gina 0.3.13-alpha.2 → 0.3.13-alpha.3

package/CHANGELOG.md

@@ -6,6 +6,23 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.3.13-alpha.3 - 2026-05-14 (npm only — no git tag)
+### Added
+* `${secret:KEY}` placeholder syntax in bundle JSON configs. Substituted at getConfig() time from process.env[KEY]. Fails closed if the env var is unset or empty. Resolution happens once per config-load cycle (cached). Pluggable-backend support is reserved for a future iteration; only the env-var backend ships in this alpha.
+* `settings.json > csrf.secret` config slot in `gina.plugins.Csrf()` — flows through the `lib/secrets` resolver, so `${secret:KEY}` placeholders work for the Csrf HMAC secret. Precedence is `opts.secret` (test override) > `settings.csrf.secret` > `process.env.GINA_CSRF_SECRET` (back-compat); existing bundles that set `GINA_CSRF_SECRET` keep working unchanged.
+* `${secret:KEY}` placeholder support in `mcp.json` for `gina bundle:mcp-start`. The cmd handler now calls `lib/secrets` on the parsed manifest immediately after `requireJSON()`, so `server.authToken` (and any other future placeholder field in mcp.json) gets filled from `process.env[KEY]` before downstream readers pick it up. Existing bundles that set `process.env.GINA_MCP_AUTH_TOKEN` directly keep working unchanged — that fallback is the last step of the precedence chain.
+### Changed
+* Added terminal-exit closure nulling to render-nunjucks for early per-request memory release, matching render-swig pattern (#M1 retrofit follow-up).
+* Bundle scaffolding (project add / bundle add) now shows the `${secret:KEY}` placeholder pattern as the recommended shape for session and CSRF secrets. `core/template/conf/settings.json` documents the new `settings.csrf.secret` slot (placeholder-compatible) alongside the existing GINA_CSRF_SECRET env-var fallback; `core/template/boilerplate/bundle/index.js` shows `self.getConfig('session').secret` (with bundle/config/session.json holding a `${secret:SESSION_SECRET}` placeholder) as the recommended session-secret wiring, keeping the direct `process.env.SESSION_SECRET` shape as a back-compat note.
+### Fixed
+* `requireJSON` line-comment stripping no longer fails when a bundle config combines a URL string with a bare `//` line-comment separator. The previous `indexOf`-into-greedy-match pass collided on the URL `://` and silently skipped the real separator, leaving `JSON.parse` to throw `Expected double-quoted property name`. The pass is now per-line on the leftmost `//`, matching the prior heuristic without the substring collision.
+### Security
+* Replaced eval() in validator nested-key rule construction (Socket #SCS campaign cluster M20).
+* Removing eval() from 4 HTML event-callback sites in the browser bundle (events.js + validator/main.js). The function-call shape `data-gina-...-event-on-*="fn(args)"` is no longer supported — register the handler on window and use the bare-identifier shape `="fn"`; a deprecation warning is logged at runtime if a function-call shape is encountered. Clears 4 of the 9 remaining Socket `Uses eval` flag sites (#M21a).
+* Removing eval() from the conditional binding evaluator fallback in form-validator.js. Form `condition` strings that previously hit the eval escape-hatch now throw with an explicit message listing the four supported shapes (binary comparison `a OP b`, RegExp instance, boolean, /regex/flags literal). Regex-literal strings still pass through. Clears 1 of the 5 remaining Socket `Uses eval` flag sites (#M21b).
+* Documenting the Pattern B eval surface at form-validator.js (user-defined validator function bodies registered on `gina.forms.validators` from disk-loaded `bundle/validators/<name>/main.js` files at framework boot). The eval is load-bearing public API and stays — no behavior change. Adds an in-source trust-model comment block and pins the invariant with `test/lib/validator-scs1i.test.js` (zero writes to `gina.forms.validators` in framework source; zero request-time identifiers around the userValidator source chain). Closes the M21 cluster (#M21c).
+* Restructuring the logger ↔ merge circular-require so the eval fallbacks at lib/logger/src/main.js + the two logger containers are no longer needed and have been removed. Root cause was merge.js requiring `helpers/index.js` (the for-loop helper loader) at module-load to populate `JSON.clone`, which transitively required `lib/logger` via several helpers and produced a partial-module return under circular load. Fix swaps that for a direct require of `utils/prototypes.json_clone` (a 100-line standalone primitive with zero top-level requires) — same JSON.clone population, no circular trigger. Clears the final 3 server-side Socket `Uses eval` sites (#M22). Phase 3c complete: 1 live framework eval site remains (the load-bearing Pattern B at form-validator.js:1886 / #M21c trust model).
+
 ## 0.3.12 - 2026-05-12
 ### Changed
 * Bumped @rhinostone/swig dependency floor from ^2.0.1 to ^2.1.0 in framework/v*/package.json. Version 2.1.0 introduces a multi-flavor architecture splitting the runtime into a shared @rhinostone/swig-core package plus per-flavor frontends (@rhinostone/swig native syntax, @rhinostone/swig-twig Twig-syntax frontend); the native @rhinostone/swig package remains drop-in compatible with the @rhinostone/swig@1.x and 2.0.x API surface gina depends on (swig.compile, swig.setFilter, swig.setTag, swig.renderFile). swigResolver DEFAULT_MIN stays at 2.0.0 since the framework does not depend on any new 2.1.0-only API. Resolves the version-currency drift surfaced by 'npm view @rhinostone/swig version' returning 2.1.0 against the current ^2.0.1 floor.

package/ROADMAP.md

@@ -156,6 +156,16 @@ Cross-site request forgery protection. Three-phase defense-in-depth plan aligned
 
 ---
 
+## Secrets & Configuration
+
+Secrets handling for bundle JSON configs without baking plaintext values into source. Pluggable-backend design with `process.env` as the default; the reserved API surface allows future Vault / SOPS / K8s Secrets backends to slot in without changing call sites or the placeholder syntax.
+
+| Status | Feature | Version | Target |
+| --- | --- | --- | --- |
+| ✅ | **`${secret:KEY}` placeholder substitution** — `lib/secrets` resolves `${secret:KEY}` placeholders embedded in bundle JSON configs (`settings.json`, `app.json`, `connectors.json`, `mcp.json`, etc.) at config-load time. Anchored regex matches the entire string value only — mixed strings (`"prefix-${secret:K}-suffix"`) pass through unchanged. Default backend reads `process.env[KEY]`; pluggable-backend interface reserved for a future iteration. Fails closed (throws `Error('Secret resolution failed')`) when an env var is unset or empty; the error message intentionally omits the key name. Resolution is once per config-load cycle (in-place mutation). `WeakMap`-backed path tracking enables a future log-redaction wrapper at merged-conf print sites. Hooked inside `core/config.js::loadBundleConfig`, so downstream readers (`getConfig()`, plugin factories) see resolved values transparently. **Consumers shipped**: `gina.plugins.Csrf()` reads `settings.csrf.secret` (precedence `opts.secret` > `settings.csrf.secret` > `process.env.GINA_CSRF_SECRET` for back-compat); `gina bundle:mcp-start` re-runs the resolver on the parsed `mcp.json` immediately after `requireJSON()` so `server.authToken` and any future placeholder field gets filled before downstream readers; bundle scaffolding (`project:add` / `bundle:add`) recommends the placeholder shape in `core/template/conf/settings.json` and `core/template/boilerplate/bundle/index.js`. 33 tests in `test/core/config-secrets-resolver.test.js`. | `0.3.13-alpha` | 2026-05-13 |
+
+---
+
 ## Connectors
 
 New database connectors follow the same interface as the existing Couchbase connector: declared in `connectors.json`, acquired via `getConnection()`.

package/framework/v0.3.13-alpha.3/VERSION

@@ -0,0 +1 @@
+0.3.13-alpha.3

package/framework/{v0.3.13-alpha.2 → v0.3.13-alpha.3}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -2732,7 +2732,8 @@ function Merge() {
 if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
     // for unit tests
     if ( typeof(JSON.clone) == 'undefined' ) {
-        require('../../../helpers');
+        // #M22 — direct require of the clone primitive instead of helpers/index.js's for-loop loader (which transitively requires lib/logger and returns a partial merge under circular load)
+        JSON.clone = require(__dirname + '/../../../../../utils/prototypes.json_clone');
     }
     // Publish as node.js module
     module.exports = Merge()
@@ -3911,7 +3912,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
 
                             isValid = new RegExp(re, flags).test(this.value)
                         } else {
-                            isValid = eval(condition);
+                            // #M21b — free-form JS condition shape unsupported; declare a documented shape instead
+                            throw new Error('[FormValidator] Unsupported condition shape — supported: binary comparison (a OP b), RegExp, boolean, /regex/flags literal. Got: `' + condition + '`');
                         }
 
                         //valid = new RegExp(condition.replace(/\//g, '')).test(this.value)
@@ -4725,6 +4727,15 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                         userValidator = gina.forms.validators[v].toString();
                     }
 
+                    // #M21c — Pattern B eval surface (trust-model invariant)
+                    // Load-bearing: user-defined validator function bodies are registered on
+                    // `gina.forms.validators` from disk-loaded `bundle/validators/<name>/main.js`
+                    // files at framework boot. Trust assumption: the source of `userValidator`
+                    // is always disk-sourced at boot — never request-time input (req.*, request.*,
+                    // form values, URL params). End-user data MUST NOT reach this eval.
+                    // Invariant pinned by test/lib/validator-scs1i.test.js (zero write sites for
+                    // `gina.forms.validators` in framework source; zero request-time identifiers
+                    // around the userValidator source chain).
                     self[el][v] = eval('(' + userValidator + ')\n//# sourceURL='+ v +'.js');
                     //self[el][v] = Function('errorMessage', 'errorStack', userValidator);
                 }
@@ -7493,7 +7504,8 @@ function on(event, cb) {
         if (htmlSuccesEventCallback != null) {
 
             if ( /\((.*)\)/.test(htmlSuccesEventCallback) ) {
-                eval(htmlSuccesEventCallback)
+                // #M21a — function-call shape unsupported; register a bare handler on window instead
+                try { console.warn('[gina-event] function-call shape no longer supported on data-gina-'+ type +'-event-on-success — use a bare identifier and register the handler on window: '+ htmlSuccesEventCallback); } catch (e) {}
             } else {
                 $el.on('success.h'+ type,  window[htmlSuccesEventCallback])
             }
@@ -7503,7 +7515,8 @@ function on(event, cb) {
         var htmlErrorEventCallback =  $el.target.getAttribute('data-gina-'+ type +'-event-on-error') || null;
         if (htmlErrorEventCallback != null) {
             if ( /\((.*)\)/.test(htmlErrorEventCallback) ) {
-                eval(htmlErrorEventCallback)
+                // #M21a — function-call shape unsupported; register a bare handler on window instead
+                try { console.warn('[gina-event] function-call shape no longer supported on data-gina-'+ type +'-event-on-error — use a bare identifier and register the handler on window: '+ htmlErrorEventCallback); } catch (e) {}
             } else {
                 $el.on('error.h'+ type, window[htmlErrorEventCallback])
             }
@@ -11906,7 +11919,8 @@ function ValidatorPlugin(rules, data, formId) {
         if (htmlSuccesEventCallback != null) {
 
             if ( /\((.*)\)/.test(htmlSuccesEventCallback) ) {
-                eval(htmlSuccesEventCallback)
+                // #M21a — function-call shape unsupported; register a bare handler on window instead
+                try { console.warn('[gina-form-event] function-call shape no longer supported on data-gina-form-event-on-submit-success — use a bare identifier and register the handler on window: '+ htmlSuccesEventCallback); } catch (e) {}
             } else {
                 $form.on('success.hform',  window[htmlSuccesEventCallback])
             }
@@ -11915,7 +11929,8 @@ function ValidatorPlugin(rules, data, formId) {
         var htmlErrorEventCallback =  $form.target.getAttribute('data-gina-form-event-on-submit-error') || null;
         if (htmlErrorEventCallback != null) {
             if ( /\((.*)\)/.test(htmlErrorEventCallback) ) {
-                eval(htmlErrorEventCallback)
+                // #M21a — function-call shape unsupported; register a bare handler on window instead
+                try { console.warn('[gina-form-event] function-call shape no longer supported on data-gina-form-event-on-submit-error — use a bare identifier and register the handler on window: '+ htmlErrorEventCallback); } catch (e) {}
             } else {
                 $form.on('error.hform', window[htmlErrorEventCallback])
             }

package/framework/{v0.3.13-alpha.2 → v0.3.13-alpha.3}/core/asset/plugin/dist/vendor/gina/js/gina.min.js

