gina 0.4.2 → 0.4.3

package/framework/v0.4.3/lib/cmd/service/start.js

@@ -0,0 +1,219 @@
+var fs      = require('fs');
+var path    = require('path');
+var spawn   = require('child_process').spawn;
+var console = lib.logger;
+var fmt     = lib.cmdStatusFormat;
+
+var CmdHelper = require('./../helper');
+
+/**
+ * @module gina/lib/cmd/service/start
+ */
+/**
+ * Starts a framework-internal service — a bundle registered under the @gina
+ * project (today: `inspector`, `proxy`). The service is launched via the
+ * daemon-free `bin/gina-container` foreground launcher spawned detached, so no
+ * `gina start` socket server (port 8124) is required. The service is started in
+ * the @gina project's own `dev`/`local` defaults (the current shell's
+ * `NODE_ENV`/`NODE_SCOPE` are deliberately NOT propagated — these are maintainer
+ * tools that only ship a `src/` form; use `bundle:start` for env/scope control).
+ *
+ * Guards (no-op rather than error where it is safe to):
+ *  - unknown service name / @gina not registered / src missing  → error, exit 1
+ *  - service already running (live pidfile)                     → no-op, exit 0
+ *
+ * `services/` is gitignored + npmignored, so in a fresh `npm install gina` the
+ * @gina project and the service src are absent and this command reports the
+ * missing src rather than starting anything — it only does real work for a
+ * maintainer who scaffolded the framework `services/` project.
+ *
+ * Usage:
+ *  gina service:start inspector
+ *  gina service:start inspector @gina
+ *  gina service:start inspector --dry-run
+ *  gina service:start inspector --format=json
+ *
+ * @class Start
+ * @constructor
+ * @param {object} opt - Parsed command-line options
+ * @param {object} opt.client - Socket client for terminal output
+ * @param {string[]} opt.argv - Full argv array
+ * @param {number} [opt.debugPort] - Node.js inspector port
+ * @param {boolean} [opt.debugBrkEnabled] - True when --inspect-brk is active
+ * @param {object} cmd - The cmd dispatcher object (lib/cmd/index.js)
+ *
+ * @example
+ *  // Start the Inspector standalone bundle (dev tooling):
+ *  //   $ gina service:start inspector
+ *  //   [ service:start ] starting inspector@gina ...
+ *  //
+ *  // Already running → no-op:
+ *  //   $ gina service:start inspector
+ *  //   [ service:start ] inspector@gina is already running (pid 12345)
+ */
+function Start(opt, cmd) {
+    var self = { format: null, dryRun: false, service: null };
+
+    /**
+     * Parse argv, resolve the @gina manifest, guard on src-existence and
+     * running-state, then spawn `gina-container <service> @gina` detached.
+     *
+     * @inner
+     * @private
+     */
+    var init = function () {
+
+        // import CMD helpers
+        new CmdHelper(self, opt.client, { port: opt.debugPort, brkEnabled: opt.debugBrkEnabled });
+
+        // check CMD configuration
+        if ( !isCmdConfigured() ) return false;
+
+        for (var i = 3, len = process.argv.length; i < len; i++) {
+            var arg = process.argv[i];
+            if ( /^\-\-format\=/.test(arg) ) {
+                self.format = arg.split(/\=/)[1];
+            } else if ( /^\-\-dry\-run$/.test(arg) ) {
+                self.dryRun = true;
+            } else if ( /^@/.test(arg) ) {
+                // Accept `@gina` as an explicit but redundant target; reject any
+                // other project — user-defined services are not a surface yet.
