gina 0.4.2-alpha.1 → 0.4.2

package/CHANGELOG.md

@@ -6,6 +6,16 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.4.2 - 2026-06-02
+
+_Additive release — opt-in HTTP/3 advertisement (`Alt-Svc`) plus two render-path fixes (`gina-container` HTML 500, layoutless `page.data` restore). No breaking changes, no settings reset._
+
+### Added
+* Added an opt-in `Alt-Svc` HTTP/3-advertisement response header. Set `server.http3Advertisement: true` to emit `Alt-Svc: h3=":443"; ma=86400` on every routed response, advertising HTTP/3 (QUIC) availability so QUIC-capable clients upgrade via a QUIC-capable edge proxy (Caddy / nginx-QUIC / Cloudflare). Gina does not implement QUIC — advertise only. Idempotent (an upstream-set Alt-Svc is never clobbered); off by default.
+### Fixed
+* `gina-container` (the Docker/K8s foreground launcher) no longer returns HTTP 500 on every HTML-rendering route. The controller read the `GINA_PID` and `GINA_CULTURE` globals directly, which the daemonless launcher does not inject; it now falls back to the bundle process id and the default culture.
+* Layoutless renders (`self.renderWithoutLayout`) now expose controller data both at top level and under `page.data` again. The 0.4.1 top-level-variable change populated only the top level, so fragment templates reading `data.X` / `page.data.X` (via `{% set data = page.data %}`) rendered empty; this restores the `page.data` copy alongside the top-level merge, matching the nunjucks engine. The copy runs before the top-level merge to avoid a circular reference in the layoutless XHR-data serialization.
+
 ## 0.4.1 - 2026-06-01
 ### Added
 * New `gina bundle:status` and `gina project:status` CLI commands report the running/stopped state, PID, port, and active env of bundles (human-readable or --format=json).

package/README.md

@@ -39,11 +39,10 @@ gina bundle:start api @myproject
 open https://localhost:3100
 ```
 
-## What's in 0.4.1
+## What's in 0.4.2
 
-- **CLI Tier 2 — run-state + lifecycle commands.** `bundle:status` / `project:status` report a bundle's (or every bundle's) running/stopped state, PID, port, and active env — human-readable or `--format=json`. `minion:list` / `minion:kill` list and reap a project's running bundle child-processes (both pidfile-tracked and `ps`-discovered orphans) with a graceful SIGTERM→SIGKILL escalation and a `--dry-run` preview. `bundle:copy` (alias `bundle:cp`) duplicates a bundle under a new name and `bundle:rename` renames one in place — both rewrite the bundle-name footprint and update the manifest / env / ports registry, with `--dry-run` / `--force`. `protocol:remove` reverts a bundle to the project's default protocol and scheme.
-- **Runtime template override** — `self.setTemplate(file, ext)` lets a controller action choose its template at request time (e.g. a catch-all dispatcher), resolved verbatim under the templates root. Honoured by both the swig and nunjucks render paths.
-- **Fixes** — nunjucks↔swig render parity (`self.setTemplate()` overrides, `controllers/setup.js` filter registration via `this.engine.addFilter()`, and a controller passing a partial `page` object no longer dropping framework-injected page data — webroot, view metadata, session); a crash that could kill a bundle serving static assets over HTTP/2 in dev mode under concurrent requests; `renderWithoutLayout` returning an empty body when the template referenced controller data as top-level variables; and clearer fail-fast errors when the `gina` CLI hits an uninstalled `GINA_VERSION` or when an interactive command (`bundle:add`/`bundle:remove`/`project:remove`/`protocol:set`/`port:set`/`view:add`) runs without a TTY.
+- **HTTP/3 advertisement (opt-in `Alt-Svc`).** Set `server.http3Advertisement: true` to emit `Alt-Svc: h3=":443"; ma=86400` on every routed response, so QUIC-capable browsers upgrade to HTTP/3 via a QUIC-capable edge proxy (Caddy, nginx-QUIC, Cloudflare) — **without Gina implementing QUIC itself.** Off by default; idempotent (an upstream-set `Alt-Svc` is never overwritten).
