gina 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -6,6 +6,23 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.4.3 - 2026-06-04
+
+_Additive release — the standalone Inspector connects over an authenticated WebSocket (with `gina service:start` and dev auto-start), `FormValidator` reflects validity into `aria-invalid` (#A11Y1), the popin / link / validator plugins drop inline `onclick` for strict-CSP compatibility, and the `@rhinostone/swig` floor moves to `^2.6.0`. No breaking changes, no settings reset._
+
+### Added
+* Added an authenticated WebSocket transport for the Inspector agent endpoint (/_gina/agent), alongside the existing SSE channel. The standalone Inspector can stream a bundle data + log feed over a single WebSocket. Outside dev mode the upgrade requires the configured inspector.agent.key (presented via ?key= or the x-gina-inspector-key header) and honours an optional inspector.agent.allowedOrigins Origin allowlist.
+* The standalone Inspector SPA can stream a bundle data + log feed over the WebSocket transport by opening with ?transport=ws (SSE stays the default and the automatic fallback if the socket cannot open). The optional ?key= is threaded on the WebSocket URL for an auth-gated endpoint.
+* Added a `gina service:start <service>` command to start a framework-internal @gina service (such as the standalone Inspector) via the daemon-free gina-container launcher, with double-start protection, `--dry-run` and `--format=json`. In dev mode the Inspector now auto-starts when a bundle boots (a no-op unless the framework services project is scaffolded locally).
+* FormValidator now reflects each managed field's validity into `aria-invalid` (#A11Y1): `true` on a committed error and `false` when valid — mirroring the native `ValidityState` where the field has native HTML constraints, so it agrees with the `:user-invalid` styling already shown. This exposes any `aria-errormessage` association on the field to assistive technology, which is otherwise inert without `aria-invalid`. When the field already references an error element via `aria-errormessage`, the redundant `form-item-error-message` div is suppressed; legacy forms with no association keep the injected div and gain an `aria-errormessage` wire to it. On a failed submit, focus moves to the first invalid field so assistive technology announces it; blur-time errors are announced through a per-form visually-hidden `aria-live="polite"` region. No public API change; existing error classes and attributes (`form-item-error`, `form-item-error-message`, `data-gina-form-errors`, submit-button state) are unchanged.
+### Changed
+* The standalone Inspector now connects to the /_gina/agent endpoint over a WebSocket by default, falling back to SSE automatically if the socket cannot open. Open the Inspector with ?transport=sse to force the SSE transport. Authentication and the production toggle are unchanged (the WebSocket reuses the same inspector.agent key).
+* Bumped the @rhinostone/swig dependency floor from ^2.5.1 to ^2.5.3 in both the root package.json and framework/v*/package.json. swig 2.5.2 fixes dynamic {% extends %} resolution on the async-loader render path in the Twig and Jinja2 frontends; 2.5.3 turns a dynamic {% extends %} on the synchronous render path into a clear error pointing to the async render path instead of a generic failure. The native @rhinostone/swig package stays drop-in compatible with the API gina depends on (swig.compile, swig.setFilter, swig.setTag, swig.renderFile). swigResolver DEFAULT_MIN stays at 2.0.0 — the framework does not depend on any new 2.5.x-only API.
+* Bumped the @rhinostone/swig floor to ^2.6.0 in both the root and framework manifests. 2.6.0 makes the native json / json_encode filters HTML-escape their output and marks them (and url_encode) safe, so {{ data|json }} is safe to embed directly inside a <script> block (url_decode is unchanged). swigResolver DEFAULT_MIN stays at 2.0.0 — the framework depends on no new 2.6.0-only API.
+### Fixed
+* Popin close elements no longer get an inline onclick="return false;" attribute injected at bind time, so popins work under a strict nonce-based Content-Security-Policy (the inline handler tripped the script-src-attr directive). Default-action suppression is unchanged — it was already handled by the registered close listener.
+* The Link plugin and the form-validator anchor submit-triggers no longer inject an inline onclick="return false;" attribute at bind time, so they work under a strict nonce-based Content-Security-Policy (the inline handler tripped the script-src-attr directive). Default-action suppression is preserved via an addEventListener-based preventDefault listener, so behaviour is unchanged.
