ruact 0.0.14 → 0.0.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '048ef204d79fa3c03ff9ab08c43e5d9d1fc1f42c0e92c7cf7311b510bc879b0a'
-  data.tar.gz: 67fdef7b25ac3ac2ea552eed361a45a62710bf28145ae7892d0e1f46f462aa47
+  metadata.gz: ab61a580bf64e964d0356fae822cc80a83d31eaaa38fdfb5398e6534158772f0
+  data.tar.gz: c66021ed18cba60a650a6f1f4e77fc60b848079e2c125aa4f34f2868f6af2101
 SHA512:
-  metadata.gz: cd6d63eaaa47a7cde090700c44ba53fe8cf9b29d82cc05ce2f672b98b01dd83dd82cb046b109cd47a328594344b1950f21d75fee5338870a0df5be438e86843e
-  data.tar.gz: 44b2880d6879617b00adc9a8ae070a1f722e147a782592c4b527e98dbe9af42d925f45c68daca3272df28a95c7a0c89d762164bf205c9da2dbf195e142e8e88d
+  metadata.gz: 053037bfb91205f625613499e5b98c14da4e886be7a94ef60239a1da934d44a35dbf104208494cc951eb7048c9bedbf1b8792c46ed9428e2a455f18d6141f729
+  data.tar.gz: '0800f0c8d28ea88c91b7d40b488ac6931b7548811cbfa0bd56458dbc9d0d4a09ab8f2db5a0884217045072b9a3889fa168cd83d969cb9f778bf22aab0ddc1cc8'

data/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.15] - 2026-10-03
+
+### Security
+
+- **Text in a prop could run as script on the page (stored XSS).** On a plain browser load, the page's Flight payload is inlined in a `<script>` element. It was embedded as a Ruby string literal with only a lowercase `</script>` escaped. A value containing `</SCRIPT>`, `</script >` or another casing closed the element, and the rest ran as HTML. A post titled `</SCRIPT><img src=x onerror=…>` executed its handler for everyone who opened the list. Any string a ruact page passes as a prop, such as user-written record content, could do it. The payload is now embedded as a JSON string literal with `<`, `>`, `&`, U+2028 and U+2029 escaped, so no character of it can end the element. Control characters such as `\e`, which the Ruby literal also delivered wrongly to JavaScript, now arrive intact. **Affects every version up to and including 0.0.14; upgrade.** `Ruact::Testing`'s matchers read both forms.
+
+- **A same-origin redirect could send the browser to another site.** `redirect_to "#{root_url}#{params[:path]}"` with `path=/evil.com` gives `https://your.app//evil.com`, which is your own host, so Rails' open-redirect check accepts it. ruact then shortened every same-origin URL to its path, `//evil.com`, and a browser reads that as a URL to `evil.com`. A server function answered `{"$redirect":"//evil.com"}` and the runtime navigated there. A page redirect produced a Flight row the router refused, so the navigation silently did nothing. A path that a browser would read as another host now keeps its absolute, same-origin URL.
+
+### Fixed
+
+- **Any text of 1 KB or more blanked the page.** The server sends every string of 1024 bytes or more as a separate row framed by its byte length, with no newline after it. The browser read the payload line by line, so it lost the row that holds the page and showed nothing: `[flight-client] No root row (id=0) found in payload`. A scaffolded post whose body was one long paragraph made the whole list disappear. The first load and the router now read the payload with one parser that works on bytes, so text arrives exactly as it left, including multibyte characters and newlines, wherever the network splits it. A truncated or malformed payload, or a reference to text that never arrived, is now an error that says so instead of a blank page. Long text inside Suspense content was also never sent at all; it is now, before the row that uses it. `Ruact::Testing`'s matchers compare a long prop by its text.
+
+- **Dates and large integers reached React as marker strings.** A Ruby `Time`, `DateTime` or `ActiveSupport::TimeWithZone` prop arrived as `"$D2026-09-08T12:30:45.123Z"`, and an integer beyond JavaScript's safe range (±(2^53 − 1)) as `"$n9007199254740993"`. A component had to know ruact's transport to use them. They now arrive as a `Date`, with the same instant and millisecond precision, and as a `BigInt`; integers inside the safe range stay numbers. This holds on the first load and after a navigation. A `BigInt` is not a `number`: `JSON.stringify` refuses it and some libraries expect numbers, so format it where you use it (`String(id)`). A `Date` is not text, so `{createdAt}` as a child now raises "Objects are not valid as a React child"; format it (`createdAt.toLocaleDateString()`). Both can go back: a server function sends a `BigInt` argument as its decimal string, and `useQuery` takes a `BigInt` or `Date` param (the generated query accessors' TypeScript parameter types do not list them yet). Years outside 0–9999 are written in the form JavaScript reads (`+010000`). A calendar `Date` (`Date.today`) arrives as `"YYYY-MM-DD"`; it used to raise `Ruact::SerializationError` in production, where `strict_serialization` is on. A symbol whose name starts with `$` is escaped like a string.
+
+- **`respond_to` answered 406 to every navigation and form submit of the client router.** The router asks for a page with `Accept: text/x-component`, which is not a Rails MIME type, so the request negotiated no format and `respond_to { |format| format.html { … } }` raised `ActionController::UnknownFormat`. That is the controller Rails' own scaffold writes: with `include Ruact::Controller`, its `create`, `update` and `destroy` failed whenever the router submitted the form. A router request now negotiates `format.html`, the same page a browser asks for: the `format.html` branch runs, and its render, status or redirect reaches the browser as a ruact answer. A URL that names a format (`/posts/1.json`) and an `Accept: application/json` request still get `format.json`. The format is negotiated before every callback, so an authentication `before_action` that answers with `respond_to` gets it too. A `respond_to` with no `format.html` still answers 406, now with a message naming the missing branch and the `data-ruact="false"` way out. A partial that exists only in another format (`.text.erb`) is no longer found by a ruact page during a router request.
+
+- **`bin/rails server` without Vite showed an empty page and no error.** Once Vite has run once, the component manifest is on disk, so a page renders without the dev server, but its JavaScript is not served: the page answered 200 with nothing in it, and the only clue was a 404 in the browser's network tab. In development, when the Vite dev server is not running and there is no build to serve, the page now shows a banner that says so and to start the app with `bin/dev`, and the Rails log gets the same `[ruact]` line. The banner is plain HTML, so it does not need the JavaScript that failed to load. Nothing changes with Vite running, with a build present, or outside development.
+
+- **Text that is not valid UTF-8 broke the page.** A string holding Latin-1 bytes, or bytes that are not text at all, made the page answer 500 for every viewer, because JSON refuses invalid UTF-8. A long one, 1024 bytes or more, was sent with a byte count that did not match what the browser decoded. Strings now leave as valid UTF-8: text in another encoding is transcoded, binary-tagged UTF-8 (`File.binread`, an HTTP body) is read as the text it is, and bytes that are not text become U+FFFD, as a browser shows them.
+
 ## [0.0.14] - 2026-10-02
 
 ### Fixed
@@ -104,7 +124,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 
 - **The README no longer claims props are an allowlist.** It said *"Props are an allowlist — other columns never cross"*, describing the opt-in rather than the default. The default is `as_json`: every attribute of a model prop crosses to the client, and the gem says so in the log (`ALL attributes exposed to client`). A reader who took the bullet at face value would have believed the safe behaviour was already on. The bullet now leads with what actually happens, then names `ruact_props` as the thing that makes it an allowlist and `strict_serialization` as what turns the permissive path into an error in production.
+
 - **The server-functions bullet no longer calls the whole generated module "typed".** Only queries carry an exact signature (one property per declared keyword, since 0.0.5). An action's accessor is typed to be callable and to satisfy `<form action>`, but its arguments and resolved value are `Record<string, unknown>` and `unknown` — useful, and not the autocomplete the word "typed" promises. Both are now described as what they are.
+
 - **The mechanism is stated where the reader meets it.** "Capitalized tag means React. Lowercase stays HTML." now sits directly under the ERB/TSX pair, and the paragraph that follows explains the wire in plain terms — the view renders server-side as it always did, the result travels as a React tree in the format React uses for Server Components, the data is inlined so React renders without a fetch, and Node builds the bundle and does nothing else.
 