+                var pname = arg.replace(/^@/, '');
+                if (pname !== 'gina') {
+                    console.error('`service:start` only targets @gina for now. Got: '+ arg);
+                    process.exit(1);
+                    return;
+                }
+            } else if ( !/^\-/.test(arg) && !self.service ) {
+                self.service = arg;
+            }
+        }
+
+        if ( !self.service ) {
+            console.error('Usage: gina service:start <service> [@gina] [--dry-run] [--format=json]');
+            process.exit(1);
+            return;
+        }
+
+        self.projects = require(_(GINA_HOMEDIR + '/projects.json'));
+        var ginaProject = self.projects['gina'];
+        if ( typeof(ginaProject) == 'undefined' || ginaProject == null ) {
+            console.error('@gina project is not registered. Run `services/configure` from the gina framework directory.');
+            process.exit(1);
+            return;
+        }
+
+        var manifestPath = _(ginaProject.path + '/manifest.json');
+        if ( !fs.existsSync(manifestPath) ) {
+            console.error('@gina manifest.json not found at '+ manifestPath);
+            process.exit(1);
+            return;
+        }
+
+        var manifest;
+        try {
+            manifest = requireJSON(manifestPath);
+        } catch (err) {
+            console.error('Could not parse @gina manifest.json: '+ err.message);
+            process.exit(1);
+            return;
+        }
+
+        var services = manifest.bundles || {};
+        if ( typeof(services[self.service]) == 'undefined' ) {
+            var available = Object.keys(services).sort().join(', ') || '(none)';
+            console.error('Unknown @gina service: '+ self.service +'. Available: '+ available);
+            process.exit(1);
+            return;
+        }
+
+        var src       = services[self.service].src || '';
+        var srcExists = src && fs.existsSync(_(ginaProject.path + '/' + src));
+        if ( !srcExists ) {
+            console.error('@gina service `'+ self.service +'` src not found at '+ _(ginaProject.path + '/' + (src || '<unset>')) +' — nothing to start.');
+            process.exit(1);
+            return;
+        }
+
+        // Already-running guard — a live pidfile means a no-op (success).
+        var runState = fmt.readPidfile(GINA_HOMEDIR + '/run', self.service, 'gina');
+        if ( runState.running ) {
+            if ( /^json?/.test(self.format) ) {
+                process.stdout.write(JSON.stringify({
+                    service: self.service, src: src, started: false,
+                    running: true, pid: runState.pid, reason: 'already-running'
+                }));
+            } else {
+                console.log('[ service:start ] '+ self.service +'@gina is already running (pid '+ runState.pid +')');
+            }
+            process.exit(0);
+            return;
+        }
+
+        // Resolve the daemon-free launcher. GINA_DIR is the gina root (set by
+        // bin/cli / gina-container); fall back to deriving it from __dirname
+        // (lib/cmd/service → up five → gina root).
+        var ginaDir   = getEnvVar('GINA_DIR') || path.resolve(__dirname, '../../../../../');
+        var container = ginaDir + '/bin/gina-container';
+        if ( !fs.existsSync(container) ) {
+            console.error('gina-container launcher not found at '+ container);
+            process.exit(1);
+            return;
+        }
+
+        if ( self.dryRun ) {
+            var preview = process.execPath +' '+ container +' '+ self.service +' @gina';
+            if ( /^json?/.test(self.format) ) {
+                process.stdout.write(JSON.stringify({
+                    service: self.service, src: src, started: false,
+                    running: false, dryRun: true, command: preview
+                }));
+            } else {
+                console.log('[ service:start ] (dry-run) would spawn: '+ preview);
+            }
+            process.exit(0);
+            return;
+        }
+
+        // Spawn detached so the service outlives this short-lived CLI process.
+        // Scrub the current shell's bundle-identity vars so gina-container
+        // resolves inspector@gina from @gina's own def_env/def_scope (dev/local)
+        // and its own port — never the caller's env/scope/port. GINA_* (homedir,
+        // dir, version) are kept so it targets the same ~/.gina. Keep this spawn
+        // shape in sync with the gna.js server.on('started') dev auto-start hook.