+
 ## 0.4.2 - 2026-06-02
 
 _Additive release — opt-in HTTP/3 advertisement (`Alt-Svc`) plus two render-path fixes (`gina-container` HTML 500, layoutless `page.data` restore). No breaking changes, no settings reset._

package/README.md

@@ -22,7 +22,7 @@ Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope
 | ORM / entities | EventEmitter-based entity system; SQL files auto-wired to entity methods |
 | Connectors | Couchbase, MongoDB, ScyllaDB / Cassandra, MySQL, PostgreSQL, Redis, SQLite, AI (LLM) — loaded from project `node_modules` |
 | AI connector | Any LLM provider via named protocol (`anthropic://`, `openai://`, `ollama://`, …) |
-| Template engine | [`@rhinostone/swig`](https://github.com/gina-io/swig) 2.5.1 — maintained fork with CVE-2023-25345 patched; streaming SSE/chunked via `renderStream()`. Nunjucks supported as opt-in via `render.engine = "nunjucks"` |
+| Template engine | [`@rhinostone/swig`](https://github.com/gina-io/swig) 2.6.0 — maintained fork with CVE-2023-25345 patched; streaming SSE/chunked via `renderStream()`. Nunjucks supported as opt-in via `render.engine = "nunjucks"` |
 | Internationalisation | Per-bundle JSON catalogs, `t()` helper, swig + nunjucks `t` filter, CLDR plurals, ICU MessageFormat opt-in via `t.icu()` |
 | Observability | Built-in `/_gina/metrics` Prometheus endpoint (opt-in, IP-allowlisted) — Node.js process metrics + HTTP counter / duration histogram with cardinality-safe route labels |
 | Hot reload | WatcherService evicts `require.cache` only on file change — zero per-request overhead in dev |
@@ -39,10 +39,12 @@ gina bundle:start api @myproject
 open https://localhost:3100
 ```
 
-## What's in 0.4.2
+## What's in 0.4.3
 
-- **HTTP/3 advertisement (opt-in `Alt-Svc`).** Set `server.http3Advertisement: true` to emit `Alt-Svc: h3=":443"; ma=86400` on every routed response, so QUIC-capable browsers upgrade to HTTP/3 via a QUIC-capable edge proxy (Caddy, nginx-QUIC, Cloudflare) — **without Gina implementing QUIC itself.** Off by default; idempotent (an upstream-set `Alt-Svc` is never overwritten).
-- **Fixes** — `gina-container` (the Docker/K8s foreground launcher) no longer returns HTTP 500 on every HTML route (it read the `GINA_PID` / `GINA_CULTURE` globals the daemonless launcher doesn't inject); and layoutless (`renderWithoutLayout`) fragment renders again expose controller data under `page.data` as well as at top level, so templates reading `data.X` / `page.data.X` keep working alongside the 0.4.1 top-level-variable fix — matching the nunjucks engine.
+- **Inspector over WebSocket.** The standalone Inspector now connects to a bundle's `/_gina/agent` endpoint over an authenticated WebSocket by default — streaming the data + log feed on one socket — and falls back to SSE automatically if the socket can't open (open with `?transport=sse` to force SSE). Outside dev mode the upgrade requires the configured `inspector.agent.key` (via `?key=` or the `x-gina-inspector-key` header) and honours an optional `inspector.agent.allowedOrigins` allowlist. A new **`gina service:start <service>`** command starts framework-internal `@gina` services (such as the standalone Inspector) via the daemon-free `gina-container` launcher, and in dev mode the Inspector auto-starts when a bundle boots.
+- **Accessible form validation (`aria-invalid`, #A11Y1).** `FormValidator` now keeps each managed field's `aria-invalid` in sync with its validity (`true` on a committed error, `false` once valid), so a field's `aria-errormessage` association is actually exposed to assistive technology. A failed submit moves focus to the first invalid field; blur-time errors are announced through a per-form `aria-live` region. Automatic — no public API change.
+- **Strict-CSP client plugins.** The popin, link, and form-validator plugins no longer inject an inline `onclick="return false;"` attribute at bind time, so they work under a strict nonce-based Content-Security-Policy (the inline handler tripped `script-src-attr`). Default-action suppression is unchanged.
