ruact 0.0.14 → 0.0.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '048ef204d79fa3c03ff9ab08c43e5d9d1fc1f42c0e92c7cf7311b510bc879b0a'
-  data.tar.gz: 67fdef7b25ac3ac2ea552eed361a45a62710bf28145ae7892d0e1f46f462aa47
+  metadata.gz: cc962c661c39c1c9905f3aee2ddb2c956dc196218f283ef5532bf8c9826fe98f
+  data.tar.gz: c3211a4a820d0ad77daebcd5ee071f91b5f10c2be9153f0bb6e62cc8153c61c9
 SHA512:
-  metadata.gz: cd6d63eaaa47a7cde090700c44ba53fe8cf9b29d82cc05ce2f672b98b01dd83dd82cb046b109cd47a328594344b1950f21d75fee5338870a0df5be438e86843e
-  data.tar.gz: 44b2880d6879617b00adc9a8ae070a1f722e147a782592c4b527e98dbe9af42d925f45c68daca3272df28a95c7a0c89d762164bf205c9da2dbf195e142e8e88d
+  metadata.gz: 8dcd8f0f4988c3a3e0f9950e6210d68986d980256a2ff9463a2847107513ad8c3090c9949f728aaebc810ccf1937d7c52589f267dd60b5a12ae6a70f9e1ce95a
+  data.tar.gz: 4c7c1bf1221798c93d183456f07cb4d4549b8ec4bfa56ff091133edff176c77bd9709f303fcbf372ffea994530aaefcb92c069d66abe9e861578578b64f68c20

