ruact 0.0.13 → 0.0.15

data/lib/ruact/controller/format_negotiation.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Ruact
+  module Controller
+    # Story 17-0j — a router request answers as `format.html`.
+    #
+    # The ruact router asks for a page with `Accept: text/x-component`, which is
+    # not a Rails MIME type: the request negotiated no format at all, and every
+    # `respond_to` raised `ActionController::UnknownFormat` (406) on a
+    # navigation or a form submit. That is the controller Rails' own scaffold
+    # writes. A router request asks for the PAGE, the same thing a browser's
+    # `text/html` asks for, so it now negotiates `:html` — unless the URL names
+    # a format (`/posts/1.json`), which wins as it always has. Whether the
+    # answer is Flight or an HTML document is still ruact's decision, read from
+    # the Accept header, not from the negotiated format.
+    module FormatNegotiation
+      extend ActiveSupport::Concern
+
+      # Rails' negotiated-formats slot on the request. Writing it directly,
+      # rather than `request.format =`, leaves `params[:format]` alone.
+      FORMATS_KEY = "action_dispatch.request.formats"
+
+      # `respond_to` with no `format.html` still answers 406 to a router
+      # request, as Rails does to a browser — with the reason and the fix. Only
+      # when THIS respond_to found no format: an UnknownFormat raised inside a
+      # branch (a nested respond_to, an explicit raise), or one for a format
+      # the URL named, keeps Rails' own message.
+      #
+      # @see ActionController::MimeResponds#respond_to
+      def respond_to(*mimes, &block)
+        collector = nil
+        recording = block && lambda { |given|
+          collector = given
+          yield(given)
+        }
+        super(*mimes, &recording)
+      rescue ActionController::UnknownFormat
+        raise unless __ruact_router_found_no_format?(collector, mimes)
+
+        raise ActionController::UnknownFormat,
+              "#{self.class.name}##{action_name} was asked for its page by the ruact router, which " \
+              "negotiates format.html, and its respond_to has no format.html branch. Add one, or " \
+              "link to this action with data-ruact=\"false\" so the browser loads it."
+      end
+
+      private
+
+      # Before every callback — a host's own `prepend_before_action` included —
+      # since this sits above AbstractController::Callbacks in the chain. An
+      # auth callback that answers with `respond_to` gets the format too.
+      def process_action(...)
+        __ruact_negotiate_router_request_as_html
+        super
+      end
+
+      def __ruact_negotiate_router_request_as_html
+        return unless ruact_request?
+        return if __ruact_url_format.present?
+
+        request.set_header(FORMATS_KEY, [Mime[:html]])
+      end
+
+      # The format the URL names (`/posts/1.json`, `?format=json`). Read from
+      # the path and query only: this runs before Rails' rescue and logging,
+      # where parsing a malformed request BODY must not raise.
+      def __ruact_url_format
+        request.path_parameters[:format] || request.query_parameters[:format]
+      rescue ActionController::BadRequest, ActionDispatch::Http::Parameters::ParseError
+        nil
+      end
+
+      def __ruact_router_found_no_format?(collector, mimes)
+        return false unless ruact_request? && __ruact_url_format.blank?
+
+        if collector
+          collector.format.nil?
+        else
+          request.negotiate_mime(mimes.map { |mime| Mime[mime] }).nil?
+        end
+      end
+    end
+  end
+end

data/lib/ruact/controller/page_rendering.rb

@@ -98,7 +98,7 @@ module Ruact
       # Whether Rails, left alone, would render `page` for `action`: the lookup
       # it does itself, with the formats it negotiated for this request (and a
       # render's own `formats:` / `variants:` / `handlers:` / `locale:`). A Flight request
-      # negotiates every format, HTML first — the page; a `.json` request or a
+      # negotiates HTML (Ruact::Controller::FormatNegotiation) — the page; a `.json` request or a
       # `format.json` branch negotiates JSON — the JSON template, or Rails' own
       # MissingTemplate.
       def __ruact_rails_would_render?(action, details, page)

data/lib/ruact/controller.rb

@@ -3,11 +3,13 @@
 require "json"
 require "socket"
 require "uri"
+require_relative "redirect_path"
 require_relative "view_helper"
 require_relative "validation_errors_collector"
 require_relative "controller/document_rendering"
 require_relative "controller/pages"
 require_relative "controller/page_rendering"
+require_relative "controller/format_negotiation"
 
 module Ruact
   # Include in the controllers whose pages render through ruact (island mode,
@@ -43,6 +45,9 @@ module Ruact
     # An explicit `render` of a ruact page goes through ruact (Story 17.0i).
     # See Ruact::Controller::PageRendering.
     include Ruact::Controller::PageRendering
+    # A router request negotiates `format.html`, so `respond_to` answers it
+    # (Story 17-0j). See Ruact::Controller::FormatNegotiation.
+    include Ruact::Controller::FormatNegotiation
 