+- **`@rhinostone/swig` → `^2.6.0`.** The template-engine floor moves to 2.6.0; the native `json` / `json_encode` filters now HTML-escape their output and are marked safe, so `{{ data|json }}` is safe to embed directly inside a `<script>` block.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -188,7 +188,7 @@ Client-side form-validation accessibility — keeping `FormValidator`'s ARIA sta
 
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
-| 📋 | **`aria-invalid` validity reflection (#A11Y1)** — `FormValidator` keeps `aria-invalid` in sync with each managed field's effective validity, so a field's `aria-errormessage` (and error `aria-describedby`) association is actually exposed to assistive technology. Per WAI-ARIA those associations are inert unless the field also carries `aria-invalid="true"`, so today screen-reader users are never told which field is invalid or what the error says even when the markup wires `aria-errormessage`. On every blur and submit pass — plus on `input` once a field has errored at least once — the validator sets `aria-invalid="true"` when invalid and `aria-invalid="false"` when valid; a pristine, never-validated field carries no attribute (three-state: absent / `false` / `true`, where `false` is a DOM-observable touched-and-valid signal the post-error `input` revalidation reads off the element). Where the field has native HTML constraints the native `ValidityState` (`element.validity.valid`) is the source of truth, so the attribute never disagrees with the `:user-invalid` styling that already drives the visible error. When the field already references an error element via `aria-errormessage`, the validator does NOT inject its `form-item-error-message` div (no duplicate message) — setting `aria-invalid` is enough to expose the existing element; legacy forms with no association keep the injected div and additionally gain an `aria-errormessage` wire to it. On a failed submit, focus moves to the first invalid field; blur-time errors (focus already gone) are announced through a dedicated visually-hidden `aria-live="polite"` status region rather than the static message, since a CSS `:user-invalid` display toggle is not reliably announced — suppressed for any field that simultaneously receives focus to avoid double-speaking. No new public API; existing `form-item-error` / `form-item-warning` / `form-item-error-message` / `error-message` / `data-gina-form-errors` classes and the submit-button `aria-disabled` / `disabled` toggling are unchanged. Acceptance: VoiceOver + NVDA announce the invalid field and its `aria-errormessage` text on a failed blur and submit, and stop once corrected; no visual regression on forms already using `form-item-error` / `error-message`. First consumer: freelancer-app-v3 public contact form. | `0.4.2-alpha` | Q3 2026 |
+| ✅ | **`aria-invalid` validity reflection (#A11Y1)** — `FormValidator` keeps `aria-invalid` in sync with each managed field's effective validity, so a field's `aria-errormessage` (and error `aria-describedby`) association is actually exposed to assistive technology. Per WAI-ARIA those associations are inert unless the field also carries `aria-invalid="true"`, so today screen-reader users are never told which field is invalid or what the error says even when the markup wires `aria-errormessage`. On every blur and submit pass — plus on `input` once a field has errored at least once — the validator sets `aria-invalid="true"` when invalid and `aria-invalid="false"` when valid; a pristine, never-validated field carries no attribute (three-state: absent / `false` / `true`, where `false` is a DOM-observable touched-and-valid signal the post-error `input` revalidation reads off the element). Where the field has native HTML constraints the native `ValidityState` (`element.validity.valid`) is the source of truth, so the attribute never disagrees with the `:user-invalid` styling that already drives the visible error. When the field already references an error element via `aria-errormessage`, the validator does NOT inject its `form-item-error-message` div (no duplicate message) — setting `aria-invalid` is enough to expose the existing element; legacy forms with no association keep the injected div and additionally gain an `aria-errormessage` wire to it. On a failed submit, focus moves to the first invalid field; blur-time errors (focus already gone) are announced through a dedicated visually-hidden `aria-live="polite"` status region rather than the static message, since a CSS `:user-invalid` display toggle is not reliably announced — suppressed for any field that simultaneously receives focus to avoid double-speaking. No new public API; existing `form-item-error` / `form-item-warning` / `form-item-error-message` / `error-message` / `data-gina-form-errors` classes and the submit-button `aria-disabled` / `disabled` toggling are unchanged. Acceptance: VoiceOver + NVDA announce the invalid field and its `aria-errormessage` text on a failed blur and submit, and stop once corrected; no visual regression on forms already using `form-item-error` / `error-message`. Blur/`input`-time passes apply to forms that opt into `data-gina-form-live-check-enabled`; the always-on submit pass covers `aria-invalid` + first-invalid focus regardless. | `0.4.3-alpha.2` | 2026-06-03 |
 
