@nexub/react 7.1.0 → 7.3.0

package/dist/utils/safeHref.d.ts

@@ -0,0 +1,12 @@
+export interface SafeHrefOptions {
+    /**
+     * `false` (7.x default): block script-capable schemes (`javascript:`,
+     * `vbscript:`, `data:`, `file:`), allow everything else.
+     * `true` (8.0 default): allow only relative URLs, `#…`, http(s), mailto, tel and sms.
+     */
+    strict?: boolean;
+}
+/** A link target that can't run script. Returns `undefined` when blocked. */
+export declare function safeHref(url: string | null | undefined, { strict }?: SafeHrefOptions): string | undefined;
+/** An image source: relative, http(s), blob: or a data:image/* URL. */
+export declare function safeSrc(url: string | null | undefined): string | undefined;

package/dist/utils/safeHref.js

@@ -0,0 +1,24 @@
+const SCHEME = /^([a-z][a-z0-9+.-]*):/i;
+const DANGEROUS = /* @__PURE__ */ new Set(["javascript", "vbscript", "data", "file"]);
+const STRICT_HREF = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel", "sms"]);
+function scheme(url) {
+  const probe = url.replace(/[\u0000- \u007f]+/g, "");
+  return SCHEME.exec(probe)?.[1]?.toLowerCase() ?? null;
+}
+function safeHref(url, { strict = false } = {}) {
+  if (!url) return void 0;
+  const s = scheme(url);
+  if (s === null) return url;
+  if (strict) return STRICT_HREF.has(s) ? url : void 0;
+  return DANGEROUS.has(s) ? void 0 : url;
+}
+function safeSrc(url) {
+  if (!url) return void 0;
+  const s = scheme(url);
+  if (s === null || s === "http" || s === "https" || s === "blob") return url;
+  return s === "data" && /^data:image\//i.test(url.trim()) ? url : void 0;
+}
+export {
+  safeHref,
+  safeSrc
+};

package/dist/utils/viewTransition.d.ts

@@ -1,5 +1,7 @@
 /**
  * Run a DOM update as a view transition (styles: @nexub/themes/view-transitions).
- * Where the API is missing, or on the server, the update just runs.
+ * React state set inside `update` is flushed synchronously, so the browser
+ * snapshots the new DOM rather than the stale one. Resolves when the transition
+ * has finished (or right after the update where the API is missing / on the server).
  */
-export declare function startViewTransition(update: () => void | Promise<void>): void;
+export declare function startViewTransition(update: () => void | Promise<void>): Promise<void>;

package/dist/utils/viewTransition.js

@@ -1,7 +1,15 @@
+import { flushSync } from "react-dom";
 function startViewTransition(update) {
+  const run = () => {
+    let result = void 0;
+    flushSync(() => {
+      result = update();
+    });
+    return result;
+  };
   const doc = typeof document === "undefined" ? void 0 : document;
-  if (doc?.startViewTransition) doc.startViewTransition(update);
-  else void update();
+  if (doc?.startViewTransition) return doc.startViewTransition(run).finished;
+  return Promise.resolve(run());
 }
 export {
   startViewTransition

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexub/react",
-  "version": "7.1.0",
+  "version": "7.3.0",
   "description": "React component library for Nexub Design System — 90+ accessible, themeable UI components built on Radix UI primitives.",
   "type": "module",
   "license": "MIT",
@@ -39,6 +39,10 @@
       "types": "./dist/utils/cn.d.ts",
       "default": "./dist/utils/cn.js"
     },
+    "./safeHref": {
+      "types": "./dist/utils/safeHref.d.ts",
+      "default": "./dist/utils/safeHref.js"
+    },
     "./*": {
       "types": "./dist/components/*/index.d.ts",
       "default": "./dist/components/*/index.js"
@@ -79,16 +83,17 @@
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "date-fns": "^4.4.0",
+    "get-nonce": "^1.0.1",
     "react-day-picker": "^10.0.2",
     "tailwind-merge": "^3.7.0",
-    "@nexub/core": "7.1.0",
-    "@nexub/icons": "7.1.0"
+    "@nexub/core": "7.3.0",
+    "@nexub/icons": "7.3.0"
   },
   "peerDependencies": {
     "react": ">=19 <20",
     "react-dom": ">=19 <20",
     "@tanstack/react-virtual": "^3.14.22",
-    "@nexub/tokens": "^7.1.0"
+    "@nexub/tokens": "^7.3.0"
   },
   "peerDependenciesMeta": {
     "@tanstack/react-virtual": {
@@ -120,8 +125,8 @@
     "vaul": "1.1.2",
     "vite": "^8.3.5",
     "vitest": "^5.0.5",
-    "@nexub/themes": "7.1.0",
-    "@nexub/tokens": "7.1.0"
+    "@nexub/themes": "7.3.0",
+    "@nexub/tokens": "7.3.0"
   },
   "scripts": {
     "build": "rm -rf dist && tsup && tsc -p tsconfig.build.json && rm -f dist/vendor/*.d.ts && node scripts/check-dts.mjs && tailwindcss -i src/styles.css -o dist/styles.css --minify && cp -R ../themes/src/fonts dist/fonts",