@nifrajs/web 4.0.0 → 5.0.0

package/src/internal/progressive-cookies.ts

@@ -0,0 +1,60 @@
+import type { CookieOptions } from "@nifrajs/core/server"
+
+export interface ProgressiveCookie {
+  readonly name: string
+  readonly value: string
+  readonly options?: CookieOptions | undefined
+  readonly deleted?: boolean
+}
+
+/** Parent-domain acceptance belongs to the browser's cookie jar and public-suffix policy. A Secure
+ * cookie on a request seen as `http:` does too: behind a TLS terminator only the browser knows its
+ * scheme, so it decides whether the cookie is kept. */
+export function progressiveCookieRedirect(
+  request: Request,
+  changes: readonly ProgressiveCookie[],
+): boolean {
+  const url = new URL(request.url)
+  const host = url.hostname.toLowerCase()
+  return changes.some((change) => {
+    const domain = change.options?.domain?.replace(/^\./, "").toLowerCase()
+    if (domain !== undefined && domain !== host && host.endsWith("." + domain)) return true
+    return secureOnPlainHttp(url, change)
+  })
+}
+
+const secureOnPlainHttp = (url: URL, change: ProgressiveCookie): boolean =>
+  (change.options?.secure ?? !change.deleted) && url.protocol !== "https:"
+
+/** Reauthorize the internal GET with action cookies that are valid for this exact owner URL. */
+export function progressiveCookieHeader(
+  request: Request,
+  changes: readonly ProgressiveCookie[],
+): string {
+  const url = new URL(request.url)
+  let pairs = (request.headers.get("cookie") ?? "")
+    .split(";")
+    .map((part) => part.trim())
+    .filter(Boolean)
+  for (const change of changes) {
+    const options = change.options
+    const domain = options?.domain?.replace(/^\./, "").toLowerCase()
+    // Parent-domain cookies need a browser cookie jar/public-suffix decision; never synthesize them.
+    if (domain !== undefined && domain !== url.hostname.toLowerCase()) continue
+    if (secureOnPlainHttp(url, change)) continue
+    const path = options?.path ?? "/"
+    if (
+      url.pathname !== path &&
+      !(url.pathname.startsWith(path) && (path.endsWith("/") || url.pathname[path.length] === "/"))
+    )
+      continue
+    pairs = pairs.filter((pair) => pair.slice(0, pair.indexOf("=")).trim() !== change.name)
+    const expired =
+      options?.maxAge !== undefined
+        ? options.maxAge <= 0
+        : options?.expires !== undefined && options.expires.getTime() <= Date.now()
+    if (!change.deleted && !expired)
+      pairs.push(change.name + "=" + encodeURIComponent(change.value))
+  }
+  return pairs.join("; ")
+}

package/src/internal/public-env.ts

@@ -0,0 +1,14 @@
+export function publicEnvDefines(
+  prefix: string,
+  env: Readonly<Record<string, string | undefined>>,
+): Record<string, string> {
+  const defines: Record<string, string> = {}
+  if (prefix === "") return defines // opt-out: bake in nothing
+  for (const [name, value] of Object.entries(env)) {
+    // Skip `undefined` (a deleted/unset key can still enumerate) so we never bake in `"undefined"`.
+    if (name.startsWith(prefix) && value !== undefined) {
+      defines[`process.env.${name}`] = JSON.stringify(value)
+    }
+  }
+  return defines
+}