 ---
 
@@ -369,10 +369,10 @@ Gina's built-in per-bundle inspector. Phases 1–2 ship as an embedded SPA at `/
 
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
-| 🔨 | **`services/src/inspector/` standalone bundle** — ~~Rename `services/src/toolbar/` to `services/src/inspector/`~~ (done). Inspector SPA as a standalone gina bundle on port 4101. Connects to bundles via authenticated WebSocket. The embedded SPA at `/_gina/inspector/` remains for quick dev-mode access. | `0.5.0` | Q1 2027 |
+| ✅ | **`services/src/inspector/` standalone bundle** — ~~Rename `services/src/toolbar/` to `services/src/inspector/`~~ (done). **Authenticated WebSocket transport shipped** (`0.4.3-alpha`): the standalone Inspector connects to a bundle's `/_gina/agent` over a WebSocket (`?transport=ws`) as well as SSE — key-authenticated outside dev mode, with an optional `inspector.agent.allowedOrigins` Origin allowlist; it falls back to SSE automatically if the socket can't open. The embedded SPA at `/_gina/inspector/` remains for quick dev-mode access. **Dev auto-start shipped** (`0.4.3-alpha`): a `gina service:start` command plus a dev-only `gna.js server.on('started')` hook auto-start the standalone Inspector via the daemon-free `gina-container` launcher (gated on dev mode + not-already-running; local-only — no-ops in a fresh install since `services/` ships in neither git nor npm). | `0.5.0` | 2026-06-02 |
 | ✅ | **Agent endpoint — dev-mode SSE (`/_gina/agent`)** — Combined data + log SSE stream. CORS, server.js + server.isaac.js (HTTP/2), Inspector SPA `tryAgent()` with `?target=` param. Named events (`event: data`, `event: log`). Manual connect form on "No source" overlay. | `0.3.0` | 2026-04-05 |
-| 🔨 | **Agent endpoint — production auth** — **Authenticated `/_gina/agent` + production-safe toggle shipped via the existing SSE transport** (opt-in `inspector.agent.enabled` + key in `settings.json`, constant-time compare, `${secret:KEY}`-capable; key via the `x-gina-inspector-key` header or a `?key=` query param; dev stays open + keyless). Authenticates remote server-log streaming outside dev mode. Remaining: WebSocket transport (deferred — only needed for bidirectional commands). | `0.5.0` | Q1 2027 |
-| 🔨 | **Toggleable instrumentation** — Runtime toggle for query + flow instrumentation independent of `NODE_ENV_IS_DEV`: a time-boxed, key-authenticated window (`POST /_gina/instrument`) runs capture in production over the authenticated `/_gina/agent` SSE, without full dev mode. Opt-in via `inspector.instrumentation`; 3600s hard cap with auto-revert. **v1 shipped 2026-05-26** (JSON/XHR + cross-bundle egress). Remaining: server-rendered HTML-page-render egress (follow-up). | `0.5.0` | Q1 2027 |
+| ✅ | **Agent endpoint — production auth** — **Authenticated `/_gina/agent` + production-safe toggle shipped via the existing SSE transport** (opt-in `inspector.agent.enabled` + key in `settings.json`, constant-time compare, `${secret:KEY}`-capable; key via the `x-gina-inspector-key` header or a `?key=` query param; dev stays open + keyless). Authenticates remote server-log streaming outside dev mode. **WebSocket transport completed** (`0.4.3-alpha`): the standalone Inspector now connects over the #INS8 WebSocket by default (`?transport=sse` forces SSE) with automatic SSE fallback; auth + prod-toggle contract unchanged. | `0.5.0` | 2026-06-02 |
+| ✅ | **Toggleable instrumentation** — Runtime toggle for query + flow instrumentation independent of `NODE_ENV_IS_DEV`: a time-boxed, key-authenticated window (`POST /_gina/instrument`) runs capture in production over the authenticated `/_gina/agent` channel, without full dev mode. Opt-in via `inspector.instrumentation`; 3600s hard cap with auto-revert. **v1 shipped 2026-05-26** (JSON/XHR + cross-bundle egress); the server-rendered HTML-page-render egress follow-up also shipped 2026-05-26 (a separate HTML-free emit path wired per render delegate). | `0.5.0` | 2026-05-26 |
 | 📋 | **Multi-bundle dashboard** — Discover all running bundles via `ports.json`, connect to each agent. Full-stack request tracing across bundle boundaries. | post-1.0.0 | — |
 | 📋 | **Browser extension companion** — Chrome/Firefox DevTools panel. Thin UI shell connecting to the standalone Inspector via WebSocket. Optional — not a replacement. | post-1.0.0 | — |
 

package/framework/v0.4.3/VERSION

@@ -0,0 +1 @@
+0.4.3

package/framework/{v0.4.2 → v0.4.3}/core/asset/plugin/dist/vendor/gina/inspector/inspector.js

@@ -3751,6 +3751,8 @@
      * @returns {boolean} `true` if a `target` param was found and connection initiated
      */
     function tryAgent() {
+        // #INS8 — if the WebSocket transport already claimed the channel, no-op.
+        if (source === 'agent') return true;
         if (typeof EventSource === 'undefined') return false;
 
         var params = new URLSearchParams(window.location.search);
@@ -3844,6 +3846,127 @@
         return true;
     }
 
+
+    // ── WebSocket /_gina/agent transport (#INS8) ─────────────────────────
+
+    /**
+     * #INS8/#INS9b — WebSocket variant of {@link tryAgent}, the DEFAULT agent
+     * transport (since #INS9b). Runs whenever the Inspector is opened with a
+     * `?target=<bundle_url>` unless `?transport=sse` forces SSE.