     # Story 17.0f — "is this action a ruact PAGE?", answered at CLASS level so the
     # navigation boundary (Ruact::NavigationBoundary) can ask it before any action
@@ -266,6 +271,8 @@ module Ruact
         redirect_url  = uri.path.nil? || uri.path.empty? ? "/" : uri.path
         redirect_url += "?#{uri.query}"    if uri.query
         redirect_url += "##{uri.fragment}" if uri.fragment
+        # Same-origin `https://app//evil.com` must not shrink to `//evil.com`.
+        redirect_url = url if Ruact::RedirectPath.protocol_relative?(redirect_url)
       rescue ::URI::InvalidURIError
         return super
       end

data/lib/ruact/flight/js_date.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Ruact
+  module Flight
+    # The ISO 8601 form a JavaScript `Date` reads back (Story 17-0c).
+    module JsDate
+      # JavaScript parses years 0–9999 in the plain form and the others only in
+      # the expanded one (`+010000`, `-000001`); Ruby writes `10000` / `-0001`,
+      # which `new Date` turns into an Invalid Date.
+      #
+      # @param value [Time, DateTime]
+      # @return [String] ISO 8601 with milliseconds
+      def self.iso8601(value)
+        iso = value.iso8601(3)
+        year = value.year
+        return iso unless year.negative? || year > 9999
+
+        format("%<sign>s%<year>06d", sign: year.negative? ? "-" : "+", year: year.abs) + iso.sub(/\A-?\d+/, "")
+      end
+    end
+  end
+end

data/lib/ruact/flight/renderer.rb

@@ -56,12 +56,17 @@ module Ruact
             sleep(deferred[:delay])
           end
 
-          # Serialize deferred content — may produce new import rows
-          import_count_before = @request.completed_import_chunks.length
+          # Serialize deferred content — may produce new import rows, and new
+          # regular rows (a string of 1024+ bytes becomes a `T` row the deferred
+          # model row references as `$T<id>`).
+          import_count_before  = @request.completed_import_chunks.length
+          regular_count_before = @request.completed_regular_chunks.length
           deferred_value = serializer.serialize_model(deferred[:element])
 
-          # Yield any import rows discovered during deferred serialization
+          # Yield the rows discovered during deferred serialization BEFORE the
+          # row that references them.
           @request.completed_import_chunks[import_count_before..].each(&block)
+          @request.completed_regular_chunks[regular_count_before..].each(&block)
 
           yield RowEmitter.model(deferred[:id], JSON.generate(deferred_value))
         end

data/lib/ruact/flight/serializer.rb

@@ -33,6 +33,10 @@ module Ruact
           serialize_symbol(value)
         when Time, DateTime
           serialize_date(value)
+        when Date
+          # A calendar date has no instant to rebuild: it travels as
+          # "YYYY-MM-DD", in strict mode too (Story 17-0c review).
+          serialize_string(value.iso8601)
         when ClientReference
           serialize_client_reference(value)
         when SuspenseElement
@@ -53,6 +57,7 @@ module Ruact
       # --- Primitives ---
 
       def serialize_string(value)
+        value = Utf8.text(value)
         # Large strings get their own T row
         if value.bytesize >= LARGE_TEXT_THRESHOLD
           id = @request.allocate_id
@@ -89,12 +94,13 @@ module Ruact
         # Only :undefined is special for now
         return "$undefined" if value == :undefined
 
-        # Unknown symbols: just use the name as a string
-        value.to_s
+        # Any other symbol is its name — escaped like a string, so `:"$nope"`
+        # cannot pose as a "$n…" marker.
+        serialize_string(value.to_s)
       end
 
       def serialize_date(value)
-        "$D#{value.iso8601(3)}"
+        "$D#{JsDate.iso8601(value)}"
       end
 