+        var childEnv = Object.assign({}, process.env);
+        delete childEnv.NODE_ENV;
+        delete childEnv.NODE_SCOPE;
+        delete childEnv.NODE_PORT;
+        delete childEnv.NODE_BUNDLE;
+        delete childEnv.NODE_PROJECT;
+
+        var child;
+        try {
+            child = spawn(process.execPath, [container, self.service, '@gina'], {
+                detached: true,
+                stdio: 'ignore',
+                env: childEnv
+            });
+            child.unref();
+        } catch (spawnErr) {
+            console.error('[ service:start ] failed to spawn '+ self.service +'@gina: '+ (spawnErr.message || spawnErr));
+            process.exit(1);
+            return;
+        }
+
+        if ( /^json?/.test(self.format) ) {
+            process.stdout.write(JSON.stringify({
+                service: self.service, src: src, started: true,
+                running: false, pid: (child && child.pid) || null
+            }));
+        } else {
+            console.log('[ service:start ] starting '+ self.service +'@gina ... (pid '+ ((child && child.pid) || '?') +')');
+        }
+        process.exit(0);
+    };
+
+    init();
+}
+
+module.exports = Start;

package/framework/v0.4.3/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "gina-framework",
+  "version": "0.4.3-alpha.2",
+  "dependencies": {
+    "@rhinostone/swig": "^2.6.0",
+    "intl-messageformat": "^11.2.4",
+    "psl": "^1.15.0",
+    "ws": "^8.20.1"
+  }
+}

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.4.2/core/gna');
+var _gna = require('./framework/v0.4.3/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.4.2/core/controller');
-var EntitySuper     = require('./framework/v0.4.2/core/model/entity');
+var SuperController = require('./framework/v0.4.3/core/controller');
+var EntitySuper     = require('./framework/v0.4.3/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.4.2/lib/uuid');
+var uuid = require('./framework/v0.4.3/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -51,7 +51,7 @@ framework/v${version}/
 
 ### Swig — `@rhinostone/swig` (npm dependency)
 
-Maintained fork of the abandoned swig 1.4.2 template engine. Published to npm as `@rhinostone/swig@2.5.1` (npm org: `rhinostone`, maintainer: `beemaster`). Repo: `https://github.com/gina-io/swig`. Declared in `framework/v*/package.json` — installed via `npm install` inside the framework directory. Requires `npm install` after clone, merge, or worktree switch (the framework `node_modules/` is gitignored).
+Maintained fork of the abandoned swig 1.4.2 template engine. Published to npm as `@rhinostone/swig@2.6.0` (npm org: `rhinostone`, maintainer: `beemaster`). Repo: `https://github.com/gina-io/swig`. Declared in `framework/v*/package.json` — installed via `npm install` inside the framework directory. Requires `npm install` after clone, merge, or worktree switch (the framework `node_modules/` is gitignored).
 
 Previously vendored at `core/deps/swig-1.4.2/` — removed in the migration to the npm dep. CVE-2023-25345 parse-time blocklist (`__proto__`/`constructor`/`prototype`) is patched in the fork's `parser.js` and `tags/set.js`. The path traversal boundary check in `controller.render-swig.js` is Gina's own code and is unaffected by this migration.
 
@@ -939,3 +939,11 @@ Dev-mode query instrumentation captures every database query tied to the current
 145. **`bin/gina-container` (the daemonless Docker/K8s launcher) defines only a SUBSET of the `GINA_*` globals the daemon defines, so a BARE `GINA_*` read in the request/render path throws `ReferenceError` (HTTP 500) on every view render under it — read injected globals via `getEnvVar('NAME') || <fallback>`, never as a bare identifier.** A bundle child's bare-global namespace is exactly the keys of `ctxObj.envVars` (`gna.js` `defineDefault(envVars)` → `helpers/context.js` `define()` → `Object.defineProperty(global, NAME)`); a name absent from `envVars` is never declared, so a bare read throws while `getEnvVar('NAME')` returns `undefined` safely. The normal `bundle:start` path (`bin/cli` → `framework:init` + `framework/start.js`) seeds ~36 keys incl. `GINA_PID` and `GINA_CULTURE`/`GINA_CULTURES`/…; `gina-container` is daemonless (no socket server, no `framework:init`) and defines only the ~20 it explicitly `setEnvVar`s, omitting `GINA_PID`, `GINA_CULTURE`, et al. Two bare reads in `setOptions`' `hasViews()` block — `controller.js` `GINA_PID` and `GINA_CULTURE` — therefore 500'd every HTML route under `gina-container` (the first masked the second); both now use `getEnvVar('GINA_PID') || String(process.pid)` and `getEnvVar('GINA_CULTURE') || 'en_CM'`, matching the safe siblings (`render-json.js`, `inspector-window-emit.js`) and the culture default (`config.js`, `init.js`). The `String(process.pid)` fallback runs in the bundle child, yielding the child's own pid — exactly what the daemon's `opt.pid` provides; JSON responses were never affected (render-json already used the guarded reader). Established 2026-06-01.