@@ -47,7 +47,7 @@ A.length==0||typeof A=='undefined'?/^true$/i.test(D)?A:U:A}if(A.length==0&&U.len
 l=0;for(A=m.length;l<A;++l)Y.push(m[l][n]);for(l=0;l<A;++l)a:for(S=aa||0,ka=D.length;S<ka;++S)if(D[S]!=null&&typeof D[S][n]!='undefined'&&D[S][n]!==m[l][n]){if(Y.indexOf(D[S][n])==-1){m.push(D[S]);Y.push(D[S][n]);aa=S+1;A<ka&&++A;break a}}else if(D[S]!=null&&typeof D[S][n]!='undefined'&&D[S][n]===m[l][n])aa=S+1;else break a;return m}for(l=0;l<A.length;++l)if(Y=null,typeof A=='undefined'||typeof A[l]!='object'||Array.isArray(A[l])||A[l]==null||(Y=Object.getOwnPropertyNames(A[l])),typeof Y!='undefined'&&
 Y!=null&&(Y=Y[0]||null),U.indexOf(A[l])>-1&&D)U.splice(U.indexOf(A[l]),1,A[l]);else if(typeof m[l]=='undefined'&&typeof A[l]=='object')for(c in m=U,typeof m[l]=='undefined'&&(m[l]={}),A[l])m[l].hasOwnProperty(c)||(m[l][c]=A[l][c]);else!D&&m.indexOf(A[l])>-1&&/number/i.test(typeof A[l])&&A[l]!==m[l]?m.push(A[l]):typeof U[l]=='undefined'||/null/i.test(U[l])||typeof U[l][n]=='undefined'||typeof A[l]=='undefined'||typeof A[l][n]=='undefined'||U[l][n]!=A[l][n]?m.indexOf(A[l])==-1&&typeof A[l]!='object'?
 m.push(A[l]):typeof U[l]=='undefined'||/null/i.test(U[l])||typeof U[l][Y]=='undefined'||typeof A[l]=='undefined'||typeof A[l][Y]=='undefined'||U[l][Y]!=A[l][Y]||(m[l]=D?A[l]:U[l]):m[l]=D?A[l]:U[l]}if(m.length>0&&U.length>0||m.length==0&&U.length==0)return m};M.prototype.setKeyComparison=function(A){this.keyComparison=A};var C=function(A){if(!A||{}.toString.call(A)!=='[object Object]'||A.nodeType||A.setInterval)return!1;var U={}.hasOwnProperty,D=U.call(A,'constructor');U=typeof A.constructor!='undefined'?
-U.call(A.constructor.prototype,'isPrototypeOf'):!1;return!A.constructor||D||U?!0:!1};I.setKeyComparison=function(A){M.keyComparison=A;return I};I.getKeyComparison=function(){var A=M.keyComparison||'id';M.keyComparison='id';return A};return I}typeof module!=='undefined'&&module.exports?(typeof JSON.clone=='undefined'&&require('../../../helpers'),module.exports=Merge()):typeof define==='function'&&define.amd&&define('lib/merge',[],function(){return Merge()});
+U.call(A.constructor.prototype,'isPrototypeOf'):!1;return!A.constructor||D||U?!0:!1};I.setKeyComparison=function(A){M.keyComparison=A;return I};I.getKeyComparison=function(){var A=M.keyComparison||'id';M.keyComparison='id';return A};return I}typeof module!=='undefined'&&module.exports?(typeof JSON.clone=='undefined'&&(JSON.clone=require(__dirname+'/../../../../../utils/prototypes.json_clone')),module.exports=Merge()):typeof define==='function'&&define.amd&&define('lib/merge',[],function(){return Merge()});
 var _alphabet='0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz',_mask=63,_step=7;function uuid(m){m=m||4;for(var E='';;)for(var I=crypto.getRandomValues(new Uint8Array(_step)),M=0;M<_step;M++){var C=I[M]&_mask;if(C<62&&(E+=_alphabet[C],E.length===m))return E}}
 uuid.customAlphabet=function(m,E){E=E||4;for(var I=1;I<m.length-1;)I=I<<1|1;var M=Math.ceil(1.6*(I+1)*E/m.length);M<5&&(M=5);return function(C){C=C||E;for(var A='';;)for(var U=crypto.getRandomValues(new Uint8Array(M)),D=0;D<M;D++){var Y=U[D]&I;if(Y<m.length&&(A+=m[Y],A.length===C))return A}}};
 if(typeof module!=='undefined'&&module.exports){if(typeof crypto==='undefined'||typeof crypto.getRandomValues!=='function'){var _webcrypto=require('crypto').webcrypto||require('crypto');typeof globalThis!=='undefined'?globalThis.crypto=_webcrypto:crypto=_webcrypto}module.exports=uuid}else typeof define==='function'&&define.amd&&define('lib/uuid',[],function(){return uuid});
@@ -78,29 +78,29 @@ J.param;L.template&&typeof L.template.ginaLoader=='undefined'&&(L.template.ginaL
 0||!ma.isRequired&&this.value==''&&!/^false$/i.test(this.value)&&this.value!=0?L=!0:ma.isRequired||typeof this.value!='string'||this.value!=''||(L=!0);if(!L&&/^(true|false)$/i.test(r))L=r;else if(!L){var G=null,K=null;if(/[!=>><a-z 0-9]+/i.test(r)){if((K=r.match(/\${0}[-_,.\[\]a-z0-9]+/ig))&&K.length>0){for(var B=0,oa=K.length;B<oa;++B)typeof c[K[B]]!='undefined'&&K[B]&&(G=new RegExp('\\$'+K[B]+'(?!\\S+)','g'),r=c[K[B]].value==''?r.replace(G,'""'):typeof c[K[B]].value=='string'?r.replace(G,'"'+c[K[B]].value+
 '"'):r.replace(G,c[K[B]].value));try{if(r=r.replace(/(\(|\)|return)/g,''),/^\//.test(r)){var X=r.match(/^\/(.+)\/([a-z]*)$/);if(!X)throw Error('Invalid regex literal: `'+r+'`');L=(new RegExp(X[1],X[2])).test(this.value)}else{G=/^\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;var la=typeof r=='string'?r.match(G):null;if(!la)throw Error('Could not evaluate condition `'+r+'`.\n(grammar: <operand><op><operand>; operand \u2208 number | "string" | true | false | null | undefined; op \u2208 === !== == != < > <= >=)');
 G=function(ra){var wa=ra.replace(/^\s+|\s+$/g,'');if(wa==='null')return null;if(wa!=='undefined'){if(wa==='true')return!0;if(wa==='false')return!1;if(/^"[^"]*"$/.test(wa))return wa.slice(1,-1);var Ja=Number(wa);if(!isNaN(Ja)&&wa!=='')return Ja;throw Error('Invalid operand: `'+ra+'`');}};var ea=G(la[1]),qa=la[2],va=G(la[3]);switch(qa){case '===':L=ea===va;break;case '!==':L=ea!==va;break;case '==':L=ea==va;break;case '!=':L=ea!=va;break;case '<':L=ea<va;break;case '>':L=ea>va;break;case '<=':L=ea<=
-va;break;case '>=':L=ea>=va}}}catch(ra){throw Error(ra.stack||ra.message);}}}else if(r instanceof RegExp)L=r.test(this.value)?!0:!1;else if(typeof r=='boolean')L=r?!0:!1;else try{/\/(.*)\//.test(r)?(G=r.match(/\/(.*)\//).pop(),K=r.replace('/'+G+'/',''),L=(new RegExp(G,K)).test(this.value)):L=eval(r)}catch(ra){throw Error(ra.stack||ra.message);}}L?L&&typeof ma[fa]!='undefined'&&delete ma[fa]:(ma[fa]=h(this.error||x||l.errorLabels[fa],this),typeof J!='undefined'&&(ma.stack=J));this.valid=L;ma.count()>
-0&&(this.errors=ma);return c[this.name]};c[g].set=function(r){this.value=l.data[this.name]=r;this.target.setAttribute('value',r);return c[this.name]};c[g].isEmail=function(){this.value=l.data[this.name]=this.value?this.value.toLowerCase():this.value;C&&this.target&&this.target.value!=''&&/[A-Z]+/.test(this.target.value)&&(this.target.value=this.value);var r=/^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/.test(this.value)?
-!0:!1,x=c[this.name].errors||{};x.isRequired||this.value!=''||(r=!0);r?r&&typeof x.isEmail!='undefined'&&delete x.isEmail:x.isEmail=h(this.error||l.errorLabels.isEmail,this);this.valid=r;x.count()>0&&(this.errors=x);return c[this.name]};c[g].isJsonWebToken=function(){this.value=l.data[this.name]=this.value?this.value.toLowerCase():this.value;C&&this.target&&this.target.value!=''&&/[A-Z]+/.test(this.target.value)&&(this.target.value=this.value);var r=/^[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$/.test(this.value)?
-!0:!1,x=c[this.name].errors||{};x.isRequired||this.value!=''||(r=!0);r?r&&typeof x.isJsonWebToken!='undefined'&&delete x.isJsonWebToken:x.isJsonWebToken=h(this.error||l.errorLabels.isJsonWebToken,this);this.valid=r;x.count()>0&&(this.errors=x);return c[this.name]};c[g].isBoolean=function(){var r=null,x=c[this.name].errors||{};x.isRequired&&this.value==0&&(delete x.isRequired,this.errors=x);switch(this.value){case 'true':case !0:case 1:r=this.value=l.data[this.name]=!0;break;case 'false':case !1:case 0:r=
-this.value=l.data[this.name]=!1}(r=r!==null?!0:!1)?r&&typeof x.isBoolean!='undefined'&&delete x.isBoolean:x.isBoolean=h(this.error||l.errorLabels.isBoolean,this);this.valid=r;x.count()>0&&(this.errors=x);return c[this.name]};c[g].isNumber=function(r,x){var J=this.value,L=!1,fa=!0,ma=!0,G=c[this.name].errors||{};try{typeof J=='string'&&/,|\./g.test(J)?J=l.data[this.name]=this.value=parseFloat(J.replace(/,/g,'.').replace(/\s+/g,'')):typeof J=='string'&&J!=''&&(J=l.data[this.name]=this.value=parseInt(J.replace(/\s+/g,
-'')))}catch(B){G.isNumber=h(this.error||l.errorLabels.isNumber,this),this.valid=!1,G.count()>0&&(this.errors=G)}if(+J===+J&&(L=!0,!G.isRequired&&J!='')){var K=J.toString().length;r&&typeof r=='number'&&K<r&&(fa=!1,this.size=r);x&&typeof x=='number'&&K>x&&(ma=!1,this.size=x)}L&&fa&&ma||(L||(G.isNumber=h(this.error||l.errorLabels.isNumber,this)),fa&&ma||(fa||(G.isNumberLength=h(this.error||l.errorLabels.isNumberMinLength,this)),ma||(G.isNumberLength=h(this.error||l.errorLabels.isNumberMaxLength,this)),
-r===x&&(G.isNumberLength=h(this.error||l.errorLabels.isNumberLength,this))),L=!1);L&&typeof G.isNumberLength!='undefined'&&delete G.isNumberLength;this.valid=L;this.value=l.data[this.name]=J!=''?Number(J):J;G.count()>0&&(this.errors=G);return c[this.name]};c[g].toInteger=function(){var r=this.value,x=c[this.name].errors||{};if(r)try{this.value=l.data[this.name]=Math.round(r)}catch(J){x.toInteger=h(this.error||l.errorLabels.toInteger,this),this.valid=!1,x.count()>0&&(this.errors=x)}return c[this.name]};
-c[g].isInteger=function(r,x){var J=this.value,L=!1,fa=!0,ma=!0,G=c[this.name].errors||{};+J===+J&&J%1===0&&(L=!0,G.isRequired||J==''||(r&&typeof r=='number'&&J.length<r&&(fa=!1,this.size=r),x&&typeof x=='number'&&J.length>x&&(ma=!1,this.size=x)));L&&fa&&ma||(L||(G.isInteger=h(this.error||l.errorLabels.isInteger,this)),fa&&ma||(fa||(G.isIntegerLength=h(this.error||l.errorLabels.isIntegerMinLength,this),L=!1),ma||(G.isIntegerLength=h(this.error||l.errorLabels.isIntegerMaxLength,this),L=!1),r===x&&(G.isIntegerLength=