 ### Fixed
@@ -144,6 +166,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   It is referenced by absolute URL and **nothing binary is committed here** — so neither `gem install ruact` nor a clone of this repository carries a multi-megabyte file, permanently, for a picture. Two things keep it from aging into a lie: the URL belongs to the site's URL contract, and `spec/readme_demo_message_spec.rb` pins the message the recording shows against a fixture the gem itself produced. If the wording changes, that spec goes red and names the recording as the thing to redo.
 
 - **`LICENSE.txt`** — the gemspec has declared `spec.license = "MIT"` since the first commit while the repository contained no licence file, so both GitHub and the packaged gem shipped a promise with nothing behind it.
+
 - **`spec.description` and `metadata["documentation_uri"]` in the gemspec** — RubyGems rendered the one-line `summary` as the whole description and fell through to rubydoc.info for documentation.
 
 ### Fixed
@@ -300,6 +323,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Tooling
 
 - **Code coverage instrumentation** (Story 6.7). Added `simplecov` and `simplecov-lcov` as development dependencies; gem CI uploads coverage from the canonical matrix cell (Ruby 3.3 × Rails 7.2) to Codecov on every push and PR with the `gem` flag. **Baseline at merge: 88.30% line (581/658), 72.25% branch (239 specs).** (Corrects the earlier 87.89% figure recorded at story-merge time, which was a typo of the SimpleCov output for 567/644 = 88.04%; the current numbers reflect the post-review state after Story 6.7 review F1 refactored `html_converter.rb#convert_element` into helpers, which added a few lines and one new spec.) Coverage is informativo (not a CI gate); see Codecov PR comments for diff coverage on individual changes. Diff coverage target per project DoD: ≥ 90% line / ≥ 80% branch on new code.
+
 - **Spec `rails_stub.rb` fix.** The previous `$LOADED_FEATURES.any? { |f| f.end_with?("/rails.rb") }` heuristic for skipping the `LOADED_FEATURES` insertion was unreliable — unrelated gems ship files at `*/rails.rb` (e.g. SimpleCov's `simplecov/profiles/rails.rb`). Replaced with an unconditional insertion guarded only by the existing `return if defined?(Rails)` early-exit, which is the correct invariant.
 
 ### Renamed
@@ -327,6 +351,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Rake task descriptions and internal `require` statements migrated from `rails_rsc` to `ruact`. Public API is unchanged; this is a documentation and tooling rename only.
 - **Render context now passed explicitly** (Story 7.1). `Ruact::ComponentRegistry` (which used `Thread.current`) has been removed; the per-render component list is now an instance of `Ruact::RenderContext` passed explicitly through `Controller#ruact_render → RenderPipeline → HtmlConverter`. The `Ruact/NoSharedState` cop now passes with no exceptions in `lib/ruact/`. **No public API change.** Note: `Ruact::Flight::*`, `Ruact::Internal::*`, and `Ruact::RenderContext` are not part of the public API and may change between minors. Hosts upgrading need no application code changes. See decision note for rationale and contributor guidance.
+
 - **`RenderPipeline` entry points consolidated** (Story 7.2). `RenderPipeline#call`, `#stream`, and `#from_html` have been removed and replaced with a single `#render(input, mode:)` entry point. `input` selects the source — `{ erb: String, binding: Binding }` for ERB templates or `{ html: String, render_context: Ruact::RenderContext }` for pre-rendered HTML; `mode:` selects the output shape — `:string` returns a `String` (deferred chunks inlined eagerly), `:stream` returns an `Enumerator` of Flight rows (deferred chunks delay). Conflicting input keys, missing siblings, and unknown modes raise `ArgumentError` with the offending input named. **No public API change** — `Ruact::Controller#ruact_render` is unchanged. Note: `Ruact::Flight::*`, `Ruact::Internal::*`, and `Ruact::RenderPipeline` are not part of the public API and may change between minors. See decision note for rationale and contributor guidance.
 
   _Migration for any external code that may have reached into `Ruact::RenderPipeline`:_ `pipeline.call(erb, binding)` → `pipeline.render({ erb: erb, binding: binding }, mode: :string)`; `pipeline.stream(erb, binding)` → `pipeline.render({ erb: erb, binding: binding }, mode: :stream)`; `pipeline.from_html(html, render_context: ctx)` → `pipeline.render({ html: html, render_context: ctx }, mode: :string)`; `pipeline.from_html(html, render_context: ctx, streaming: true)` → `pipeline.render({ html: html, render_context: ctx }, mode: :stream)`.
@@ -360,23 +385,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - **ERB preprocessor** — PascalCase RSC component tags (`<Button />`, `<LikeButton postId={@post.id} />`) are transformed to Flight placeholders in ERB templates before Ruby evaluation.
+
 - **`<Suspense>` support** — `<Suspense fallback="Loading...">` in ERB templates maps to React Suspense boundaries in the Flight payload.
+
 - **React Flight wire format serializer** — Full Ruby-to-Flight protocol implementation covering: nil, booleans, integers, floats (NaN/Infinity/-0), strings (with `$` escaping), arrays, hashes, `Time`/`DateTime`, large strings (T rows), `ReactElement`, `SuspenseElement`, and `ClientReference`.
+
 - **`Ruact::Controller` concern** — Include in `ApplicationController` to enable RSC rendering. Provides `ruact_render`, RSC request detection (`text/x-component` / `Ruact-Request: 1` header), HTML shell generation with inline `__FLIGHT_DATA`, and Flight-aware `redirect_to`.
+
 - **Streaming mode** — When `ActionController::Live` is included, Flight rows are streamed to the client as they are produced (Suspense-aware).
+
 - **Client component resolution** — `Ruact::ClientManifest` reads `public/react-client-manifest.json` (generated by the Vite plugin) and resolves component names to `ClientReference` objects via a dual-path resolver.
+
 - **`Ruact::Serializable` mixin** — `ruact_props` DSL for declaring safe prop attributes on Ruby model objects.
+
 - **Install generator** — `rails generate ruact:install` scaffolds the initializer, Vite config patch, and JavaScript entry point.
+
 - **`ruact:doctor` Rake task** — Checks manifest presence, Vite server accessibility, controller setup, and streaming mode configuration.
+
 - **`vite-plugin-ruact`** — Vite plugin (npm package, co-versioned) that scans `"use client"` components and emits `public/react-client-manifest.json`.
+
 - **Client-side navigation** — JavaScript `ruact-router.js` intercepts same-origin link clicks and form submissions, fetches Flight payloads, and updates the React tree without full-page reloads.
+
 - **Error overlay** — Development-mode React error boundary with dismissible overlay for Flight parse and rendering errors.
+
 - **RSpec test suite** — 223 examples covering all modules: Flight serializer, ERB preprocessor, HTML converter, render pipeline, controller, client manifest, serializable, install generator, and `ruact:doctor`.
+
 - **Memory benchmark** — `rake benchmark:memory` enforces a 120% allocation regression gate against `spec/benchmarks/baseline.json`.
+
 - **CI matrix** — GitHub Actions: RSpec across Ruby 3.2 × 3.3 × Rails 7.0 × 7.1 × 7.2 × 8.0; RuboCop; YARD docs; memory benchmark; E2E system tests against React 19.0.0 and 19.x (Capybara + Cuprite); non-blocking React@next job with auto-issue on failure.
+
 - **E2E test app** — `e2e/` Rails app (no DB, in-memory Post model) with full CRUD system tests validating the complete request cycle.
 