+- **Fixes** — `gina-container` (the Docker/K8s foreground launcher) no longer returns HTTP 500 on every HTML route (it read the `GINA_PID` / `GINA_CULTURE` globals the daemonless launcher doesn't inject); and layoutless (`renderWithoutLayout`) fragment renders again expose controller data under `page.data` as well as at top level, so templates reading `data.X` / `page.data.X` keep working alongside the 0.4.1 top-level-variable fix — matching the nunjucks engine.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -285,7 +285,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **Configurable `maxConcurrentStreams` and `initialWindowSize`** — move from hardcoded to `settings.json` `http2Options` | `0.3.0-alpha.1` | 2026-04-05 | All four HTTP/2 server settings configurable: `maxConcurrentStreams` (256), `initialWindowSize` (655350), `maxSessionRejectedStreams` (100), `maxSessionInvalidFrames` (1000). Security guards (`maxHeaderListSize`, `enablePush`) remain hardcoded. |
 | ✅ | **Application-level rapid reset rate limiter** (CVE-2023-44487) — per-session stream creation counter | `0.3.13` | 2026-05-14 | The Isaac HTTP/2 session handler counts new streams in a rolling 1s window per session; over `maxStreamsPerSecond` (default 200) it sends a GOAWAY and closes the session. More targeted than `maxSessionRejectedStreams` (which counts refused streams, not created ones). Configurable via `settings.json` `http2Options.maxStreamsPerSecond`; `/_gina/info` exposes a `rapidResetBlocked` counter. |
 | ✅ | **Trailer support** — `stream.sendTrailers()` + `waitForTrailers: true` | `0.4.0` | 2026-05-22 | Opt-in HTTP/2 response trailers via `self.sendTrailers(fields)`. The render pipeline sets `waitForTrailers` and emits the trailing headers after the body (in the `wantTrailers` event), across all render delegates. Activated only when a controller calls `self.sendTrailers(fields)`; HTTP/1.1 and the no-trailers path are unchanged. For gRPC-style streaming (`grpc-status`) and content-integrity (`Digest`) use cases. |
-| 📋 | **Alt-Svc header** — advertise HTTP/3 availability | `0.5.0` | Q1 2027 | Set `Alt-Svc: h3=":443"; ma=86400` response header to advertise HTTP/3 (QUIC) availability via a QUIC-capable reverse proxy (nginx, Caddy, Cloudflare). Gina does not need to implement QUIC — just announce it. Opt-in via `settings.server.json`. Native HTTP/3 is out of scope: Node.js has no stable QUIC API, and the standard deployment topology (Gina → proxy → client) already delivers HTTP/3 at the edge. |
+| ✅ | **Alt-Svc header** — advertise HTTP/3 availability | `0.5.0` | Q1 2027 | Set `Alt-Svc: h3=":443"; ma=86400` response header to advertise HTTP/3 (QUIC) availability via a QUIC-capable reverse proxy (nginx, Caddy, Cloudflare). Gina does not need to implement QUIC — just announce it. Opt-in via `settings.server.json`. Native HTTP/3 is out of scope: Node.js has no stable QUIC API, and the standard deployment topology (Gina → proxy → client) already delivers HTTP/3 at the edge. |
 | 📋 | **RFC 9218 Extensible Priorities** — read `Priority: u=N, i` request header | `0.5.0` | Q1 2027 | Use the RFC 9218 priority header to order response writes for multiplexed API clients. Low value for typical HTML page loads; high value for parallel API requests with declared urgency. |
 | 📋 | **WebSocket over HTTP/2** (RFC 8441 — CONNECT method extension) | `0.5.0` | Q1 2027 | Tunnel WebSocket over an HTTP/2 stream without a separate HTTP/1.1 connection. Node.js supports this since v10.19. Enables WebSocket in HTTP/2-only deployments. |
 

package/framework/v0.4.2/VERSION

@@ -0,0 +1 @@
+0.4.2

package/framework/{v0.4.2-alpha.1 → v0.4.2}/core/asset/plugin/dist/vendor/gina/inspector/inspector.css

@@ -3640,5 +3640,3 @@ details[open] > summary.bm-summary::before {
     text-align: left;
   }
 }
-
-/*# sourceMappingURL=inspector.css.map */

package/framework/{v0.4.2-alpha.1 → v0.4.2}/core/controller/controller.js

@@ -449,7 +449,8 @@ function SuperController(options) {
             }
 
             set('page.environment.gina', version.number);
-            set('page.environment.gina pid', GINA_PID);