-h(this.error||l.errorLabels.isIntegerLength,this),L=!1)));this.valid=L;this.value=l.data[this.name]=Number(J);G.count()>0&&(this.errors=G);return c[this.name]};c[g].toFloat=function(r){var x=document.getElementById(this.target.getAttribute('id')).value||this.value;isFloatingWithCommas=!1;typeof x=='string'&&(x=x.replace(/\s+/g,''),/,/.test(x)&&/\./.test(x)?x=x.replace(/,/g,''):/,/.test(x)&&(x=x.replace(/,/g,'.'),isFloatingWithCommas=!0));l.data[this.name]=x;var J=c[this.name].errors||{},L=!0;r?this.decimals=
-parseInt(r):typeof this.decimals=='undefined'&&(this.decimals=2);if(x)if(this.isNumber().valid)try{Number.isFinite(x)||(x=new Number(parseFloat(x.match(/[0-9.,]+/g).join('').replace(/,/,'.'))))}catch(fa){L=!1,J.toFloat=h(this.error||l.errorLabels.toFloat,this),this.valid=!1,J.count()>0&&(this.errors=J)}else L=!1,J.toFloat=h(this.error||l.errorLabels.toFloatNAN,this);else return c[this.name];this.decimals&&x&&!J.toFloat&&(x=parseFloat(x.toFixed(this.decimals)));this.value=l.data[this.name]=x;C&&(isFloatingWithCommas&&
-(x=(''+x).replace(/\./g,',')),this.target.setAttribute('value',x));this.valid=L;J.count()>0&&(this.errors=J);return c[this.name]};c[g].isFloat=function(r){typeof this.value=='string'&&(this.value=this.value.replace(/\s+/g,''));var x=l.data[this.name]=this.value;r=c[this.name].errors||{};typeof x=='string'&&/\./.test(x)&&Number.isFinite(Number(x));typeof x=='string'&&/,/g.test(x)&&(x=this.value=l.data[this.name]=Number(x.replace(/,/g,'.')));Number(x)===x&&x%1!==0?(this.value=l.data[this.name]=Number(x),
-x=!0):x=!1;r.isRequired||this.value!=''||(x=!0);x||(r.isFloat=h(this.error||l.errorLabels.isFloat,this));this.valid=x;r.count()>0&&(this.errors=r);return c[this.name]};c[g].isRequired=function(r){if(typeof r=='boolean'&&!r)return this.valid=!0,r=l.excluded.indexOf(this.name),r>-1&&l.excluded.splice(r,1),c[this.name];if(C&&this.target&&this.target.tagName=='INPUT'&&typeof this.target.type!='undefined'&&this.target.type=='radio'){var x=this.target;r=document.getElementsByName(this.name);r=Array.prototype.filter.call(r,
-function(fa){return fa.form===x.form});for(var J=0,L=r.length;J<L;++J)if(r[J].checked){/true|false/.test(r[J].value)?this.value=l.data[this.name]=/true/.test(r[J].value)?!0:!1:this.value=l.data[this.name]=r[J].value;this.valid=!0;break}}r=typeof this.value=='undefined'||this.value==null||this.value==''||/^\s+/.test(this.value)?!1:!0;J=c[this.name].errors||{};r?r&&typeof J.isRequired!='undefined'&&delete J.isRequired:J.isRequired=h(this.error||l.errorLabels.isRequired,this);this.valid=r;J.count()>
-0&&(this.errors=J);return c[this.name]};c[g].isString=function(r,x){var J=l.data[this.name]=this.value,L=!1,fa=!0,ma=!0,G=c[this.name].errors||{};typeof J!='string'||G.isRequired||J==''||(L=!0,r&&typeof r=='number'&&J.length<r&&(fa=!1,this.size=r),x&&typeof x=='number'&&J.length>x&&(ma=!1,this.size=x));L&&fa&&ma||(!L&&G.isRequired&&J==''?(L=!1,G.isString=h(this.error||l.errorLabels.isString,this)):L||G.isRequired||(L=!0),fa&&ma||(L=!1,fa||(G.isStringLength=h(this.error||l.errorLabels.isStringMinLength,
-this)),ma||(G.isStringLength=h(this.error||l.errorLabels.isStringMaxLength,this)),r===x&&(G.isStringLength=h(this.error||l.errorLabels.isStringLength,this))));this.valid=L;G.count()>0&&(this.errors=G);return c[this.name]};c[g].isDate=function(r){var x=this.value,J=!1,L=c[this.name].errors||{},fa=null;if(!x||x==''||/NaN|Invalid Date/i.test(x))return/NaN|Invalid Date/i.test(x)&&(console.warn('[FormValidator::isDate] Provided value for field `'+this.name+'` is not allowed: `'+x+'`'),L.isDate=h(this.error||
-l.errorLabels.isDate,this)),this.valid=J,L.count()>0&&(this.errors=L),c[this.name];if(typeof r=='undefined'||typeof r!='undefined'&&/true/i.test(r))r='yyyy-mm-dd';if(x instanceof Date)x=x.format(r);else{try{fa=r.match(/[^\/\- ]+/g)}catch(oa){throw Error('[FormValidator::isDate] Provided mask not allowed: `'+r+'`');}try{x=x.match(/[^\/\- ]+/g);var ma={},G;var K=0;for(G=fa.length;K<G;++K)ma[fa[K]]=x[K];for(var B in ma)r=r.replace(new RegExp(B,'g'),ma[B])}catch(oa){throw Error('[FormValidator::isDate] Provided value not allowed: `'+
-x+'`'+oa);}x=this.value=l.data[this.name]=new Date(r);if(/Invalid Date/i.test(x)||x instanceof Date===!1)return L.isRequired||this.value!=''?L.isDate=h(this.error||l.errorLabels.isDate,this):J=!0,this.valid=J,L.count()>0&&(this.errors=L),c[this.name];J=!0}this.valid=J;return x};c[g].format=function(r,x){var J=this.value;return J?J.format(r,x):c[this.name]};c[g].setFlash=function(r,x){typeof x!='undefined'&&x!=''&&(this.error=x);return c[this.name]};c[g].setLabel=function(r){typeof r!='undefined'&&
-r!=''&&(this.label=r);return c[this.name]};c[g].trim=function(r){if(typeof r=='boolean'&&r)return this.value=this.value.replace(/^\s+|\s+$/,''),l.data[this.name]=l.data[this.name]=this.value,c[this.name]};c[g].exclude=function(r){if(typeof r=='boolean'&&!r)return/^true|false$/i.test(this.value)&&(this.value=/^true$/i.test(this.value)?!0:!1,l.data[this.name]=this.value),c[this.name];this.isExcluded=!1;l.excluded.indexOf(this.name)<0&&(l.excluded.push(this.name),this.isExcluded=!0);return c[this.name]};
-c[g].query=u;c[g].getValidationContext=function(){return{isGFFCtx:C,self:c,local:l,replace:h}};if(n()){F=q=null;try{for(let r in gina.forms.validators)F='/validators/'+r+'/main.js',l.errorLabels[r]='Condition not satisfied',C?(q=ka(gina.forms.validators[r].data),q=q.replace(/(\)\s+\{|\)\{){1}/,'$&\n\tvar validationContext = this.getValidationContext(),isGFFCtx = validationContext.isGFFCtx,self = validationContext.self,local = validationContext.local,replace = validationContext.replace;')):q=gina.forms.validators[r].toString(),
-c[g][r]=eval('('+q+')\n//# sourceURL='+r+'.js')}catch(r){throw Error('[UserFormValidator] Could not evaluate: `'+F+'`\n'+r.stack);}}};for(let g in c)V(g,c[g]);c.addField=function(g,q){typeof c[g]=='undefined'&&V(g,q)};c.isValid=function(){return c.getErrors().count()>0?!1:!0};c.setErrors=function(g){if(!g)return{};for(var q in c)if(typeof c[q]=='object'){for(var F in c[q])typeof g[q]=='object'&&typeof g[q][F]!='undefined'&&(typeof c[q].valid!='undefined'&&/^true$/i.test(c[q].valid)?delete g[q][F]:
-(typeof c[q].errors=='undefined'&&(c[q].errors={}),c[q].errors[F]=g[q][F]));(typeof c[q].errors=='undefined'&&typeof g[q]!='undefined'||typeof c[q].errors!='undefined'&&c[q].errors.count()==0&&typeof g[q]!='undefined')&&delete g[q]}return g};c.getErrors=function(g){var q={};if(typeof g!='undefined')return typeof c[g]!='undefined'&&c[g]&&typeof c[g].errors!='undefined'&&c[g].errors.count()>0&&(q[g]=c[g].errors),q;for(var F in c)typeof c[F]=='object'&&typeof c[F].errors!='undefined'&&c[F].errors.count()>
-0&&(q[F]=c[F].errors);return q};c.toData=function(){if(l.excluded.length>0)for(var g=0,q=l.excluded.length;g<q;++g)typeof l.data[l.excluded[g]]!='undefined'&&delete l.data[l.excluded[g]];return l.data};var h=function(g,q){var F=g.match(/%[a-z]+/gi);if(F)for(var N=0,r=F.length;N<r;++N)g=g.replace(new RegExp(F[N],'g'),q[l.keys[F[N]]]);return g};c.setErrorLabels=function(g){typeof g!='undefined'&&(l.errorLabels=A(g,l.errorLabels))};return c}
-typeof module!=='undefined'&&module.exports?module.exports=FormValidatorUtil:typeof define==='function'&&define.amd&&define('lib/form-validator',[],function(){return FormValidatorUtil});
+va;break;case '>=':L=ea>=va}}}catch(ra){throw Error(ra.stack||ra.message);}}}else if(r instanceof RegExp)L=r.test(this.value)?!0:!1;else if(typeof r=='boolean')L=r?!0:!1;else try{if(/\/(.*)\//.test(r))G=r.match(/\/(.*)\//).pop(),K=r.replace('/'+G+'/',''),L=(new RegExp(G,K)).test(this.value);else throw Error('[FormValidator] Unsupported condition shape \u2014 supported: binary comparison (a OP b), RegExp, boolean, /regex/flags literal. Got: `'+r+'`');}catch(ra){throw Error(ra.stack||ra.message);}}L?
+L&&typeof ma[fa]!='undefined'&&delete ma[fa]:(ma[fa]=h(this.error||x||l.errorLabels[fa],this),typeof J!='undefined'&&(ma.stack=J));this.valid=L;ma.count()>0&&(this.errors=ma);return c[this.name]};c[g].set=function(r){this.value=l.data[this.name]=r;this.target.setAttribute('value',r);return c[this.name]};c[g].isEmail=function(){this.value=l.data[this.name]=this.value?this.value.toLowerCase():this.value;C&&this.target&&this.target.value!=''&&/[A-Z]+/.test(this.target.value)&&(this.target.value=this.value);
+var r=/^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/.test(this.value)?!0:!1,x=c[this.name].errors||{};x.isRequired||this.value!=''||(r=!0);r?r&&typeof x.isEmail!='undefined'&&delete x.isEmail:x.isEmail=h(this.error||l.errorLabels.isEmail,this);this.valid=r;x.count()>0&&(this.errors=x);return c[this.name]};c[g].isJsonWebToken=function(){this.value=l.data[this.name]=this.value?this.value.toLowerCase():
+this.value;C&&this.target&&this.target.value!=''&&/[A-Z]+/.test(this.target.value)&&(this.target.value=this.value);var r=/^[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$/.test(this.value)?!0:!1,x=c[this.name].errors||{};x.isRequired||this.value!=''||(r=!0);r?r&&typeof x.isJsonWebToken!='undefined'&&delete x.isJsonWebToken:x.isJsonWebToken=h(this.error||l.errorLabels.isJsonWebToken,this);this.valid=r;x.count()>0&&(this.errors=x);return c[this.name]};c[g].isBoolean=function(){var r=null,x=c[this.name].errors||