       # --- Collections ---
@@ -104,7 +110,7 @@ module Ruact
       end
 
       def serialize_hash(value)
-        value.transform_keys(&:to_s).transform_values { |v| serialize_model(v) }
+        value.transform_keys { |key| Utf8.text(key.to_s) }.transform_values { |v| serialize_model(v) }
       end
 
       # --- React Element ---

data/lib/ruact/flight/utf8.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Ruact
+  module Flight
+    # Every string leaves the serializer as valid UTF-8. A `T` row is framed by
+    # its byte length, and JSON (a model row, the inline page payload) refuses
+    # invalid UTF-8: one record holding Latin-1 bytes made its page answer 500
+    # for every viewer.
+    module Utf8
+      REPLACEMENT = "\uFFFD"
+
+      # Binary-tagged text (`File.binread`, an HTTP body) is retagged; another
+      # encoding is transcoded; bytes that are not text in that encoding become
+      # U+FFFD, as a browser shows them.
+      #
+      # @param value [String]
+      # @return [String] valid UTF-8 (the same object when it already was)
+      def self.text(value)
+        return value if value.encoding == Encoding::UTF_8 && value.valid_encoding?
+
+        text =
+          begin
+            if [Encoding::BINARY, Encoding::UTF_8].include?(value.encoding)
+              value.dup.force_encoding(Encoding::UTF_8)
+            else
+              value.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: REPLACEMENT)
+            end
+          rescue Encoding::ConverterNotFoundError
+            # An encoding Ruby cannot convert from (UTF-7, say): its bytes.
+            value.dup.force_encoding(Encoding::UTF_8)
+          end
+        text.valid_encoding? ? text : text.scrub(REPLACEMENT)
+      end
+    end
+  end
+end

data/lib/ruact/flight.rb

@@ -3,6 +3,8 @@
 require_relative "flight/react_element"
 require_relative "flight/request"
 require_relative "flight/row_emitter"
+require_relative "flight/js_date"
+require_relative "flight/utf8"
 require_relative "flight/serializer"
 require_relative "flight/renderer"
 

data/lib/ruact/redirect_path.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Ruact
+  # Reducing a same-origin redirect URL to its path is what lets the client
+  # navigate in place. One path must not be produced that way: `//host` (or
+  # `/\host`), which a browser reads as a URL to ANOTHER host. Shared by the
+  # page redirect ({Ruact::Controller}) and the server-function `$redirect`
+  # ({Ruact::Server}); neither loads the other.
+  module RedirectPath
+    # @param path [String] a redirect target already reduced to a path
+    # @return [Boolean] whether a browser would read it as another host
+    def self.protocol_relative?(path)
+      path.match?(%r{\A[/\\]{2}})
+    end
+  end
+end

data/lib/ruact/routing.rb

@@ -24,9 +24,9 @@ module Ruact
   # The path segment reuses {Ruact::ServerFunctions::NameBridge} verbatim
   # (D4): `def search_users` → `GET /q/searchUsers`, named
   # `ruact_query_searchUsers`. Invalid or JS-reserved method names raise
-  # {Ruact::ConfigurationError} at route-draw time; two query classes mounting
-  # the same method name collide on the route NAME / path and fail Rails' own
-  # duplicate checks — both are loud boot failures, never request-time
+  # {Ruact::ConfigurationError} at route-draw time, and so do two query
+  # classes mounting the same method name (they would collide on the route
+  # name and on the export) — both are loud boot failures, never request-time
   # surprises.
   #
   # The generated dispatch controller PRESERVES the query class's namespace
@@ -56,11 +56,29 @@ module Ruact
 
         query_class.public_instance_methods(false).each do |query_method|
           js_identifier = ServerFunctions::NameBridge.to_js_identifier(query_method)
-          mapper.get("#{prefix}/#{js_identifier}",
-                     to: "#{target}##{query_method}",
-                     as: :"ruact_query_#{js_identifier}")
+          begin
+            mapper.get("#{prefix}/#{js_identifier}",
+                       to: "#{target}##{query_method}",
+                       as: :"ruact_query_#{js_identifier}")
+          rescue ArgumentError => e
+            raise unless e.message.include?("already in use")
+
+            raise_query_name_taken!(query_class, query_method, "#{prefix}/#{js_identifier}")
+          end
         end
       end
+
+      # Rails' own message ("Invalid route name, already in use") names a route
+      # the app never wrote. Name the query, the method and the way out.
+      def raise_query_name_taken!(query_class, query_method, path)
+        raise Ruact::ConfigurationError,
+              "#{query_class}##{query_method} cannot be mounted: GET #{path} is already mounted " \
+              "in these routes — by another query class that also defines `#{query_method}`, or " \
+              "by `ruact_queries #{query_class}` appearing twice. Query names share one namespace " \
+              "(one route and one export of @/.ruact/server-functions per name): remove the " \
+              "duplicate mount, or rename one of the methods (the scaffold names its search " \
+              "after the resource: search_posts, search_comments)."
+      end
     end
   end
 end

