fix: persist reviver no longer corrupts ordinary strings into Dates (TODO 9)

[lopugit]

Fixes TODO item 9 — 🐛 DATA CORRUPTION: the persist reviver turns ordinary strings into Dates.

Problem

ThingtimeProvider's localforage reviver revived any string that passed V8's lenient Date.parse into a Date. Everyday values like "Post 1", "1", "2024", "March 2024", "5 April" became Date objects on reload; the replacer then rewrote them as ISO strings — permanently corrupting user data after one save/reload cycle (and Date objects could reach React render paths).

Fix

• Replacer: Dates now persist tagged as {ttype:'date', iso}, mirroring the existing ttype:'function' scheme. Subtlety: JSON.stringify (which flatted wraps) runs Date.prototype.toJSON before the replacer, so the replacer's old value instanceof Date branch was unreachable — Dates were actually persisting as bare ISO strings, which is exactly why revival had to guess. The fix reads the original Date off the holder (this[key]), the standard escape hatch for this; flatted 3.4.2 forwards the holder correctly (verified in its source).
• Reviver: revives tagged {ttype:'date'} values, plus — for backward compatibility with already-persisted state — bare strings that exactly match the old replacer's toISOString() output (YYYY-MM-DDTHH:mm:ss.sssZ). Everything else stays a string.
• Invalid Dates (isNaN(getTime())) are never tagged; a tagged value with an unparseable iso degrades to the raw string instead of throwing.

Known accepted tradeoff: a user string that exactly matches full toISOString() format still revives as a Date (required to keep legacy persisted Dates working). Near-ISO strings ("2024-03-05", "2024-03-05T12:34", "...+02:00") now stay strings.

Verification

• 27-case node test against real flatted 3.4.2: ordinary strings survive roundtrips; Dates roundtrip as Dates; legacy-format data keeps its Dates while "Post 1"/"2024" are no longer corrupted; double roundtrip is stable; functions still tag; circular refs still work; invalid Dates don't crash.
• Live browser (worktree dev server, ports 16170-16172): app boots with zero console errors; in-page window.flatted roundtrip checks all pass; end-to-end setThingtime(['settings','x'], 'March 2024') + a real Date → debounced autosave → reload → hydrate: the string survives as a string, the Date as a Date (previously the string came back as a Date, then an ISO string).

Note: the eval-based ttype:'function' revival directly below this code is TODO item 10 (security: eval + CSP) and intentionally untouched here — whoever picks it up should rebase on this since we share the reviver/replacer.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thingtime	Ready	Preview, Comment	Jul 26, 2026 12:52pm

[lopugit]

Duplicate-work notice (parallel sessions): PR #94 and PR #96 both fix TODO 9 — they raced before the shared claims protocol (TODO/.claims/, created by session 1 mid-run) existed. One should be merged and the other closed. A precise comparison to help pick:

Where they agree — both revive bare strings only when they exactly match toISOString() output (YYYY-MM-DDTHH:mm:ss.sssZ) with a Date.parse validity check, both keep legacy persisted Dates working, both leave the ttype:'function' eval path (TODO 10) byte-identical, and both were verified against real flatted plus a live browser persist→reload cycle.

Where they differ — the persist format going forward:

• fix(persist): stop Date-reviver corruption + kill persisted-state eval RCE, add CSP (TODO 9 + 10) #94 keeps Dates as bare ISO strings (the Date.toJSON output) forever, and removes the replacer's dead instanceof Date branch. Simpler, no format change — but a user string that exactly matches full ISO format will be mis-revived as a Date permanently, since the format can never distinguish the two.
• fix: persist reviver no longer corrupts ordinary strings into Dates (TODO 9) #96 persists Dates tagged as {ttype:'date', iso}, mirroring the existing ttype:'function' scheme. fix(persist): stop Date-reviver corruption + kill persisted-state eval RCE, add CSP (TODO 9 + 10) #94's claim that tagging "can't work without an expensive pre-serialize tree walk" is not correct: JSON.stringify calls the replacer with the holder as this, so this[key] instanceof Date sees the original Date after toJSON has run — no tree walk needed, and flatted 3.4.2 forwards the holder ($.call(this, key, value), cjs/index.js L106). The tagged objects are visible in fix: persist reviver no longer corrupts ordinary strings into Dates (TODO 9) #96's persisted output. With tagging, the exact-ISO collision only applies to legacy blobs, and the bare-string heuristic can be deleted entirely after a migration window.

Recommendation: merge #96 (tagged format is strictly more future-proof and matches the TODO's suggested scheme), and cherry-pick #94's nice TODO/TODO.md ✅-annotation hunk. Merging #94 instead is also safe — the formats are compatible one-way (#96's reviver reads #94's output, not vice versa), so #94→#96 later would work, #96→#94 would strand tagged saves.

(Posted by session 1; identical comment on both PRs.)

[lopugit]

Triage note (session 3/10): this duplicates TODO 9 with #94 and #98 — #94 was the first claim (claim branch pushed ~23 min before this PR) and carries a 26-check flatted suite + live browser load→autosave verification. Owner should pick one and close the others.

[lopugit]

Consolidating the TODO 8/9/10 security PRs: #99 is the single winner and now carries this PR's unique value (see the consolidation note on #99 for exactly what was folded in and why). Closing as a duplicate.