-[Unreleased]: https://github.com/luizcg/ruact/compare/v0.0.14...HEAD
+[Unreleased]: https://github.com/luizcg/ruact/compare/v0.0.15...HEAD
+[0.0.15]: https://github.com/luizcg/ruact/releases/tag/v0.0.15
 [0.0.14]: https://github.com/luizcg/ruact/releases/tag/v0.0.14
 [0.0.13]: https://github.com/luizcg/ruact/releases/tag/v0.0.13
 [0.0.12]: https://github.com/luizcg/ruact/releases/tag/v0.0.12

data/lib/ruact/controller/format_negotiation.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Ruact
+  module Controller
+    # Story 17-0j — a router request answers as `format.html`.
+    #
+    # The ruact router asks for a page with `Accept: text/x-component`, which is
+    # not a Rails MIME type: the request negotiated no format at all, and every
+    # `respond_to` raised `ActionController::UnknownFormat` (406) on a
+    # navigation or a form submit. That is the controller Rails' own scaffold
+    # writes. A router request asks for the PAGE, the same thing a browser's
+    # `text/html` asks for, so it now negotiates `:html` — unless the URL names
+    # a format (`/posts/1.json`), which wins as it always has. Whether the
+    # answer is Flight or an HTML document is still ruact's decision, read from
+    # the Accept header, not from the negotiated format.
+    module FormatNegotiation
+      extend ActiveSupport::Concern
+
+      # Rails' negotiated-formats slot on the request. Writing it directly,
+      # rather than `request.format =`, leaves `params[:format]` alone.
+      FORMATS_KEY = "action_dispatch.request.formats"
+
+      # `respond_to` with no `format.html` still answers 406 to a router
+      # request, as Rails does to a browser — with the reason and the fix. Only
+      # when THIS respond_to found no format: an UnknownFormat raised inside a
+      # branch (a nested respond_to, an explicit raise), or one for a format
+      # the URL named, keeps Rails' own message.
+      #
+      # @see ActionController::MimeResponds#respond_to
+      def respond_to(*mimes, &block)
+        collector = nil
+        recording = block && lambda { |given|
+          collector = given
+          yield(given)
+        }
+        super(*mimes, &recording)
+      rescue ActionController::UnknownFormat
+        raise unless __ruact_router_found_no_format?(collector, mimes)
+
+        raise ActionController::UnknownFormat,
+              "#{self.class.name}##{action_name} was asked for its page by the ruact router, which " \
+              "negotiates format.html, and its respond_to has no format.html branch. Add one, or " \
+              "link to this action with data-ruact=\"false\" so the browser loads it."
+      end
+
+      private
+
+      # Before every callback — a host's own `prepend_before_action` included —
+      # since this sits above AbstractController::Callbacks in the chain. An
+      # auth callback that answers with `respond_to` gets the format too.
+      def process_action(...)
+        __ruact_negotiate_router_request_as_html
+        super
+      end
+
+      def __ruact_negotiate_router_request_as_html
+        return unless ruact_request?
+        return if __ruact_url_format.present?
+
+        request.set_header(FORMATS_KEY, [Mime[:html]])
+      end
+
+      # The format the URL names (`/posts/1.json`, `?format=json`). Read from
+      # the path and query only: this runs before Rails' rescue and logging,
+      # where parsing a malformed request BODY must not raise.
+      def __ruact_url_format
+        request.path_parameters[:format] || request.query_parameters[:format]
+      rescue ActionController::BadRequest, ActionDispatch::Http::Parameters::ParseError
+        nil
+      end
+
+      def __ruact_router_found_no_format?(collector, mimes)
+        return false unless ruact_request? && __ruact_url_format.blank?
+
+        if collector
+          collector.format.nil?
+        else
+          request.negotiate_mime(mimes.map { |mime| Mime[mime] }).nil?
+        end
+      end
+    end
+  end
+end

data/lib/ruact/controller/page_rendering.rb

@@ -98,7 +98,7 @@ module Ruact
       # Whether Rails, left alone, would render `page` for `action`: the lookup
       # it does itself, with the formats it negotiated for this request (and a
       # render's own `formats:` / `variants:` / `handlers:` / `locale:`). A Flight request
-      # negotiates every format, HTML first — the page; a `.json` request or a
+      # negotiates HTML (Ruact::Controller::FormatNegotiation) — the page; a `.json` request or a
       # `format.json` branch negotiates JSON — the JSON template, or Rails' own
       # MissingTemplate.
       def __ruact_rails_would_render?(action, details, page)

data/lib/ruact/controller.rb

@@ -3,11 +3,13 @@
 require "json"
 require "socket"
 require "uri"
+require_relative "redirect_path"
 require_relative "view_helper"
 require_relative "validation_errors_collector"
 require_relative "controller/document_rendering"
 require_relative "controller/pages"
 require_relative "controller/page_rendering"
+require_relative "controller/format_negotiation"
 
 module Ruact
   # Include in the controllers whose pages render through ruact (island mode,
@@ -43,6 +45,9 @@ module Ruact
     # An explicit `render` of a ruact page goes through ruact (Story 17.0i).
     # See Ruact::Controller::PageRendering.
     include Ruact::Controller::PageRendering
+    # A router request negotiates `format.html`, so `respond_to` answers it
+    # (Story 17-0j). See Ruact::Controller::FormatNegotiation.
+    include Ruact::Controller::FormatNegotiation
 
     # Story 17.0f — "is this action a ruact PAGE?", answered at CLASS level so the
     # navigation boundary (Ruact::NavigationBoundary) can ask it before any action
@@ -266,6 +271,8 @@ module Ruact
         redirect_url  = uri.path.nil? || uri.path.empty? ? "/" : uri.path
         redirect_url += "?#{uri.query}"    if uri.query
         redirect_url += "##{uri.fragment}" if uri.fragment
+        # Same-origin `https://app//evil.com` must not shrink to `//evil.com`.
+        redirect_url = url if Ruact::RedirectPath.protocol_relative?(redirect_url)
       rescue ::URI::InvalidURIError
         return super
       end

data/lib/ruact/flight/js_date.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Ruact
+  module Flight
+    # The ISO 8601 form a JavaScript `Date` reads back (Story 17-0c).
+    module JsDate
+      # JavaScript parses years 0–9999 in the plain form and the others only in
+      # the expanded one (`+010000`, `-000001`); Ruby writes `10000` / `-0001`,
+      # which `new Date` turns into an Invalid Date.
+      #
+      # @param value [Time, DateTime]
+      # @return [String] ISO 8601 with milliseconds
+      def self.iso8601(value)
+        iso = value.iso8601(3)
+        year = value.year
+        return iso unless year.negative? || year > 9999
+
+        format("%<sign>s%<year>06d", sign: year.negative? ? "-" : "+", year: year.abs) + iso.sub(/\A-?\d+/, "")
+      end
+    end
+  end
+end

data/lib/ruact/flight/renderer.rb

@@ -56,12 +56,17 @@ module Ruact
             sleep(deferred[:delay])
           end
 
-          # Serialize deferred content — may produce new import rows
-          import_count_before = @request.completed_import_chunks.length
+          # Serialize deferred content — may produce new import rows, and new
+          # regular rows (a string of 1024+ bytes becomes a `T` row the deferred
+          # model row references as `$T<id>`).
+          import_count_before  = @request.completed_import_chunks.length
+          regular_count_before = @request.completed_regular_chunks.length
           deferred_value = serializer.serialize_model(deferred[:element])
 
