gina 0.3.13-alpha.1 → 0.3.13-alpha.2

package/.playwright-mcp/console-2026-05-13T00-40-40-225Z.log

@@ -0,0 +1,2 @@
+[     213ms] [ERROR] Failed to load resource: the server responded with a status of 404 (File not found) @ http://127.0.0.1:8765/%7B%7B%20page.environment.webroot%20%7D%7D_gina/assets/routing.json:0
+[     219ms] [ERROR] Failed to load resource: the server responded with a status of 404 (File not found) @ http://127.0.0.1:8765/favicon.ico:0

package/.playwright-mcp/page-2026-05-13T00-40-40-476Z.yml

@@ -0,0 +1,7 @@
+- generic [active] [ref=e1]:
+  - heading "M20 validator refactor smoke" [level=1] [ref=e2]
+  - paragraph [ref=e3]:
+    - text: Loads
+    - code [ref=e4]: gina.min.js
+    - text: standalone and reports global setup.
+  - generic [ref=e5]: Loading...

package/ROADMAP.md

@@ -134,11 +134,11 @@ Four focused follow-up sessions to close the deferred gap left by the `0.3.7-alp
 
 ### Eval safety
 
-Complete the removal of `eval` / `new Function` call sites from the published tarball. Four tranches shipped across `0.3.7-alpha.4` / `0.3.7-alpha.5` cleared 13 of 24 catalogued sites; 2 more were removed by deleting orphaned source during the toolbar cleanup (15 of 24 addressed). Three clusters remain, each needing a focused session.
+Complete the removal of `eval` / `new Function` call sites from the published tarball. Four tranches shipped across `0.3.7-alpha.4` / `0.3.7-alpha.5` cleared 13 of 24 catalogued sites; 2 more were removed by deleting orphaned source during the toolbar cleanup (15 of 24 addressed). The validator structural refactor cleared 3 more on `0.3.13-alpha.2` (18 of 24). Two clusters remain, each needing a focused session.
 
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
-| 📋 | **Validator structural refactor** — Refactor `makeObjectFromArgs` in the validator plugin to replace the string-accumulator path-build-then-`eval('root=value')` pattern with a segments-array threaded through recursion and a safe setter. Clears 3 eval sites. Test coverage for the validator plugin was bootstrapped in the prior tranche, so the refactor has a safety net. | `0.3.8` | Q1 2027 |
+| ✅ | **Validator structural refactor** — Refactored `makeObjectFromArgs` in the validator plugin: the previous string-accumulator path-build + runtime evaluation is replaced by a segments-array threaded through the recursion plus a local safe setter. Cleared 3 eval sites. +27 parity tests in `test/lib/validator-scs1f.test.js`. Browser bundle rebuilt. | `0.3.13-alpha.2` | 2026-05-13 |
 | 📋 | **Feature-intrinsic eval design pass** — 6 sites eval user-supplied JS by design (user-defined form validators, HTML event callbacks on form data attributes). Decision pass: safe-eval sandbox via `vm.Script`, pre-parse to a restricted AST, or formalise "accept and document" with an explicit trust assumption. Outcome may include dropping unused placeholder features. | `0.3.8` | Q1 2027 |
 | 📋 | **Logger circular-require refactor** — 3 load-bearing `eval(fs.readFileSync(...))` fallbacks in the logger work around a circular `merge → helpers → logger` require chain. Restructure the chain so the fallback is no longer needed. Clears the final 3 sites of the campaign. Regression risk touches every logger-consuming test. | `0.3.8` | Q1 2027 |
 

package/framework/v0.3.13-alpha.2/VERSION

@@ -0,0 +1 @@
+0.3.13-alpha.2

package/framework/{v0.3.13-alpha.1 → v0.3.13-alpha.2}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -12509,39 +12509,75 @@ function ValidatorPlugin(rules, data, formId) {
 