 
 146. **#H11 Alt-Svc HTTP/3-advertisement header — opt-in `server.http3Advertisement` makes `completeHeaders` (`core/server.js`) emit `Alt-Svc: h3=":443"; ma=86400` on every routed (user-facing) response, BOTH engines; advertise-only (Gina implements no QUIC).** Gate: `if (conf.server.http3Advertisement && typeof(response.getHeader)=='function' && !response.getHeader('alt-svc')) response.setHeader('alt-svc','h3=":443"; ma=86400')` — idempotent first-writer-wins (an upstream/proxy Alt-Svc is never clobbered), off by default (zero behaviour change when unset). **Why `completeHeaders`, not the #HDR8 `/_gina/*` closure-helper:** a framework header's natural home is wherever the responses it must reach are built. #HDR8's X-Powered-By lives on the Isaac `/_gina/*` `writeHead` sites because that is the ONLY place Isaac emits it (Isaac user pages carry no X-Powered-By); Alt-Svc must reach USER-facing pages (that is where browsers cache the h3-upgrade), whose builder is `completeHeaders` — and it covers BOTH engines (Isaac routed requests reach it via the engine-agnostic `composeHeadersMiddleware` drain that `gna.js` registers with `instance.use()` → `instance.completeHeaders`; the render delegates then fold `response.getHeaders()` into the HTTP/2 `stream.respond`). So one gate covers user pages on both engines; the `/_gina/*` framework endpoints (health / metrics / inspector) are NOT browser-h3-upgrade-relevant and deliberately don't carry it (avoids the 17-site `_setPoweredByHeader`-style fan-out + a parallel test pin for zero functional gain). **`:443` is the EDGE's public QUIC port, NOT gina's own listen port** — a QUIC-capable edge (Caddy / nginx-QUIC / Cloudflare) terminates HTTP/3 on :443; advertising gina's internal port (e.g. :3142) would point clients at a port gina does not serve QUIC on (a bare boolean with a fixed `:443` is therefore more correct than deriving from the bound port). Settings: `settings.json > server.http3Advertisement` (sibling of `hidePoweredBy`) + a commented boilerplate `settings.server.json` doc. Tests: `server.test.js` source-pins + a pure-logic replica (present-when-on / absent-when-off / first-writer-wins / typeof-guard). Empirically smoke-confirmed via `bin/gina-container` on a disposable starter bundle (Isaac engine, http/1.1: flag ON → `alt-svc: h3=":443"; ma=86400` on the wire, OFF → absent). Established 2026-06-02.
+
+147. **Layoutless (`renderWithoutLayout`) renders expose controller `userData` BOTH at top level AND under `page.data`; the stash-before-merge order is circular-ref-critical (shipped 0.4.2).** The swig `isWithoutLayout` branch in `controller.render-swig.js` copies each `userData` key into `data.page.data` BEFORE `data = merge(userData, data)`, so a layoutless fragment template resolves bare `{{ var }}` (top level) AND `data.X` / `page.data.X` (via `{% set data = page.data %}` — the data path popins rely on). **The copy MUST precede the merge:** `lib/merge` returns its first argument, so after `merge(userData, data)` `data === userData`; writing `data.page.data = merge(userData, data.page.data)` afterwards would make `data.page.data` alias `data` → a circular structure that throws in the layoutless XHR-data `JSON.stringify` (the `gina-without-layout-xhr-data` hidden input) → HTTP 500. 0.4.1's 'top-level variables' fix had populated ONLY the top level (locked by a negative-invariant test FORBIDDING `page.data`); 0.4.2 restored the `page.data` copy to reach parity with the nunjucks engine (which already populated both) and flipped that test to the both-contract. **Process lesson:** a patch framed as a 'regression fix' that makes a FAILING test pass is suspect — a test that FORBIDS the patched behaviour means the prior choice was deliberate + test-locked; verify the prior decision's intent and treat the test flip as a sanctioned (approval-gated) test change, not a silent restore. Backed by a real-`merge` behavioural replica + a SUBTRACT proving the stash-after-merge cycle in `render-swig.test.js`. Commit `cd690698`. Established 2026-06-02.