+     * Connects to `{target}/_gina/agent` over a WebSocket, parsing the same
+     * `{event, data}` envelopes the SSE channel emits. Threads the optional
+     * `?key=` on the WS URL (browsers cannot set WebSocket handshake headers,
+     * same constraint as EventSource). Falls back to SSE ({@link tryAgent}) once
+     * if the socket never opens (e.g. an HTTP/2-only target that cannot upgrade).
+     *
+     * @inner
+     * @returns {boolean} `true` if a `target` param was found and a socket was opened
+     */
+    function tryAgentWS() {
+        if (typeof WebSocket === 'undefined') return false;
+
+        var params = new URLSearchParams(window.location.search);
+        var target = params.get('target');
+        if (!target) return false;
+
+        // Normalise: strip trailing slash, switch scheme to ws/wss.
+        target = target.replace(/\/+$/, '');
+        var wsUrl = target.replace(/^http/i, 'ws') + '/_gina/agent';
+
+        var agentKey = params.get('key');
+        if (agentKey) {
+            wsUrl += '?key=' + encodeURIComponent(agentKey);
+        }
+
+        qs('#bm-dot').className = 'bm-dot warn';
+        qs('#bm-label').textContent = 'Connecting…';
+
+        var _opened = false, _fellBack = false;
+
+        try {
+            var ws = new WebSocket(wsUrl);
+            // Claim the channel only after the socket is constructed, so a
+            // constructor throw leaves source unset and tryAgent() opens SSE.
+            source = 'agent';
+
+            ws.onopen = function () {
+                _opened = true;
+                qs('#bm-dot').className = 'bm-dot ok';
+            };
+
+            ws.onmessage = function (ev) {
+                try {
+                    var frame = JSON.parse(ev.data);
+                    if (!frame || !frame.event) return;
+                    if (frame.event === 'data') {
+                        var gd = frame.data;
+                        if (!gd) return;
+                        var str = JSON.stringify(gd);
+                        if (str === lastGdStr) return;
+                        showLoader();
+                        lastGdStr = str;
+                        ginaData = gd;
+                        var env = (gd.user && gd.user.environment) || {};
+                        qs('#bm-label').textContent = (env.bundle || '?') + '@' + (env.env || '?');
+                        qs('#bm-dot').className = 'bm-dot ok';
+                        document.title = 'Inspector — ' + (env.bundle || '?') + '@' + (env.env || '?');
+                        qs('#bm-no-source').classList.add('hidden');
+                        renderEnvironmentInfo();
+                        updateRevealVisibility();
+                        var tab = activeTab();
+                        if (tab !== 'logs') renderTab(tab);
+                        if (tab !== 'query') {
+                            var _u = gd.user || {};
+                            var _hasXhr = typeof _u['data-xhr'] !== 'undefined';
+                            var _qd = _hasXhr && _u['data-xhr'] && _u['data-xhr'].queries
+                                ? _u['data-xhr'].queries : _u.queries;
+                            updateQueryToolbar(_qd || null);
+                        }
+                        if (tab !== 'view') {
+                            var _u2 = gd.user || {};
+                            var _isXhr2 = typeof _u2['view-xhr'] !== 'undefined';
+                            var _vm = getPageMetrics(_isXhr2);
+                            var _dxhr = typeof _u2['data-xhr'] !== 'undefined';
+                            var _vq = _dxhr && _u2['data-xhr'] && _u2['data-xhr'].queries
+                                ? _u2['data-xhr'].queries : _u2.queries;
+                            updateViewDot(checkPerfAnomalies(_vm, _vq || []));
+                        }
+                        hideLoader();
+                    } else if (frame.event === 'log') {
+                        if (paused) return;
+                        var entry = frame.data;
+                        if (!entry) return;
+                        entry._id = ++_logIdCounter;
+                        logs.push(entry);
+                        if (logs.length > MAX_LOG_ENTRIES) logs.shift();
+                        updateLogDot([entry]);
+                        scheduleRender();
+                    }
+                } catch (e) {}
+            };
+
+            ws.onerror = function () {
+                qs('#bm-dot').className = 'bm-dot warn';
+            };
+
+            ws.onclose = function () {
+                qs('#bm-dot').className = 'bm-dot warn';
+                // If the socket never opened, fall back to SSE once so the
+                // Inspector still connects (e.g. an HTTP/2-only target whose
+                // server cannot upgrade a WebSocket).