+{};x.isRequired&&this.value==0&&(delete x.isRequired,this.errors=x);switch(this.value){case 'true':case !0:case 1:r=this.value=l.data[this.name]=!0;break;case 'false':case !1:case 0:r=this.value=l.data[this.name]=!1}(r=r!==null?!0:!1)?r&&typeof x.isBoolean!='undefined'&&delete x.isBoolean:x.isBoolean=h(this.error||l.errorLabels.isBoolean,this);this.valid=r;x.count()>0&&(this.errors=x);return c[this.name]};c[g].isNumber=function(r,x){var J=this.value,L=!1,fa=!0,ma=!0,G=c[this.name].errors||{};try{typeof J==
+'string'&&/,|\./g.test(J)?J=l.data[this.name]=this.value=parseFloat(J.replace(/,/g,'.').replace(/\s+/g,'')):typeof J=='string'&&J!=''&&(J=l.data[this.name]=this.value=parseInt(J.replace(/\s+/g,'')))}catch(B){G.isNumber=h(this.error||l.errorLabels.isNumber,this),this.valid=!1,G.count()>0&&(this.errors=G)}if(+J===+J&&(L=!0,!G.isRequired&&J!='')){var K=J.toString().length;r&&typeof r=='number'&&K<r&&(fa=!1,this.size=r);x&&typeof x=='number'&&K>x&&(ma=!1,this.size=x)}L&&fa&&ma||(L||(G.isNumber=h(this.error||
+l.errorLabels.isNumber,this)),fa&&ma||(fa||(G.isNumberLength=h(this.error||l.errorLabels.isNumberMinLength,this)),ma||(G.isNumberLength=h(this.error||l.errorLabels.isNumberMaxLength,this)),r===x&&(G.isNumberLength=h(this.error||l.errorLabels.isNumberLength,this))),L=!1);L&&typeof G.isNumberLength!='undefined'&&delete G.isNumberLength;this.valid=L;this.value=l.data[this.name]=J!=''?Number(J):J;G.count()>0&&(this.errors=G);return c[this.name]};c[g].toInteger=function(){var r=this.value,x=c[this.name].errors||
+{};if(r)try{this.value=l.data[this.name]=Math.round(r)}catch(J){x.toInteger=h(this.error||l.errorLabels.toInteger,this),this.valid=!1,x.count()>0&&(this.errors=x)}return c[this.name]};c[g].isInteger=function(r,x){var J=this.value,L=!1,fa=!0,ma=!0,G=c[this.name].errors||{};+J===+J&&J%1===0&&(L=!0,G.isRequired||J==''||(r&&typeof r=='number'&&J.length<r&&(fa=!1,this.size=r),x&&typeof x=='number'&&J.length>x&&(ma=!1,this.size=x)));L&&fa&&ma||(L||(G.isInteger=h(this.error||l.errorLabels.isInteger,this)),
+fa&&ma||(fa||(G.isIntegerLength=h(this.error||l.errorLabels.isIntegerMinLength,this),L=!1),ma||(G.isIntegerLength=h(this.error||l.errorLabels.isIntegerMaxLength,this),L=!1),r===x&&(G.isIntegerLength=h(this.error||l.errorLabels.isIntegerLength,this),L=!1)));this.valid=L;this.value=l.data[this.name]=Number(J);G.count()>0&&(this.errors=G);return c[this.name]};c[g].toFloat=function(r){var x=document.getElementById(this.target.getAttribute('id')).value||this.value;isFloatingWithCommas=!1;typeof x=='string'&&
+(x=x.replace(/\s+/g,''),/,/.test(x)&&/\./.test(x)?x=x.replace(/,/g,''):/,/.test(x)&&(x=x.replace(/,/g,'.'),isFloatingWithCommas=!0));l.data[this.name]=x;var J=c[this.name].errors||{},L=!0;r?this.decimals=parseInt(r):typeof this.decimals=='undefined'&&(this.decimals=2);if(x)if(this.isNumber().valid)try{Number.isFinite(x)||(x=new Number(parseFloat(x.match(/[0-9.,]+/g).join('').replace(/,/,'.'))))}catch(fa){L=!1,J.toFloat=h(this.error||l.errorLabels.toFloat,this),this.valid=!1,J.count()>0&&(this.errors=
+J)}else L=!1,J.toFloat=h(this.error||l.errorLabels.toFloatNAN,this);else return c[this.name];this.decimals&&x&&!J.toFloat&&(x=parseFloat(x.toFixed(this.decimals)));this.value=l.data[this.name]=x;C&&(isFloatingWithCommas&&(x=(''+x).replace(/\./g,',')),this.target.setAttribute('value',x));this.valid=L;J.count()>0&&(this.errors=J);return c[this.name]};c[g].isFloat=function(r){typeof this.value=='string'&&(this.value=this.value.replace(/\s+/g,''));var x=l.data[this.name]=this.value;r=c[this.name].errors||
+{};typeof x=='string'&&/\./.test(x)&&Number.isFinite(Number(x));typeof x=='string'&&/,/g.test(x)&&(x=this.value=l.data[this.name]=Number(x.replace(/,/g,'.')));Number(x)===x&&x%1!==0?(this.value=l.data[this.name]=Number(x),x=!0):x=!1;r.isRequired||this.value!=''||(x=!0);x||(r.isFloat=h(this.error||l.errorLabels.isFloat,this));this.valid=x;r.count()>0&&(this.errors=r);return c[this.name]};c[g].isRequired=function(r){if(typeof r=='boolean'&&!r)return this.valid=!0,r=l.excluded.indexOf(this.name),r>-1&&
+l.excluded.splice(r,1),c[this.name];if(C&&this.target&&this.target.tagName=='INPUT'&&typeof this.target.type!='undefined'&&this.target.type=='radio'){var x=this.target;r=document.getElementsByName(this.name);r=Array.prototype.filter.call(r,function(fa){return fa.form===x.form});for(var J=0,L=r.length;J<L;++J)if(r[J].checked){/true|false/.test(r[J].value)?this.value=l.data[this.name]=/true/.test(r[J].value)?!0:!1:this.value=l.data[this.name]=r[J].value;this.valid=!0;break}}r=typeof this.value=='undefined'||
+this.value==null||this.value==''||/^\s+/.test(this.value)?!1:!0;J=c[this.name].errors||{};r?r&&typeof J.isRequired!='undefined'&&delete J.isRequired:J.isRequired=h(this.error||l.errorLabels.isRequired,this);this.valid=r;J.count()>0&&(this.errors=J);return c[this.name]};c[g].isString=function(r,x){var J=l.data[this.name]=this.value,L=!1,fa=!0,ma=!0,G=c[this.name].errors||{};typeof J!='string'||G.isRequired||J==''||(L=!0,r&&typeof r=='number'&&J.length<r&&(fa=!1,this.size=r),x&&typeof x=='number'&&
+J.length>x&&(ma=!1,this.size=x));L&&fa&&ma||(!L&&G.isRequired&&J==''?(L=!1,G.isString=h(this.error||l.errorLabels.isString,this)):L||G.isRequired||(L=!0),fa&&ma||(L=!1,fa||(G.isStringLength=h(this.error||l.errorLabels.isStringMinLength,this)),ma||(G.isStringLength=h(this.error||l.errorLabels.isStringMaxLength,this)),r===x&&(G.isStringLength=h(this.error||l.errorLabels.isStringLength,this))));this.valid=L;G.count()>0&&(this.errors=G);return c[this.name]};c[g].isDate=function(r){var x=this.value,J=
+!1,L=c[this.name].errors||{},fa=null;if(!x||x==''||/NaN|Invalid Date/i.test(x))return/NaN|Invalid Date/i.test(x)&&(console.warn('[FormValidator::isDate] Provided value for field `'+this.name+'` is not allowed: `'+x+'`'),L.isDate=h(this.error||l.errorLabels.isDate,this)),this.valid=J,L.count()>0&&(this.errors=L),c[this.name];if(typeof r=='undefined'||typeof r!='undefined'&&/true/i.test(r))r='yyyy-mm-dd';if(x instanceof Date)x=x.format(r);else{try{fa=r.match(/[^\/\- ]+/g)}catch(oa){throw Error('[FormValidator::isDate] Provided mask not allowed: `'+
+r+'`');}try{x=x.match(/[^\/\- ]+/g);var ma={},G;var K=0;for(G=fa.length;K<G;++K)ma[fa[K]]=x[K];for(var B in ma)r=r.replace(new RegExp(B,'g'),ma[B])}catch(oa){throw Error('[FormValidator::isDate] Provided value not allowed: `'+x+'`'+oa);}x=this.value=l.data[this.name]=new Date(r);if(/Invalid Date/i.test(x)||x instanceof Date===!1)return L.isRequired||this.value!=''?L.isDate=h(this.error||l.errorLabels.isDate,this):J=!0,this.valid=J,L.count()>0&&(this.errors=L),c[this.name];J=!0}this.valid=J;return x};
+c[g].format=function(r,x){var J=this.value;return J?J.format(r,x):c[this.name]};c[g].setFlash=function(r,x){typeof x!='undefined'&&x!=''&&(this.error=x);return c[this.name]};c[g].setLabel=function(r){typeof r!='undefined'&&r!=''&&(this.label=r);return c[this.name]};c[g].trim=function(r){if(typeof r=='boolean'&&r)return this.value=this.value.replace(/^\s+|\s+$/,''),l.data[this.name]=l.data[this.name]=this.value,c[this.name]};c[g].exclude=function(r){if(typeof r=='boolean'&&!r)return/^true|false$/i.test(this.value)&&
+(this.value=/^true$/i.test(this.value)?!0:!1,l.data[this.name]=this.value),c[this.name];this.isExcluded=!1;l.excluded.indexOf(this.name)<0&&(l.excluded.push(this.name),this.isExcluded=!0);return c[this.name]};c[g].query=u;c[g].getValidationContext=function(){return{isGFFCtx:C,self:c,local:l,replace:h}};if(n()){F=q=null;try{for(let r in gina.forms.validators)F='/validators/'+r+'/main.js',l.errorLabels[r]='Condition not satisfied',C?(q=ka(gina.forms.validators[r].data),q=q.replace(/(\)\s+\{|\)\{){1}/,
+'$&\n\tvar validationContext = this.getValidationContext(),isGFFCtx = validationContext.isGFFCtx,self = validationContext.self,local = validationContext.local,replace = validationContext.replace;')):q=gina.forms.validators[r].toString(),c[g][r]=eval('('+q+')\n//# sourceURL='+r+'.js')}catch(r){throw Error('[UserFormValidator] Could not evaluate: `'+F+'`\n'+r.stack);}}};for(let g in c)V(g,c[g]);c.addField=function(g,q){typeof c[g]=='undefined'&&V(g,q)};c.isValid=function(){return c.getErrors().count()>
+0?!1:!0};c.setErrors=function(g){if(!g)return{};for(var q in c)if(typeof c[q]=='object'){for(var F in c[q])typeof g[q]=='object'&&typeof g[q][F]!='undefined'&&(typeof c[q].valid!='undefined'&&/^true$/i.test(c[q].valid)?delete g[q][F]:(typeof c[q].errors=='undefined'&&(c[q].errors={}),c[q].errors[F]=g[q][F]));(typeof c[q].errors=='undefined'&&typeof g[q]!='undefined'||typeof c[q].errors!='undefined'&&c[q].errors.count()==0&&typeof g[q]!='undefined')&&delete g[q]}return g};c.getErrors=function(g){var q=
+{};if(typeof g!='undefined')return typeof c[g]!='undefined'&&c[g]&&typeof c[g].errors!='undefined'&&c[g].errors.count()>0&&(q[g]=c[g].errors),q;for(var F in c)typeof c[F]=='object'&&typeof c[F].errors!='undefined'&&c[F].errors.count()>0&&(q[F]=c[F].errors);return q};c.toData=function(){if(l.excluded.length>0)for(var g=0,q=l.excluded.length;g<q;++g)typeof l.data[l.excluded[g]]!='undefined'&&delete l.data[l.excluded[g]];return l.data};var h=function(g,q){var F=g.match(/%[a-z]+/gi);if(F)for(var N=0,
+r=F.length;N<r;++N)g=g.replace(new RegExp(F[N],'g'),q[l.keys[F[N]]]);return g};c.setErrorLabels=function(g){typeof g!='undefined'&&(l.errorLabels=A(g,l.errorLabels))};return c}typeof module!=='undefined'&&module.exports?module.exports=FormValidatorUtil:typeof define==='function'&&define.amd&&define('lib/form-validator',[],function(){return FormValidatorUtil});