 
     /**
-     * makeObjectFromArgs
+     * setByPath — Safe property setter that walks a segments array and
+     * assigns a value at the terminal segment, creating intermediate
+     * `{}` / `[]` based on the next segment's type (numeric → array,
+     * otherwise object).
      *
+     * @inner
+     * @private
      *
-     * @param {string} root
-     * @param {array} args
-     * @param {object} obj
-     * @param {number} len
-     * @param {number} i
-     * @param {string|object} value
-     * @param {object} [rootObj]
+     * @param {object|array} rootObj - Root container to mutate in place.
+     * @param {array} segments - Path keys (numbers for array indices, strings for object props).
+     * @param {*} value - Value to assign at the terminal segment.
+     *
+     * @returns {void}
+     *
+     * @example
+     *   var root = {};
+     *   setByPath(root, ['foo', 'bar'], 42);
+     *   // root === { foo: { bar: 42 } }
      *
-     * @returns {Object} rootObj
+     * @example
+     *   var root = {};
+     *   setByPath(root, ['items', 0], 'first');
+     *   // root === { items: ['first'] }
      */
-    var makeObjectFromArgs = function(_root, args, _obj, len, i, _value, _rootObj) {
+    var setByPath = function(rootObj, segments, value) {
+        var cur = rootObj;
+        for (var i = 0; i < segments.length - 1; i++) {
+            var seg = segments[i];
+            if ( cur[seg] === undefined || cur[seg] === null ) {
+                cur[seg] = (typeof segments[i + 1] === 'number') ? [] : {};
+            }
+            cur = cur[seg];
+        }
+        cur[segments[segments.length - 1]] = value;
+    };
 
-        // Closure Compiler requirements
-        var _global = window['gina']['_global'];
-        // js_externs
-        _global.register({
-            'root'      : _root || null,
-            'obj'       : _obj || null,
-            'value'     : _value || null,
-            'rootObj'   : _rootObj || null
-        });
 
+    /**
+     * makeObjectFromArgs — Recursive builder of a nested object/array tree
+     * from a flat segments array. Threads a `rootSegments` path through the
+     * recursion and assigns at the terminal via `setByPath`.
+     *
+     * #M20: replaced the previous string-path accumulator and runtime
+     * evaluation with the segments-array + safe setter (see `setByPath`
+     * above).
+     *
+     * @inner
+     * @private
+     *
+     * @param {array} _root - Initial path segments (overwritten in init branch on first call).
+     * @param {array} args - Bracketed key sequence.
+     * @param {object} _obj - Current sub-tree being walked.
+     * @param {number} len - args.length.
+     * @param {number} i - Current index into args.
+     * @param {*} _value - Terminal value to assign.
+     * @param {object} [_rootObj] - Accumulator root object (null on first call).
+     *
+     * @returns {Object} A `JSON.clone`d snapshot of the assembled root tree.
+     */
+    var makeObjectFromArgs = function(_root, args, _obj, len, i, _value, _rootObj) {
+
+        var rootSegments = Array.isArray(_root) ? _root : ['rootObj'];
+        var obj          = _obj || null;
+        var value        = _value || null;
+        var rootObj      = _rootObj || null;
 
         if (i == len) { // end
-            eval(root +'=value');
-            // backup result
-            var result = JSON.clone(rootObj);
-            // cleanup _global
-            _global.unregister(['root', 'obj', 'rootObj', 'value', 'valueType']);
-            return result
+            setByPath(rootObj, rootSegments.slice(1), value);
+            return JSON.clone(rootObj);
         }
 
         var key = args[i].replace(/^\[|\]$/g, '');
@@ -12549,22 +12585,19 @@ function ValidatorPlugin(rules, data, formId) {
         // init root object
         if ( typeof(rootObj) == 'undefined' || !rootObj ) {
             rootObj = {};
-            root = 'rootObj';
+            rootSegments = ['rootObj'];
 
-            root += (/^\d+$/.test(key)) ? '['+ key + ']' : '["'+ key +'"]';
-            eval(root +'=obj');
+            rootSegments.push((/^\d+$/.test(key)) ? parseInt(key, 10) : key);
+            setByPath(rootObj, rootSegments.slice(1), obj);
         } else {
-            root += (/^\d+$/.test(key)) ? '['+ key + ']' : '["'+ key +'"]';
+            rootSegments.push((/^\d+$/.test(key)) ? parseInt(key, 10) : key);
         }
 
 
         var nextKey = ( typeof(args[i + 1]) != 'undefined' ) ? args[i + 1].replace(/^\[|\]$/g, '') : null;
         var valueType = ( nextKey && parseInt(nextKey) == nextKey ) ? [] : {};
-        _global.register({
-            'valueType' : valueType
-        });
         if ( nextKey ) {
-            eval(root +' = valueType');
+            setByPath(rootObj, rootSegments.slice(1), valueType);
         }
 
         if ( typeof(obj[key]) == 'undefined' ) {
@@ -12576,11 +12609,11 @@ function ValidatorPlugin(rules, data, formId) {
             }
 