+
+148. **#INS8 — authenticated WebSocket transport for `/_gina/agent`, alongside the existing SSE channel (the substrate for future bidirectional Inspector features #INS11/#INS12; today still server→client push only).** One file-scope `attachInspectorAgentWs(rawServer, ctx)` in `core/server.js` attaches a single `upgrade` listener to the raw server captured at the unified `listen()` point — covering BOTH engines (the isaac instance IS the raw server; express's `app.listen()` returns it), so there is deliberately NO isaac-specific mirror; the isaac engine.io `server.on('upgrade')` handler (registered only in `ioServer`-attach mode) gains a `/_gina/agent(?:\?|$)` skip-guard so it defers to the WS handler. `ws@^8.20.1` (already transitive via engine.io; now declared in BOTH the root + `framework/v*` manifests) provides `new WebSocketServer({ noServer: true })` + `handleUpgrade`, lazy-required in try/catch so a missing `ws` disables WS and leaves SSE as the transport. **Auth = SSE parity on the upgrade socket:** gate `(dev || process.gina._inspectorAgentEnabled)`; outside dev a valid key via the SHARED `_agentKeyValid(req)` (it already parses `?key=` from `req.url` — browsers can't set WS handshake headers, same constraint that forced `?key=` for EventSource), fail-closed. Denials are RAW status lines written on the upgrade socket (`socket.write('HTTP/1.1 401/404/403 …'); socket.destroy()`) — there is no `ServerResponse` at upgrade time, so the #HDR8 `_setPoweredByHeader` wrapper does NOT apply (deliberate deviation). 404 when not-dev-and-not-enabled (endpoint invisible), 401 on bad key, 403 on Origin mismatch. **Origin allowlist** `inspector.agent.allowedOrigins` (captured to `process.gina._inspectorAgentAllowedOrigins` in `gna.js` alongside the agent key; default `[]` ⇒ allow any origin, parity with the SSE CORS `*`; enforced ONLY when non-empty — cross-origin is the norm, Inspector on :4101 → target on another port). Frames are `{event:'data'|'log', data}` JSON envelopes mirroring the SSE named-event shape; snapshot replay + the `inspector#data`/`logger#default` listener wiring reuse the dev-or-active-window gate (#INS10), cleaned up on ws close/error; inbound frames are reserved (only a `{type:'ping'}` heartbeat answered). **Client `tryAgentWS()`** (Inspector SPA `inspector.js`, the DEFAULT agent transport since #INS9b — `?target=<url>`; `?transport=sse` forces SSE): converts the scheme `http→ws` (`https→wss` preserved), threads `?key=`, parses the envelopes (same data/log apply logic as `tryAgent()`), falls back to SSE ONCE if the socket never opens (e.g. an HTTP/2-only target that can't upgrade). **Anchor-preservation trick:** the existing `var isAgent = tryAgent()` init line is UNCHANGED — `tryAgentWS()` runs before it and claims `source='agent'` only AFTER the socket constructs, so `tryAgent()` short-circuits (a new `if (source === 'agent') return true` guard) on WS success and opens SSE on a constructor throw; this kept the §39/§55 source-pins green with ZERO existing-test changes (the alternative — editing the over-specific `var isAgent = tryAgent()` literal that four pre-existing tests anchor on — would have needed the approval-gated test-change path). **Dev auto-start SHIPPED** (deferral lifted): `gina service:start <service>` (`lib/cmd/service/start.js`) starts a framework-internal `@gina` service (e.g. the standalone Inspector) via the daemon-free `bin/gina-container` launcher — spawned detached+unref'd with the caller's `NODE_ENV`/`NODE_SCOPE`/`NODE_PORT`/`NODE_BUNDLE`/`NODE_PROJECT` scrubbed so it resolves `inspector@gina` from `@gina`'s own dev/local defaults — guarded on srcExists + a `lib.cmdStatusFormat.readPidfile` not-running check (already-running → no-op exit 0), with `--dry-run` + `--format=json`. AND a `gna.js server.on('started')` hook auto-starts the Inspector when a USER bundle boots in dev: gated `isDev && projectName !