 function Routing(){var m=typeof module!=='undefined'&&module.exports?!1:!0,E={allowedMethods:['get','post','put','delete'],reservedParams:['controle','file','title','namespace','path'],notFound:{},getInstance:function(n){return Routing.instance}};if(typeof Routing.initialized=='undefined')Routing.initialized=!0,Routing.instance=E,Routing._cached=[],Routing._cachedRoutes={},Routing._tries={};else return E=E.getInstance();E.allowedMethodsString=E.allowedMethods.join(',');var I=null,M=null,C=null;m?
 (M&&typeof M=='function'||(M=require('lib/merge')),C&&typeof C=='function'||(C=require('lib/form-validator'))):(require('fs'),require('util'),require('../../inherits'),M=require('../../merge'),I=require(__dirname+'/../../../core/plugins')||getContext('gina').plugins,C=I.Validator);E.getUrlProps=function(n,l){var c={};if(m){var S=window.gina.config;c.hostname=S.hostname;typeof n!='undefined'&&(n=this.getRoute('webroot@'+n),c.hostname=n.hostname,c.host=n.host,c.webroot=n.webroot)}else S=getContext('gina').config,
 typeof getContext('argvFilename')!='undefined'&&(S.getRouting=getContext('gina').Config.instance.getRouting),typeof n=='undefined'&&(n=S.bundle),typeof l=='undefined'&&(l=S.env),c.hostname=S.envConf[n][l].hostname,c.host=S.envConf[n][l].host,c.webroot=S.envConf[n][l].server.webroot,console.debug('[self.getUrlProps][isProxyHost = '+getContext('isProxyHost')+'] hostname ',S.envConf[n][l].hostname,vs,process.gina.PROXY_HOSTNAME);return c};E.cache=function(n,l,c,S,ka){Routing._cached.indexOf(n)==-1&&
@@ -330,28 +330,29 @@ document.getElementById(y[ta].getAttribute('data-upload-'+b+'-link-id')):documen
 b+'-method` was not defined. Switching to `'+k+'` by default.'));var W=a.getAttribute('data-gina-form-upload-'+b+'-is-synchrone');if(/null/i.test(W)||typeof k=='undefined'||k=='')W=!0;z={url:z,method:k,isSynchrone:W,headers:{'Content-Type':'application/x-www-form-urlencoded; charset=UTF-8','X-Requested-With':'XMLHttpRequest'}};h(k)&&(W=V())&&(z.headers['X-Gina-CSRF-Token']=W);z=setupXhr(z);/GET|DELETE/i.test(k)?z.send():z.send(JSON.stringify({files:H}));if(/none/i.test(window.getComputedStyle(a).display)){if(/none/i.test(a.parentElement.style.display)){a.parentElement.style.display=
 'block';return}a.style.display='block'}removeListener(gina,$uploadResetTrigger,'click',function(){f.remove();y[ta].remove()});Z--;ta--;break}}},X=function(a,b,e,k,z){var y=new FileReader;y.addEventListener('load',function(f){f.preventDefault();try{var O=this.result,H=void 0;f='';var W=null;typeof H=='undefined'&&(H=8);var ta=H/8;switch(H){case 8:W=new Uint8Array(O);break;case 16:W=new Uint16Array(O);break;case 32:W=new Uint32Array(O);break;default:W=new Uint8Array(O)}var Z=W.length;O=256+ta;H=0;for(var p=
 ta=null;H<Z;H+=O)ta=Math.min(O,Z-H),p=W.subarray(H,H+ta),f+=String.fromCharCode.apply(null,p);a[this.index].bin+=f;a[this.index].file.type||(a[this.index].file.type='application/octet-stream')}catch(da){return z(da,null,!0)}e+='--'+b+'\r\n';e+='Content-Disposition: form-data; name="'+a[this.index].key+'"; group="'+a[this.index].group+'"; filename="'+a[this.index].file.name+'"\r\nContent-Type: '+a[this.index].file.type+'\r\nContent-Length: '+a[this.index].bin.length+'\r\n\r\n';e+=a[this.index].bin+
-'\r\n';++this.index;this.index==a.length?(e+='--'+b+'--',z(!1,e,!0)):X(a,b,e,this.index,z)},!1);y.index=k;a[k].bin='';y.readAsArrayBuffer(a[k].file)},la=function(a){var b=a.target.getAttribute('data-gina-form-event-on-submit-success')||null;if(b!=null)if(/\((.*)\)/.test(b))eval(b);else a.on('success.hform',window[b]);b=a.target.getAttribute('data-gina-form-event-on-submit-error')||null;if(b!=null)if(/\((.*)\)/.test(b))eval(b);else a.on('error.hform',window[b])},ea=function(a){var b=null,e=a;if(!c.$forms)throw Error('`$forms` collection not found');
-if(typeof e=='undefined')if(typeof this.id!='undefined'&&this.id!=''&&this.id!=null)e=this.id;else throw Error('[ FormValidator::destroy(formId) ] `formId` is missing');if(typeof e=='string')e=e.replace(/#/,'');else{if(typeof e!='object'||Array.isArray(e))throw Error('[ FormValidator::destroy(formId) ] `formId` should be a `string`');a=e.form;e=a.getAttribute('id')||'form.'+U();a.setAttribute('id',e)}typeof c.$forms[e]!='undefined'?b=c.$forms[e]:typeof this.binded!='undefined'&&(b=this);if(b)addListener(gina,
-b.target,'destroy.'+e,function(k){cancelEvent(k);delete c.$forms[e];removeListener(gina,k.currentTarget,k.type);removeListener(gina,k.currentTarget,'destroy')}),b=Sa(b),triggerEvent(gina,b.target,'destroy.'+e);else throw Error('[ FormValidator::destroy(formId) ] `'+e+'` not found');},qa=function(){var a=typeof arguments[0]!='undefined'?arguments[0]:c.rules;for(let k in a){var b=Object.getOwnPropertyNames(a[k]),e=0;let z=b.length,y=!1,f=null;for(;e<z;){if(/^_case_/.test(b[e])){y=!0;f=b[e];break}e++}y||
-typeof a[k]!='object'||qa(a[k]);if(f&&Array.isArray(a[k][f].conditions)&&a[k][f].conditions.length>0)for(b=0,e=a[k][f].conditions.length;b<e;)typeof a[k][f].conditions[b].rules!='undefined'&&a[k][f].conditions[b].rules.count()==0&&(a[k][f].conditions.splice(b,1),e--,b--),b++}},va=function(a){var b=JSON.stringify(a),e=b.match(/("@import\s+[-_a-z A-Z 0-9/.]+")/g)||[],k=[];for(let O=0,H=e.length;O<H;O++)k.indexOf(e[O])<0&&k.push(e[O]);e=k;k=b.match(/("_merging(.*))(\s+:|:)(.*)(",|")/g);c.rules||(c.rules=
-{});if(e&&e.length>0){a={};for(let O=0,H=e.length;O<H;++O){var z=e[O].replace(/(@import\s+|"|')/g,'');var y=z.replace(/(@import\s+|"|')/g,'').split(/\s/g);for(let W=0,ta=y.length;W<ta;++W){var f=y[W].replace(/\//g,'.').replace(/\-/g,'.');typeof c.rules[f]!='undefined'?(f=JSON.stringify(c.rules[f]),f=JSON.parse(f),f._comment=typeof f._comment!='undefined'?f._comment+'\n':'',f._comment+='Imported from `'+z+'`',f=JSON.stringify(f),b=b.replace(new RegExp(e[O],'g'),f),c.rules=JSON.parse(JSON.stringify(c.rules).replace(new RegExp(e[O],
-'g'),'{}'))):console.warn('[formValidator:rules] <@import error> on `'+e[O]+'`: rule `'+y[W]+'` not found. Ignoring.')}y=new RegExp(e[O]);if(z=k&&y.test(k.join())?!0:!1)for(let W=0,ta=k.length;W<ta;W++)if(y.test(k[W])){z=JSON.stringify(a);z=z.substring(1,z.length-1);W<ta-1&&(z+=',');try{b=b.replace(new RegExp(k[W],'g'),z),c.rules=JSON.parse(JSON.stringify(c.rules).replace(new RegExp(k[W],'g'),'{}'))}catch(Z){throw Z;}}a={}}a=JSON.parse(b);wa(a,'');try{qa()}catch(O){console.error(O.stack)}}return a},
-ra=function(a){gina.hasValidator?(c=D(c,gina.validator),c.on('init',function(b){c.isReady=!0;triggerEvent(gina,c.target,'ready.'+c.id,c)})):(c.target=document,c.setOptions=q,c.getFormById=F,c.validateFormById=r,c.resetErrorsDisplay=fa,c.resetFields=ma,c.handleErrorsDisplay=L,c.send=K,c.on('init',function(b){if(typeof a!='undefined'&&a.count())try{wa(a,''),a=va(a),gina.forms.rules=typeof gina.forms.rules!='undefined'&&gina.forms.rules?D(gina.forms.rules,a,!0):a,c.rules=D(c.rules,JSON.clone(gina.forms.rules),
-!0)}catch(ta){throw ta;}ka.count()||(ka=JSON.clone(c.rules));S.setOptions=q;S.getFormById=F;S.validateFormById=r;S.resetErrorsDisplay=fa;S.resetFields=ma;S.handleErrorsDisplay=L;S.submit=G;S.send=K;S.unbind=Sa;S.bind=Ya;S.reBind=jb;S.destroy=ea;b=0;for(var e=document.getElementsByTagName('form'),k=0,z=e.length;k<z;++k){if(e[k].getAttribute){var y=e[k].getAttribute('id')||'form.'+U();y!==e[k].getAttribute('id')&&e[k].setAttribute('id',y)}else y='form.'+U(),e[k].setAttribute('id',y);S.id=y;S.target=
-e[k];c.$forms[y]=D({},S);var f=e[k].getAttribute('data-gina-form-rule');if(f){f=f.replace(/\-|\//g,'.');if(typeof a!='undefined'){if(!/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(f))throw Error('Invalid form rule path: `'+f+'`');for(var O=f.split('.'),H=gina.forms.rules,W=0;H!=null&&W<O.length;W++)H=H[O[W]];c.$forms[y].rules[f]=c.rules[f]=ka[f]=D(JSON.clone(H),c.rules[f])}if(typeof ka[f]=='undefined')throw Error('['+y+'] no rule found with key: `'+f+'`. Please check if json is not malformed @ /forms/rules/'+
-f.replace(/\./g,'/')+'.json');f=c.rules[f]}typeof y=='string'&&typeof ka[y.replace(/\-/g,'.')]!='undefined'||typeof f=='object'?(y=c.$forms[y].target,f?Ya(y,f):Ya(y),++b):(typeof e[k].id=='object'?(delete c.$forms[e[k].id],y=e[k].attributes.getNamedItem('id').nodeValue||'form.'+U(),e[k].setAttribute('id',y),e[k].id=y,S.target=e[k],c.$forms[y]=D({},S),y=c.$forms[y].target):y=c.$forms[e[k].id].target,f?Ya(y,f):Ya(y))}if(window.XMLHttpRequest)v=new XMLHttpRequest;else if(window.ActiveXObject)try{v=new ActiveXObject('Msxml2.XMLHTTP')}catch(ta){try{v=
-new ActiveXObject('Microsoft.XMLHTTP')}catch(Z){}}c.isReady=!0;gina.hasValidator=!0;gina.validator=c;triggerEvent(gina,c.target,'ready.'+c.id,c)}));c.initialized=!0;return c},wa=function(a,b){var e;for(e in a)if(typeof a[e]=='object'&&typeof c.rules[b+e]=='undefined'){var k=e;/\[|\]/.test(e)&&(k=e.replace(/\[/g,'.').replace(/\]/g,''));c.rules[b+k]=a[e];wa(a[e],b+k+'.')}},Ja=function(a){if(typeof ka[a]!='undefined')return ka[a];var b=null;if(typeof c.rules[a]=='undefined'){if(wa(ka,''),ka=va(ka),b=
-ka[a],!b)return{}}else b=c.rules[a];b=JSON.clone(b);var e=new RegExp('^'+a),k=new RegExp('^'+a+'.'),z=null,y=function(O,H,W,ta,Z,p,da){if(H.length){var ja=Object.getOwnPropertyNames(O)[0],Q=H[0];Q=Z==''?Z+=Q:Z+'['+Q+']';H.length==1&&(O[ja]=D(O[ja],W,!0));H.splice(0,1);Q==ja?y(O[ja],H,W,ta,Q,p,da):typeof O[ja]!='undefined'?y(O[ja],H,W,ta,Q,p,da):y(O,H,W,ta,Z,p,da)}},f;for(f in c.rules)f!=a&&e.test(f)&&(z=f.replace(k,''),/\./.test(z)&&(z=z.split(/\./g),y(b,z,c.rules[f],b,'',0,b.count()-1)));return ka[a]=