package/src/internal/render-document.ts

@@ -76,6 +76,7 @@ export interface RenderedPage {
 }
 
 export interface RenderPageOptions {
+  readonly serverComponents?: import("../server-components/types.ts").ComponentState
   readonly adapter: RenderAdapter
   /** The layout chain to render - outermost layout → page (opaque; the adapter renders it). */
   readonly chain: readonly unknown[]
@@ -343,6 +344,10 @@ export function renderPageResult(options: RenderPageInput): MaybePromise<Rendere
     boundarySplit === undefined
       ? ""
       : `,"${BOUNDARY_GLOBAL}":${serializeData(boundarySplit.forClient)}`
+  const componentTail =
+    options.serverComponents === undefined
+      ? ""
+      : `,"__NIFRA_COMPONENTS__":${serializeData(options.serverComponents)}`
   const deferredRuntime =
     allDeferred.length > 0 ? `<script${nonceAttr}>${DEFERRED_RUNTIME}</script>` : ""
   // The regex only injects the CSP nonce into the (constant) hydration head; with no nonce it's a
@@ -443,7 +448,7 @@ export function renderPageResult(options: RenderPageInput): MaybePromise<Rendere
   // Tail - the page-state handover + the client module. Module scripts defer (run after parse), so
   // the handover + every streamed deferred resolution are in the document before the entry hydrates.
   const tailHtml = hydrate
-    ? `${slot.tailPre}${serializeData(forClient)}${action}${layoutTail}${boundaryTail}${slot.tailPost}`
+    ? `${slot.tailPre}${serializeData(forClient)}${action}${layoutTail}${boundaryTail}${componentTail}${slot.tailPost}`
     : (slot.tailPost as string)
   const headers: Record<string, string> = { "content-type": "text/html; charset=utf-8" }
   // Caller-supplied headers (a terminal status page's `cache-control`, say). Applied before the
@@ -469,6 +474,9 @@ export function renderPageResult(options: RenderPageInput): MaybePromise<Rendere
     if (policy !== undefined) headers["content-security-policy"] = policy
   }
   const renderProps: RenderProps = {
+    ...(options.serverComponents === undefined
+      ? {}
+      : { serverComponents: options.serverComponents }),
     data: forComponent,
     actionData: actionSplit?.forComponent,
     // `params`/`path` thread the matched route + URL to the adapter's `useParams`/`useLocation` so they
@@ -616,13 +624,17 @@ function streamDocument(
   enc: TextEncoder,
   nonceAttr: string,
 ): ReadableStream<Uint8Array> {
+  const reader = stream.getReader()
+  // A client that goes away cancels the body: the renderer stops, and nothing more is written.
+  let cancelled = false
+  let released = false
   return new ReadableStream({
     async start(controller) {
-      const reader = stream.getReader()
       try {
         controller.enqueue(shell)
         for (;;) {
           const { done, value } = await reader.read()
+          if (cancelled) return
           if (done) break
           controller.enqueue(value)
         }
@@ -631,34 +643,37 @@ function streamDocument(
         // defer() must not block a faster one; each script self-addresses by id, so order is irrelevant.
         await Promise.all(
           deferred.map(async (d) => {
+            let script: string
             try {
               const value = serializeData(await d.promise)
               // `serializeData` JSON-serializes the value and escapes `<`, `>`, and Unicode line
               // separators before this framework-owned script is emitted.
-              controller.enqueue(
-                enc.encode(`<script${nonceAttr}>window.__nifraResolve(${d.id},${value})</script>`), // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
-              )
+              script = `<script${nonceAttr}>window.__nifraResolve(${d.id},${value})</script>` // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
             } catch (err) {
               // A rejected deferred streams __nifraReject (the client `<Await>` surfaces it) - it must
               // not break the whole body. Redact: stream a stable opaque code, never the raw error
               // text; log the real reason server-side.
               console.error("[nifra/web] deferred value rejected:", err)
-              controller.enqueue(
-                enc.encode(
-                  `<script${nonceAttr}>window.__nifraReject(${d.id},${serializeData(DEFERRED_ERROR_CODE)})</script>`,
-                ),
-              )
+              script = `<script${nonceAttr}>window.__nifraReject(${d.id},${serializeData(DEFERRED_ERROR_CODE)})</script>`
             }
+            if (!cancelled) controller.enqueue(enc.encode(script))
           }),
         )
+        if (cancelled) return
         controller.enqueue(tail)
         controller.close()
       } catch (err) {
-        controller.error(err)
+        if (!cancelled) controller.error(err)
       } finally {
+        released = true
         reader.releaseLock()
       }
     },
+    cancel(reason) {
+      cancelled = true
+      // Once the renderer is drained the reader is released, and there is nothing left to stop.
+      return released ? undefined : reader.cancel(reason)
+    },
   })
 }
 

package/src/internal/response-controls.ts

@@ -2,9 +2,15 @@ import {
   type CookieOptions,
   type ResponseResult,
   status as statusResult,
+  writableResponse,
 } from "@nifrajs/core/server"
 import type { LoaderResponseControls } from "../manifest.ts"
 import { DATA_HEADER } from "../router.ts"
+import {
+  type ProgressiveCookie,
+  progressiveCookieHeader,
+  progressiveCookieRedirect,
+} from "./progressive-cookies.ts"
 import { isResponseResult } from "./render-document.ts"
 