-          # Yield any import rows discovered during deferred serialization
+          # Yield the rows discovered during deferred serialization BEFORE the
+          # row that references them.
           @request.completed_import_chunks[import_count_before..].each(&block)
+          @request.completed_regular_chunks[regular_count_before..].each(&block)
 
           yield RowEmitter.model(deferred[:id], JSON.generate(deferred_value))
         end

data/lib/ruact/flight/serializer.rb

@@ -33,6 +33,10 @@ module Ruact
           serialize_symbol(value)
         when Time, DateTime
           serialize_date(value)
+        when Date
+          # A calendar date has no instant to rebuild: it travels as
+          # "YYYY-MM-DD", in strict mode too (Story 17-0c review).
+          serialize_string(value.iso8601)
         when ClientReference
           serialize_client_reference(value)
         when SuspenseElement
@@ -53,6 +57,7 @@ module Ruact
       # --- Primitives ---
 
       def serialize_string(value)
+        value = Utf8.text(value)
         # Large strings get their own T row
         if value.bytesize >= LARGE_TEXT_THRESHOLD
           id = @request.allocate_id
@@ -89,12 +94,13 @@ module Ruact
         # Only :undefined is special for now
         return "$undefined" if value == :undefined
 
-        # Unknown symbols: just use the name as a string
-        value.to_s
+        # Any other symbol is its name — escaped like a string, so `:"$nope"`
+        # cannot pose as a "$n…" marker.
+        serialize_string(value.to_s)
       end
 
       def serialize_date(value)
-        "$D#{value.iso8601(3)}"
+        "$D#{JsDate.iso8601(value)}"
       end
 
       # --- Collections ---
@@ -104,7 +110,7 @@ module Ruact
       end
 
       def serialize_hash(value)
-        value.transform_keys(&:to_s).transform_values { |v| serialize_model(v) }
+        value.transform_keys { |key| Utf8.text(key.to_s) }.transform_values { |v| serialize_model(v) }
       end
 
       # --- React Element ---

data/lib/ruact/flight/utf8.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Ruact
+  module Flight
+    # Every string leaves the serializer as valid UTF-8. A `T` row is framed by
+    # its byte length, and JSON (a model row, the inline page payload) refuses
+    # invalid UTF-8: one record holding Latin-1 bytes made its page answer 500
+    # for every viewer.
+    module Utf8
+      REPLACEMENT = "\uFFFD"
+
+      # Binary-tagged text (`File.binread`, an HTTP body) is retagged; another
+      # encoding is transcoded; bytes that are not text in that encoding become
+      # U+FFFD, as a browser shows them.
+      #
+      # @param value [String]
+      # @return [String] valid UTF-8 (the same object when it already was)
+      def self.text(value)
+        return value if value.encoding == Encoding::UTF_8 && value.valid_encoding?
+
+        text =
+          begin
+            if [Encoding::BINARY, Encoding::UTF_8].include?(value.encoding)
+              value.dup.force_encoding(Encoding::UTF_8)
+            else
+              value.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: REPLACEMENT)
+            end
+          rescue Encoding::ConverterNotFoundError
+            # An encoding Ruby cannot convert from (UTF-7, say): its bytes.
+            value.dup.force_encoding(Encoding::UTF_8)
+          end
+        text.valid_encoding? ? text : text.scrub(REPLACEMENT)
+      end
+    end
+  end
+end

data/lib/ruact/flight.rb

@@ -3,6 +3,8 @@
 require_relative "flight/react_element"
 require_relative "flight/request"
 require_relative "flight/row_emitter"
+require_relative "flight/js_date"
+require_relative "flight/utf8"
 require_relative "flight/serializer"
 require_relative "flight/renderer"
 

data/lib/ruact/redirect_path.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Ruact
+  # Reducing a same-origin redirect URL to its path is what lets the client
+  # navigate in place. One path must not be produced that way: `//host` (or
+  # `/\host`), which a browser reads as a URL to ANOTHER host. Shared by the
+  # page redirect ({Ruact::Controller}) and the server-function `$redirect`
+  # ({Ruact::Server}); neither loads the other.
+  module RedirectPath
+    # @param path [String] a redirect target already reduced to a path
+    # @return [Boolean] whether a browser would read it as another host
+    def self.protocol_relative?(path)
+      path.match?(%r{\A[/\\]{2}})
+    end
+  end
+end

data/lib/ruact/server.rb

@@ -14,6 +14,7 @@ require_relative "../ruact"
 require_relative "server_functions/error_rendering"
 require_relative "server_functions/bucket_two_payload"
 require_relative "server_functions/name_bridge"
+require_relative "redirect_path"
 require_relative "validation_errors_collector"
 
 module Ruact
@@ -327,6 +328,11 @@ module Ruact
       path = uri.path.nil? || uri.path.empty? ? "/" : uri.path
       path += "?#{uri.query}" if uri.query
       path += "##{uri.fragment}" if uri.fragment
+      # `https://app//evil.com` is same-origin, and Rails lets it through; as a
+      # path, `//evil.com` is a protocol-relative URL to ANOTHER host. Keep
+      # the absolute URL for any path a browser would read that way.
+      return url if Ruact::RedirectPath.protocol_relative?(path)
+
       path
     rescue ::URI::InvalidURIError
       url

data/lib/ruact/testing/component_query.rb

@@ -26,10 +26,14 @@ module Ruact
       ELEMENT_HEAD = "$"
       # A client-component element's type is "$L" followed by the import's hex id.
       CLIENT_REF = /\A\$L(?<hex>\h+)\z/
+      # A string of 1024+ bytes travels as a `T` row, and the props hold a
+      # `"$T<hex>"` reference to it (Story 17-0d).
+      TEXT_REF = /\A\$T(?<hex>\h+)\z/
 
       # @param wire [String] the raw Flight wire byte string.
       def initialize(wire)
         @rows = FlightWireParser.parse(wire)
+        @texts = index_texts(@rows)
         @imports = index_imports(@rows)
         @instances = collect_instances(@rows)
       end
@@ -74,6 +78,24 @@ module Ruact
         end
       end
 
+      def index_texts(rows)
+        rows.each_with_object({}) do |row, acc|
+          acc[row[:id]] = row[:payload].dup.force_encoding(Encoding::UTF_8) if row[:class] == :text
+        end
+      end
+
+      # Props as the component receives them: text references resolved.
+      def resolve_texts(node)
+        case node
+        when String
+          ref = node.match(TEXT_REF)
+          ref && @texts.key?(ref[:hex].to_i(16)) ? @texts[ref[:hex].to_i(16)] : node
+        when Array then node.map { |child| resolve_texts(child) }
+        when Hash then node.transform_values { |child| resolve_texts(child) }
+        else node
+        end
+      end
+
       def import_ids_for(name)
         @imports.select do |_id, meta|
           meta[:export_name] == name || meta[:basename] == name
@@ -95,7 +117,7 @@ module Ruact
       def walk(node, instances)
         if element?(node)
           ref = node[1].match(CLIENT_REF)
-          instances << { ref_id: ref[:hex].to_i(16), props: node[3] } if ref
+          instances << { ref_id: ref[:hex].to_i(16), props: resolve_texts(node[3]) } if ref
           # An element's props/children may themselves contain nested elements.
           walk(node[3], instances)
         elsif node.is_a?(Array)

data/lib/ruact/testing/flight_extractor.rb

@@ -133,7 +133,12 @@ module Ruact
                   "This response did not render a ruact component (no Flight data was inlined)."
           end
 
-          decode_ruby_string_literal(match[:literal])
+          literal = match[:literal]
+          # The literal is JSON (ruact >= 0.0.15). The Ruby-literal decoder stays
+          # for documents captured from earlier versions.
+          JSON.parse(literal)
+        rescue JSON::ParserError
+          decode_ruby_string_literal(literal)
         end
 
         def json_body?(body)

data/lib/ruact/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ruact
-  VERSION = "0.0.14"
+  VERSION = "0.0.15"
 end

data/lib/ruact/view_helper.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "erb"
 require "json"
 require "socket"
 