-b},ca=formatDataFromString,ua=function(a){var b=c.$forms[a.form.getAttribute('id')],e=/^true$/i.test(a.disabled)?!0:!1;e&&typeof b.rule!='undefined'&&typeof b.rule[a.name]!='undefined'&&typeof b.rule[a.name].exclude!='undefined'&&/^false$/i.test(b.rule[a.name].exclude)&&(e=!1);if(/^(radio|text|hidden|password|number|date|email)$/i.test(a.type)&&!e){var k=Object.getOwnPropertyDescriptor(HTMLInputElement.prototype,'value'),z=k.set;k.set=function(y){Object.defineProperty(this,'value',{set:z});var f=
-'change.'+this.id;y===this.value&&y===this.defaultValue||y===this.value||(this.value=y,console.debug('Value set: '+y),typeof gina.events[f]!='undefined'&&(console.debug('trigger event on: ',this.name,f),triggerEvent(gina,this,f,y)));Object.defineProperty(this,'value',k)};Object.defineProperty(a,'value',k)}},Ba=function(a,b,e,k){typeof k=='undefined'&&(k=!1);var z=a.rules,y=c.$forms[b.form.getAttribute('id')],f=/^true$/i.test(b.disabled)?!0:!1;f&&typeof y.rule!='undefined'&&typeof y.rule[b.name]!=
-'undefined'&&typeof y.rule[b.name].exclude!='undefined'&&/^false$/i.test(y.rule[b.name].exclude)&&(f=!1);if(/^(radio|checkbox|text|hidden|password|number|date|email)$/i.test(b.type)&&!f||k&&!f){k=b.name;y=z[k]||null;if(!y&&(Za(z,b),typeof z[k]=='undefined'))return;if(a.target.dataset.ginaFormLiveCheckEnabled&&y&&(k=[],y=null,f=0,/^(radio|checkbox)$/i.test(b.type)?y=/^(radio|checkbox)$/i.test(b.type)?'changed.'+b.id:'change.'+b.id:(addEventListener(gina,b,'focusout.'+b.id,function(H){H.preventDefault();
-clearTimeout(e)}),y='change.'+b.id,typeof gina.events[y]=='undefined'&&(k[f]=y,++f),y='keyup.'+b.id,typeof gina.events[y]=='undefined'&&(k[f]=y,++f),y='focusin.'+b.id,typeof gina.events[y]=='undefined'&&(k[f]=y,++f),y='focusout.'+b.id),typeof gina.events[y]=='undefined'&&(k[f]=y,++f),k.length>0)){var O=!1;addListener(gina,b,k,function(H){H.preventDefault();clearTimeout(e);if(!O&&/^changed\./i.test(H.type)||!O&&/^(radio|checkbox)$/i.test(H.target.type))O=!0;else if(O&&/^changed\./i.test(H.type)||O&&
-/^(radio|checkbox)$/i.test(H.target.type))return!1;if(typeof c.$forms[H.target.form.getAttribute('id')].isSubmitting!='undefined'&&/true/i.test(c.$forms[H.target.form.getAttribute('id')].isSubmitting))return!1;var W=function(){/^(password)$/i.test(H.target.type)||console.debug('processing: '+H.target.name+'/'+H.target.id);if(!/^(radio|checkbox)$/i.test(H.target.type)&&H.target.value===H.target.defaultValue&&H.target.value!=''){var ta=c.$forms[H.target.form.getAttribute('id')].errors;if(ta&&ta.count()!=
-0)L(H.target.form,ta,null,H.target.name);else return L(H.target.form,{},null,H.target.name),cancelEvent(H)}ta={};var Z={};ta[H.target.name]=H.target.value;Z[H.target.name]=H.target;c.$forms[H.target.form.getAttribute('id')].isValidating=!0;T(H.target,ta,Z,a.rules,function(p){p.isValid()?L(H.target.form,{},p.data,H.target.name):L(H.target.form,p.error,p.data,H.target.name);var da=H.target.form,ja=null,Q=null,ha=null;ha=kb(da,z);ja=ha.fields;Q=ha.$fields;var sa=da.getAttribute('id');ha=c.$forms[sa].rules;
-c.$forms[sa].isValidating=!0;T(da,ja,Q,ha,function(ia){c.$forms[sa].isValidating=!1;console.debug('['+sa+'] onSilentGlobalLiveValidation: '+ia.isValid(),ia,ja);var xa=ia.isValid();A&&C&&typeof window.ginaToolbar!='undefined'&&window.ginaToolbar&&(gina.forms.errors||(gina.forms.errors={}),window.ginaToolbar.update('forms',{id:sa,errors:ia.error||{}}));if(!xa&&ia.error){c.$forms[b.form.getAttribute('id')].errors=D(p.error,ia.error);var Ma=H.target.name;typeof ia.error[Ma]!='undefined'&&(x(Q[Ma]),L(da,
-ia.error,ia.data,Ma))}else c.$forms[sa].errors&&!c.$forms[sa].errors.count()&&(c.$forms[sa].errors={},console.debug('resetting field: '+b.name),J[sa]={},L(da,{},null,b.name));eb(da,xa);O=!1})})};if(/^changed\./i.test(H.type)||/^change\./i.test(H.type)&&H.target.type=='radio')return function(ta,Z){if(!(Z>0))return++Z,setTimeout(()=>{console.debug(' changed .... '+b.id);W()},0)}(O,0);/^focusin\./i.test(H.type)?/\-error/.test(b.parentNode.className)&&(console.debug('#1 you just focusin ....'+b.id,b.value,
-c.$forms[b.form.getAttribute('id')].isValidating),x(b)):/^focusout\./i.test(H.type)?/\-warning/.test(b.parentNode.className)&&(console.debug('#1 you just focusout ....'+b.id,b.value),c.$forms[b.form.getAttribute('id')].isValidating=!1,x(b),L(b.form,c.$forms[b.form.getAttribute('id')].errors,null,b.name)):/^keyup\./i.test(H.type)?(b.ginaFormValidatorTestedValue=b.value,e=setTimeout(function(){['91','17','16'].indexOf(''+H.keyCode)>-1&&aa.count()==0||(console.debug('[A]['+aa.count()+'] keyup ('+H.keyCode+
-') .... '+b.id,b.value,' VS ',b.ginaFormValidatorTestedValue+'(old)'),W())},1E3)):/^change\./i.test(H.type)&&!/^(checkbox)$/i.test(H.target.type)&&(console.debug(' change .... '+b.id),W())})}}},Oa=function(a,b){a.setSelectionRange?(a.focus(),a.setSelectionRange(b,b)):a.createTextRange&&(a=a.createTextRange(),a.collapse(!0),a.moveEnd('character',b),a.moveStart('character',b),a.select())},Ia=function(a,b){if(document.activeElement&&document.activeElement.form){a=Array.prototype.filter.call(document.activeElement.form.querySelectorAll('a:not([disabled]), button:not([disabled]), input[type=text]:not([disabled]), select:not([disabled]), [tabindex]:not([disabled]):not([tabindex="-1"])'),
+'\r\n';++this.index;this.index==a.length?(e+='--'+b+'--',z(!1,e,!0)):X(a,b,e,this.index,z)},!1);y.index=k;a[k].bin='';y.readAsArrayBuffer(a[k].file)},la=function(a){var b=a.target.getAttribute('data-gina-form-event-on-submit-success')||null;if(b!=null)if(/\((.*)\)/.test(b))try{console.warn('[gina-form-event] function-call shape no longer supported on data-gina-form-event-on-submit-success \u2014 use a bare identifier and register the handler on window: '+b)}catch(e){}else a.on('success.hform',window[b]);
+b=a.target.getAttribute('data-gina-form-event-on-submit-error')||null;if(b!=null)if(/\((.*)\)/.test(b))try{console.warn('[gina-form-event] function-call shape no longer supported on data-gina-form-event-on-submit-error \u2014 use a bare identifier and register the handler on window: '+b)}catch(e){}else a.on('error.hform',window[b])},ea=function(a){var b=null,e=a;if(!c.$forms)throw Error('`$forms` collection not found');if(typeof e=='undefined')if(typeof this.id!='undefined'&&this.id!=''&&this.id!=
+null)e=this.id;else throw Error('[ FormValidator::destroy(formId) ] `formId` is missing');if(typeof e=='string')e=e.replace(/#/,'');else{if(typeof e!='object'||Array.isArray(e))throw Error('[ FormValidator::destroy(formId) ] `formId` should be a `string`');a=e.form;e=a.getAttribute('id')||'form.'+U();a.setAttribute('id',e)}typeof c.$forms[e]!='undefined'?b=c.$forms[e]:typeof this.binded!='undefined'&&(b=this);if(b)addListener(gina,b.target,'destroy.'+e,function(k){cancelEvent(k);delete c.$forms[e];
+removeListener(gina,k.currentTarget,k.type);removeListener(gina,k.currentTarget,'destroy')}),b=Sa(b),triggerEvent(gina,b.target,'destroy.'+e);else throw Error('[ FormValidator::destroy(formId) ] `'+e+'` not found');},qa=function(){var a=typeof arguments[0]!='undefined'?arguments[0]:c.rules;for(let k in a){var b=Object.getOwnPropertyNames(a[k]),e=0;let z=b.length,y=!1,f=null;for(;e<z;){if(/^_case_/.test(b[e])){y=!0;f=b[e];break}e++}y||typeof a[k]!='object'||qa(a[k]);if(f&&Array.isArray(a[k][f].conditions)&&
+a[k][f].conditions.length>0)for(b=0,e=a[k][f].conditions.length;b<e;)typeof a[k][f].conditions[b].rules!='undefined'&&a[k][f].conditions[b].rules.count()==0&&(a[k][f].conditions.splice(b,1),e--,b--),b++}},va=function(a){var b=JSON.stringify(a),e=b.match(/("@import\s+[-_a-z A-Z 0-9/.]+")/g)||[],k=[];for(let O=0,H=e.length;O<H;O++)k.indexOf(e[O])<0&&k.push(e[O]);e=k;k=b.match(/("_merging(.*))(\s+:|:)(.*)(",|")/g);c.rules||(c.rules={});if(e&&e.length>0){a={};for(let O=0,H=e.length;O<H;++O){var z=e[O].replace(/(@import\s+|"|')/g,
+'');var y=z.replace(/(@import\s+|"|')/g,'').split(/\s/g);for(let W=0,ta=y.length;W<ta;++W){var f=y[W].replace(/\//g,'.').replace(/\-/g,'.');typeof c.rules[f]!='undefined'?(f=JSON.stringify(c.rules[f]),f=JSON.parse(f),f._comment=typeof f._comment!='undefined'?f._comment+'\n':'',f._comment+='Imported from `'+z+'`',f=JSON.stringify(f),b=b.replace(new RegExp(e[O],'g'),f),c.rules=JSON.parse(JSON.stringify(c.rules).replace(new RegExp(e[O],'g'),'{}'))):console.warn('[formValidator:rules] <@import error> on `'+
+e[O]+'`: rule `'+y[W]+'` not found. Ignoring.')}y=new RegExp(e[O]);if(z=k&&y.test(k.join())?!0:!1)for(let W=0,ta=k.length;W<ta;W++)if(y.test(k[W])){z=JSON.stringify(a);z=z.substring(1,z.length-1);W<ta-1&&(z+=',');try{b=b.replace(new RegExp(k[W],'g'),z),c.rules=JSON.parse(JSON.stringify(c.rules).replace(new RegExp(k[W],'g'),'{}'))}catch(Z){throw Z;}}a={}}a=JSON.parse(b);wa(a,'');try{qa()}catch(O){console.error(O.stack)}}return a},ra=function(a){gina.hasValidator?(c=D(c,gina.validator),c.on('init',
+function(b){c.isReady=!0;triggerEvent(gina,c.target,'ready.'+c.id,c)})):(c.target=document,c.setOptions=q,c.getFormById=F,c.validateFormById=r,c.resetErrorsDisplay=fa,c.resetFields=ma,c.handleErrorsDisplay=L,c.send=K,c.on('init',function(b){if(typeof a!='undefined'&&a.count())try{wa(a,''),a=va(a),gina.forms.rules=typeof gina.forms.rules!='undefined'&&gina.forms.rules?D(gina.forms.rules,a,!0):a,c.rules=D(c.rules,JSON.clone(gina.forms.rules),!0)}catch(ta){throw ta;}ka.count()||(ka=JSON.clone(c.rules));