data/lib/ruact/server.rb

@@ -14,6 +14,7 @@ require_relative "../ruact"
 require_relative "server_functions/error_rendering"
 require_relative "server_functions/bucket_two_payload"
 require_relative "server_functions/name_bridge"
+require_relative "redirect_path"
 require_relative "validation_errors_collector"
 
 module Ruact
@@ -327,6 +328,11 @@ module Ruact
       path = uri.path.nil? || uri.path.empty? ? "/" : uri.path
       path += "?#{uri.query}" if uri.query
       path += "##{uri.fragment}" if uri.fragment
+      # `https://app//evil.com` is same-origin, and Rails lets it through; as a
+      # path, `//evil.com` is a protocol-relative URL to ANOTHER host. Keep
+      # the absolute URL for any path a browser would read that way.
+      return url if Ruact::RedirectPath.protocol_relative?(path)
+
       path
     rescue ::URI::InvalidURIError
       url

data/lib/ruact/testing/component_query.rb

@@ -26,10 +26,14 @@ module Ruact
       ELEMENT_HEAD = "$"
       # A client-component element's type is "$L" followed by the import's hex id.
       CLIENT_REF = /\A\$L(?<hex>\h+)\z/
+      # A string of 1024+ bytes travels as a `T` row, and the props hold a
+      # `"$T<hex>"` reference to it (Story 17-0d).
+      TEXT_REF = /\A\$T(?<hex>\h+)\z/
 
       # @param wire [String] the raw Flight wire byte string.
       def initialize(wire)
         @rows = FlightWireParser.parse(wire)
+        @texts = index_texts(@rows)
         @imports = index_imports(@rows)
         @instances = collect_instances(@rows)
       end
@@ -74,6 +78,24 @@ module Ruact
         end
       end
 
+      def index_texts(rows)
+        rows.each_with_object({}) do |row, acc|
+          acc[row[:id]] = row[:payload].dup.force_encoding(Encoding::UTF_8) if row[:class] == :text
+        end
+      end
+
+      # Props as the component receives them: text references resolved.
+      def resolve_texts(node)
+        case node
+        when String
+          ref = node.match(TEXT_REF)
+          ref && @texts.key?(ref[:hex].to_i(16)) ? @texts[ref[:hex].to_i(16)] : node
+        when Array then node.map { |child| resolve_texts(child) }
+        when Hash then node.transform_values { |child| resolve_texts(child) }
+        else node
+        end
+      end
+
       def import_ids_for(name)
         @imports.select do |_id, meta|
           meta[:export_name] == name || meta[:basename] == name
@@ -95,7 +117,7 @@ module Ruact
       def walk(node, instances)
         if element?(node)
           ref = node[1].match(CLIENT_REF)
-          instances << { ref_id: ref[:hex].to_i(16), props: node[3] } if ref
+          instances << { ref_id: ref[:hex].to_i(16), props: resolve_texts(node[3]) } if ref
           # An element's props/children may themselves contain nested elements.
           walk(node[3], instances)
         elsif node.is_a?(Array)

data/lib/ruact/testing/flight_extractor.rb

@@ -133,7 +133,12 @@ module Ruact
                   "This response did not render a ruact component (no Flight data was inlined)."
           end
 
-          decode_ruby_string_literal(match[:literal])
+          literal = match[:literal]
+          # The literal is JSON (ruact >= 0.0.15). The Ruby-literal decoder stays
+          # for documents captured from earlier versions.
+          JSON.parse(literal)
+        rescue JSON::ParserError
+          decode_ruby_string_literal(literal)
         end
 
         def json_body?(body)

data/lib/ruact/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ruact
-  VERSION = "0.0.13"
+  VERSION = "0.0.15"
 end

data/lib/ruact/view_helper.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "erb"
 require "json"
 require "socket"
 