+            // gina-container (daemonless launcher) injects no GINA_PID global — fall back to this pid
+            set('page.environment.gina pid', getEnvVar('GINA_PID') || String(process.pid));
             set('page.environment.nodejs', version.nodejs +' '+ version.platform +' '+ version.arch);
             set('page.environment.engine', options.conf.server.engine);//version.middleware
             set('page.environment.uvThreadpoolSize', process.env.UV_THREADPOOL_SIZE);
@@ -704,7 +705,8 @@ function SuperController(options) {
             set('page.view.route', rule);
 
 
-            var acceptLanguage = GINA_CULTURE; // by default : language-COUNTRY
+            // gina-container injects no GINA_CULTURE global — fall back to the framework default
+            var acceptLanguage = getEnvVar('GINA_CULTURE') || 'en_CM'; // by default : language-COUNTRY
             if ( typeof(req.headers['accept-language']) != 'undefined' ) {
                 acceptLanguage = req.headers['accept-language']
             } else if ( typeof(local.options.conf.server.response.header['accept-language']) != 'undefined' ) {

package/framework/{v0.4.2-alpha.1 → v0.4.2}/core/controller/controller.render-swig.js

@@ -548,12 +548,28 @@ module.exports = async function render(userData, displayInspector, errOptions, d
             userData = { page: { view: {}}}
         } else if ( isWithoutLayout ) {
             // Layoutless renders (self.renderWithoutLayout) have no page envelope
-            // — no `view.layout`, no breadcrumb, no session card — so the
-            // `page`-key-presence gating used below for full pages serves no
-            // purpose here and only buries the controller's context under
-            // `data.page.data`, where the fragment template's top-level
-            // {{ var }} references can't reach it. Merge user context at
-            // top level unconditionally for fragments.
+            // — no `view.layout`, no breadcrumb, no session card. Expose the
+            // controller's userData two ways so both fragment-template idioms work:
+            //   (1) at top level, so bare `{{ var }}` references resolve; and
+            //   (2) under `page.data`, so templates using `{% set data = page.data %}`
+            //       / `data.X` (the layoutless contract popins rely on) keep working.
+            // The page.data copy MUST run BEFORE the top-level merge below: while
+            // userData still has no `page` key and `data` is the distinct page
+            // envelope, the per-key copy creates only shared leaf refs. Running it
+            // AFTER `data = merge(userData, data)` (where `merge` returns its first
+            // arg, so `data === userData`) would make `data.page.data` alias `data`
+            // — a circular ref that throws in the layoutless XHR-data `JSON.stringify`.
+            // Mirrors the render-nunjucks userData stash; additive (page.data already
+            // carried these keys before the top-level-only change).
+            if ( !isRenderingCustomError && userData && !userData['page'] ) {
+                if ( typeof(data['page']) == 'undefined' ) { data['page'] = {}; }
+                if ( typeof(data['page']['data']) == 'undefined' ) { data['page']['data'] = {}; }
+                for ( var _udk in userData ) {
+                    if ( Object.prototype.hasOwnProperty.call(userData, _udk) ) {
+                        data['page']['data'][_udk] = userData[_udk];
+                    }
+                }
+            }
             data = (isRenderingCustomError) ? userData : merge(userData, data)
         } else if ( userData && !userData['page']) {
 

package/framework/{v0.4.2-alpha.1 → v0.4.2}/core/server.js

@@ -1483,6 +1483,8 @@ function Server(options) {
      * Merges configured response headers (CORS, cache-control, etc.) into the
      * response. Resolves `Access-Control-Allow-Origin` against the bundle's
      * allowed origins list and normalises HTTP/1.1 vs HTTP/2 header names.
+     * When `server.http3Advertisement` is enabled, also emits the opt-in
+     * `Alt-Svc: h3=":443"; ma=86400` HTTP/3-advertisement header (#H11).