 /** The serving app's response controls - the structural subset of a route handler's `c.set` used here. */
@@ -107,19 +113,9 @@ export function privateOutcome(outcome: unknown): unknown {
 
 function privateResponse(response: Response): Response {
   if (response.headers.get(CACHE_CONTROL) === PRIVATE_NO_STORE) return response
-  try {
-    response.headers.set(CACHE_CONTROL, PRIVATE_NO_STORE)
-    return response
-  } catch {
-    // Immutable headers (`Response.redirect()`, a `fetch()` result): answer with a copy.
-    const headers = new Headers(response.headers)
-    headers.set(CACHE_CONTROL, PRIVATE_NO_STORE)
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    })
-  }
+  const target = writableResponse(response)
+  target.headers.set(CACHE_CONTROL, PRIVATE_NO_STORE)
+  return target
 }
 
 interface WrittenHeaders {
@@ -140,6 +136,7 @@ export class PageResponseControls {
   #written: WrittenHeaders[] | undefined
   #sealed = false
   #personalized = false
+  #cookieChanges: ProgressiveCookie[] | undefined
 
   constructor(c: { readonly set: CoreResponseControls }) {
     this.#c = c
@@ -167,7 +164,27 @@ export class PageResponseControls {
   cookies(member: string): CoreResponseControls {
     this.assertOpen(member)
     this.personalize()
-    return this.#c.set
+    const controls = this.#c.set
+    return {
+      headers: controls.headers,
+      cookie: (name, value, options) => {
+        controls.cookie(name, value, options)
+        this.#cookieChanges ??= []
+        this.#cookieChanges.push({ name, value, options })
+      },
+      deleteCookie: (name, options) => {
+        controls.deleteCookie(name, options)
+        this.#cookieChanges ??= []
+        this.#cookieChanges.push({ name, value: "", options, deleted: true })
+      },
+    }
+  }
+
+  progressiveCookies(request: Request): string {
+    return progressiveCookieHeader(request, this.#cookieChanges ?? [])
+  }
+  progressiveRedirect(request: Request): boolean {
+    return progressiveCookieRedirect(request, this.#cookieChanges ?? [])
   }
 
   /** Mark the response as one visitor's - a queued cookie, or a draft render - so no cache stores it. */

package/src/internal/revive-dates.ts

@@ -0,0 +1,35 @@
+/**
+ * `t.date()` across the wire, browser half: every place the browser parses page data rebuilds the
+ * `{ "__nifra_date": iso }` tags the server's `wireDate()` wrote into `Date`s. Kept apart from
+ * `wire-date.ts` so client bundles never carry the server class.
+ */
+
+export const DATE_TAG = "__nifra_date"
+const TAGGED = `"${DATE_TAG}"`
+
+// A JSON.parse reviver runs leaves first and defines each result as an own property, so a key named
+// `__proto__` never becomes the prototype.
+const revive = (_key: string, value: unknown): unknown => {
+  if (typeof value !== "object" || value === null) return value
+  const tagged: unknown = Reflect.get(value, DATE_TAG)
+  return typeof tagged === "string" && Object.keys(value).length === 1 ? new Date(tagged) : value
+}
+
+/** `JSON.parse` that rebuilds every `{ "__nifra_date": iso }` into a `Date`, when the text has one. */
+export const parsePageData = (text: string): unknown =>
+  text.includes(TAGGED) ? JSON.parse(text, revive) : JSON.parse(text)
+
+/**
+ * {@link parsePageData}'s reviver as source declaring `__nifraDates`, for client code nifra generates rather than
+ * bundles (server-function stubs; `DEFERRED_RUNTIME` carries the same text). A literal with nothing
+ * interpolated: Bun keeps a template that interpolates an import, and with it every string built from
+ * it, in client bundles that never use them.
+ */
+export const REVIVE_DATES_SOURCE = `const __nifraDates = (d) => {
+  if (!d || typeof d !== "object") return d
+  if (Array.isArray(d)) { for (let i = 0; i < d.length; i++) d[i] = __nifraDates(d[i]); return d }
+  const k = Object.keys(d)
+  if (k.length === 1 && k[0] === "__nifra_date" && typeof d.__nifra_date === "string") return new Date(d.__nifra_date)
+  for (const x of k) { const v = __nifraDates(d[x]); if (v !== d[x]) Object.defineProperty(d, x, { value: v, enumerable: true, writable: true, configurable: true }) }
+  return d
+}`

