` -- fixed-decimal string with
     # zero-padding, rounding half toward +Infinity (matching `round`).
     def to_fixed(value, digits = 0)
@@ -741,6 +810,38 @@ module BarefootJS
       s[0...idx] + n + s[(idx + o.length)..]
     end
 
+    # `String.prototype.replaceAll(pattern, replacement)` -- string-pattern
+    # form only (#2182), replacing EVERY occurrence (the all-occurrences
+    # sibling of `replace` above). Deliberately NOT `String#gsub`: Ruby's
+    # `gsub` interprets `\1` / `\&` backreference syntax in the replacement
+    # even for a literal string pattern (`"abc".gsub("b", "\\1")` -> "ac",
+    # not the literal "\1"), which would diverge from `.replace`'s literal
+    # splice above and from the other backends' literal treatment. The
+    # index/splice loop keeps the replacement literal, matching `replace`.
+    # An empty pattern inserts at every boundary, including before the
+    # first and after the last character (`"abc".replaceAll("", "X")` ->
+    # "XaXbXcX"), matching JS.
+    def replace_all(recv, pattern, replacement)
+      s = recv.nil? ? '' : string(recv)
+      o = pattern.nil? ? '' : string(pattern)
+      n = replacement.nil? ? '' : string(replacement)
+      return ([''] + s.chars + ['']).join(n) if o.empty?
+
+      # `+''` (not the frozen `''` literal under frozen_string_literal)
+      # so `<<` can append in place instead of `+=` reallocating a new
+      # string each iteration (quadratic for long inputs / many matches).
+      out = +''
+      pos = 0
+      loop do
+        idx = s.index(o, pos)
+        break if idx.nil?
+
+        out << s[pos...idx] << n
+        pos = idx + o.length
+      end
+      out << s[pos..]
+    end
+
     # `queryHref(base, { ... })` (#2042) -- build "base?k=v&..." from a flat
     # list of (guard, key, value) triples. A pair is included iff its guard
     # is truthy AND its value is a non-empty string. A value may instead be
@@ -978,6 +1079,10 @@ module BarefootJS
       !(n.respond_to?(:nan?) && n.nan?) && !(n.respond_to?(:infinite?) && n.infinite?)
     end
 
+    def nan_number?(n)
+      n.respond_to?(:nan?) && n.nan?
+    end
+
     def html_escape(s)
       s.gsub('&', '&amp;').gsub('<', '&lt;').gsub('>', '&gt;').gsub('"', '&#34;').gsub("'", '&#39;')
     end

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barefootjs/erb",
-  "version": "0.18.4",
+  "version": "0.18.5",
   "description": "ERB (Embedded Ruby) adapter for BarefootJS — compiles IR to .erb templates and ships the Ruby rendering backend; runs under any Rack app (Sinatra, Rails)",
   "type": "module",
   "main": "./dist/index.js",
@@ -54,14 +54,14 @@
     "directory": "packages/adapter-erb"
   },
   "dependencies": {
-    "@barefootjs/shared": "0.18.4"
+    "@barefootjs/shared": "0.18.5"
   },
   "peerDependencies": {
     "@barefootjs/jsx": ">=0.2.0"
   },
   "devDependencies": {
     "@barefootjs/adapter-tests": "0.1.0",
-    "@barefootjs/jsx": "0.18.4",
+    "@barefootjs/jsx": "0.18.5",
     "typescript": "^5.0.0"
   }
 }

package/src/__tests__/erb-adapter.test.ts

@@ -304,3 +304,24 @@ export { Slot }
     expect(template).toMatch(/\*\*v\[:rest\]/)
   })
 })
+
+describe('ErbAdapter - named-slot capture identifier safety (#2168 jsx-element-prop)', () => {
+  // A JSX-valued prop under a hyphenated name (`data-slot`, a valid JSX
+  // attribute name) must not leak into the buffer-slice capture's local
+  // variables — Ruby local variable names can't contain `-`. The capture
+  // suffix is purely counter-based (never derived from the prop name); the
+  // hash KEY passed to `render_child` still carries the real name, quoted
+  // via `rubySymbolKey`.
+  test('a hyphenated prop name does not appear in the capture variables', () => {
+    const { template } = compileAndGenerate(`
+function Card(props) { return null }
+export function Parent() {
+  return <Card data-slot={<strong>Title</strong>}>text</Card>
+}
+`)
+    expect(template).toContain('__bf_len_0 = _erbout.length')
+    expect(template).toContain('__bf_prop_0 = bf.backend.mark_raw(__bf_praw_0)')
+    expect(template).toContain('"data-slot": __bf_prop_0')
+    expect(template).not.toContain('bf_prop_data')
+  })
+})