+S.setOptions=q;S.getFormById=F;S.validateFormById=r;S.resetErrorsDisplay=fa;S.resetFields=ma;S.handleErrorsDisplay=L;S.submit=G;S.send=K;S.unbind=Sa;S.bind=Ya;S.reBind=jb;S.destroy=ea;b=0;for(var e=document.getElementsByTagName('form'),k=0,z=e.length;k<z;++k){if(e[k].getAttribute){var y=e[k].getAttribute('id')||'form.'+U();y!==e[k].getAttribute('id')&&e[k].setAttribute('id',y)}else y='form.'+U(),e[k].setAttribute('id',y);S.id=y;S.target=e[k];c.$forms[y]=D({},S);var f=e[k].getAttribute('data-gina-form-rule');
+if(f){f=f.replace(/\-|\//g,'.');if(typeof a!='undefined'){if(!/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(f))throw Error('Invalid form rule path: `'+f+'`');for(var O=f.split('.'),H=gina.forms.rules,W=0;H!=null&&W<O.length;W++)H=H[O[W]];c.$forms[y].rules[f]=c.rules[f]=ka[f]=D(JSON.clone(H),c.rules[f])}if(typeof ka[f]=='undefined')throw Error('['+y+'] no rule found with key: `'+f+'`. Please check if json is not malformed @ /forms/rules/'+f.replace(/\./g,'/')+'.json');f=c.rules[f]}typeof y=='string'&&
+typeof ka[y.replace(/\-/g,'.')]!='undefined'||typeof f=='object'?(y=c.$forms[y].target,f?Ya(y,f):Ya(y),++b):(typeof e[k].id=='object'?(delete c.$forms[e[k].id],y=e[k].attributes.getNamedItem('id').nodeValue||'form.'+U(),e[k].setAttribute('id',y),e[k].id=y,S.target=e[k],c.$forms[y]=D({},S),y=c.$forms[y].target):y=c.$forms[e[k].id].target,f?Ya(y,f):Ya(y))}if(window.XMLHttpRequest)v=new XMLHttpRequest;else if(window.ActiveXObject)try{v=new ActiveXObject('Msxml2.XMLHTTP')}catch(ta){try{v=new ActiveXObject('Microsoft.XMLHTTP')}catch(Z){}}c.isReady=
+!0;gina.hasValidator=!0;gina.validator=c;triggerEvent(gina,c.target,'ready.'+c.id,c)}));c.initialized=!0;return c},wa=function(a,b){var e;for(e in a)if(typeof a[e]=='object'&&typeof c.rules[b+e]=='undefined'){var k=e;/\[|\]/.test(e)&&(k=e.replace(/\[/g,'.').replace(/\]/g,''));c.rules[b+k]=a[e];wa(a[e],b+k+'.')}},Ja=function(a){if(typeof ka[a]!='undefined')return ka[a];var b=null;if(typeof c.rules[a]=='undefined'){if(wa(ka,''),ka=va(ka),b=ka[a],!b)return{}}else b=c.rules[a];b=JSON.clone(b);var e=new RegExp('^'+
+a),k=new RegExp('^'+a+'.'),z=null,y=function(O,H,W,ta,Z,p,da){if(H.length){var ja=Object.getOwnPropertyNames(O)[0],Q=H[0];Q=Z==''?Z+=Q:Z+'['+Q+']';H.length==1&&(O[ja]=D(O[ja],W,!0));H.splice(0,1);Q==ja?y(O[ja],H,W,ta,Q,p,da):typeof O[ja]!='undefined'?y(O[ja],H,W,ta,Q,p,da):y(O,H,W,ta,Z,p,da)}},f;for(f in c.rules)f!=a&&e.test(f)&&(z=f.replace(k,''),/\./.test(z)&&(z=z.split(/\./g),y(b,z,c.rules[f],b,'',0,b.count()-1)));return ka[a]=b},ca=formatDataFromString,ua=function(a){var b=c.$forms[a.form.getAttribute('id')],
+e=/^true$/i.test(a.disabled)?!0:!1;e&&typeof b.rule!='undefined'&&typeof b.rule[a.name]!='undefined'&&typeof b.rule[a.name].exclude!='undefined'&&/^false$/i.test(b.rule[a.name].exclude)&&(e=!1);if(/^(radio|text|hidden|password|number|date|email)$/i.test(a.type)&&!e){var k=Object.getOwnPropertyDescriptor(HTMLInputElement.prototype,'value'),z=k.set;k.set=function(y){Object.defineProperty(this,'value',{set:z});var f='change.'+this.id;y===this.value&&y===this.defaultValue||y===this.value||(this.value=
+y,console.debug('Value set: '+y),typeof gina.events[f]!='undefined'&&(console.debug('trigger event on: ',this.name,f),triggerEvent(gina,this,f,y)));Object.defineProperty(this,'value',k)};Object.defineProperty(a,'value',k)}},Ba=function(a,b,e,k){typeof k=='undefined'&&(k=!1);var z=a.rules,y=c.$forms[b.form.getAttribute('id')],f=/^true$/i.test(b.disabled)?!0:!1;f&&typeof y.rule!='undefined'&&typeof y.rule[b.name]!='undefined'&&typeof y.rule[b.name].exclude!='undefined'&&/^false$/i.test(y.rule[b.name].exclude)&&
+(f=!1);if(/^(radio|checkbox|text|hidden|password|number|date|email)$/i.test(b.type)&&!f||k&&!f){k=b.name;y=z[k]||null;if(!y&&(Za(z,b),typeof z[k]=='undefined'))return;if(a.target.dataset.ginaFormLiveCheckEnabled&&y&&(k=[],y=null,f=0,/^(radio|checkbox)$/i.test(b.type)?y=/^(radio|checkbox)$/i.test(b.type)?'changed.'+b.id:'change.'+b.id:(addEventListener(gina,b,'focusout.'+b.id,function(H){H.preventDefault();clearTimeout(e)}),y='change.'+b.id,typeof gina.events[y]=='undefined'&&(k[f]=y,++f),y='keyup.'+
+b.id,typeof gina.events[y]=='undefined'&&(k[f]=y,++f),y='focusin.'+b.id,typeof gina.events[y]=='undefined'&&(k[f]=y,++f),y='focusout.'+b.id),typeof gina.events[y]=='undefined'&&(k[f]=y,++f),k.length>0)){var O=!1;addListener(gina,b,k,function(H){H.preventDefault();clearTimeout(e);if(!O&&/^changed\./i.test(H.type)||!O&&/^(radio|checkbox)$/i.test(H.target.type))O=!0;else if(O&&/^changed\./i.test(H.type)||O&&/^(radio|checkbox)$/i.test(H.target.type))return!1;if(typeof c.$forms[H.target.form.getAttribute('id')].isSubmitting!=
+'undefined'&&/true/i.test(c.$forms[H.target.form.getAttribute('id')].isSubmitting))return!1;var W=function(){/^(password)$/i.test(H.target.type)||console.debug('processing: '+H.target.name+'/'+H.target.id);if(!/^(radio|checkbox)$/i.test(H.target.type)&&H.target.value===H.target.defaultValue&&H.target.value!=''){var ta=c.$forms[H.target.form.getAttribute('id')].errors;if(ta&&ta.count()!=0)L(H.target.form,ta,null,H.target.name);else return L(H.target.form,{},null,H.target.name),cancelEvent(H)}ta={};
+var Z={};ta[H.target.name]=H.target.value;Z[H.target.name]=H.target;c.$forms[H.target.form.getAttribute('id')].isValidating=!0;T(H.target,ta,Z,a.rules,function(p){p.isValid()?L(H.target.form,{},p.data,H.target.name):L(H.target.form,p.error,p.data,H.target.name);var da=H.target.form,ja=null,Q=null,ha=null;ha=kb(da,z);ja=ha.fields;Q=ha.$fields;var sa=da.getAttribute('id');ha=c.$forms[sa].rules;c.$forms[sa].isValidating=!0;T(da,ja,Q,ha,function(ia){c.$forms[sa].isValidating=!1;console.debug('['+sa+'] onSilentGlobalLiveValidation: '+
+ia.isValid(),ia,ja);var xa=ia.isValid();A&&C&&typeof window.ginaToolbar!='undefined'&&window.ginaToolbar&&(gina.forms.errors||(gina.forms.errors={}),window.ginaToolbar.update('forms',{id:sa,errors:ia.error||{}}));if(!xa&&ia.error){c.$forms[b.form.getAttribute('id')].errors=D(p.error,ia.error);var Ma=H.target.name;typeof ia.error[Ma]!='undefined'&&(x(Q[Ma]),L(da,ia.error,ia.data,Ma))}else c.$forms[sa].errors&&!c.$forms[sa].errors.count()&&(c.$forms[sa].errors={},console.debug('resetting field: '+b.name),
+J[sa]={},L(da,{},null,b.name));eb(da,xa);O=!1})})};if(/^changed\./i.test(H.type)||/^change\./i.test(H.type)&&H.target.type=='radio')return function(ta,Z){if(!(Z>0))return++Z,setTimeout(()=>{console.debug(' changed .... '+b.id);W()},0)}(O,0);/^focusin\./i.test(H.type)?/\-error/.test(b.parentNode.className)&&(console.debug('#1 you just focusin ....'+b.id,b.value,c.$forms[b.form.getAttribute('id')].isValidating),x(b)):/^focusout\./i.test(H.type)?/\-warning/.test(b.parentNode.className)&&(console.debug('#1 you just focusout ....'+
+b.id,b.value),c.$forms[b.form.getAttribute('id')].isValidating=!1,x(b),L(b.form,c.$forms[b.form.getAttribute('id')].errors,null,b.name)):/^keyup\./i.test(H.type)?(b.ginaFormValidatorTestedValue=b.value,e=setTimeout(function(){['91','17','16'].indexOf(''+H.keyCode)>-1&&aa.count()==0||(console.debug('[A]['+aa.count()+'] keyup ('+H.keyCode+') .... '+b.id,b.value,' VS ',b.ginaFormValidatorTestedValue+'(old)'),W())},1E3)):/^change\./i.test(H.type)&&!/^(checkbox)$/i.test(H.target.type)&&(console.debug(' change .... '+
+b.id),W())})}}},Oa=function(a,b){a.setSelectionRange?(a.focus(),a.setSelectionRange(b,b)):a.createTextRange&&(a=a.createTextRange(),a.collapse(!0),a.moveEnd('character',b),a.moveStart('character',b),a.select())},Ia=function(a,b){if(document.activeElement&&document.activeElement.form){a=Array.prototype.filter.call(document.activeElement.form.querySelectorAll('a:not([disabled]), button:not([disabled]), input[type=text]:not([disabled]), select:not([disabled]), [tabindex]:not([disabled]):not([tabindex="-1"])'),
 function(z){return z.offsetWidth>0||z.offsetHeight>0||z===document.activeElement});var e=a.indexOf(document.activeElement);if(e>-1){var k=a[e+1];b&&(k=a[e-1]);(k||a[0]).focus()}}},Ka=function(a,b){a.setAttribute('readonly','readonly');addListener(gina,a,'focusout.'+a.id,function(e){e.preventDefault();clearTimeout(b);e=e.currentTarget;triggerEvent(gina,e,'change.'+e.id);e.setAttribute('readonly','readonly')});addListener(gina,a,'focusin.'+a.id,function(e){e.preventDefault();e.currentTarget.removeAttribute('readonly');
 var k='keydown.'+e.currentTarget.id;typeof gina.events[k]=='undefined'&&addListener(gina,e.currentTarget,k,function(z){z.preventDefault();clearTimeout(b);var y=z.currentTarget,f=z.currentTarget.value,O=y.selectionStart,H=y.selectionEnd;y.removeAttribute('readonly');switch(z.keyCode){case 46:O!=H?(y.value=f.substring(0,O)+f.substring(H),O==0&&(y.value=f.substring(H+1))):y.value=O==0?f.substring(O+1):f.substring(0,O)+f.substring(H+1);z.currentTarget.setAttribute('readonly','readonly');setTimeout(()=>
 {y.removeAttribute('readonly');setTimeout(()=>{Oa(y,O)},0)},0);break;case 8:O!=H?(y.value=f.substring(0,O)+f.substring(H),O==0&&(y.value=f.substring(H))):y.value=O==0?f.substring(O+1):f.substring(0,O-1)+f.substring(H);z.currentTarget.setAttribute('readonly','readonly');setTimeout(()=>{y.removeAttribute('readonly');setTimeout(()=>{O!=H?Oa(y,O):O==0?Oa(y,O):Oa(y,O-1)},0)},0);break;case 9:aa[16]&&aa[9]?Ia(y,!0):Ia(y);break;case 13:case 16:break;case 37:console.debug('moving left ',O-1);Oa(y,O-1);break;

