gina 0.4.4-alpha.1 → 0.4.5-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,14 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.4.4 - 2026-06-05
+
+_Additive release — `templates.json` gains comma-separated section keys (share one stylesheet/script block across several routes at once) and an optional `_common.config` block for page-level defaults. No breaking changes, no settings reset._
+
+### Added
+* templates.json section keys may now be comma-separated (for example "products, productDetail") to share a stylesheet or script block across several routes at once. The block is replicated under each named section, merging into any section you also declare on its own, so a section's own keys win on collision.
+* templates.json now accepts an optional `_common.config` block for page-level defaults (such as routeNameAsFilenameEnabled or javascriptsDeferEnabled). It is flattened back into _common at load time, so existing bundles are unaffected and any direct _common key still overrides the config block.
+
 ## 0.4.3 - 2026-06-04
 
 _Additive release — the standalone Inspector connects over an authenticated WebSocket (with `gina service:start` and dev auto-start), `FormValidator` reflects validity into `aria-invalid` (#A11Y1), the popin / link / validator plugins drop inline `onclick` for strict-CSP compatibility, and the `@rhinostone/swig` floor moves to `^2.6.0`. No breaking changes, no settings reset._

package/README.md

@@ -39,12 +39,10 @@ gina bundle:start api @myproject
 open https://localhost:3100
 ```
 
-## What's in 0.4.3
+## What's in 0.4.4
 
-- **Inspector over WebSocket.** The standalone Inspector now connects to a bundle's `/_gina/agent` endpoint over an authenticated WebSocket by default — streaming the data + log feed on one socket — and falls back to SSE automatically if the socket can't open (open with `?transport=sse` to force SSE). Outside dev mode the upgrade requires the configured `inspector.agent.key` (via `?key=` or the `x-gina-inspector-key` header) and honours an optional `inspector.agent.allowedOrigins` allowlist. A new **`gina service:start <service>`** command starts framework-internal `@gina` services (such as the standalone Inspector) via the daemon-free `gina-container` launcher, and in dev mode the Inspector auto-starts when a bundle boots.
-- **Accessible form validation (`aria-invalid`, #A11Y1).** `FormValidator` now keeps each managed field's `aria-invalid` in sync with its validity (`true` on a committed error, `false` once valid), so a field's `aria-errormessage` association is actually exposed to assistive technology. A failed submit moves focus to the first invalid field; blur-time errors are announced through a per-form `aria-live` region. Automatic — no public API change.
-- **Strict-CSP client plugins.** The popin, link, and form-validator plugins no longer inject an inline `onclick="return false;"` attribute at bind time, so they work under a strict nonce-based Content-Security-Policy (the inline handler tripped `script-src-attr`). Default-action suppression is unchanged.
-- **`@rhinostone/swig` → `^2.6.0`.** The template-engine floor moves to 2.6.0; the native `json` / `json_encode` filters now HTML-escape their output and are marked safe, so `{{ data|json }}` is safe to embed directly inside a `<script>` block.
+- **`templates.json` multi-section keys.** A section key may now be comma-separated — e.g. `"products, productDetail"` — to share a stylesheet or `<script>` block across several routes at once. The block is replicated under each named section and deep-merged into any section you also declare on its own, so a section's own keys win on collision. Single-section keys behave exactly as before.
+- **`templates.json` `_common.config` block.** An optional `_common.config` block holds page-level defaults (such as `routeNameAsFilenameEnabled` or `javascriptsDeferEnabled`). It is flattened back into `_common` at load time, so existing bundles are unaffected and any direct `_common` key still overrides the config block.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/framework/v0.4.5-alpha.1/VERSION

@@ -0,0 +1 @@
+0.4.5-alpha.1

package/framework/{v0.4.4-alpha.1 → v0.4.5-alpha.1}/core/config.js

@@ -1795,6 +1795,44 @@ function Config(opt, contextResetNeeded) {
 
         var hasViews = (typeof(files['templates']) != 'undefined' && typeof(files['templates']['_common']) != 'undefined') ? true : false;
 
+        // templates.json pre-process (runs once per bundle, BEFORE the routing<->template GET
+        // auto-vivify and the _common / per-section merge loops below, so every downstream
+        // consumer sees fully-expanded single-section keys).
+        if ( typeof(files['templates']) != 'undefined' && files['templates'] !== null ) {
+
+            // gina-io/gina#10 — optional `_common.config` block: flatten it back into `_common`
+            // so the existing _common read sites keep working unchanged. Direct `_common.*` keys
+            // win over `_common.config.*` (merge keeps the first argument on a key collision).
+            if ( typeof(files['templates']._common) != 'undefined'
+                 && typeof(files['templates']._common.config) != 'undefined' ) {
+                files['templates']._common = merge(files['templates']._common, files['templates']._common.config);
+                delete files['templates']._common.config;
+            }
+
+            // gina-io/gina#8 — comma-separated section keys (e.g. `"a, b"`): replicate the block
+            // under each named section, MERGING into any section that already exists so a section's
+            // own keys win over the shared block. Route names never contain commas, so the split is
+            // unambiguous; the original comma key is removed. Collect first, then mutate, to avoid
+            // changing the object mid for-in.