package/src/internal/route-path.ts

@@ -0,0 +1,8 @@
+/**
+ * A route pattern's literal text as a request path spells it. A route file named `café.tsx` is
+ * requested as `/caf%C3%A9`, so the routers, which compare the raw request path, are given the pattern
+ * that way. Only controls, space and non-ASCII are encoded (what a browser encodes in a path), so ASCII
+ * punctuation such as a param constraint keeps its meaning. Runs once per pattern, never per request.
+ */
+export const requestPattern = (pattern: string): string =>
+  pattern.normalize("NFC").replace(/[^!-~]/gu, encodeURIComponent)

package/src/internal/secret-scan.ts

@@ -148,15 +148,54 @@ const JWT = /\beyJ[A-Za-z0-9_-]{8,}\.(eyJ[A-Za-z0-9_-]{8,})\.[A-Za-z0-9_-]{16,}/
 const PLACEHOLDER =
   /^(?:user(?:name)?|pass(?:word)?|pwd|secret|admin|root|guest|test|demo|example|changeme|change-me|xxx+|\*+|\.\.\.+|my-?password|your-?password|<[^>]*>|\$\{[^}]*\}|\{\{[^}]*\}\}|%[A-Za-z_]+%?)$/i
 
-/** A literal assigned to a name: `apiKey: "..."`, `const secret = '...'`. Template literals with an
- * interpolation are not literals. The lookbehind starts a name only where an identifier starts: a
- * match from inside a long word run backtracks the rest of that run, quadratic in its length. */
+/** A literal assigned to a name: `apiKey: "..."`, `const secret = '...'`, `"x-api-key": "..."`.
+ * Template literals with an interpolation are not literals. The lookbehind starts a name only where
+ * an identifier starts: a match from inside a long word run backtracks the rest of that run,
+ * quadratic in its length. A hyphenated name starts only right after a quote, for the same reason. */
 const ASSIGNED =
-  /(?<![\w$])([A-Za-z_$][\w$]*)["']?\s*(?:[:=]|\?\?=|\|\|=)\s*(?:"([^"\\\r\n]{16,256})"|'([^'\\\r\n]{16,256})'|`([^`\\$\r\n]{16,256})`)/g
+  /(?<![\w$])((?<=["'])[A-Za-z_$][\w$-]*(?=["'])|[A-Za-z_$][\w$]*)(["']?)\s*([:=]|\?\?=|\|\|=)\s*(?:"([^"\\\r\n]{16,256})"|'([^'\\\r\n]{16,256})'|`([^`\\$\r\n]{16,256})`)/g
+
+/** Whether a match's name is what the literal is assigned to. A quoted name must be the whole string,
+ * not the tail of one (`? "new-password" : "current-password"`), and a key is never preceded by a
+ * ternary's `?` or a member access's `.` (`ready ? config.apiKey : "..."`). */
+function namesTheTarget(text: string, start: number, quote: string, operator: string): boolean {
+  let before = start - 1
+  if (quote !== "") {
+    if (text[before] !== quote) return false
+    before--
+  }
+  if (operator !== ":") return true
+  while (before >= 0 && /\s/.test(text[before] ?? "")) before--
+  return text[before] !== "?" && text[before] !== "."
+}
+
+/** A quoted name and a literal written as a pair: `headers.set("x-api-key", "...")`,
+ * `new Headers([["x-api-key", "..."]])`. The last group is what follows the literal. */
+const PAIRED =
+  /(["'])([A-Za-z_$][\w$-]*)\1\s*,\s*(?:"([^"\\\r\n]{16,256})"|'([^'\\\r\n]{16,256})'|`([^`\\$\r\n]{16,256})`)\s*([\]),]?)/g
+
+/** A value spelled as words or as a constant's name: another field (`["password",
+ * "passwordConfirmation"]`), an environment variable, a stand-in token (`"Bearer not-a-token"`). */
+const NAME_LIKE =
+  /^(?:[A-Za-z][a-z]*(?:[A-Z][a-z]+|[_.-][A-Za-z][a-z]*)+|[A-Z][A-Z0-9]*(?:_[A-Z][A-Z0-9]*)+)$/
+
+/** Whether a pair is a whole two-element array, or the first two arguments of `.set(` or `.append(`:
+ * an element in a longer list is not a pair. */
+function opensAPair(text: string, quoteAt: number, after: string): boolean {
+  let before = quoteAt - 1
+  while (before >= 0 && /\s/.test(text[before] ?? "")) before--
+  if (text[before] === "[") return after === "]"
+  if (text[before] !== "(" || (after !== ")" && after !== ",")) return false
+  return /\.(?:set|append)$/.test(text.slice(Math.max(0, before - 7), before))
+}
 
 const EXTRA_SECRET_NAME =
   /(?:accesskey|signingkey|encryptionkey|masterkey|serviceaccountkey|connectionstring)$/
 