data/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.16] - 2026-10-03
+
+### Fixed
+
+- **A quoted attribute on a component was dropped without a word.** `<PostCard title="Hello" />` reached the component with no `title`: only `title={…}` was read, and the quoted form is the first thing a JSX hand writes. Component tags now take the three JSX forms. `name={ruby}` is a Ruby expression, as before — except that a hyphenated name keeps its hyphen: `aria-label={…}` used to arrive as `label`. `name="text"` is the string; a quoted value never runs Ruby. A bare `name` is `true`. Anything else raises a template error that names the attribute, including ERB inside a quoted value (`title="<%= @t %>"`), which a component attribute cannot run: write `title={@t}`.
+
+- **The Getting Started page logged a React error.** Server-rendered siblings, such as an `<h1>` next to a component or the rows of an ERB loop, reached React as an array of elements with no keys, and React logged "Each child in a list should have a unique key" on the guide's own example. Siblings are now handed to React as separate children, the way JSX compiles them, so React does not check them for keys. That covers the page itself, any element's children and the content a `<Suspense>` boundary streams in. No key is invented, and a key the template gives still wins. A data array passed as a `children` prop is left as it is.
+
+- **A form React handles itself also got a router request.** The client router decided on clicks and form submits before the app's own handlers ran, so a form whose `onSubmit` calls `preventDefault()` was also fetched by the router: the scaffold's form sent a stray `GET` of its own page on every save. The router now decides after them, and an event the app prevented is left alone. The same holds for a link whose `onClick` prevents the default. A handler that stops the event's propagation now also keeps it from the router, which then leaves the browser to follow the link or submit the form, as Turbo does.
+
+- **The install message said a component works in any ERB view.** In island mode, the default, it works in the views of a controller that has `include Ruact::Controller`; the message now says so.
+
+### Changed
+
+- **A server function no longer returns what callbacks and auth libraries put on the controller, or answers 500 because of it.** A function call's JSON was the controller's whole `view_assigns`. An authentication library that memoizes the user in an instance variable (Devise's `current_user` sets `@current_user` on its first call) put that user in every response. Under `strict_serialization`, on by default in production, a user model without `ruact_props` then made every function call answer 500. Two rules now decide what the JSON holds:
+  - **What callbacks set stays out, unless the action assigns it a different object.** `@post = Post.find(...)` in the action is returned. A `before_action :set_post` whose `@post` the action only updates in place (`@post.update(...)`) is not: reassign it (`@post = @post.reload`) or `render json:`. This covers plain values too: a callback's `@current_user_id = 5` is not returned, and neither is a value the action sets to the very same object the callback stored (`@count = 0` after a callback did the same, or a memoized helper's result).
+  - **Authentication and authorization memos are never returned,** even when the action fills them by calling `current_user` or `authorize`. The names are in the new `config.server_function_hidden_ivars`, default `["current_user", "current_ability", "pundit"]` for Devise's `:user` scope, CanCanCan and Pundit. Every name starting with `_` is hidden too. Add the memo of any other scope or helper, such as Devise's `@current_admin` for `devise_for :admins`: `config.server_function_hidden_ivars += ["current_admin"]`.
+
+  A page render's view still sees every instance variable.
+
+## [0.0.15] - 2026-10-03
+
+### Security
+
+- **Text in a prop could run as script on the page (stored XSS).** On a plain browser load, the page's Flight payload is inlined in a `<script>` element. It was embedded as a Ruby string literal with only a lowercase `</script>` escaped. A value containing `</SCRIPT>`, `</script >` or another casing closed the element, and the rest ran as HTML. A post titled `</SCRIPT><img src=x onerror=…>` executed its handler for everyone who opened the list. Any string a ruact page passes as a prop, such as user-written record content, could do it. The payload is now embedded as a JSON string literal with `<`, `>`, `&`, U+2028 and U+2029 escaped, so no character of it can end the element. Control characters such as `\e`, which the Ruby literal also delivered wrongly to JavaScript, now arrive intact. **Affects every version up to and including 0.0.14; upgrade.** `Ruact::Testing`'s matchers read both forms.
+
+- **A same-origin redirect could send the browser to another site.** `redirect_to "#{root_url}#{params[:path]}"` with `path=/evil.com` gives `https://your.app//evil.com`, which is your own host, so Rails' open-redirect check accepts it. ruact then shortened every same-origin URL to its path, `//evil.com`, and a browser reads that as a URL to `evil.com`. A server function answered `{"$redirect":"//evil.com"}` and the runtime navigated there. A page redirect produced a Flight row the router refused, so the navigation silently did nothing. A path that a browser would read as another host now keeps its absolute, same-origin URL.
+
+### Fixed
+
+- **Any text of 1 KB or more blanked the page.** The server sends every string of 1024 bytes or more as a separate row framed by its byte length, with no newline after it. The browser read the payload line by line, so it lost the row that holds the page and showed nothing: `[flight-client] No root row (id=0) found in payload`. A scaffolded post whose body was one long paragraph made the whole list disappear. The first load and the router now read the payload with one parser that works on bytes, so text arrives exactly as it left, including multibyte characters and newlines, wherever the network splits it. A truncated or malformed payload, or a reference to text that never arrived, is now an error that says so instead of a blank page. Long text inside Suspense content was also never sent at all; it is now, before the row that uses it. `Ruact::Testing`'s matchers compare a long prop by its text.
+
+- **Dates and large integers reached React as marker strings.** A Ruby `Time`, `DateTime` or `ActiveSupport::TimeWithZone` prop arrived as `"$D2026-09-08T12:30:45.123Z"`, and an integer beyond JavaScript's safe range (±(2^53 − 1)) as `"$n9007199254740993"`. A component had to know ruact's transport to use them. They now arrive as a `Date`, with the same instant and millisecond precision, and as a `BigInt`; integers inside the safe range stay numbers. This holds on the first load and after a navigation. A `BigInt` is not a `number`: `JSON.stringify` refuses it and some libraries expect numbers, so format it where you use it (`String(id)`). A `Date` is not text, so `{createdAt}` as a child now raises "Objects are not valid as a React child"; format it (`createdAt.toLocaleDateString()`). Both can go back: a server function sends a `BigInt` argument as its decimal string, and `useQuery` takes a `BigInt` or `Date` param (the generated query accessors' TypeScript parameter types do not list them yet). Years outside 0–9999 are written in the form JavaScript reads (`+010000`). A calendar `Date` (`Date.today`) arrives as `"YYYY-MM-DD"`; it used to raise `Ruact::SerializationError` in production, where `strict_serialization` is on. A symbol whose name starts with `$` is escaped like a string.
+
+- **`respond_to` answered 406 to every navigation and form submit of the client router.** The router asks for a page with `Accept: text/x-component`, which is not a Rails MIME type, so the request negotiated no format and `respond_to { |format| format.html { … } }` raised `ActionController::UnknownFormat`. That is the controller Rails' own scaffold writes: with `include Ruact::Controller`, its `create`, `update` and `destroy` failed whenever the router submitted the form. A router request now negotiates `format.html`, the same page a browser asks for: the `format.html` branch runs, and its render, status or redirect reaches the browser as a ruact answer. A URL that names a format (`/posts/1.json`) and an `Accept: application/json` request still get `format.json`. The format is negotiated before every callback, so an authentication `before_action` that answers with `respond_to` gets it too. A `respond_to` with no `format.html` still answers 406, now with a message naming the missing branch and the `data-ruact="false"` way out. A partial that exists only in another format (`.text.erb`) is no longer found by a ruact page during a router request.
+
+- **`bin/rails server` without Vite showed an empty page and no error.** Once Vite has run once, the component manifest is on disk, so a page renders without the dev server, but its JavaScript is not served: the page answered 200 with nothing in it, and the only clue was a 404 in the browser's network tab. In development, when the Vite dev server is not running and there is no build to serve, the page now shows a banner that says so and to start the app with `bin/dev`, and the Rails log gets the same `[ruact]` line. The banner is plain HTML, so it does not need the JavaScript that failed to load. Nothing changes with Vite running, with a build present, or outside development.
+
+- **Text that is not valid UTF-8 broke the page.** A string holding Latin-1 bytes, or bytes that are not text at all, made the page answer 500 for every viewer, because JSON refuses invalid UTF-8. A long one, 1024 bytes or more, was sent with a byte count that did not match what the browser decoded. Strings now leave as valid UTF-8: text in another encoding is transcoded, binary-tagged UTF-8 (`File.binread`, an HTTP body) is read as the text it is, and bytes that are not text become U+FFFD, as a browser shows them.
+
 ## [0.0.14] - 2026-10-02
 