+            let _commaKeys = [];
+            for (let _k in files['templates']) {
+                if ( _k.indexOf(',') > -1 ) _commaKeys.push(_k);
+            }
+            for (let _i = 0, _iLen = _commaKeys.length; _i < _iLen; ++_i) {
+                let _key      = _commaKeys[_i];
+                let _block    = files['templates'][_key];
+                let _sections = _key.split(/\s*,\s*/);
+                for (let _s = 0, _sLen = _sections.length; _s < _sLen; ++_s) {
+                    let _section = _sections[_s].trim();
+                    if ( !_section ) continue;
+                    files['templates'][_section] = ( typeof(files['templates'][_section]) != 'undefined' )
+                        ? merge(files['templates'][_section], JSON.clone(_block))
+                        : JSON.clone(_block);
+                }
+                delete files['templates'][_key];
+            }
+        }
+
         // e.g.: 404 rendering for JSON APIs by checking `env.template`: JSON response can be forced even if the bundle has views
         if ( hasViews && typeof(self.userConf[bundle][env].template) != 'undefined' && self.userConf[bundle][env].template == false) {
             conf[bundle][env].template = false

package/framework/{v0.4.4-alpha.1 → v0.4.5-alpha.1}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.4.4-alpha.1",
+  "version": "0.4.5-alpha.1",
   "dependencies": {
     "@rhinostone/swig": "^2.6.0",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.4.4-alpha.1/core/gna');
+var _gna = require('./framework/v0.4.5-alpha.1/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.4.4-alpha.1/core/controller');
-var EntitySuper     = require('./framework/v0.4.4-alpha.1/core/model/entity');
+var SuperController = require('./framework/v0.4.5-alpha.1/core/controller');
+var EntitySuper     = require('./framework/v0.4.5-alpha.1/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.4.4-alpha.1/lib/uuid');
+var uuid = require('./framework/v0.4.5-alpha.1/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -947,3 +947,5 @@ Dev-mode query instrumentation captures every database query tied to the current
 149. **Client-bundle plugins must NOT inject inline event-handler attributes (`setAttribute('onclick', …)`, `el.onX = …`) — they trip CSP `script-src-attr` under nonce-based policies; suppress the default action with an `addEventListener('click', e => e.preventDefault())` listener instead (popin close + link + validator submit-triggers fixed in `0.4.3-alpha.2`).** Setting an inline event-handler attribute compiles an inline handler governed by CSP `script-src-attr` (which falls back to `script-src`); once a `'nonce-…'` source is present in `script-src`, `'unsafe-inline'` is disabled for inline handlers (CSP Level 3), so the injection is reported in report-only mode and blocked in enforce mode — exactly what stops a nonce-adopting bundle from flipping its CSP to enforce. Three plugins injected `onclick="return false;"` at bind time: the popin close-binding (`popin/main.js`), the link binding (`link/main.js`), and the form-validator anchor submit-trigger binding (`core/plugins/lib/validator/src/main.js`). **The CSP-safe replacement is element-shape-dependent:** (a) popin already had a DIRECT `addEventListener('click', …)` whose `cancelEvent()` (preventDefault + stopPropagation) fires unconditionally, so removing the inline onclick was a pure, behaviour-neutral removal (the "click scrolls to #" worst-case never materialises — the existing listener's `preventDefault` runs regardless); (b) link + validator default-prevention runs through an id-gated DELEGATION listener (link: document-level; validator: form-level `clickProxyHandler`) that misses child-clicks, so each needed a NEW per-element listener — and it MUST be `preventDefault`-only, NOT `cancelEvent`, because `cancelEvent`'s `stopPropagation` would stop the event reaching the delegation listener and break the link AJAX trigger / validator submit. A `preventDefault`-only listener sets `event.defaultPrevented` exactly as the inline handler did (so the validator's `clickProxyHandler` `if (event.defaultPrevented) return` short-circuit still fires identically) and covers direct AND child clicks. In all three, the dead/live `else if` append branch was dropped and the injection gates preserved. **Rule:** replace an inline `on*` attribute with an `addEventListener` listener; use `preventDefault`-only (NOT `cancelEvent`/`stopPropagation`) whenever the element participates in event delegation or bubbling that other handlers depend on. **Browser-verified** (gina-starter harness, real `Content-Security-Policy-Report-Only: script-src-attr 'none'`): the inline-onclick mechanism raises a `script-src-attr` report violation on execution; the `addEventListener`+`preventDefault` mechanism raises none; both prevent default; gina loads clean. Tests: `popin.test.js` §14 + `csp-inline-handler.test.js` (source pins: no `setAttribute('onclick'` in any of the three + the preventDefault listeners + the rebuilt-dist whole-bundle zero-injection invariant). Established 2026-06-03.