@@ -214,15 +215,31 @@ module Ruact
 
     # The `__FLIGHT_DATA` inline bootstrap `<script>` — pushes the per-render
     # Flight payload onto the global queue the bootstrap entry drains on boot.
-    # `</script>` in the payload is escaped to prevent an HTML/XSS breakout
-    # (mandatory whenever Flight data is inlined into a `<script>` tag).
+    #
+    # The payload carries application data (props, record content), so it is
+    # embedded as a JSON string literal with `<`, `>`, `&`, U+2028 and U+2029
+    # escaped as `\uXXXX`. No byte of the payload can then close the `<script>`
+    # — `</SCRIPT>`, `</script >` and `<!--` included — and every character
+    # reaches JavaScript intact (a Ruby `String#inspect` literal did neither:
+    # it escaped only a lowercase `</script>`, and its `\e`-style escapes mean
+    # something else in JS).
+    SCRIPT_UNSAFE = /[<>&\u2028\u2029]/
+    private_constant :SCRIPT_UNSAFE
+
+    # A JSON string literal that is also safe inside a `<script>` element.
+    # The payload is UTF-8 by construction (the serializer normalizes every
+    # string); a binary-tagged buffer is retagged, not transcoded.
+    def __ruact_script_safe_json(string)
+      utf8 = string.encoding == Encoding::UTF_8 ? string : string.dup.force_encoding(Encoding::UTF_8)
+      JSON.generate(utf8).gsub(SCRIPT_UNSAFE) { |char| format("\\u%04x", char.ord) }
+    end
+
     def ruact_flight_data_script(flight_payload)
-      escaped_payload = flight_payload.gsub("</script>", '<\/script>')
       <<~HTML.strip
         <script>
           (function() {
             var d = (self.__FLIGHT_DATA = self.__FLIGHT_DATA || []);
-            d.push(#{escaped_payload.inspect});
+            d.push(#{__ruact_script_safe_json(flight_payload)});
           })();
         </script>
       HTML
@@ -257,10 +274,31 @@ module Ruact
         # virtual entry id (the manifest key Vite emits for the virtual input).
         entry = vite_manifest_entry(Ruact.bootstrap_virtual_id)
         src   = entry ? "/assets/#{entry['file']}" : "/assets/application.js"
-        %(<script type="module" src="#{src}"></script>)
+        tag   = %(<script type="module" src="#{src}"></script>)
+        # Story 17-0k — in development with neither the Vite dev server nor a
+        # build, that script 404s and the page stays empty with no error.
+        Rails.env.development? && entry.nil? ? "#{ruact_vite_down_warning}\n#{tag}" : tag
       end
     end
 
+    # Story 17-0k — `bin/rails server` on its own, once Vite has run before:
+    # the component manifest is on disk, so the render succeeds, but the page's
+    # JavaScript is not served and `#root` stays empty — a blank 200 whose only
+    # clue was a 404 in the network tab. Development only. Plain HTML with
+    # inline style: the warning cannot depend on the bundle that did not load.
+    def ruact_vite_down_warning
+      server = Ruact.config.vite_dev_server.chomp("/")
+      message = "The Vite dev server is not running (#{server}), so this page has no JavaScript " \
+                "and its React components cannot render. Start the app with bin/dev, which runs " \
+                "Rails and Vite together."
+      Rails.logger&.warn("[ruact] #{message}")
+      <<~HTML.strip
+        <div role="alert" data-ruact-vite-down style="position:fixed;inset:0 0 auto 0;z-index:2147483647;padding:12px 16px;background:#7f1d1d;color:#fff;font:14px/1.4 system-ui,sans-serif">
+          <strong>[ruact]</strong> #{ERB::Util.html_escape(message)}
+        </div>
+      HTML
+    end
+
     # The Vite dev-server URL for the virtual bootstrap. Vite serves virtual
     # modules under `/@id/`, encoding the resolved id's leading NUL (`\0`) as
     # `__x00__` — so `\0virtual:ruact/bootstrap` is served at

data/vendor/javascript/ruact-server-functions-runtime/index.js

@@ -270,6 +270,16 @@ let inflightQueries = new WeakMap();
 // is still invoked and the error surfaces (Story 9.5 behavior), instead of an
 // invalid call wrongly joining an in-flight no-param request. `null`/no params
 // both serialize to "".
+// Story 17-0c — a query param as it goes on the wire, or `undefined` when it
+// cannot be one. Pages now hand components a `BigInt` (an id beyond JS's safe
+// range) and a `Date` (a Ruby Time); both must be able to go back as params.
+function wireParam(value) {
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return String(value);
+  if (typeof value === "bigint") return value.toString();
+  if (value instanceof Date && !Number.isNaN(value.getTime())) return value.toISOString();
+  return undefined;
+}
+
 function canonicalParamsKey(params) {
   if (params == null) return "";
   if (typeof params !== "object" || Array.isArray(params)) return null;
@@ -279,8 +289,8 @@ function canonicalParamsKey(params) {
     if (value === undefined) continue;
     if (value === null) {
       tokens.push(encodeURIComponent(key)); // bare key — mirrors buildQueryUrl
-    } else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-      tokens.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+    } else if (wireParam(value) !== undefined) {
+      tokens.push(`${encodeURIComponent(key)}=${encodeURIComponent(wireParam(value))}`);
     } else {
       return null; // array/object value — buildQueryUrl throws; non-shareable
     }
@@ -536,16 +546,12 @@ function buildQueryUrl(path, params) {
     if (value === undefined) continue;
     if (value === null) {
       bareKeys.push(encodeURIComponent(key));
-    } else if (
-      typeof value === "string" ||
-      typeof value === "number" ||
-      typeof value === "boolean"
-    ) {
-      search.append(key, String(value));
+    } else if (wireParam(value) !== undefined) {
+      search.append(key, wireParam(value));
     } else {
       throw new TypeError(
         `ruact useQuery for ${path}: param "${key}" must be a string, number, ` +
-          "boolean, or null — arrays and objects are rejected",
+          "bigint, Date, boolean, or null — arrays and objects are rejected",
       );
     }
   }
@@ -684,7 +690,10 @@ function buildFetchInit(args, method = "POST") {
     body = args;
   } else {
     headers["Content-Type"] = "application/json";
-    body = JSON.stringify(args ?? {});
+    // A BigInt (an id beyond JS's safe range, Story 17-0c) has no JSON form:
+    // it goes as its decimal string, which Rails reads as it reads any id.
+    // A Date already serializes to its ISO string.
+    body = JSON.stringify(args ?? {}, (_key, value) => (typeof value === "bigint" ? value.toString() : value));
   }
 
   return {

data/vendor/javascript/ruact-server-functions-runtime/index.test.mjs

@@ -491,6 +491,13 @@ describe("mutation core — configureRuactRuntime", () => {
 });
 
 describe("Story 8.1 — __internals (test-only surface)", () => {
+  // Story 17-0c — a BigInt id from a page has no JSON form; it goes as its
+  // decimal string instead of throwing.
+  it("sends a BigInt argument as its decimal string", () => {
+    const init = __internals.buildFetchInit({ id: 9007199254740993n, at: new Date("2026-09-08T00:00:00.000Z") });
+    expect(JSON.parse(init.body)).toEqual({ id: "9007199254740993", at: "2026-09-08T00:00:00.000Z" });
+  });
+
   it("exposes buildFetchInit, resolveCsrfToken, parseResponse for granular asserts", () => {
     expect(typeof __internals.buildFetchInit).toBe("function");
     expect(typeof __internals.resolveCsrfToken).toBe("function");

data/vendor/javascript/ruact-server-functions-runtime/usequery.test.mjs

@@ -203,6 +203,18 @@ describe("Story 9.5 — _makeQuery / buildQueryUrl wire format (FR88)", () => {
     expect(() => buildQueryUrl("/q/search", { q: { deep: 1 } })).toThrow(/arrays and objects are rejected/);
   });
 