             ++i;
-            return makeObjectFromArgs(root, args, obj[key], len, i, value, rootObj);
+            return makeObjectFromArgs(rootSegments, args, obj[key], len, i, value, rootObj);
         }
 
         ++i;
-        return makeObjectFromArgs(root, args, obj[key], len, i, value, rootObj);
+        return makeObjectFromArgs(rootSegments, args, obj[key], len, i, value, rootObj);
     }
 
 

package/framework/{v0.3.13-alpha.1 → v0.3.13-alpha.2}/core/controller/controller.render-nunjucks.js

@@ -784,7 +784,13 @@ module.exports = async function renderNunjucks(userData, displayInspector, errOp
     // level (the full render-swig file has much more nuanced handling;
     // MVP keeps it simple).
     if (!hasViews || !hasViews()) {
-        return sendHtmlResponse(local, '', req, res);
+        sendHtmlResponse(local, '', req, res);
+        // Release per-request refs on the closure. The function-scoped
+        // `req` / `res` / `_next` captures stay alive until return.
+        local.req = null;
+        local.res = null;
+        local.next = null;
+        return;
     }
 
     // headersSent guard — if the pipeline already sent headers (e.g. an
@@ -1074,4 +1080,10 @@ module.exports = async function renderNunjucks(userData, displayInspector, errOp
     }
 
     sendHtmlResponse(local, html, req, res);
+
+    // Release per-request refs on the closure. The function-scoped
+    // `req` / `res` / `_next` captures stay alive until return.
+    local.req = null;
+    local.res = null;
+    local.next = null;
 };

package/framework/{v0.3.13-alpha.1 → v0.3.13-alpha.2}/core/plugins/lib/validator/src/main.js

@@ -3003,39 +3003,75 @@ function ValidatorPlugin(rules, data, formId) {
 
 
     /**
-     * makeObjectFromArgs
+     * setByPath — Safe property setter that walks a segments array and
+     * assigns a value at the terminal segment, creating intermediate
+     * `{}` / `[]` based on the next segment's type (numeric → array,
+     * otherwise object).
      *
+     * @inner
+     * @private
      *
-     * @param {string} root
-     * @param {array} args
-     * @param {object} obj
-     * @param {number} len
-     * @param {number} i
-     * @param {string|object} value
-     * @param {object} [rootObj]
+     * @param {object|array} rootObj - Root container to mutate in place.
+     * @param {array} segments - Path keys (numbers for array indices, strings for object props).
+     * @param {*} value - Value to assign at the terminal segment.
+     *
+     * @returns {void}
      *
-     * @returns {Object} rootObj
+     * @example
+     *   var root = {};
+     *   setByPath(root, ['foo', 'bar'], 42);
+     *   // root === { foo: { bar: 42 } }
+     *
+     * @example
+     *   var root = {};
+     *   setByPath(root, ['items', 0], 'first');
+     *   // root === { items: ['first'] }
      */
-    var makeObjectFromArgs = function(_root, args, _obj, len, i, _value, _rootObj) {
+    var setByPath = function(rootObj, segments, value) {
+        var cur = rootObj;
+        for (var i = 0; i < segments.length - 1; i++) {
+            var seg = segments[i];
+            if ( cur[seg] === undefined || cur[seg] === null ) {
+                cur[seg] = (typeof segments[i + 1] === 'number') ? [] : {};
+            }
+            cur = cur[seg];
+        }
+        cur[segments[segments.length - 1]] = value;
+    };
 
-        // Closure Compiler requirements
-        var _global = window['gina']['_global'];
-        // js_externs
-        _global.register({
-            'root'      : _root || null,
-            'obj'       : _obj || null,
-            'value'     : _value || null,
-            'rootObj'   : _rootObj || null
-        });
 