 ### Fixed
@@ -104,7 +144,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 
 - **The README no longer claims props are an allowlist.** It said *"Props are an allowlist — other columns never cross"*, describing the opt-in rather than the default. The default is `as_json`: every attribute of a model prop crosses to the client, and the gem says so in the log (`ALL attributes exposed to client`). A reader who took the bullet at face value would have believed the safe behaviour was already on. The bullet now leads with what actually happens, then names `ruact_props` as the thing that makes it an allowlist and `strict_serialization` as what turns the permissive path into an error in production.
+
 - **The server-functions bullet no longer calls the whole generated module "typed".** Only queries carry an exact signature (one property per declared keyword, since 0.0.5). An action's accessor is typed to be callable and to satisfy `<form action>`, but its arguments and resolved value are `Record<string, unknown>` and `unknown` — useful, and not the autocomplete the word "typed" promises. Both are now described as what they are.
+
 - **The mechanism is stated where the reader meets it.** "Capitalized tag means React. Lowercase stays HTML." now sits directly under the ERB/TSX pair, and the paragraph that follows explains the wire in plain terms — the view renders server-side as it always did, the result travels as a React tree in the format React uses for Server Components, the data is inlined so React renders without a fetch, and Node builds the bundle and does nothing else.
 
 ### Fixed
@@ -144,6 +186,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   It is referenced by absolute URL and **nothing binary is committed here** — so neither `gem install ruact` nor a clone of this repository carries a multi-megabyte file, permanently, for a picture. Two things keep it from aging into a lie: the URL belongs to the site's URL contract, and `spec/readme_demo_message_spec.rb` pins the message the recording shows against a fixture the gem itself produced. If the wording changes, that spec goes red and names the recording as the thing to redo.
 
 - **`LICENSE.txt`** — the gemspec has declared `spec.license = "MIT"` since the first commit while the repository contained no licence file, so both GitHub and the packaged gem shipped a promise with nothing behind it.
+
 - **`spec.description` and `metadata["documentation_uri"]` in the gemspec** — RubyGems rendered the one-line `summary` as the whole description and fell through to rubydoc.info for documentation.
 
 ### Fixed
@@ -300,6 +343,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Tooling
 
 - **Code coverage instrumentation** (Story 6.7). Added `simplecov` and `simplecov-lcov` as development dependencies; gem CI uploads coverage from the canonical matrix cell (Ruby 3.3 × Rails 7.2) to Codecov on every push and PR with the `gem` flag. **Baseline at merge: 88.30% line (581/658), 72.25% branch (239 specs).** (Corrects the earlier 87.89% figure recorded at story-merge time, which was a typo of the SimpleCov output for 567/644 = 88.04%; the current numbers reflect the post-review state after Story 6.7 review F1 refactored `html_converter.rb#convert_element` into helpers, which added a few lines and one new spec.) Coverage is informativo (not a CI gate); see Codecov PR comments for diff coverage on individual changes. Diff coverage target per project DoD: ≥ 90% line / ≥ 80% branch on new code.
+
 - **Spec `rails_stub.rb` fix.** The previous `$LOADED_FEATURES.any? { |f| f.end_with?("/rails.rb") }` heuristic for skipping the `LOADED_FEATURES` insertion was unreliable — unrelated gems ship files at `*/rails.rb` (e.g. SimpleCov's `simplecov/profiles/rails.rb`). Replaced with an unconditional insertion guarded only by the existing `return if defined?(Rails)` early-exit, which is the correct invariant.
 
 ### Renamed
@@ -327,6 +371,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Rake task descriptions and internal `require` statements migrated from `rails_rsc` to `ruact`. Public API is unchanged; this is a documentation and tooling rename only.
 - **Render context now passed explicitly** (Story 7.1). `Ruact::ComponentRegistry` (which used `Thread.current`) has been removed; the per-render component list is now an instance of `Ruact::RenderContext` passed explicitly through `Controller#ruact_render → RenderPipeline → HtmlConverter`. The `Ruact/NoSharedState` cop now passes with no exceptions in `lib/ruact/`. **No public API change.** Note: `Ruact::Flight::*`, `Ruact::Internal::*`, and `Ruact::RenderContext` are not part of the public API and may change between minors. Hosts upgrading need no application code changes. See decision note for rationale and contributor guidance.
+
 - **`RenderPipeline` entry points consolidated** (Story 7.2). `RenderPipeline#call`, `#stream`, and `#from_html` have been removed and replaced with a single `#render(input, mode:)` entry point. `input` selects the source — `{ erb: String, binding: Binding }` for ERB templates or `{ html: String, render_context: Ruact::RenderContext }` for pre-rendered HTML; `mode:` selects the output shape — `:string` returns a `String` (deferred chunks inlined eagerly), `:stream` returns an `Enumerator` of Flight rows (deferred chunks delay). Conflicting input keys, missing siblings, and unknown modes raise `ArgumentError` with the offending input named. **No public API change** — `Ruact::Controller#ruact_render` is unchanged. Note: `Ruact::Flight::*`, `Ruact::Internal::*`, and `Ruact::RenderPipeline` are not part of the public API and may change between minors. See decision note for rationale and contributor guidance.
 