+  // Story 17-0c — pages now hand components BigInt ids and Date values; they
+  // must be able to go back as query params.
+  it("sends a BigInt as its decimal string and a Date as its ISO string", () => {
+    expect(buildQueryUrl("/q/search", { id: 9007199254740993n })).toBe("/q/search?id=9007199254740993");
+    expect(buildQueryUrl("/q/search", { at: new Date("2026-09-08T12:30:45.123Z") }))
+      .toBe("/q/search?at=2026-09-08T12%3A30%3A45.123Z");
+  });
+
+  it("rejects an Invalid Date rather than sending 'Invalid Date'", () => {
+    expect(() => buildQueryUrl("/q/search", { at: new Date("nope") })).toThrow(/arrays and objects are rejected/);
+  });
+
   it("rejects a top-level array of params", () => {
     expect(() => buildQueryUrl("/q/search", [1, 2])).toThrow(/plain object/);
   });

data/vendor/javascript/vite-plugin-ruact/flight-client.test.mjs

@@ -36,6 +36,7 @@ import path from "node:path";
 import {
   buildTree,
   createFromFlightPayload,
+  createRowParser,
   clearPendingChunks,
 } from "./runtime/flight-client.js";
 
@@ -319,3 +320,133 @@ describe("Story 17.0a — the contract, driven by a gem-produced fixture", () =>
     expect(tree.props.posts).toEqual([{ id: 1, title: "$5 plan" }]);
   });
 });
+
+// Story 17-0d — every string of 1024+ bytes travels as a `T` row framed by its
+// BYTE length, with no trailing newline. The decoder split on "\n" and so lost
+// the root row: one long post body blanked the whole page. The fixtures are
+// what the Ruby serializer emits (spec/ruact/flight/text_framing_fixtures_spec.rb
+// writes and guards them).
+describe("text rows (Story 17-0d)", () => {
+  const FIXTURES = path.join(import.meta.dirname, "../../../spec/fixtures/flight");
+  const read = (name) => fs.readFileSync(path.join(FIXTURES, name));
+  const expected = JSON.parse(read("text_framing_expected.json").toString("utf8"));
+
+  const rowsOf = (chunks) => {
+    const rows = new Map();
+    const parser = createRowParser(({ id, row }) => rows.set(id, row));
+    for (const chunk of chunks) parser.push(chunk);
+    parser.end();
+    return rows;
+  };
+
+  it("decodes every value the serializer framed, byte for byte", () => {
+    const tree = createFromFlightPayload(read("text_framing.txt").toString("utf8"), MODULE_REGISTRY);
+    expect(tree).toEqual(expected);
+  });
+
+  it("puts long text inside Suspense content where the deferred row points", () => {
+    const tree = createFromFlightPayload(read("text_framing_suspense.txt").toString("utf8"), MODULE_REGISTRY);
+    const deferred = tree.props.children.type; // the already-arrived deferred row, wrapped
+    expect(deferred().props.children).toBe(expected.multibyte);
+  });
+
+  it("does not depend on where the network splits the bytes", () => {
+    const bytes = new Uint8Array(read("text_framing.txt"));
+    const whole = rowsOf([bytes]);
+
+    // Every single split point: inside ids, `T` lengths, text bodies and
+    // multibyte code points, and between rows.
+    for (let cut = 1; cut < bytes.length; cut += 1) {
+      const split = rowsOf([bytes.subarray(0, cut), bytes.subarray(cut)]);
+      expect(split).toEqual(whole);
+    }
+
+    // And one byte at a time.
+    expect(rowsOf([...bytes].map((b) => Uint8Array.of(b)))).toEqual(whole);
+  });
+
+  it("refuses a truncated text row instead of rendering part of the page", () => {
+    const bytes = new Uint8Array(read("text_framing.txt"));
+    const firstText = Buffer.from(bytes).indexOf(":T") + 10;
+    expect(() => rowsOf([bytes.subarray(0, firstText)])).toThrow(/Truncated Flight payload/);
+  });
+
+  it("refuses a malformed text length", () => {
+    const enc = new TextEncoder();
+    expect(() => rowsOf([enc.encode("1:Tzz,abc0:\"$T1\"\n")])).toThrow(/Malformed text row length/);
+  });
+
+  it("names a text reference whose row never arrived", () => {
+    expect(() => createFromFlightPayload('0:{"body":"$T7"}\n', MODULE_REGISTRY))
+      .toThrow(/Text row 7 is referenced but was never received/);
+  });
+
+  it("skips a stray line without a colon instead of losing the row after it", () => {
+    const rows = rowsOf([new TextEncoder().encode('garbage\n0:{"a":1}\n')]);
+    expect(rows.get(0)).toEqual({ kind: "model", value: { a: 1 } });
+  });
+
+  it("reads a large row arriving in small chunks in linear time", () => {
+    const big = JSON.stringify({ items: Array.from({ length: 60000 }, (_, i) => ({ id: i, name: `item ${i}` })) });
+    const bytes = new TextEncoder().encode(`0:${big}\n`);
+    const chunks = [];
+    for (let i = 0; i < bytes.length; i += 4096) chunks.push(bytes.subarray(i, i + 4096));
+    const started = performance.now();
+    const rows = rowsOf(chunks);
+    expect(rows.get(0).value.items).toHaveLength(60000);
+    // ~2.3 MB in 4 KB chunks; quadratic re-copying took seconds.
+    expect(performance.now() - started).toBeLessThan(1000);
+  });
+
+  it("still reads a last row that lost its trailing newline", () => {
+    const rows = rowsOf([new TextEncoder().encode('0:{"a":1}')]);
+    expect(rows.get(0)).toEqual({ kind: "model", value: { a: 1 } });
+  });
+});
+
+// Story 17-0c — the serializer emits Ruby Time/DateTime as "$D<ISO>" and
+// integers beyond ±(2^53 − 1) as "$n<decimal>". Components got the marker
+// strings. The fixture is the Ruby serializer's own output
+// (spec/ruact/flight/scalar_fixtures_spec.rb writes and guards it).
+describe("dates and big integers (Story 17-0c)", () => {
+  const FIXTURES = path.join(import.meta.dirname, "../../../spec/fixtures/flight");
+  const payload = fs.readFileSync(path.join(FIXTURES, "scalar_round_trip.txt"), "utf8");
+  const expected = JSON.parse(fs.readFileSync(path.join(FIXTURES, "scalar_round_trip_expected.json"), "utf8"));
+
+  // Expected JSON tags what JSON cannot hold: { date: ISO } and { bigint: "…" }.
+  const revive = (value) => {
+    if (Array.isArray(value)) return value.map(revive);
+    if (value && typeof value === "object") {
+      if ("date" in value) return new Date(value.date);
+      if ("bigint" in value) return BigInt(value.bigint);
+      return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, revive(v)]));
+    }
+    return value;
+  };
+
+  it("rebuilds every value with its JS type, nested ones included", () => {
+    const tree = createFromFlightPayload(payload, MODULE_REGISTRY);
+    expect(tree).toEqual(revive(expected));
+  });
+
+  it("gives a Date the same instant, offset applied, to the millisecond", () => {
+    const tree = createFromFlightPayload(payload, MODULE_REGISTRY);
+    expect(tree.time).toBeInstanceOf(Date);
+    expect(tree.time.toISOString()).toBe("2026-09-08T12:30:45.123Z");
+    expect(tree.zoned.toISOString()).toBe("2026-09-08T12:30:00.000Z");
+  });
+
+  it("keeps safe integers as numbers and only the unsafe ones as BigInt", () => {
+    const tree = createFromFlightPayload(payload, MODULE_REGISTRY);
+    expect(typeof tree.max_safe).toBe("number");
+    expect(typeof tree.min_safe).toBe("number");
+    expect(typeof tree.big).toBe("bigint");
+    expect(tree.big).toBe(9007199254740993n);
+    expect(tree.negative_big).toBe(-18446744073709551616n);
+  });
+
+  it("leaves a literal string that starts with $D a string", () => {
+    const tree = createFromFlightPayload(payload, MODULE_REGISTRY);
+    expect(tree.literal).toBe("$D2026-01-01 is a string");
+  });
+});

data/vendor/javascript/vite-plugin-ruact/ruact-router.test.mjs

@@ -11,6 +11,8 @@
 // classifier is never a silent no-op; and a Flight response still renders.
 