+    /**
+     * makeObjectFromArgs — Recursive builder of a nested object/array tree
+     * from a flat segments array. Threads a `rootSegments` path through the
+     * recursion and assigns at the terminal via `setByPath`.
+     *
+     * #M20: replaced the previous string-path accumulator and runtime
+     * evaluation with the segments-array + safe setter (see `setByPath`
+     * above).
+     *
+     * @inner
+     * @private
+     *
+     * @param {array} _root - Initial path segments (overwritten in init branch on first call).
+     * @param {array} args - Bracketed key sequence.
+     * @param {object} _obj - Current sub-tree being walked.
+     * @param {number} len - args.length.
+     * @param {number} i - Current index into args.
+     * @param {*} _value - Terminal value to assign.
+     * @param {object} [_rootObj] - Accumulator root object (null on first call).
+     *
+     * @returns {Object} A `JSON.clone`d snapshot of the assembled root tree.
+     */
+    var makeObjectFromArgs = function(_root, args, _obj, len, i, _value, _rootObj) {
+
+        var rootSegments = Array.isArray(_root) ? _root : ['rootObj'];
+        var obj          = _obj || null;
+        var value        = _value || null;
+        var rootObj      = _rootObj || null;
 
         if (i == len) { // end
-            eval(root +'=value');
-            // backup result
-            var result = JSON.clone(rootObj);
-            // cleanup _global
-            _global.unregister(['root', 'obj', 'rootObj', 'value', 'valueType']);
-            return result
+            setByPath(rootObj, rootSegments.slice(1), value);
+            return JSON.clone(rootObj);
         }
 
         var key = args[i].replace(/^\[|\]$/g, '');
@@ -3043,22 +3079,19 @@ function ValidatorPlugin(rules, data, formId) {
         // init root object
         if ( typeof(rootObj) == 'undefined' || !rootObj ) {
             rootObj = {};
-            root = 'rootObj';
+            rootSegments = ['rootObj'];
 
-            root += (/^\d+$/.test(key)) ? '['+ key + ']' : '["'+ key +'"]';
-            eval(root +'=obj');
+            rootSegments.push((/^\d+$/.test(key)) ? parseInt(key, 10) : key);
+            setByPath(rootObj, rootSegments.slice(1), obj);
         } else {
-            root += (/^\d+$/.test(key)) ? '['+ key + ']' : '["'+ key +'"]';
+            rootSegments.push((/^\d+$/.test(key)) ? parseInt(key, 10) : key);
         }
 
 
         var nextKey = ( typeof(args[i + 1]) != 'undefined' ) ? args[i + 1].replace(/^\[|\]$/g, '') : null;
         var valueType = ( nextKey && parseInt(nextKey) == nextKey ) ? [] : {};
-        _global.register({
-            'valueType' : valueType
-        });
         if ( nextKey ) {
-            eval(root +' = valueType');
+            setByPath(rootObj, rootSegments.slice(1), valueType);
         }
 
         if ( typeof(obj[key]) == 'undefined' ) {
@@ -3070,11 +3103,11 @@ function ValidatorPlugin(rules, data, formId) {
             }
 
             ++i;
-            return makeObjectFromArgs(root, args, obj[key], len, i, value, rootObj);
+            return makeObjectFromArgs(rootSegments, args, obj[key], len, i, value, rootObj);
         }
 
         ++i;
-        return makeObjectFromArgs(root, args, obj[key], len, i, value, rootObj);
+        return makeObjectFromArgs(rootSegments, args, obj[key], len, i, value, rootObj);
     }
 
 

package/framework/{v0.3.13-alpha.1 → v0.3.13-alpha.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.3.13-alpha.1",
+  "version": "0.3.13-alpha.2",
   "dependencies": {
     "@rhinostone/swig": "^2.2.0",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.3.13-alpha.1/core/gna');
+var _gna = require('./framework/v0.3.13-alpha.2/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.3.13-alpha.1/core/controller');
-var EntitySuper     = require('./framework/v0.3.13-alpha.1/core/model/entity');
+var SuperController = require('./framework/v0.3.13-alpha.2/core/controller');
+var EntitySuper     = require('./framework/v0.3.13-alpha.2/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.3.13-alpha.1/lib/uuid');
+var uuid = require('./framework/v0.3.13-alpha.2/lib/uuid');
 
 module.exports = {
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.3.13-alpha.1",
+  "version": "0.3.13-alpha.2",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -56,7 +56,7 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.3.13-alpha.1/core/gna",
+  "main": "./framework/v0.3.13-alpha.2/core/gna",
   "types": "./types/index.d.ts",
   "typesVersions": {
     "*": {

package/framework/v0.3.13-alpha.1/VERSION

@@ -1 +0,0 @@
-0.3.13-alpha.1