+                if (!_opened && !_fellBack && source === 'agent') {
+                    _fellBack = true;
+                    source = null;
+                    tryAgent();
+                }
+            };
+        } catch (e) {
+            return false;
+        }
+
+        return true;
+    }
+
     // ── Passive /_gina/agent subscription (opener mode) ──────────────────
 
     /**
@@ -4898,6 +5021,16 @@
         // Agent mode (?target= param) is the highest-priority source — it
         // provides both data and logs via a single SSE stream.  When active,
         // opener/localStorage polling and tryServerLogs() are unnecessary.
+        // #INS9b — WebSocket is the DEFAULT agent transport; SSE is the automatic
+        // fallback (tryAgentWS() falls back to tryAgent() on a failed open, and
+        // only acts when a ?target= is present). ?transport=sse forces SSE. On a
+        // successful handshake tryAgentWS() claims source='agent', so the
+        // tryAgent() call below short-circuits to a no-op.
+        var _agentTransport = (typeof URLSearchParams !== 'undefined')
+            ? new URLSearchParams(window.location.search).get('transport') : null;
+        if (_agentTransport !== 'sse') {
+            tryAgentWS();
+        }
         var isAgent = tryAgent();
 
         if (!isAgent) {

package/framework/{v0.4.2 → v0.4.3}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -9017,7 +9017,6 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
                 , url               = null
                 , elId              = null
                 , onEvent           = null
-                , onclickAttribute  = null
                 // a
                 , $a                = $target.getElementsByTagName('a')
                 // buttons
@@ -9062,20 +9061,12 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
                 evt         = elId;
                 $el.setAttribute('id', evt);
 
-                if ($el.tagName == 'A') {
-                    onclickAttribute = $el.getAttribute('onclick');
-                }
-
-                if ( !onclickAttribute ) {
-                    $el.setAttribute('onclick', 'return false;')
-                } else if ( typeof(onclickAttribute) != 'undefined' && !/return false/.test(onclickAttribute) ) {
-                    if ( /\;$/.test(onclickAttribute) ) {
-                        onclickAttribute += 'return false;'
-                    } else {
-                        onclickAttribute += '; return false;'
-                    }
-                    $el.setAttribute('onclick', onclickAttribute);
-                }
+                // [CSP] Suppress the link's default action via a click listener instead of an
+                // inline onclick="return false;" attribute — the inline handler tripped CSP
+                // script-src-attr under nonce-based policies. preventDefault (NOT cancelEvent —
+                // its stopPropagation would block the document-level delegation that fires the
+                // AJAX request) covers direct AND child clicks while leaving the delegation intact.
+                addListener(gina, $el, 'click', function(e) { e.preventDefault(); });
 
                 $newLink = null;
 
@@ -10149,9 +10140,43 @@ function ValidatorPlugin(rules, data, formId) {
         }
     }
 
+    /**
+     * #A11Y1 (slice 4) — lazily create one visually-hidden aria-live="polite" status region per
+     * form and announce a blur-time committed error through it. A CSS :user-invalid display toggle
+     * is not reliably announced by screen readers, and on blur the field has lost focus so its own
+     * aria-invalid / aria-errormessage are not re-read; the polite region decouples the announcement
+     * from visual display. Submit-time errors use focus (see onValidate), not this region.
+     * @param {object} $form - the HTMLFormElement the region belongs to
+     * @param {string} text - the error text to announce
+     * @returns {object|null} the live-region element, or null when nothing was announced
+     */
+    var announceA11yError = function($form, text) {
+        if ( !$form || !text ) return null;
+        var _fid    = ( typeof($form.id) != 'undefined' && $form.id ) ? $form.id : ( $form.getAttribute('id') || 'form' );
+        var _liveId = 'gina-aria-live-' + _fid;
+        var _live   = document.getElementById(_liveId);
+        if ( !_live ) {
+            _live = document.createElement('div');
+            _live.id = _liveId;
+            _live.setAttribute('role', 'status');
+            _live.setAttribute('aria-live', 'polite');
+            _live.setAttribute('aria-atomic', 'true');
+            _live.className = 'gina-visually-hidden';
+            _live.style.cssText = 'position:absolute;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap;border:0;';
+            $form.appendChild(_live);
+        }
+        _live.textContent = text;
+        return _live;
+    };
+
     /**
      * handleErrorsDisplay
      * Attention: if you are going to handle errors display by hand, set data to `null` to prevent Toolbar refresh with empty data
+     *
+     * #A11Y1 — besides toggling `form-item-error` / `form-item-warning` and the error-message div,
+     * this reflects each managed field's committed validity into `aria-invalid` ("true" on a
+     * committed error, "false" when valid — mirroring the native ValidityState where the field has
+     * native HTML constraints so it agrees with `:user-invalid`). Soft live-check warnings are not asserted.