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
 import { setupRouter, teardownRouter } from "./runtime/ruact-router.js";
 
 const ORIGIN = "http://localhost:3000";
@@ -431,3 +433,85 @@ describe("ruact-router — the navigation boundary (Story 17.0f)", () => {
     });
   });
 });
+
+// Story 17-0d — a navigation reads the same byte parser as the initial load.
+// The stream is cut inside a `T` length, inside a multibyte code point and
+// inside a text body; the page must still render with the exact text.
+describe("ruact-router — long text in a streamed navigation (Story 17-0d)", () => {
+  const FIXTURES = path.join(import.meta.dirname, "../../../spec/fixtures/flight");
+  let dom;
+  let onNavigate;
+  let onError;
+
+  beforeEach(() => {
+    dom = installDom();
+    onNavigate = vi.fn();
+    onError = vi.fn();
+    globalThis.fetch = vi.fn();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    setupRouter({ onNavigate, moduleRegistry: {}, onError });
+  });
+
+  afterEach(() => {
+    teardownRouter();
+    vi.restoreAllMocks();
+  });
+
+  it("renders every framed string, whatever the chunk boundaries", async () => {
+    const bytes = new Uint8Array(fs.readFileSync(path.join(FIXTURES, "text_framing.txt")));
+    const expected = JSON.parse(fs.readFileSync(path.join(FIXTURES, "text_framing_expected.json"), "utf8"));
+    const firstLength = Buffer.from(bytes).indexOf(":T") + 3;      // inside the first hex length
+    const multibyte = Buffer.from(bytes).indexOf(Buffer.from("ç")) + 1; // between the two bytes of "ç"
+    const cuts = [0, firstLength, multibyte, multibyte + 700, bytes.length];
+    const body = new ReadableStream({
+      start(controller) {
+        for (let i = 0; i < cuts.length - 1; i += 1) controller.enqueue(bytes.slice(cuts[i], cuts[i + 1]));
+        controller.close();
+      },
+    });
+    const headers = new Headers({ "content-type": "text/x-component" });
+    fetch.mockResolvedValue({ ok: true, status: 200, statusText: "200", url: `${ORIGIN}/posts`, headers, body });
+
+    click(dom.listeners, "/posts");
+    await settle();
+
+    expect(onError).not.toHaveBeenCalled();
+    expect(onNavigate).toHaveBeenCalledTimes(1);
+    expect(onNavigate.mock.calls[0][0]).toEqual(expected);
+  });
+});
+
+// Story 17-0c — a navigation decodes dates and big integers like the first load.
+describe("ruact-router — dates and big integers in a navigation (Story 17-0c)", () => {
+  const FIXTURES = path.join(import.meta.dirname, "../../../spec/fixtures/flight");
+  let dom;
+  let onNavigate;
+
+  beforeEach(() => {
+    dom = installDom();
+    onNavigate = vi.fn();
+    globalThis.fetch = vi.fn();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    setupRouter({ onNavigate, moduleRegistry: {}, onError: vi.fn() });
+  });
+
+  afterEach(() => {
+    teardownRouter();
+    vi.restoreAllMocks();
+  });
+
+  it("hands the component a Date and a BigInt", async () => {
+    const body = fs.readFileSync(path.join(FIXTURES, "scalar_round_trip.txt"), "utf8");
+    fetch.mockResolvedValue(respond({ body, url: `${ORIGIN}/events` }));
+
+    click(dom.listeners, "/events");
+    await settle();
+
+    const tree = onNavigate.mock.calls[0][0];
+    expect(tree.time).toBeInstanceOf(Date);
+    expect(tree.time.toISOString()).toBe("2026-09-08T12:30:45.123Z");
+    expect(tree.big).toBe(9007199254740993n);
+    expect(tree.nested.ids).toEqual([1152921504606846976n, 7]);
+  });
+});
+

data/vendor/javascript/vite-plugin-ruact/runtime/flight-client.js

@@ -4,6 +4,19 @@
  * Handles the subset we emit from the Ruby server:
  *   - Model rows:  <hex_id>:<json>\n
  *   - Import rows: <hex_id>:I[moduleId, exportName, chunks]\n
+ *   - Error rows:  <hex_id>:E<json>\n
+ *   - Text rows:   <hex_id>:T<hex_byte_length>,<utf-8 text>   (NO newline)
+ *
+ * Every string of 1024 bytes or more travels as a text row, framed by its
+ * byte length, and is referenced from a model row as "$T<hex_id>". Both the
+ * initial load and the router read rows through ONE incremental byte parser
+ * ({@link createRowParser}), so a payload decodes the same whichever way it
+ * arrives and wherever the network splits it.
+ *
+ * Values JSON cannot hold travel as "$"-prefixed strings and are rebuilt:
+ * "$D<ISO 8601>" → Date, "$n<decimal>" → BigInt, "$NaN"/"$Infinity"/… →
+ * the number, "$undefined" → undefined. A literal string that starts with
+ * "$" arrives escaped as "$$…".
  *
  * Returns a React element tree by recursively converting
  * ["$", type, key, props] tuples into React.createElement calls.
@@ -72,6 +85,7 @@ export function parseLine(line) {
 
   const colonIdx = line.indexOf(":");
   if (colonIdx === -1) return null;
+  if (colonIdx === 0) return null; // hint row (":H…") — a preload signal, no id
 