      *
      * @inner
      * @private
@@ -1508,6 +1510,25 @@ function Server(options) {
             responseHeaders = {};
         }
 
+        // #H11 — opt-in Alt-Svc HTTP/3-advertisement header on every routed
+        // (user-facing) response. When server.http3Advertisement is true,
+        // advertise an HTTP/3 (QUIC) alternative on :443 so QUIC-capable
+        // clients upgrade via a QUIC-capable edge proxy (Caddy / nginx-QUIC /
+        // Cloudflare). Gina does NOT implement QUIC — advertise only; the edge
+        // terminates HTTP/3 on :443 (NOT the bundle's own listen port). Set via
+        // response.setHeader so it is carried onto both engines: completeHeaders
+        // runs for Isaac routed requests through the composeHeadersMiddleware
+        // drain and for the Express engine alike, and the render delegates fold
+        // response.getHeaders() into the HTTP/2 stream.respond. First-writer-
+        // wins: an upstream-set Alt-Svc is never clobbered. Off by default.
+        if (
+            conf.server.http3Advertisement
+            && typeof(response.getHeader) == 'function'
+            && !response.getHeader('alt-svc')
+        ) {
+            response.setHeader('alt-svc', 'h3=":443"; ma=86400');
+        }
+
         // Copy to avoid override
         resHeaders  = JSON.clone(conf.server.response.header);
         if ( typeof(request.routing) == 'undefined' ) {

package/framework/{v0.4.2-alpha.1 → v0.4.2}/core/template/boilerplate/bundle/config/settings.server.json

@@ -31,6 +31,16 @@
     //     "maxStreamsPerSecond": 200
     // },
 
+    /**
+    * `http3Advertisement` setting (#H11)
+    * Opt-in Alt-Svc header advertising HTTP/3 (QUIC) at the edge.
+    * Set true to emit `Alt-Svc: h3=":443"; ma=86400` on every routed
+    * response. Gina does not implement QUIC — a QUIC-capable proxy
+    * (Caddy / nginx-QUIC / Cloudflare) terminates HTTP/3 on :443.
+    * Idempotent (first-writer-wins); off by default.
+    */
+    // "http3Advertisement": true,
+
     /**
     * `response` settings
     * This section is mostly used to setup CORS

package/framework/{v0.4.2-alpha.1 → v0.4.2}/core/template/conf/settings.json

@@ -13,6 +13,14 @@
     // suspenders bundles can mount both.
     // Default `false` preserves shipped behaviour; opt-in by setting to `true`.
     "hidePoweredBy": false,
+    // #H11 — opt-in Alt-Svc HTTP/3-advertisement header. When `true`, every
+    // routed (user-facing) response carries `Alt-Svc: h3=":443"; ma=86400`,
+    // advertising HTTP/3 (QUIC) availability so QUIC-capable clients upgrade
+    // via a QUIC-capable edge proxy (Caddy / nginx-QUIC / Cloudflare). Gina
+    // does NOT implement QUIC — this only advertises it; the edge terminates
+    // HTTP/3 on :443. Idempotent (first-writer-wins: an upstream-set Alt-Svc
+    // is never clobbered). Default `false` = zero behaviour change.