      * @param {object} $form - Target (HTMLFormElement)
      * @param {object} errors
      * @param {object|null} data
@@ -10282,6 +10307,14 @@ function ValidatorPlugin(rules, data, formId) {
 
             if (!name) continue;
 
+            // #A11Y1 (slice 2) — detect a consumer-provided aria-errormessage association. When
+            // present, the field already references its own error element, so we must NOT inject a
+            // competing form-item-error-message div (aria-invalid alone exposes it). Any wire we add
+            // ourselves is marked (data-gina-aria-errormessage) so it is not mistaken for a consumer's.
+            var _ariaErrId         = $el.getAttribute('aria-errormessage');
+            var _ginaOwnsErrMsg    = ( typeof($el.dataset) != 'undefined' && typeof($el.dataset.ginaAriaErrormessage) != 'undefined' ) ? true : false;
+            var _hasConsumerErrMsg = ( _ariaErrId && !_ginaOwnsErrMsg ) ? true : false;
+
             if (
                 errors
                 && typeof(errors[name]) != 'undefined'
@@ -10304,6 +10337,14 @@ function ValidatorPlugin(rules, data, formId) {
                     $err.className = 'form-item-error-message';
                 }
 
+                // #A11Y1 — reflect a committed invalid state into aria-invalid so any
+                // aria-errormessage association on the field is exposed to assistive tech.
+                // Soft (live-check) warnings while the field is still being edited are not
+                // asserted — only committed errors (blur/submit) are.
+                if ( !isWarning && $el.type != 'hidden' ) {
+                    $el.setAttribute('aria-invalid', 'true');
+                }
+
                 // injecting error messages
                 for (var e in errors[name]) {
 
@@ -10322,10 +10363,31 @@ function ValidatorPlugin(rules, data, formId) {
                     }
                 }
 
-                if ($target.type != 'hidden')
+                // #A11Y1 (slice 2) — skip the injected message div when the field already references
+                // a consumer-provided error element; otherwise inject it and wire aria-errormessage
+                // to it so assistive tech can resolve the message text.
+                if ($target.type != 'hidden' && !_hasConsumerErrMsg) {
+                    if ( !$el.getAttribute('aria-errormessage') || _ginaOwnsErrMsg ) {
+                        $err.id = ('gina-errormessage-' + (id || 'form') + '-' + (name || 'field')).replace(/[^a-zA-Z0-9_-]+/g, '-');
+                        $el.setAttribute('aria-errormessage', $err.id);
+                        if ( typeof($el.dataset) != 'undefined' ) {
+                            $el.dataset.ginaAriaErrormessage = 'true';
+                        }
+                    }
                     insertAfter($target, $err);
+                }
 
-
+                // #A11Y1 (slice 4) — announce a blur-time committed error through the form's polite
+                // live region (submit-time errors use focus instead). Only on the per-field/blur path
+                // (fieldName set) and only once focus has left the field; soft warnings are skipped.
+                if (
+                    !isWarning
+                    && typeof(fieldName) != 'undefined'
+                    && $err
+                    && $el !== document.activeElement
+                ) {
+                    announceA11yError($form, $err.textContent);
+                }
 
             } else if (
                 errors
@@ -10358,6 +10420,21 @@ function ValidatorPlugin(rules, data, formId) {
 
                 $parent.className = $parent.className.replace(/(\s+form\-item\-error|form\-item\-error|\s+form\-item\-warning|form\-item\-warning)/, '');
 
+                // #A11Y1 — field is valid per Gina; mirror the native ValidityState (where the
+                // field has native HTML constraints) so aria-invalid never disagrees with the
+                // :user-invalid styling already shown. Explicit "false" is a touched-and-valid signal.
+                if ( $el.type != 'hidden' ) {
+                    var _a11yNativeInvalid = ( $el.willValidate && $el.validity && !$el.validity.valid ) ? true : false;
+                    $el.setAttribute('aria-invalid', _a11yNativeInvalid ? 'true' : 'false');
+                }
+
+                // #A11Y1 (slice 2) — the referenced div was just removed; drop the aria-errormessage
+                // wire we own (a consumer-provided association, lacking our marker, is left intact).
+                if ( typeof($el.dataset) != 'undefined' && typeof($el.dataset.ginaAriaErrormessage) != 'undefined' ) {
+                    $el.removeAttribute('aria-errormessage');
+                    delete $el.dataset.ginaAriaErrormessage;
+                }
+
             } else if (
                 errors.count() > 0
                 && typeof(errors[name]) != 'undefined'
@@ -10378,6 +10455,11 @@ function ValidatorPlugin(rules, data, formId) {
                         $err = document.createElement('div');
                         $err.setAttribute('class', 'form-item-error-message');
 
+                        // #A11Y1 (slice 2) — preserve the aria-errormessage wire we own across refresh.