 
 150. **#A11Y1 — `FormValidator` reflects each managed field's validity into `aria-invalid`, so `aria-errormessage` associations actually reach assistive technology; done at the rule-agnostic error-display chokepoint `handleErrorsDisplay` (`core/plugins/lib/validator/src/main.js`).** Per WAI-ARIA an `aria-errormessage` (or error `aria-describedby`) association is inert unless the field also carries `aria-invalid="true"`, which the validator never set. Now the chokepoint sets `aria-invalid="true"` on a committed error (error-set + refresh branches, gated `!isWarning` so soft live-check warnings while typing are NOT asserted) and `"false"` on clear — but on clear it MIRRORS the native `ValidityState` (`$el.willValidate && $el.validity && !$el.validity.valid` ⇒ keep `"true"`) so it never disagrees with the `:user-invalid` styling already shown for natively-constrained fields. Hidden fields (`$el.type=='hidden'`) are skipped. **No-duplicate-message + auto-wire:** a `_hasConsumerErrMsg` probe hoisted before the branch chain suppresses the injected `form-item-error-message` div when the field already references its own error element via `aria-errormessage`; legacy forms with no association keep the injected div and gain an `aria-errormessage` wire to it — a deterministic `gina-errormessage-<form>-<field>` id (sanitised), marked `data-gina-aria-errormessage` so a gina-owned wire is distinguished from a consumer's, removed on clear, and the refresh branch preserves the owned id. **Submit + blur announcement:** on a failed submit (`onValidate`) focus moves to the first DOM-order invalid field (hidden / unfocusable / zero-count skipped) so AT announces it; blur-time committed errors are announced through a lazily-created per-form visually-hidden `aria-live="polite"` region (`announceA11yError`), gated on the per-field path (`fieldName` set) once focus has LEFT the field — a CSS `:user-invalid` toggle is not reliably announced and on blur the field's own aria state isn't re-read; submit-time errors use focus, not the region. **Scope nuance:** the per-field blur/`input` passes fire only when the form opts into `data-gina-form-live-check-enabled` (the warning branch is gated on it); the always-on submit pass covers `aria-invalid` + focus regardless, so a non-live form still gets submit-time exposure. Rule-agnostic (the chokepoint operates on `errors[name]`, not per rule — `isRequired` / `isEmail` / `isInList` / every rule covered). No public API change; existing `form-item-error` / `form-item-warning` / `form-item-error-message` / `data-gina-form-errors` classes + submit-button toggling unchanged. Real-AT smoke (VoiceOver / NVDA announcing the field + message) is the manual acceptance step — the automated coverage exercises the DOM attributes that drive AT. Shipped as four atomic commits. Tests: `test/core/validator-aria-invalid.test.js` (42 — jsdom DOM-behaviour replicas + source pins). Established 2026-06-03.
+
+151. **`templates.json` pre-process pass in `core/config.js` (right after the `hasViews` line, BEFORE the routing↔template GET auto-vivify) expands two additive section-key shapes once per bundle — gina-io/gina#8 comma-separated keys + #10 `_common.config`.** #8: a comma-separated section key (`"a, b": {…}`) is split on `/\s*,\s*/` (each name `.trim()`med, empty segments skipped) and the block is replicated under each named section, MERGING into any section that already exists so a section's own keys win — `merge(existing, JSON.clone(block))`, and `lib/merge` keeps its FIRST argument on a leaf collision (`override=false` default). #10: an optional `_common.config` block is `merge(_common, _common.config)`-flattened back into `_common` then deleted, so the existing `_common.*` read sites are unchanged and a direct `_common.X` overrides `_common.config.X`. **Placement is load-bearing:** the pass must run before the GET auto-vivify `files['templates'][rule.toLowerCase()] = {}` (which keys off CLEAN route names from routing.json) — otherwise a comma key leaves the real route names "missing" → empty `{}` sections get minted AND the comma key survives to produce a dead `"a, b@bundle"` route. **Both are no-ops when absent** (no comma → single-element split → identical; no `_common.config` → untouched), so existing bundles are byte-identical — verified zero comma keys across known consumer + gina fixture `templates.json` before shipping. **#7 (a Swig-like `{ "inherit": … }` directive) was closed un-shipped**, so #8 is NOT redundant: `_common` shares to ALL routes, #8 shares a chosen SUBSET — a gap nothing else fills. Collect-then-mutate (gather comma keys first) avoids changing the object mid-`for…in`. Tests: `test/core/config-templates-preprocess.test.js` (source pins incl. placement-before-auto-vivify + a real-`merge` pure-logic replica: split / union-merge / own-keys-win / trim / empty-segment / flatten / no-op). Established 2026-06-05.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.4.4-alpha.1",
+  "version": "0.4.5-alpha.1",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -72,7 +72,7 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.4.4-alpha.1/core/gna",
+  "main": "./framework/v0.4.5-alpha.1/core/gna",
   "types": "./types/index.d.ts",
   "typesVersions": {
     "*": {

package/framework/v0.4.4-alpha.1/VERSION

@@ -1 +0,0 @@
-0.4.4-alpha.1