+/** Header names whose value puts a scheme before the credential: `"Bearer <token>"`. */
+const AUTHORIZATION_NAME = /^(?:proxy)?authorization$/
+const AUTHORIZATION_VALUE = /^(?:(bearer)|basic) +(\S+)$/i
+
 /** Values that look like keys but are public by design. */
 const PUBLIC_VALUE =
   /^(?:AIza[0-9A-Za-z_-]{35}|pk_(?:live|test)_[0-9A-Za-z]+|6L[0-9A-Za-z_-]{38}|G-[A-Z0-9]{6,}|UA-\d+-\d+)$/
@@ -186,6 +225,32 @@ function looksRandom(value: string, minLength: number): boolean {
   return classes >= 2 && entropy(value) >= 3.5
 }
 
+/** A password the scanned text spells as a placeholder or a dev default. */
+function placeholderPassword(user: string, password: string): boolean {
+  // nifra-expect NF-S002: a password equal to its user name is a placeholder in the text being
+  // scanned; nothing is authenticated here.
+  return PLACEHOLDER.test(password) || password === user || /[${}<>*]/.test(password)
+}
+
+/** The credential an `Authorization` literal carries: a Bearer token, or a Basic `user:password`
+ * that is not a placeholder. */
+function authorizationCredential(value: string): string | undefined {
+  const found = AUTHORIZATION_VALUE.exec(value)
+  if (found === null) return undefined
+  const credential = found[2] ?? ""
+  if (found[1] !== undefined) return NAME_LIKE.test(credential) ? undefined : credential
+  let decoded: string
+  try {
+    decoded = atob(credential)
+  } catch {
+    return undefined
+  }
+  const colon = decoded.indexOf(":")
+  if (colon === -1 || placeholderPassword(decoded.slice(0, colon), decoded.slice(colon + 1)))
+    return undefined
+  return credential
+}
+
 function jwtRole(payload: string): unknown {
   try {
     const json = atob(payload.replaceAll("-", "+").replaceAll("_", "/"))
@@ -217,11 +282,7 @@ function formatMatches(text: string): Match[] {
     matches.push({ rule: "private-key", index: found.index, text: found[0], what: "private key" })
   }
   for (const found of text.matchAll(CREDENTIAL_URL)) {
-    const user = found[1] ?? ""
-    const password = found[2] ?? ""
-    // @nifra-gate-reviewed: a password equal to its user name is a placeholder in the text being
-    // scanned; nothing is authenticated here.
-    if (PLACEHOLDER.test(password) || password === user || /[${}<>*]/.test(password)) continue
+    if (placeholderPassword(found[1] ?? "", found[2] ?? "")) continue
     matches.push({
       rule: "credential-url",
       index: found.index,
@@ -232,20 +293,46 @@ function formatMatches(text: string): Match[] {
   return matches
 }
 
+/** The credential a literal given to `name` carries, when the name is secret-like and the literal
+ * looks random. */
+function credentialOf(name: string, value: string): string | undefined {
+  const key = name.toLowerCase().replace(/[-_]/g, "")
+  const header = AUTHORIZATION_NAME.test(key)
+  if (!header && !isSensitiveFieldName(name) && !EXTRA_SECRET_NAME.test(key)) return undefined
+  const secret = header ? authorizationCredential(value) : value
+  if (
+    secret === undefined ||
+    PUBLIC_VALUE.test(secret) ||
+    PLACEHOLDER.test(secret) ||
+    !looksRandom(secret, 16)
+  )
+    return undefined
+  return secret
+}
+
 function assignedMatches(text: string): Match[] {
   const matches: Match[] = []
-  for (const found of text.matchAll(ASSIGNED)) {
-    const name = found[1] ?? ""
-    if (!isSensitiveFieldName(name) && !EXTRA_SECRET_NAME.test(name.toLowerCase())) continue
-    const value = found[2] ?? found[3] ?? found[4] ?? ""
-    if (PUBLIC_VALUE.test(value) || PLACEHOLDER.test(value) || !looksRandom(value, 16)) continue
+  const add = (name: string, value: string, valueAt: number): void => {
+    const secret = credentialOf(name, value)
+    if (secret === undefined) return
     matches.push({
       rule: "assigned-secret",
-      index: found.index + found[0].indexOf(value),
-      text: value,
+      // The credential is the value's tail: a header value's scheme is not part of it.
+      index: valueAt + value.length - secret.length,
+      text: secret,
       what: `literal assigned to "${name}"`,
     })
   }
+  for (const found of text.matchAll(ASSIGNED)) {
+    if (!namesTheTarget(text, found.index, found[2] ?? "", found[3] ?? "")) continue
+    const value = found[4] ?? found[5] ?? found[6] ?? ""
+    add(found[1] ?? "", value, found.index + found[0].lastIndexOf(value))
+  }
+  for (const found of text.matchAll(PAIRED)) {
+    const value = found[3] ?? found[4] ?? found[5] ?? ""
+    if (NAME_LIKE.test(value) || !opensAPair(text, found.index, found[6] ?? "")) continue
+    add(found[2] ?? "", value, found.index + found[0].lastIndexOf(value))
+  }
   return matches
 }
 