+    "http3Advertisement": false,
     // [Listen] Binding address: `0.0.0.0` by default or `127.0.0.1` for ipv4 only, `::` for ipv6 only, `:::` for both
     "address": "0.0.0.0",
     // [Listen] Queue length limited to os values : tcp_max_syn_backlog, somaxconn

package/framework/{v0.4.2-alpha.1 → v0.4.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.4.2-alpha.1",
+  "version": "0.4.2-alpha.2",
   "dependencies": {
     "@rhinostone/swig": "^2.5.1",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.4.2-alpha.1/core/gna');
+var _gna = require('./framework/v0.4.2/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.4.2-alpha.1/core/controller');
-var EntitySuper     = require('./framework/v0.4.2-alpha.1/core/model/entity');
+var SuperController = require('./framework/v0.4.2/core/controller');
+var EntitySuper     = require('./framework/v0.4.2/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.4.2-alpha.1/lib/uuid');
+var uuid = require('./framework/v0.4.2/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -935,3 +935,7 @@ Dev-mode query instrumentation captures every database query tied to the current
 143. **`lib/cmd-status-format` — shared run-state/port display primitive for the status/list CLI handlers (`pad` / `pickPreferredPort` / `readPidfile`).** `bundle:list`, `service:list`, `bundle:status`, and `project:status` each carried byte-identical inline copies of three helpers; they now consume `lib.cmdStatusFormat` (`var fmt = lib.cmdStatusFormat;` — the ambient registry global; the bare `require('lib/cmd-status-format')` form does NOT resolve in `bin/cli`/`bin/cmd` daemon scope, the same constraint as `routing-introspect`/`connector-registry`, because the `NODE_PATH` shim runs at bundle runtime). The module is **pure** — requires only node `fs`/`path`, reads no framework globals — so it is unit-testable by a direct require. The load-bearing design move: `readPidfile` was generalised from the inline `readPidfile(bundleName, projectName)` (which read the `GINA_HOMEDIR` + `_` globals) to `readPidfile(runDir, bundleName, projectName)` built with `path.join`; callers pass `GINA_HOMEDIR + '/run'`, and `service:list`'s hardwired `@gina` case becomes `fmt.readPidfile(GINA_HOMEDIR + '/run', name, 'gina')`. `pad` / `pickPreferredPort` were already pure and moved verbatim. **Test-extraction pattern**: the four handler test files were source-inspection suites pinning the inline *definitions*; extraction invalidates those pins, so they were rewritten to consume-the-primitive assertions (`/fmt\.readPidfile\(/` + `doesNotMatch /var readPidfile = function/`) and the behavioural coverage moved to `test/lib/cmd-status-format.test.js` (require-by-path, 15 tests) — the handlers' tests stay thin, the primitive is the behavioural surface. `lib/cmd/connector/list.js`'s byte-identical inline `pad(s, width)` was given the same treatment in `79d71abf` (call site routed through `fmt.pad`, test source-pin re-aimed — the new `var fmt` pin tolerates the column-aligned declaration via `/var fmt\s+= /`); `lib/cmd/cache/stats.js`'s `pad(str, len)` is a different signature and stays inline. Commits `fa0e0c1d`..`45459fa9` (+ `79d71abf` connector:list). Established 2026-05-31.
 
 144. **`self.setTemplate(file, ext)` — runtime template override (controller action API, shipped `0.4.1-alpha.2`).** A controller action resolving its template dynamically (e.g. a catch-all dispatcher) calls `self.setTemplate(file, ext)` AFTER `setOptions()` to override the rule's default; it stashes `local.options._templateOverride = {file, ext}` (ext leading-dot-normalised; non-string args ignored; bails if `local.options` unset). BOTH render delegates read it and resolve the override **verbatim under the templates root with NO namespace prefixing**: render-swig in the path-resolution block ahead of the `namespace` branch, gated `!isRenderingCustomError` (swig's block is shared with custom-error rendering, so a leftover override must not hijack the framework error template); render-nunjucks via an early `return ovFile` in `resolveTemplatePath()` (its custom-error path uses `errOptions`, which carries no override, so no gate needed). **Inert-API gotcha — the writer alone is a no-op:** #27 shipped the writer with ZERO readers (it set `_templateOverride` but no delegate consumed it; source-inspection tests on the writer passed while the feature did nothing). When adding any 'the delegates read X' API, grep the delegates for the reader first and back it with a BEHAVIOURAL test that the rendered output changes. Commits `9f2471f0` (#27 writer + swig reader) + `61211bfb` (#29 nunjucks reader). Established 2026-06-01.