   _Migration for any external code that may have reached into `Ruact::RenderPipeline`:_ `pipeline.call(erb, binding)` → `pipeline.render({ erb: erb, binding: binding }, mode: :string)`; `pipeline.stream(erb, binding)` → `pipeline.render({ erb: erb, binding: binding }, mode: :stream)`; `pipeline.from_html(html, render_context: ctx)` → `pipeline.render({ html: html, render_context: ctx }, mode: :string)`; `pipeline.from_html(html, render_context: ctx, streaming: true)` → `pipeline.render({ html: html, render_context: ctx }, mode: :stream)`.
@@ -360,23 +405,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - **ERB preprocessor** — PascalCase RSC component tags (`<Button />`, `<LikeButton postId={@post.id} />`) are transformed to Flight placeholders in ERB templates before Ruby evaluation.
+
 - **`<Suspense>` support** — `<Suspense fallback="Loading...">` in ERB templates maps to React Suspense boundaries in the Flight payload.
+
 - **React Flight wire format serializer** — Full Ruby-to-Flight protocol implementation covering: nil, booleans, integers, floats (NaN/Infinity/-0), strings (with `$` escaping), arrays, hashes, `Time`/`DateTime`, large strings (T rows), `ReactElement`, `SuspenseElement`, and `ClientReference`.
+
 - **`Ruact::Controller` concern** — Include in `ApplicationController` to enable RSC rendering. Provides `ruact_render`, RSC request detection (`text/x-component` / `Ruact-Request: 1` header), HTML shell generation with inline `__FLIGHT_DATA`, and Flight-aware `redirect_to`.
+
 - **Streaming mode** — When `ActionController::Live` is included, Flight rows are streamed to the client as they are produced (Suspense-aware).
+
 - **Client component resolution** — `Ruact::ClientManifest` reads `public/react-client-manifest.json` (generated by the Vite plugin) and resolves component names to `ClientReference` objects via a dual-path resolver.
+
 - **`Ruact::Serializable` mixin** — `ruact_props` DSL for declaring safe prop attributes on Ruby model objects.
+
 - **Install generator** — `rails generate ruact:install` scaffolds the initializer, Vite config patch, and JavaScript entry point.
+
 - **`ruact:doctor` Rake task** — Checks manifest presence, Vite server accessibility, controller setup, and streaming mode configuration.
+
 - **`vite-plugin-ruact`** — Vite plugin (npm package, co-versioned) that scans `"use client"` components and emits `public/react-client-manifest.json`.
+
 - **Client-side navigation** — JavaScript `ruact-router.js` intercepts same-origin link clicks and form submissions, fetches Flight payloads, and updates the React tree without full-page reloads.
+
 - **Error overlay** — Development-mode React error boundary with dismissible overlay for Flight parse and rendering errors.
+
 - **RSpec test suite** — 223 examples covering all modules: Flight serializer, ERB preprocessor, HTML converter, render pipeline, controller, client manifest, serializable, install generator, and `ruact:doctor`.
+
 - **Memory benchmark** — `rake benchmark:memory` enforces a 120% allocation regression gate against `spec/benchmarks/baseline.json`.
+
 - **CI matrix** — GitHub Actions: RSpec across Ruby 3.2 × 3.3 × Rails 7.0 × 7.1 × 7.2 × 8.0; RuboCop; YARD docs; memory benchmark; E2E system tests against React 19.0.0 and 19.x (Capybara + Cuprite); non-blocking React@next job with auto-issue on failure.
+
 - **E2E test app** — `e2e/` Rails app (no DB, in-memory Post model) with full CRUD system tests validating the complete request cycle.
 
-[Unreleased]: https://github.com/luizcg/ruact/compare/v0.0.14...HEAD
+[Unreleased]: https://github.com/luizcg/ruact/compare/v0.0.16...HEAD
+[0.0.16]: https://github.com/luizcg/ruact/releases/tag/v0.0.16
+[0.0.15]: https://github.com/luizcg/ruact/releases/tag/v0.0.15
 [0.0.14]: https://github.com/luizcg/ruact/releases/tag/v0.0.14
 [0.0.13]: https://github.com/luizcg/ruact/releases/tag/v0.0.13
 [0.0.12]: https://github.com/luizcg/ruact/releases/tag/v0.0.12

data/lib/generators/ruact/install/install_generator.rb

@@ -425,7 +425,8 @@ module Ruact
 
         show_shadcn_next_steps if shadcn?
 