@@ -214,15 +215,31 @@ module Ruact
 
     # The `__FLIGHT_DATA` inline bootstrap `<script>` — pushes the per-render
     # Flight payload onto the global queue the bootstrap entry drains on boot.
-    # `</script>` in the payload is escaped to prevent an HTML/XSS breakout
-    # (mandatory whenever Flight data is inlined into a `<script>` tag).
+    #
+    # The payload carries application data (props, record content), so it is
+    # embedded as a JSON string literal with `<`, `>`, `&`, U+2028 and U+2029
+    # escaped as `\uXXXX`. No byte of the payload can then close the `<script>`
+    # — `</SCRIPT>`, `</script >` and `<!--` included — and every character
+    # reaches JavaScript intact (a Ruby `String#inspect` literal did neither:
+    # it escaped only a lowercase `</script>`, and its `\e`-style escapes mean
+    # something else in JS).
+    SCRIPT_UNSAFE = /[<>&\u2028\u2029]/
+    private_constant :SCRIPT_UNSAFE
+
+    # A JSON string literal that is also safe inside a `<script>` element.
+    # The payload is UTF-8 by construction (the serializer normalizes every
+    # string); a binary-tagged buffer is retagged, not transcoded.
+    def __ruact_script_safe_json(string)
+      utf8 = string.encoding == Encoding::UTF_8 ? string : string.dup.force_encoding(Encoding::UTF_8)
+      JSON.generate(utf8).gsub(SCRIPT_UNSAFE) { |char| format("\\u%04x", char.ord) }
+    end
+
     def ruact_flight_data_script(flight_payload)
-      escaped_payload = flight_payload.gsub("</script>", '<\/script>')
       <<~HTML.strip
         <script>
           (function() {
             var d = (self.__FLIGHT_DATA = self.__FLIGHT_DATA || []);
-            d.push(#{escaped_payload.inspect});
+            d.push(#{__ruact_script_safe_json(flight_payload)});
           })();
         </script>
       HTML
@@ -257,10 +274,31 @@ module Ruact
         # virtual entry id (the manifest key Vite emits for the virtual input).
         entry = vite_manifest_entry(Ruact.bootstrap_virtual_id)
         src   = entry ? "/assets/#{entry['file']}" : "/assets/application.js"
-        %(<script type="module" src="#{src}"></script>)
+        tag   = %(<script type="module" src="#{src}"></script>)
+        # Story 17-0k — in development with neither the Vite dev server nor a
+        # build, that script 404s and the page stays empty with no error.
+        Rails.env.development? && entry.nil? ? "#{ruact_vite_down_warning}\n#{tag}" : tag
       end
     end
 
+    # Story 17-0k — `bin/rails server` on its own, once Vite has run before:
+    # the component manifest is on disk, so the render succeeds, but the page's
+    # JavaScript is not served and `#root` stays empty — a blank 200 whose only
+    # clue was a 404 in the network tab. Development only. Plain HTML with
+    # inline style: the warning cannot depend on the bundle that did not load.
+    def ruact_vite_down_warning
+      server = Ruact.config.vite_dev_server.chomp("/")
+      message = "The Vite dev server is not running (#{server}), so this page has no JavaScript " \
+                "and its React components cannot render. Start the app with bin/dev, which runs " \
+                "Rails and Vite together."
+      Rails.logger&.warn("[ruact] #{message}")
+      <<~HTML.strip
+        <div role="alert" data-ruact-vite-down style="position:fixed;inset:0 0 auto 0;z-index:2147483647;padding:12px 16px;background:#7f1d1d;color:#fff;font:14px/1.4 system-ui,sans-serif">
+          <strong>[ruact]</strong> #{ERB::Util.html_escape(message)}
+        </div>
+      HTML
+    end
+
     # The Vite dev-server URL for the virtual bootstrap. Vite serves virtual
     # modules under `/@id/`, encoding the resolved id's leading NUL (`\0`) as
     # `__x00__` — so `\0virtual:ruact/bootstrap` is served at