+
+145. **`bin/gina-container` (the daemonless Docker/K8s launcher) defines only a SUBSET of the `GINA_*` globals the daemon defines, so a BARE `GINA_*` read in the request/render path throws `ReferenceError` (HTTP 500) on every view render under it — read injected globals via `getEnvVar('NAME') || <fallback>`, never as a bare identifier.** A bundle child's bare-global namespace is exactly the keys of `ctxObj.envVars` (`gna.js` `defineDefault(envVars)` → `helpers/context.js` `define()` → `Object.defineProperty(global, NAME)`); a name absent from `envVars` is never declared, so a bare read throws while `getEnvVar('NAME')` returns `undefined` safely. The normal `bundle:start` path (`bin/cli` → `framework:init` + `framework/start.js`) seeds ~36 keys incl. `GINA_PID` and `GINA_CULTURE`/`GINA_CULTURES`/…; `gina-container` is daemonless (no socket server, no `framework:init`) and defines only the ~20 it explicitly `setEnvVar`s, omitting `GINA_PID`, `GINA_CULTURE`, et al. Two bare reads in `setOptions`' `hasViews()` block — `controller.js` `GINA_PID` and `GINA_CULTURE` — therefore 500'd every HTML route under `gina-container` (the first masked the second); both now use `getEnvVar('GINA_PID') || String(process.pid)` and `getEnvVar('GINA_CULTURE') || 'en_CM'`, matching the safe siblings (`render-json.js`, `inspector-window-emit.js`) and the culture default (`config.js`, `init.js`). The `String(process.pid)` fallback runs in the bundle child, yielding the child's own pid — exactly what the daemon's `opt.pid` provides; JSON responses were never affected (render-json already used the guarded reader). Established 2026-06-01.
+
+146. **#H11 Alt-Svc HTTP/3-advertisement header — opt-in `server.http3Advertisement` makes `completeHeaders` (`core/server.js`) emit `Alt-Svc: h3=":443"; ma=86400` on every routed (user-facing) response, BOTH engines; advertise-only (Gina implements no QUIC).** Gate: `if (conf.server.http3Advertisement && typeof(response.getHeader)=='function' && !response.getHeader('alt-svc')) response.setHeader('alt-svc','h3=":443"; ma=86400')` — idempotent first-writer-wins (an upstream/proxy Alt-Svc is never clobbered), off by default (zero behaviour change when unset). **Why `completeHeaders`, not the #HDR8 `/_gina/*` closure-helper:** a framework header's natural home is wherever the responses it must reach are built. #HDR8's X-Powered-By lives on the Isaac `/_gina/*` `writeHead` sites because that is the ONLY place Isaac emits it (Isaac user pages carry no X-Powered-By); Alt-Svc must reach USER-facing pages (that is where browsers cache the h3-upgrade), whose builder is `completeHeaders` — and it covers BOTH engines (Isaac routed requests reach it via the engine-agnostic `composeHeadersMiddleware` drain that `gna.js` registers with `instance.use()` → `instance.completeHeaders`; the render delegates then fold `response.getHeaders()` into the HTTP/2 `stream.respond`). So one gate covers user pages on both engines; the `/_gina/*` framework endpoints (health / metrics / inspector) are NOT browser-h3-upgrade-relevant and deliberately don't carry it (avoids the 17-site `_setPoweredByHeader`-style fan-out + a parallel test pin for zero functional gain). **`:443` is the EDGE's public QUIC port, NOT gina's own listen port** — a QUIC-capable edge (Caddy / nginx-QUIC / Cloudflare) terminates HTTP/3 on :443; advertising gina's internal port (e.g. :3142) would point clients at a port gina does not serve QUIC on (a bare boolean with a fixed `:443` is therefore more correct than deriving from the bound port). Settings: `settings.json > server.http3Advertisement` (sibling of `hidePoweredBy`) + a commented boilerplate `settings.server.json` doc. Tests: `server.test.js` source-pins + a pure-logic replica (present-when-on / absent-when-off / first-writer-wins / typeof-guard). Empirically smoke-confirmed via `bin/gina-container` on a disposable starter bundle (Isaac engine, http/1.1: flag ON → `alt-svc: h3=":443"; ma=86400` on the wire, OFF → absent). Established 2026-06-02.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.4.2-alpha.1",
+  "version": "0.4.2",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -72,7 +72,7 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.4.2-alpha.1/core/gna",
+  "main": "./framework/v0.4.2/core/gna",
   "types": "./types/index.d.ts",
   "typesVersions": {
     "*": {

package/framework/v0.4.2-alpha.1/VERSION

@@ -1 +0,0 @@
-0.4.2-alpha.1