-        say "\nThen add <MyComponent /> to any ERB view."
+        say "\nThen add <MyComponent /> to an ERB view of a ruact page:" unless whole_app?
+        say "\nThen add <MyComponent /> to any ERB view." if whole_app?
         say layout_summary
         say ""
         say "Note: re-run this generator after updating the ruact gem to refresh"

data/lib/generators/ruact/install/templates/AGENTS.md.tt

@@ -84,8 +84,8 @@ READ IT instead of simulating the name generation. Regenerate after routes/queri
    `<Suspense fallback="...">...</Suspense>` pair.
 2. **`{}` props are Ruby, not JavaScript.** `<Badge label={@post.title} />`
    evaluates `@post.title` as a Ruby expression in the ERB. No JS ternaries,
-   no `{...spread}`, no JSX children. Plain unbraced string props are not
-   supported either — always use braces.
+   no `{...spread}`, no JSX children. A quoted value (`title="Hi"`) is a
+   plain string and a bare attribute is `true`, as in JSX.
 3. **One action, two response shapes.** A `Ruact::Server` non-GET action
    answers JSON — its instance variables, or `204`, or `{"$redirect": path}` —
    when the request's `Accept` header is exactly `application/json`, which is

data/lib/ruact/component_attributes.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Ruact
+  # The attributes of a PascalCase component tag in ERB, read the way JSX
+  # reads them (see {ErbPreprocessor}). Returns ordered
+  # +[name, ruby_expr]+ pairs for the props Hash the template renders.
+  module ComponentAttributes
+    ATTR_NAME_RE = /\A[a-zA-Z_][\w-]*/
+
+    # Parses the attributes string of a component tag into ordered
+    # +[name, ruby_expr]+ pairs, e.g. [["postId", "@post.id"], ["title", "\"Hi\""]].
+    # The names feed the Story 13.5 contract check; the pairs render the props
+    # Hash. The three JSX attribute forms:
+    #
+    #   name={ruby}   — the Ruby expression (nested braces honored)
+    #   name="text"   — the string, as JSX passes it (single quotes too)
+    #   name          — +true+, as JSX passes a bare attribute
+    #
+    # Anything else raises instead of being dropped: an unbraced attribute used
+    # to vanish without a word, and it is the first thing a JSX hand writes.
+    def self.parse(attrs_string)
+      attrs = attrs_string.sub(%r{\s*/\z}, "")
+      pairs = []
+      i = 0
+      while i < attrs.length
+        if attrs[i].match?(/\s/)
+          i += 1
+          next
+        end
+        name = attrs[i..][ATTR_NAME_RE] ||
+               raise(PreprocessorError, "unexpected #{attrs[i, 20].inspect} in the component's attributes")
+        i += name.length
+        i += 1 while attrs[i]&.match?(/\s/)
+        if attrs[i] == "="
+          i += 1
+          i += 1 while attrs[i]&.match?(/\s/)
+          value, i = parse_value(attrs, i, name)
+          pairs << [name, value]
+        else
+          pairs << [name, "true"]
+        end
+      end
+      pairs
+    end
+
+    # One attribute value at +attrs[i]+ → [ruby_expr, index after it].
+    def self.parse_value(attrs, pos, name)
+      case attrs[pos]
+      when "{"
+        expr = extract_braced_expr(attrs, pos + 1)
+        raise PreprocessorError, "#{name}={} is empty: put a Ruby expression in the braces" if expr.strip.empty?
+
+        [expr, pos + expr.length + 2]
+      when '"', "'"
+        close = attrs.index(attrs[pos], pos + 1)
+        text = attrs[(pos + 1)...(close || attrs.length)]
+        if text.include?("<%")
+          raise PreprocessorError, "#{name}= holds ERB, which a component attribute cannot run. " \
+                                   "Pass the Ruby in braces instead: #{name}={...}"
+        end
+        unless close
+          raise PreprocessorError, "unclosed quote in #{name}= (a component tag cannot contain `>`, " \
+                                   "even inside a quoted value: pass the text from Ruby instead)"
+        end
+
+        [text.inspect, close + 1]
+      else
+        raise PreprocessorError, "#{name}= needs a value: #{name}={ruby} or #{name}=\"text\""
+      end
+    end
+
+    # Given a string and a start position (just after the opening '{'),
+    # returns the content up to the matching '}'.
+    def self.extract_braced_expr(str, start)
+      depth = 1
+      i = start
+      while i < str.length && depth.positive?
+        case str[i]
+        when "{" then depth += 1
+        when "}" then depth -= 1
+        end
+        i += 1
+      end
+      raise PreprocessorError, "unclosed brace in prop expression" if depth.positive?
+
+      str[start...(i - 1)]
+    end
+
+    private_class_method :parse_value, :extract_braced_expr
+  end
+end

data/lib/ruact/configuration.rb

@@ -26,6 +26,7 @@ module Ruact
       shadcn_compatible_versions
       layout
       layout_stylesheets
+      server_function_hidden_ivars
     ].freeze
 