data/vendor/javascript/ruact-server-functions-runtime/index.js

@@ -270,6 +270,16 @@ let inflightQueries = new WeakMap();
 // is still invoked and the error surfaces (Story 9.5 behavior), instead of an
 // invalid call wrongly joining an in-flight no-param request. `null`/no params
 // both serialize to "".
+// Story 17-0c — a query param as it goes on the wire, or `undefined` when it
+// cannot be one. Pages now hand components a `BigInt` (an id beyond JS's safe
+// range) and a `Date` (a Ruby Time); both must be able to go back as params.
+function wireParam(value) {
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return String(value);
+  if (typeof value === "bigint") return value.toString();
+  if (value instanceof Date && !Number.isNaN(value.getTime())) return value.toISOString();
+  return undefined;
+}
+
 function canonicalParamsKey(params) {
   if (params == null) return "";
   if (typeof params !== "object" || Array.isArray(params)) return null;
@@ -279,8 +289,8 @@ function canonicalParamsKey(params) {
     if (value === undefined) continue;
     if (value === null) {
       tokens.push(encodeURIComponent(key)); // bare key — mirrors buildQueryUrl
-    } else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-      tokens.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+    } else if (wireParam(value) !== undefined) {
+      tokens.push(`${encodeURIComponent(key)}=${encodeURIComponent(wireParam(value))}`);
     } else {
       return null; // array/object value — buildQueryUrl throws; non-shareable
     }
@@ -536,16 +546,12 @@ function buildQueryUrl(path, params) {
     if (value === undefined) continue;
     if (value === null) {
       bareKeys.push(encodeURIComponent(key));
-    } else if (
-      typeof value === "string" ||
-      typeof value === "number" ||
-      typeof value === "boolean"
-    ) {
-      search.append(key, String(value));
+    } else if (wireParam(value) !== undefined) {
+      search.append(key, wireParam(value));
     } else {
       throw new TypeError(
         `ruact useQuery for ${path}: param "${key}" must be a string, number, ` +
-          "boolean, or null — arrays and objects are rejected",
+          "bigint, Date, boolean, or null — arrays and objects are rejected",
       );
     }
   }
@@ -684,7 +690,10 @@ function buildFetchInit(args, method = "POST") {
     body = args;
   } else {
     headers["Content-Type"] = "application/json";
-    body = JSON.stringify(args ?? {});
+    // A BigInt (an id beyond JS's safe range, Story 17-0c) has no JSON form:
+    // it goes as its decimal string, which Rails reads as it reads any id.
+    // A Date already serializes to its ISO string.
+    body = JSON.stringify(args ?? {}, (_key, value) => (typeof value === "bigint" ? value.toString() : value));
   }
 
   return {

data/vendor/javascript/ruact-server-functions-runtime/index.test.mjs

@@ -491,6 +491,13 @@ describe("mutation core — configureRuactRuntime", () => {
 });
 
 describe("Story 8.1 — __internals (test-only surface)", () => {
+  // Story 17-0c — a BigInt id from a page has no JSON form; it goes as its
+  // decimal string instead of throwing.
+  it("sends a BigInt argument as its decimal string", () => {
+    const init = __internals.buildFetchInit({ id: 9007199254740993n, at: new Date("2026-09-08T00:00:00.000Z") });
+    expect(JSON.parse(init.body)).toEqual({ id: "9007199254740993", at: "2026-09-08T00:00:00.000Z" });
+  });
+
   it("exposes buildFetchInit, resolveCsrfToken, parseResponse for granular asserts", () => {
     expect(typeof __internals.buildFetchInit).toBe("function");
     expect(typeof __internals.resolveCsrfToken).toBe("function");

data/vendor/javascript/ruact-server-functions-runtime/usequery.test.mjs

@@ -203,6 +203,18 @@ describe("Story 9.5 — _makeQuery / buildQueryUrl wire format (FR88)", () => {
     expect(() => buildQueryUrl("/q/search", { q: { deep: 1 } })).toThrow(/arrays and objects are rejected/);
   });
 
+  // Story 17-0c — pages now hand components BigInt ids and Date values; they
+  // must be able to go back as query params.
+  it("sends a BigInt as its decimal string and a Date as its ISO string", () => {
+    expect(buildQueryUrl("/q/search", { id: 9007199254740993n })).toBe("/q/search?id=9007199254740993");
+    expect(buildQueryUrl("/q/search", { at: new Date("2026-09-08T12:30:45.123Z") }))
+      .toBe("/q/search?at=2026-09-08T12%3A30%3A45.123Z");
+  });
+
+  it("rejects an Invalid Date rather than sending 'Invalid Date'", () => {
+    expect(() => buildQueryUrl("/q/search", { at: new Date("nope") })).toThrow(/arrays and objects are rejected/);
+  });
+
   it("rejects a top-level array of params", () => {
     expect(() => buildQueryUrl("/q/search", [1, 2])).toThrow(/plain object/);
   });