== 'gina'` (the timing-proof self-spawn guard — a `@gina` service must never re-trigger the auto-start, else the Inspector would re-spawn itself on boot) + srcExists (the local-only no-op — `services/` is gitignored+npmignored so the hook does nothing in a fresh `npm install gina`) + the same readPidfile check, fail-closed; the spawn shape is kept in sync with the command. The correct hook IS `gna.js server.on('started')` per-bundle (NOT the daemon `framework/start.js`, which lacks a per-bundle dev signal). The embedded `/_gina/inspector/` SPA remains for zero-start dev access. Tests: `inspector.test.js` §74-77 (WS) + `service-start.test.js` (command + hook gate, source-pins + pure-logic replicas). Commits `b8b74fc2` (server) + `bc25e328` (SPA). Established 2026-06-02.
+
+149. **Client-bundle plugins must NOT inject inline event-handler attributes (`setAttribute('onclick', …)`, `el.onX = …`) — they trip CSP `script-src-attr` under nonce-based policies; suppress the default action with an `addEventListener('click', e => e.preventDefault())` listener instead (popin close + link + validator submit-triggers fixed in `0.4.3-alpha.2`).** Setting an inline event-handler attribute compiles an inline handler governed by CSP `script-src-attr` (which falls back to `script-src`); once a `'nonce-…'` source is present in `script-src`, `'unsafe-inline'` is disabled for inline handlers (CSP Level 3), so the injection is reported in report-only mode and blocked in enforce mode — exactly what stops a nonce-adopting bundle from flipping its CSP to enforce. Three plugins injected `onclick="return false;"` at bind time: the popin close-binding (`popin/main.js`), the link binding (`link/main.js`), and the form-validator anchor submit-trigger binding (`core/plugins/lib/validator/src/main.js`). **The CSP-safe replacement is element-shape-dependent:** (a) popin already had a DIRECT `addEventListener('click', …)` whose `cancelEvent()` (preventDefault + stopPropagation) fires unconditionally, so removing the inline onclick was a pure, behaviour-neutral removal (the "click scrolls to #" worst-case never materialises — the existing listener's `preventDefault` runs regardless); (b) link + validator default-prevention runs through an id-gated DELEGATION listener (link: document-level; validator: form-level `clickProxyHandler`) that misses child-clicks, so each needed a NEW per-element listener — and it MUST be `preventDefault`-only, NOT `cancelEvent`, because `cancelEvent`'s `stopPropagation` would stop the event reaching the delegation listener and break the link AJAX trigger / validator submit. A `preventDefault`-only listener sets `event.defaultPrevented` exactly as the inline handler did (so the validator's `clickProxyHandler` `if (event.defaultPrevented) return` short-circuit still fires identically) and covers direct AND child clicks. In all three, the dead/live `else if` append branch was dropped and the injection gates preserved. **Rule:** replace an inline `on*` attribute with an `addEventListener` listener; use `preventDefault`-only (NOT `cancelEvent`/`stopPropagation`) whenever the element participates in event delegation or bubbling that other handlers depend on. **Browser-verified** (gina-starter harness, real `Content-Security-Policy-Report-Only: script-src-attr 'none'`): the inline-onclick mechanism raises a `script-src-attr` report violation on execution; the `addEventListener`+`preventDefault` mechanism raises none; both prevent default; gina loads clean. Tests: `popin.test.js` §14 + `csp-inline-handler.test.js` (source pins: no `setAttribute('onclick'` in any of the three + the preventDefault listeners + the rebuilt-dist whole-bundle zero-injection invariant). Established 2026-06-03.