     # @!attribute [r] manifest_path
@@ -125,6 +126,19 @@ module Ruact
     #   @example Set an app-wide default expiry
     #     Ruact.configure { |c| c.signed_global_id_default_expires_in = 1.hour }
     #
+    # @!attribute [r] server_function_hidden_ivars
+    #   @return [Array<String>] Instance-variable names (no `@`) a server
+    #     function's JSON never returns, even when the action set them: the
+    #     memoization ivars of authentication and authorization libraries,
+    #     which an action fills just by calling `current_user` or `authorize`.
+    #     Names starting with `_` are always hidden. Default
+    #     `["current_user", "current_ability", "pundit"]` (Devise's `:user`
+    #     scope, CanCanCan, Pundit); another Devise scope memoizes its own
+    #     `@current_<scope>` — add it. Assign to replace the list; to keep the
+    #     defaults, add to them.
+    #   @example Also hide an app's own memoized account
+    #     Ruact.configure { |c| c.server_function_hidden_ivars += ["current_account"] }
+    #
     # @!attribute [r] shadcn_compatible_versions
     #   @return [Array<Integer>] Story 10.5 — the shadcn/ui MAJOR versions the
     #     `ruact:scaffold` generator is regression-tested against. When the
@@ -255,6 +269,7 @@ module Ruact
         @shadcn_compatible_versions = [1, 2, 4]
         @layout = false
         @layout_stylesheets = [:app]
+        @server_function_hidden_ivars = %w[current_user current_ability pundit]
       end
     end
 
@@ -278,6 +293,9 @@ module Ruact
     # @api private
     # @return [Ruact::Configuration] self, frozen
     def seal!
+      # An Array attribute mutated in place inside the block (`list << x`)
+      # never passed through its writer; validate it here, before publication.
+      validate_attribute_value!(:server_function_hidden_ivars, server_function_hidden_ivars)
       ATTRIBUTES.each do |attr|
         value = public_send(attr)
         next if value.nil? || value.frozen?
@@ -322,6 +340,7 @@ module Ruact
       when :shadcn_compatible_versions then validate_shadcn_compatible_versions!(value)
       when :layout                     then validate_layout!(value)
       when :layout_stylesheets         then validate_layout_stylesheets!(value)
+      when :server_function_hidden_ivars then validate_server_function_hidden_ivars!(value)
       end
     end
 
@@ -440,6 +459,15 @@ module Ruact
             "major versions (e.g. [1, 2]); got #{value.inspect}."
     end
 
+    # An Array of ivar names; a leading `@` is a typo that would hide nothing.
+    def validate_server_function_hidden_ivars!(value)
+      return if value.is_a?(Array) && value.all? { |name| name.is_a?(String) && !name.start_with?("@") }
+
+      raise Ruact::ConfigurationError,
+            "Ruact::Configuration#server_function_hidden_ivars must be an Array of instance-variable " \
+            "names without the @ (e.g. [\"current_user\"]); got #{value.inspect}."
+    end
+
     def build_error_message(attr, location)
       <<~MSG.strip
         ruact: cannot mutate Ruact::Configuration##{attr} after initialization.

data/lib/ruact/controller/format_negotiation.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Ruact
+  module Controller
+    # Story 17-0j — a router request answers as `format.html`.
+    #
+    # The ruact router asks for a page with `Accept: text/x-component`, which is
+    # not a Rails MIME type: the request negotiated no format at all, and every
+    # `respond_to` raised `ActionController::UnknownFormat` (406) on a
+    # navigation or a form submit. That is the controller Rails' own scaffold
+    # writes. A router request asks for the PAGE, the same thing a browser's
+    # `text/html` asks for, so it now negotiates `:html` — unless the URL names
+    # a format (`/posts/1.json`), which wins as it always has. Whether the
+    # answer is Flight or an HTML document is still ruact's decision, read from
+    # the Accept header, not from the negotiated format.
+    module FormatNegotiation
+      extend ActiveSupport::Concern
+
+      # Rails' negotiated-formats slot on the request. Writing it directly,
+      # rather than `request.format =`, leaves `params[:format]` alone.
+      FORMATS_KEY = "action_dispatch.request.formats"
+
+      # `respond_to` with no `format.html` still answers 406 to a router
+      # request, as Rails does to a browser — with the reason and the fix. Only
+      # when THIS respond_to found no format: an UnknownFormat raised inside a
+      # branch (a nested respond_to, an explicit raise), or one for a format
+      # the URL named, keeps Rails' own message.
+      #
+      # @see ActionController::MimeResponds#respond_to
+      def respond_to(*mimes, &block)
+        collector = nil
+        recording = block && lambda { |given|
+          collector = given
+          yield(given)
+        }
+        super(*mimes, &recording)
+      rescue ActionController::UnknownFormat
+        raise unless __ruact_router_found_no_format?(collector, mimes)
+
+        raise ActionController::UnknownFormat,
+              "#{self.class.name}##{action_name} was asked for its page by the ruact router, which " \
+              "negotiates format.html, and its respond_to has no format.html branch. Add one, or " \
+              "link to this action with data-ruact=\"false\" so the browser loads it."
+      end
+
+      private
+
+      # Before every callback — a host's own `prepend_before_action` included —
+      # since this sits above AbstractController::Callbacks in the chain. An
+      # auth callback that answers with `respond_to` gets the format too.
+      def process_action(...)
+        __ruact_negotiate_router_request_as_html
+        super
+      end
+
+      def __ruact_negotiate_router_request_as_html
+        return unless ruact_request?
+        return if __ruact_url_format.present?
+
+        request.set_header(FORMATS_KEY, [Mime[:html]])
+      end
+
+      # The format the URL names (`/posts/1.json`, `?format=json`). Read from
+      # the path and query only: this runs before Rails' rescue and logging,
+      # where parsing a malformed request BODY must not raise.
+      def __ruact_url_format
+        request.path_parameters[:format] || request.query_parameters[:format]
+      rescue ActionController::BadRequest, ActionDispatch::Http::Parameters::ParseError
+        nil
+      end
+
+      def __ruact_router_found_no_format?(collector, mimes)
+        return false unless ruact_request? && __ruact_url_format.blank?
+
+        if collector
+          collector.format.nil?
+        else
+          request.negotiate_mime(mimes.map { |mime| Mime[mime] }).nil?
+        end
+      end
+    end
+  end
+end