package/framework/{v0.3.13-alpha.2 → v0.3.13-alpha.3}/core/config.js

@@ -22,6 +22,7 @@ var inherits        = lib.inherits;
 var console         = lib.logger;
 var Collection      = lib.Collection;
 var modelUtil       = new lib.Model();
+var secrets         = lib.secrets;
 
 
 /**
@@ -2747,6 +2748,18 @@ function Config(opt, contextResetNeeded) {
         // }
         self.envConf[bundle][env] = conf[bundle][env];
 
+        // ${secret:KEY} placeholder substitution. Walks the merged config
+        // for this bundle in place, replacing every string value that
+        // matches `^\${secret:KEY\}$` with the value resolved by the env
+        // backend. Runs once per bundle inside the config-load cycle;
+        // downstream reads (getConfig, getInstance) see the resolved
+        // values. Fail-closed: backend throws on unset/empty values.
+        try {
+            secrets.resolve(self.envConf[bundle][env]);
+        } catch (secretErr) {
+            return callback(secretErr);
+        }
+
         ++b;
         if (b < bundles.length) {
             loadBundleConfig(bundles, b, callback, reload, collectedRules)

package/framework/{v0.3.13-alpha.2 → v0.3.13-alpha.3}/core/plugins/lib/csrf/src/main.js

@@ -64,6 +64,7 @@ var MAC_BYTES   = 32;
  */
 function resolveSettingsDefaults() {
     var defaults = {
+        secret:         null,
         cookieName:     DEFAULT_COOKIE_NAME,
         headerName:     DEFAULT_HEADER_NAME,
         fieldName:      DEFAULT_FIELD_NAME,
@@ -87,6 +88,12 @@ function resolveSettingsDefaults() {
         csrfConf = {};
     }
 
+    // `settings.csrf.secret` flows through `lib/secrets` at config-load
+    // time — a `${secret:KEY}` placeholder is already resolved by the
+    // time we read it here.
+    if (typeof csrfConf.secret === 'string' && csrfConf.secret) {
+        defaults.secret = csrfConf.secret;
+    }
     if (typeof csrfConf.cookieName === 'string' && csrfConf.cookieName) {
         defaults.cookieName = csrfConf.cookieName;
     }
@@ -422,13 +429,24 @@ var SESSIONLESS_MESSAGE =
     + ' - CSRF doesn\'t apply to non-cookie authentication.';
 
 /**
- * Build the CSRF middleware. The factory reads
- * `process.env.GINA_CSRF_SECRET` once, at call time, and refuses to
- * proceed if it is missing — no dev fallback.
+ * Build the CSRF middleware. The factory reads the HMAC secret at call
+ * time from a three-step chain and refuses to proceed if all three are
+ * missing — no dev fallback. Precedence:
+ *
+ *   1. `opts.secret` — factory override (test harness only).
+ *   2. `settings.json > csrf.secret` — resolver-compatible config slot.
+ *      `${secret:KEY}` placeholders are filled by `lib/secrets` at
+ *      config-load time from `process.env[KEY]`, so this slot lets
+ *      consumers name the env var anything they like.
+ *   3. `process.env.GINA_CSRF_SECRET` — back-compat direct env read.
+ *      Always honoured when set, regardless of (2).
  *
  * @example
+ *   // settings.json — recommended shape:
+ *   // { "csrf": { "secret": "${secret:MY_CSRF_KEY}" } }
+ *   // then set process.env.MY_CSRF_KEY at deploy time.
  *   var csrf = require('gina').plugins.Csrf();
- *   app.use(session({ secret: process.env.SESSION_SECRET }));
+ *   app.use(session({ secret: self.getConfig('session').secret }));
  *   app.use(csrf);
  *
  * @example
@@ -441,7 +459,7 @@ var SESSIONLESS_MESSAGE =
  *   }
  *
  * @param   {object} [opts]
- * @param   {string} [opts.secret]      — overrides `GINA_CSRF_SECRET` (test harness)
+ * @param   {string} [opts.secret]      — overrides settings.csrf.secret and GINA_CSRF_SECRET (test harness)
  * @param   {string} [opts.cookieName]
  * @param   {string} [opts.headerName]
  * @param   {string} [opts.fieldName]
@@ -453,23 +471,28 @@ var SESSIONLESS_MESSAGE =
  *                                             which itself defaults to the bundle's
  *                                             configured hostname.
  * @returns {function}                  — Express-compatible middleware `(req, res, next)`
- * @throws  {Error} when `GINA_CSRF_SECRET` is missing or no origin can be resolved.
+ * @throws  {Error} when no secret is resolvable from any of the three sources,
+ *                  or no origin can be resolved.
  */
 function Csrf(opts) {
     opts = opts || {};
 
+    var defaults = resolveSettingsDefaults();
+
     var secret = (typeof opts.secret === 'string' && opts.secret)
                  ? opts.secret
-                 : process.env.GINA_CSRF_SECRET;
+                 : (typeof defaults.secret === 'string' && defaults.secret)
+                   ? defaults.secret
+                   : process.env.GINA_CSRF_SECRET;
     if (typeof secret !== 'string' || !secret) {
         throw new Error(
-            '[gina csrf] GINA_CSRF_SECRET env var is required.'
+            '[gina csrf] GINA_CSRF_SECRET env var is required'
+            + ' (or set settings.json > csrf.secret — supports ${secret:KEY} placeholders).'
             + ' Generate once: openssl rand -base64 64.'
             + ' Place in your bundle\'s env.json or your shell profile.'
         );
     }
 
-    var defaults    = resolveSettingsDefaults();
     var cookieName  = (typeof opts.cookieName === 'string' && opts.cookieName) ? opts.cookieName : defaults.cookieName;
     var headerName  = (typeof opts.headerName === 'string' && opts.headerName) ? opts.headerName : defaults.headerName;
     var fieldName   = (typeof opts.fieldName  === 'string' && opts.fieldName)  ? opts.fieldName  : defaults.fieldName;

package/framework/{v0.3.13-alpha.2 → v0.3.13-alpha.3}/core/plugins/lib/validator/src/form-validator.js

@@ -1069,7 +1069,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
 
                             isValid = new RegExp(re, flags).test(this.value)
                         } else {
-                            isValid = eval(condition);
+                            // #M21b — free-form JS condition shape unsupported; declare a documented shape instead
+                            throw new Error('[FormValidator] Unsupported condition shape — supported: binary comparison (a OP b), RegExp, boolean, /regex/flags literal. Got: `' + condition + '`');
                         }
 
                         //valid = new RegExp(condition.replace(/\//g, '')).test(this.value)
@@ -1883,6 +1884,15 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                         userValidator = gina.forms.validators[v].toString();
                     }
 
+                    // #M21c — Pattern B eval surface (trust-model invariant)
+                    // Load-bearing: user-defined validator function bodies are registered on
+                    // `gina.forms.validators` from disk-loaded `bundle/validators/<name>/main.js`
+                    // files at framework boot. Trust assumption: the source of `userValidator`
+                    // is always disk-sourced at boot — never request-time input (req.*, request.*,
+                    // form values, URL params). End-user data MUST NOT reach this eval.
+                    // Invariant pinned by test/lib/validator-scs1i.test.js (zero write sites for
+                    // `gina.forms.validators` in framework source; zero request-time identifiers
+                    // around the userValidator source chain).
                     self[el][v] = eval('(' + userValidator + ')\n//# sourceURL='+ v +'.js');
                     //self[el][v] = Function('errorMessage', 'errorStack', userValidator);
                 }

package/framework/{v0.3.13-alpha.2 → v0.3.13-alpha.3}/core/plugins/lib/validator/src/main.js

@@ -2400,7 +2400,8 @@ function ValidatorPlugin(rules, data, formId) {
         if (htmlSuccesEventCallback != null) {
 
             if ( /\((.*)\)/.test(htmlSuccesEventCallback) ) {
-                eval(htmlSuccesEventCallback)
+                // #M21a — function-call shape unsupported; register a bare handler on window instead
+                try { console.warn('[gina-form-event] function-call shape no longer supported on data-gina-form-event-on-submit-success — use a bare identifier and register the handler on window: '+ htmlSuccesEventCallback); } catch (e) {}
             } else {
                 $form.on('success.hform',  window[htmlSuccesEventCallback])
             }
@@ -2409,7 +2410,8 @@ function ValidatorPlugin(rules, data, formId) {
         var htmlErrorEventCallback =  $form.target.getAttribute('data-gina-form-event-on-submit-error') || null;
         if (htmlErrorEventCallback != null) {
             if ( /\((.*)\)/.test(htmlErrorEventCallback) ) {
-                eval(htmlErrorEventCallback)
+                // #M21a — function-call shape unsupported; register a bare handler on window instead
+                try { console.warn('[gina-form-event] function-call shape no longer supported on data-gina-form-event-on-submit-error — use a bare identifier and register the handler on window: '+ htmlErrorEventCallback); } catch (e) {}
             } else {
                 $form.on('error.hform', window[htmlErrorEventCallback])
             }