@@ -493,7 +580,7 @@ export function createRedactor(
     for (const { what, pattern } of KEY_FORMATS) out = out.replace(pattern, `[redacted:${what}]`)
     out = out.replace(JWT, "[redacted:JWT]")
     out = out.replace(CREDENTIAL_URL, (match, user: string, password: string) =>
-      // @nifra-gate-reviewed: the same placeholder test as the scan; nothing is authenticated here.
+      // nifra-expect NF-S002: the same placeholder test as the scan; nothing is authenticated here.
       PLACEHOLDER.test(password) || password === user
         ? match
         : match.replace(`:${password}@`, ":[redacted]@"),

package/src/internal/server-boundary.ts

@@ -14,6 +14,7 @@
 export const SERVER_FN_MODULE = /\.fn(\.[cm]?[jt]sx?)?$/
 
 import { jsStringLiteral } from "./js-string.ts"
+import { DATE_TAG, REVIVE_DATES_SOURCE } from "./revive-dates.ts"
 
 // ---------------------------------------------------------------------------------------------------
 // `.fn` - turn a server-function module into the client stubs that call it.
@@ -50,15 +51,18 @@ const DECLARATION =
 const ANY_CALL = /\bserverFn\s*[<(]/g
 /** Strip line and block comments by forward index scan, so prose cannot register as code. Not a
  * regex: every regex shape for comment stripping either backtracks polynomially on adversarial
- * source or is opaque enough that reviewers cannot tell. A `//` preceded by `:` is kept (URL in a
- * string - the same heuristic the previous implementation used); an unterminated block comment
- * swallows the rest of the source, matching a real parser. */
+ * source or is opaque enough that reviewers cannot tell. String literals are stepped over, so a
+ * `"image/*"` cannot open a comment; a `//` preceded by `:` is kept (a URL outside a string); an
+ * unterminated block comment swallows the rest of the source, matching a real parser. */
 function stripComments(source: string): string {
   const parts: string[] = []
   let keepFrom = 0
   let i = 0
   while (i < source.length) {
-    if (source.startsWith("/*", i)) {
+    const char = source[i]
+    if (char === '"' || char === "'" || char === "`") {
+      i = stringEnd(source, i)
+    } else if (source.startsWith("/*", i)) {
       const close = source.indexOf("*/", i + 2)
       parts.push(source.slice(keepFrom, i))
       i = close === -1 ? source.length : close + 2
@@ -76,6 +80,21 @@ function stripComments(source: string): string {
   return parts.join("")
 }
 
+/** The index just past the string literal opening at `start`. A quote or apostrophe string also ends
+ * at a line break, so a stray one (JSX text, a regex literal) misreads one line at most. */
+function stringEnd(source: string, start: number): number {
+  const quote = source[start]
+  let i = start + 1
+  while (i < source.length) {
+    const char = source[i]
+    if (char === "\\") i += 2
+    else if (char === quote) return i + 1
+    else if (char === "\n" && quote !== "`") return i
+    else i++
+  }
+  return source.length
+}
+
 /**
  * The namespace a `*.fn.ts` module is mounted under: its filename without the `.fn` suffix.
  *
@@ -143,9 +162,14 @@ async function __nifraCall(name, input) {
     }
     throw new Error(\`[nifra/fn] \${name} failed: \${response.status}\${detail ? \` \${detail}\` : ""}\`)
   }
-  return response.status === 204 ? undefined : await response.json()
+  if (response.status === 204) return undefined
+  const text = await response.text()
+  const value = JSON.parse(text)
+  return text.includes('"${DATE_TAG}"') ? __nifraDates(value) : value
 }
 
+${REVIVE_DATES_SOURCE}
+
 ${calls}
 `
 }