data/lib/ruact/controller/page_rendering.rb

@@ -98,7 +98,7 @@ module Ruact
       # Whether Rails, left alone, would render `page` for `action`: the lookup
       # it does itself, with the formats it negotiated for this request (and a
       # render's own `formats:` / `variants:` / `handlers:` / `locale:`). A Flight request
-      # negotiates every format, HTML first — the page; a `.json` request or a
+      # negotiates HTML (Ruact::Controller::FormatNegotiation) — the page; a `.json` request or a
       # `format.json` branch negotiates JSON — the JSON template, or Rails' own
       # MissingTemplate.
       def __ruact_rails_would_render?(action, details, page)

data/lib/ruact/controller.rb

@@ -3,11 +3,13 @@
 require "json"
 require "socket"
 require "uri"
+require_relative "redirect_path"
 require_relative "view_helper"
 require_relative "validation_errors_collector"
 require_relative "controller/document_rendering"
 require_relative "controller/pages"
 require_relative "controller/page_rendering"
+require_relative "controller/format_negotiation"
 
 module Ruact
   # Include in the controllers whose pages render through ruact (island mode,
@@ -43,6 +45,9 @@ module Ruact
     # An explicit `render` of a ruact page goes through ruact (Story 17.0i).
     # See Ruact::Controller::PageRendering.
     include Ruact::Controller::PageRendering
+    # A router request negotiates `format.html`, so `respond_to` answers it
+    # (Story 17-0j). See Ruact::Controller::FormatNegotiation.
+    include Ruact::Controller::FormatNegotiation
 
     # Story 17.0f — "is this action a ruact PAGE?", answered at CLASS level so the
     # navigation boundary (Ruact::NavigationBoundary) can ask it before any action
@@ -266,6 +271,8 @@ module Ruact
         redirect_url  = uri.path.nil? || uri.path.empty? ? "/" : uri.path
         redirect_url += "?#{uri.query}"    if uri.query
         redirect_url += "##{uri.fragment}" if uri.fragment
+        # Same-origin `https://app//evil.com` must not shrink to `//evil.com`.
+        redirect_url = url if Ruact::RedirectPath.protocol_relative?(redirect_url)
       rescue ::URI::InvalidURIError
         return super
       end

data/lib/ruact/erb_preprocessor.rb

@@ -51,11 +51,6 @@ module Ruact
     # unrelated `<% "</Dialog>" %>` appears later).
     ERB_ISLAND_RE = /<%.*?%>/m
 