+
+150. **#A11Y1 — `FormValidator` reflects each managed field's validity into `aria-invalid`, so `aria-errormessage` associations actually reach assistive technology; done at the rule-agnostic error-display chokepoint `handleErrorsDisplay` (`core/plugins/lib/validator/src/main.js`).** Per WAI-ARIA an `aria-errormessage` (or error `aria-describedby`) association is inert unless the field also carries `aria-invalid="true"`, which the validator never set. Now the chokepoint sets `aria-invalid="true"` on a committed error (error-set + refresh branches, gated `!isWarning` so soft live-check warnings while typing are NOT asserted) and `"false"` on clear — but on clear it MIRRORS the native `ValidityState` (`$el.willValidate && $el.validity && !$el.validity.valid` ⇒ keep `"true"`) so it never disagrees with the `:user-invalid` styling already shown for natively-constrained fields. Hidden fields (`$el.type=='hidden'`) are skipped. **No-duplicate-message + auto-wire:** a `_hasConsumerErrMsg` probe hoisted before the branch chain suppresses the injected `form-item-error-message` div when the field already references its own error element via `aria-errormessage`; legacy forms with no association keep the injected div and gain an `aria-errormessage` wire to it — a deterministic `gina-errormessage-<form>-<field>` id (sanitised), marked `data-gina-aria-errormessage` so a gina-owned wire is distinguished from a consumer's, removed on clear, and the refresh branch preserves the owned id. **Submit + blur announcement:** on a failed submit (`onValidate`) focus moves to the first DOM-order invalid field (hidden / unfocusable / zero-count skipped) so AT announces it; blur-time committed errors are announced through a lazily-created per-form visually-hidden `aria-live="polite"` region (`announceA11yError`), gated on the per-field path (`fieldName` set) once focus has LEFT the field — a CSS `:user-invalid` toggle is not reliably announced and on blur the field's own aria state isn't re-read; submit-time errors use focus, not the region. **Scope nuance:** the per-field blur/`input` passes fire only when the form opts into `data-gina-form-live-check-enabled` (the warning branch is gated on it); the always-on submit pass covers `aria-invalid` + focus regardless, so a non-live form still gets submit-time exposure. Rule-agnostic (the chokepoint operates on `errors[name]`, not per rule — `isRequired` / `isEmail` / `isInList` / every rule covered). No public API change; existing `form-item-error` / `form-item-warning` / `form-item-error-message` / `data-gina-form-errors` classes + submit-button toggling unchanged. Real-AT smoke (VoiceOver / NVDA announcing the field + message) is the manual acceptance step — the automated coverage exercises the DOM attributes that drive AT. Shipped as four atomic commits. Tests: `test/core/validator-aria-invalid.test.js` (42 — jsdom DOM-behaviour replicas + source pins). Established 2026-06-03.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -72,7 +72,7 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.4.2/core/gna",
+  "main": "./framework/v0.4.3/core/gna",
   "types": "./types/index.d.ts",
   "typesVersions": {
     "*": {
@@ -94,16 +94,17 @@
   "license": "MIT",
   "readmeFilename": "README.md",
   "dependencies": {
-    "@rhinostone/swig": "^2.5.1",
+    "@rhinostone/swig": "^2.6.0",
     "engine.io": "^6.6.7",
-    "psl": "^1.15.0"
+    "psl": "^1.15.0",
+    "ws": "^8.20.1"
   },
   "devDependencies": {
     "csso-cli": "4.0.2",
     "engine.io-client": "^6.6.4",
     "jsdom": "^29.1.1",
     "requirejs": "^2.3.7",
-    "sass": "1.99.0"
+    "sass": "1.100.0"
   },
   "overrides": {
     "ws": "^8.20.1"

package/framework/v0.4.2/VERSION

@@ -1 +0,0 @@
-0.4.2

package/framework/v0.4.2/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "gina-framework",
-  "version": "0.4.2-alpha.2",
-  "dependencies": {
-    "@rhinostone/swig": "^2.5.1",
-    "intl-messageformat": "^11.2.4",
-    "psl": "^1.15.0"
-  }
-}