   const id   = parseInt(line.slice(0, colonIdx), 16);
   const rest = line.slice(colonIdx + 1);
@@ -97,6 +111,140 @@ export function parseLine(line) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Incremental row parser (bytes in, rows out)
+// ---------------------------------------------------------------------------
+
+const COLON   = 0x3a;
+const COMMA   = 0x2c;
+const NEWLINE = 0x0a;
+const TAG_T   = 0x54;
+const HEX     = /^[0-9a-fA-F]+$/;
+
+const utf8 = new TextDecoder("utf-8");
+
+/**
+ * An incremental Flight row parser. Feed it the payload's bytes in any number
+ * of chunks — split anywhere, including inside a header, a length or a UTF-8
+ * code point — and it calls `onRow({ id, row })` once per complete row.
+ *
+ * Text rows are framed by their BYTE length, so the parser works on bytes,
+ * never on decoded strings: a string's `length` counts UTF-16 units and would
+ * misread any non-ASCII text.
+ *
+ * `end()` must be called when the input is complete. A truncated text row or
+ * a malformed length throws instead of yielding a partial payload.
+ *
+ * @param {(parsed: { id: number, row: object }) => void} onRow
+ * @returns {{ push(bytes: Uint8Array): void, end(): void }}
+ */
+export function createRowParser(onRow) {
+  // A growable byte buffer: `buf[pos, len)` is what is not parsed yet. It
+  // grows by doubling and is compacted only when full, so a large row arriving
+  // in many small chunks costs linear time, not a copy per chunk.
+  let buf = new Uint8Array(4096);
+  let len = 0;
+  let pos = 0;
+  // How far the newline search for the row at `pos` already got, so a long
+  // model row is not re-scanned from its start on every chunk.
+  let scanned = 0;
+
+  const append = (bytes) => {
+    if (len + bytes.length > buf.length) {
+      const rest = len - pos;
+      if (rest + bytes.length <= buf.length) {
+        buf.copyWithin(0, pos, len);
+      } else {
+        let capacity = buf.length * 2;
+        while (capacity < rest + bytes.length) capacity *= 2;
+        const next = new Uint8Array(capacity);
+        next.set(buf.subarray(pos, len));
+        buf = next;
+      }
+      scanned = Math.max(0, scanned - pos);
+      len = rest;
+      pos = 0;
+    }
+    buf.set(bytes, len);
+    len += bytes.length;
+  };
+
+  const advance = (to) => {
+    pos = to;
+    scanned = 0;
+  };
+
+  // Parses one row starting at `pos`. Returns false when it needs more bytes.
+  const step = () => {
+    const view  = buf.subarray(0, len);
+    const colon = view.indexOf(COLON, pos);
+
+    // A line with no colon before its end is not a row (a stray line from a
+    // proxy, say): skip it rather than let it swallow the row after it.
+    const headerEnd = colon === -1 ? len : colon;
+    const stray = view.subarray(pos, headerEnd).indexOf(NEWLINE);
+    if (stray !== -1) {
+      advance(pos + stray + 1);
+      return true;
+    }
+    if (colon === -1 || colon + 1 >= len) return false;
+
+    const header = utf8.decode(view.subarray(pos, colon)).trim();
+
+    if (HEX.test(header) && view[colon + 1] === TAG_T) {
+      const comma = view.indexOf(COMMA, colon + 2);
+      if (comma === -1) return false;
+      const lengthHex = utf8.decode(view.subarray(colon + 2, comma));
+      if (!HEX.test(lengthHex)) {
+        throw new Error(`[flight-client] Malformed text row length "${lengthHex}" for row ${header}`);
+      }
+      const length = parseInt(lengthHex, 16);
+      const start  = comma + 1;
+      if (start + length > len) return false;
+      onRow({ id: parseInt(header, 16), row: { kind: "text", value: utf8.decode(view.subarray(start, start + length)) } });
+      advance(start + length);
+      return true;
+    }
+
+    const newline = view.indexOf(NEWLINE, Math.max(colon + 1, scanned));
+    if (newline === -1) {
+      scanned = len;
+      return false;
+    }
+    const parsed = parseLine(utf8.decode(view.subarray(pos, newline)));
+    if (parsed) onRow(parsed);
+    advance(newline + 1);
+    return true;
+  };
+
+  return {
+    push(bytes) {
+      append(bytes);
+      while (pos < len) {
+        // Blank separators between rows carry nothing.
+        while (pos < len && (buf[pos] === NEWLINE || buf[pos] === 0x0d)) advance(pos + 1);
+        if (pos >= len || !step()) break;
+      }
+    },
+
+    end() {
+      const rest = utf8.decode(buf.subarray(pos, len));
+      if (!rest.trim()) return;
+      // A last model/import/error row without its trailing newline is complete
+      // as far as JSON can tell; a cut-off text row or header is not.
+      const colon = rest.indexOf(":");
+      const header = colon === -1 ? "" : rest.slice(0, colon).trim();
+      if (colon !== -1 && HEX.test(header) && rest[colon + 1] === "T") {
+        throw new Error(`[flight-client] Truncated Flight payload: text row ${header} is incomplete`);
+      }
+      const parsed = colon === -1 ? null : parseLine(rest);
+      if (!parsed) throw new Error(`[flight-client] Truncated Flight payload: "${rest.slice(0, 40)}"`);
+      onRow(parsed);
+      advance(len);
+    },
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Tree building
 // ---------------------------------------------------------------------------
@@ -136,11 +284,10 @@ export function buildTree(value, rows, moduleRegistry) {
  * @param {Object}  moduleRegistry
  */
 export function createFromFlightPayload(payload, moduleRegistry) {
-  const rows = new Map();
-  for (const line of payload.split("\n")) {
-    const parsed = parseLine(line);
-    if (parsed) rows.set(parsed.id, parsed.row);
-  }
+  const rows   = new Map();
+  const parser = createRowParser(({ id, row }) => rows.set(id, row));
+  parser.push(new TextEncoder().encode(payload));
+  parser.end();
   return buildTreeFromRows(rows, moduleRegistry);
 }
 
@@ -159,6 +306,21 @@ function _buildTree(value, rows, moduleRegistry) {
     if (value === "$Infinity")    return Infinity;
     if (value === "$-Infinity")   return -Infinity;
     if (value === "$-0")          return -0;
+    if (value.startsWith("$T")) {
+      const refId = parseInt(value.slice(2), 16);
+      const row   = rows.get(refId);
+      if (!row || row.kind !== "text") {
+        throw new Error(`[flight-client] Text row ${value.slice(2)} is referenced but was never received`);
+      }
+      return row.value;
+    }
+    // Story 17-0c — the serializer emits Ruby Time/DateTime as "$D<ISO 8601>"
+    // and integers outside JS's safe range as "$n<decimal>". The component
+    // gets the type, not the marker. (A literal string starting with "$" was
+    // escaped to "$$…" on the server and is handled above.)
+    if (value.startsWith("$D")) return new Date(value.slice(2));
+    // Guarded: a malformed marker must not throw and take the page down.
+    if (value.startsWith("$n") && /^-?\d+$/.test(value.slice(2))) return BigInt(value.slice(2));
     if (value.startsWith("$L")) {
       const refId = parseInt(value.slice(2), 16);
       const row   = rows.get(refId);

data/vendor/javascript/vite-plugin-ruact/runtime/ruact-router.js

@@ -10,7 +10,7 @@
  */
 
 import {
-  parseLine,
+  createRowParser,
   buildTreeFromRows,
   buildTree,
   resolvePendingChunk,
@@ -564,11 +564,10 @@ async function _processFlightResponse(response, {
   let   initialTreeSet = false;
   let   redirected     = false;
 
-  const processLine = (line) => {
-    const parsed = parseLine(line);
-    if (!parsed) return;
-
+  const processRow = (parsed) => {
     rows.set(parsed.id, parsed.row);
+    // A text row is data a model row points at; nothing renders on its own.
+    if (parsed.row.kind === "text") return;
 
     if (!initialTreeSet && rows.has(0)) {
       const rootRow = rows.get(0);
@@ -606,25 +605,17 @@ async function _processFlightResponse(response, {
     }
   };
 
-  const reader  = response.body.getReader();
-  const decoder = new TextDecoder();
-  let   buffer  = "";
+  // The same byte parser the initial load uses: text rows are framed by byte
+  // length, so the stream is never decoded line by line.
+  const parser = createRowParser(processRow);
+  const reader = response.body.getReader();
 
   while (true) {
     const { done, value } = await reader.read();
     if (done) break;
-
-    buffer += decoder.decode(value, { stream: true });
-
-    let newlineIdx;
-    while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
-      processLine(buffer.slice(0, newlineIdx));
-      buffer = buffer.slice(newlineIdx + 1);
-    }
+    parser.push(value);
   }
-
-  // Handle any remaining content without a trailing newline
-  if (buffer.trim()) processLine(buffer);
+  parser.end();
 
   // Fallback: if row 0 never triggered (shouldn't happen with valid server)
   if (!initialTreeSet && !redirected && rows.has(0)) {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruact
 version: !ruby/object:Gem::Version
-  version: 0.0.14
+  version: 0.0.15
 platform: ruby
 authors:
 - Luiz Garcia
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -76,6 +76,7 @@ files:
 - lib/ruact/configuration.rb
 - lib/ruact/controller.rb
 - lib/ruact/controller/document_rendering.rb
+- lib/ruact/controller/format_negotiation.rb
 - lib/ruact/controller/page_rendering.rb
 - lib/ruact/controller/pages.rb
 - lib/ruact/doctor.rb
@@ -83,11 +84,13 @@ files:
 - lib/ruact/erb_preprocessor_hook.rb
 - lib/ruact/errors.rb
 - lib/ruact/flight.rb
+- lib/ruact/flight/js_date.rb
 - lib/ruact/flight/react_element.rb
 - lib/ruact/flight/renderer.rb
 - lib/ruact/flight/request.rb
 - lib/ruact/flight/row_emitter.rb
 - lib/ruact/flight/serializer.rb
+- lib/ruact/flight/utf8.rb
 - lib/ruact/html_converter.rb
 - lib/ruact/layout_source.rb
 - lib/ruact/manifest_resolver.rb
@@ -95,6 +98,7 @@ files:
 - lib/ruact/packaging.rb
 - lib/ruact/query.rb
 - lib/ruact/railtie.rb
+- lib/ruact/redirect_path.rb
 - lib/ruact/render_context.rb
 - lib/ruact/render_pipeline.rb
 - lib/ruact/routing.rb