-    # Matches a +{ruby_expr}+ attribute value — captures everything between the braces.
-    # We use a simple bracket-depth counter approach during scanning instead of regex
-    # because expressions can contain nested braces: {foo.bar({ a: 1 })}.
-    PROP_RE = /\b([a-zA-Z_][a-zA-Z0-9_]*)=\{/
-
     # Transform ERB source, replacing component tags with ERB placeholders.
     # Returns the transformed source string.
     #
@@ -114,7 +109,7 @@ module Ruact
           # the render path surfaces the clear error). In prod this is the
           # boot-loaded Ruact.manifest, unchanged.
           registry = ManifestResolver.resolve_soft if registry == :default
-          pairs = parse_prop_pairs(attrs_string)
+          pairs = ComponentAttributes.parse(attrs_string)
           validate_contract(registry, component_name, pairs.map(&:first),
                             at: { file: identifier, line: line, snippet: match.strip })
           props_ruby = pairs.map { |name, expr| "#{name.inspect} => #{expr}" }.join(", ")
@@ -247,46 +242,5 @@ module Ruact
       m = identifier.to_s.match(%r{app/views/(.+)/[^/]+\z})
       m && m[1]
     end
-
-    # Parses the attributes string of a component tag into ordered
-    # +[name, ruby_expr]+ pairs, e.g. [["postId", "@post.id"], ["count", "5"]].
-    # Honors nested braces in values (via {#extract_braced_expr}). The names
-    # feed the Story 13.5 contract check; the pairs render the props Hash.
-    def parse_prop_pairs(attrs_string)
-      return [] if attrs_string.empty?
-
-      pairs = []
-      remaining = attrs_string.dup
-
-      while (m = PROP_RE.match(remaining))
-        prop_name = m[1]
-        # Find the matching closing brace, respecting nesting
-        value_start = m.end(0)
-        value_expr  = extract_braced_expr(remaining, value_start)
-        pairs << [prop_name, value_expr]
-        # Advance past this prop
-        remaining = remaining[(value_start + value_expr.length + 1)..] # +1 for closing }
-        break if remaining.nil?
-      end
-
-      pairs
-    end
-
-    # Given a string and a start position (just after the opening '{'),
-    # returns the content up to the matching '}'.
-    def extract_braced_expr(str, start)
-      depth = 1
-      i = start
-      while i < str.length && depth.positive?
-        case str[i]
-        when "{" then depth += 1
-        when "}" then depth -= 1
-        end
-        i += 1
-      end
-      raise PreprocessorError, "unclosed brace in prop expression" if depth.positive?
-
-      str[start...(i - 1)]
-    end
   end
 end

data/lib/ruact/flight/js_date.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Ruact
+  module Flight
+    # The ISO 8601 form a JavaScript `Date` reads back (Story 17-0c).
+    module JsDate
+      # JavaScript parses years 0–9999 in the plain form and the others only in
+      # the expanded one (`+010000`, `-000001`); Ruby writes `10000` / `-0001`,
+      # which `new Date` turns into an Invalid Date.
+      #
+      # @param value [Time, DateTime]
+      # @return [String] ISO 8601 with milliseconds
+      def self.iso8601(value)
+        iso = value.iso8601(3)
+        year = value.year
+        return iso unless year.negative? || year > 9999
+
+        format("%<sign>s%<year>06d", sign: year.negative? ? "-" : "+", year: year.abs) + iso.sub(/\A-?\d+/, "")
+      end
+    end
+  end
+end

data/lib/ruact/flight/renderer.rb

@@ -56,12 +56,17 @@ module Ruact
             sleep(deferred[:delay])
           end
 
-          # Serialize deferred content — may produce new import rows
-          import_count_before = @request.completed_import_chunks.length
+          # Serialize deferred content — may produce new import rows, and new
+          # regular rows (a string of 1024+ bytes becomes a `T` row the deferred
+          # model row references as `$T<id>`).
+          import_count_before  = @request.completed_import_chunks.length
+          regular_count_before = @request.completed_regular_chunks.length
           deferred_value = serializer.serialize_model(deferred[:element])
 
-          # Yield any import rows discovered during deferred serialization
+          # Yield the rows discovered during deferred serialization BEFORE the
+          # row that references them.
           @request.completed_import_chunks[import_count_before..].each(&block)
+          @request.completed_regular_chunks[regular_count_before..].each(&block)
 
           yield RowEmitter.model(deferred[:id], JSON.generate(deferred_value))
         end

data/lib/ruact/flight/serializer.rb

@@ -33,6 +33,10 @@ module Ruact
           serialize_symbol(value)
         when Time, DateTime
           serialize_date(value)
+        when Date
+          # A calendar date has no instant to rebuild: it travels as
+          # "YYYY-MM-DD", in strict mode too (Story 17-0c review).
+          serialize_string(value.iso8601)
         when ClientReference
           serialize_client_reference(value)
         when SuspenseElement
@@ -53,6 +57,7 @@ module Ruact
       # --- Primitives ---
 
       def serialize_string(value)
+        value = Utf8.text(value)
         # Large strings get their own T row
         if value.bytesize >= LARGE_TEXT_THRESHOLD
           id = @request.allocate_id
@@ -89,12 +94,13 @@ module Ruact
         # Only :undefined is special for now
         return "$undefined" if value == :undefined
 
-        # Unknown symbols: just use the name as a string
-        value.to_s
+        # Any other symbol is its name — escaped like a string, so `:"$nope"`
+        # cannot pose as a "$n…" marker.
+        serialize_string(value.to_s)
       end
 
       def serialize_date(value)
-        "$D#{value.iso8601(3)}"
+        "$D#{JsDate.iso8601(value)}"
       end
 
       # --- Collections ---
@@ -104,7 +110,7 @@ module Ruact
       end
 
       def serialize_hash(value)
-        value.transform_keys(&:to_s).transform_values { |v| serialize_model(v) }
+        value.transform_keys { |key| Utf8.text(key.to_s) }.transform_values { |v| serialize_model(v) }
       end
 
       # --- React Element ---