+                        if ( _ginaOwnsErrMsg && _ariaErrId ) {
+                            $err.id = _ariaErrId;
+                        }
+
                         // Fixed on 2025-03-09: className cleanup
                         if (
                             !isWarning
@@ -10410,9 +10492,14 @@ function ValidatorPlugin(rules, data, formId) {
                     }
                 }
 
-                if ($err && $target.type != 'hidden') {
+                if ($err && $target.type != 'hidden' && !_hasConsumerErrMsg) {
                     insertAfter($target, $err);
                 }
+
+                // #A11Y1 — the committed error persists on refresh; keep aria-invalid asserted.
+                if ( !isWarning && $el.type != 'hidden' ) {
+                    $el.setAttribute('aria-invalid', 'true');
+                }
             }
 
             if (
@@ -15577,6 +15664,28 @@ function ValidatorPlugin(rules, data, formId) {
                     } else if ($form) { // just in case the form is being destroyed
                         $form.send(result['data']);
                     }
+                } else {
+                    // #A11Y1 (slice 3) — failed submit: move focus to the first invalid field so
+                    // assistive tech announces it (accessible name + aria-invalid + the
+                    // aria-errormessage text). DOM order; hidden / unfocusable fields are skipped.
+                    var _a11yErrs = result['fields'] || result['error'];
+                    if ( _a11yErrs ) {
+                        var $a11yForm = event['target'];
+                        for (var _ai = 0, _aLen = $a11yForm.length; _ai < _aLen; ++_ai) {
+                            var _aField = $a11yForm[_ai];
+                            var _aName  = _aField.getAttribute('name');
+                            if (
+                                _aName
+                                && typeof(_a11yErrs[_aName]) != 'undefined'
+                                && ( typeof(_a11yErrs[_aName].count) != 'function' || _a11yErrs[_aName].count() > 0 )
+                                && _aField.type != 'hidden'
+                                && typeof(_aField.focus) == 'function'
+                            ) {
+                                _aField.focus();
+                                break;
+                            }
+                        }
+                    }
                 }
             })
         }
@@ -15744,14 +15853,15 @@ function ValidatorPlugin(rules, data, formId) {
                 isSubmitType        = $submit.getAttribute('data-gina-form-submit');
 
                 if ( !onclickAttribute && !isSubmitType) {
-                    $submit.setAttribute('onclick', 'return false;')
-                } else if ( !/return false/i.test(onclickAttribute) && !isSubmitType) {
-                    if ( /\;$/.test(onclickAttribute) ) {
-                        onclickAttribute += 'return false;'
-                    } else {
-                        onclickAttribute += '; return false;'
-                    }
+                    // [CSP] Suppress the default action via a click listener instead of an inline
+                    // onclick="return false;" attribute (tripped CSP script-src-attr under nonce
+                    // policies). A preventDefault-only listener sets event.defaultPrevented exactly
+                    // as the inline handler did, so the form-level clickProxyHandler's
+                    // `if (event.defaultPrevented) return` guard still short-circuits identically.
+                    addListener(gina, $submit, 'click', function(e) { e.preventDefault(); });
                 }
+                // (an existing onclick is left untouched, as before; the dead else-if append
+                //  branch — it only mutated a local, never written back — was removed.)
             }
 
             if (!$submit['id']) {
@@ -17762,23 +17872,16 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                 }
             }
 
-            var onclickAttribute = null, evt = null;
+            var evt = null;
             // close events
+            // NB.: the close element's default action (e.g. an `<a href="#">` navigation) is already
+            //      suppressed by register('close', …) below — the click listener it attaches calls
+            //      cancelEvent() (preventDefault/stopPropagation) on every click. The previous inline
+            //      onclick="return false;" injection here was redundant with that listener AND tripped
+            //      CSP script-src-attr under nonce-based policies (a nonce in script-src disables
+            //      'unsafe-inline' for inline event-handler attributes), so it has been removed.
             b = 0; len = $close.length;
             for (; b < len; ++b) {
-                if ($close[b].tagName == 'A') {
-                    onclickAttribute = $close[b].getAttribute('onclick');
-                }
-
-                if ( !onclickAttribute ) {
-                    $close[b].setAttribute('onclick', 'return false;')
-                } else if ( typeof(onclickAttribute) != 'undefined' && !/return false/.test(onclickAttribute) ) {
-                    if ( /\;$/.test(onclickAttribute) ) {
-                        onclickAttribute += 'return false;'
-                    } else {
-                        onclickAttribute += '; return false;'
-                    }
-                }
 
                 if (!$close[b]['id']) {