gina 0.4.5 → 0.4.6

package/CHANGELOG.md

@@ -6,6 +6,42 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.4.6 - 2026-06-10
+### Added
+* Added an opt-in async template-loader extension point for the swig engine (settings.template.swig.loader): render templates from a custom backend instead of the local filesystem through an isolated per-bundle engine, with a built-in in-memory loader and a CVE-2023-25345 path-traversal guard. Remote/object-storage loaders and full asset-injection parity land in follow-ups.
+* The async swig template-loader path (settings.template.swig.loader) now injects the gina client runtime — stylesheets, scripts, external plugins and the client bootstrap — into rendered pages, so a full page served from a custom/off-disk backend ships the client bundle and is production-usable. Per-request CSP nonces are honoured on the injected bootstrap script.
+* The async swig template loader gains an "http" built-in (settings.template.swig.loader.type: "http") that fetches templates over HTTP(S) from a configured origin + basePath — for templates served from a CDN, object storage or a CMS endpoint instead of the local filesystem. A Tier-1 source cache (keyed by resolved URL) collapses per-render fetches with a default 60-second TTL, plus opt-in ETag revalidation (revalidate: true). Every resolved URL is containment-checked to stay under the configured origin and basePath.
+* The async template-loader extension point now supports the nunjucks engine. A bundle using render.engine "nunjucks" can configure settings.template.nunjucks.loader (the same "memory" and "http" built-ins available for swig) to render templates from a custom async backend — remote, CDN, object storage, or in-memory — instead of the local filesystem. The page template and its full extends/include chain are fetched through the loader, with the CVE-2023-25345 path-traversal guard applied on every hop. Bundles without a nunjucks loader render from the filesystem exactly as before.
+* Popin plugin: opt-in `preOpen` option that fills the popin with a loading skeleton and opens it (a born native modal in dialog mode, an active overlay in div mode) before the XHR returns, then swaps in the real content on completion. Pass a `loadingShell` HTML string for custom skeleton markup, or omit it for the built-in gina skeleton. Off by default; lets a consuming app delete its own pre-open observer.
+* Opt-in compiled-template reuse for async template loaders, via settings.template.swig.loader.cache and settings.template.nunjucks.loader.cache (boolean, default off, automatically disabled in development). When enabled, the per-bundle engine/environment and its compiled templates are shared across requests instead of being rebuilt per render. Off by default so template edits are always picked up live without a restart.
+* New `data-gina-dialog` dialog API built on the native `<dialog>` element: `data-gina-dialog="ID"` opens an in-page dialog, `data-gina-dialog-src="URL"` loads content over Asynchronous JavaScript and XML (AJAX), `data-gina-dialog-target="#sel"` does a partial (slot-only) replace that preserves the dialog chrome, and `data-gina-dialog-modal` forces modal or non-modal. Adds hover/focus preloading of AJAX content, automatic Accessible Rich Internet Applications (ARIA) wiring (aria-haspopup, aria-controls, and aria-labelledby pointed at a real title element), focus return to the trigger on close, and `[autofocus]` support. The legacy `data-gina-popin-name` and `data-gina-popin-url` trigger attributes keep working unchanged; a legacy-only trigger still opens through its existing popin handler. The legacy attributes are aliased onto the new dialog path with a one-time deprecation warning only when combined with a new `data-gina-dialog` / `data-gina-dialog-src` attribute on the same trigger. The engine-managed `data-gina-popin-is-link` / `data-gina-popin-loading` attributes are unchanged.
+* The `gina version` command (and its `gina framework:version` long form) now prints the bundled template engine name and version beneath the middleware line — for example `Template engine: @rhinostone/swig@2.7.2`. The line is shown only when the engine package can be resolved and is omitted from `gina version --short=true` output.
+* Added request.rawBody on the isaac engine: the exact unparsed request body is now preserved before parsing, so controllers and middlewares can verify inbound webhook signatures (an HMAC computed over the raw bytes). Always-on and cheap; the multipart/form-data upload path is unaffected.
+### Changed
+* CSP plugin: report-only policies (`reportOnly: true`) now omit the `sandbox` directive, which browsers ignore in report-only mode and warn about in the console. Behaviour is unchanged — `sandbox` does nothing in report-only — and it is still emitted in enforcing mode from the same config, so a single directive set works across both modes. A report-only policy whose every directive is report-only-inert now throws at startup.
+* Dialog popins now render as native modals in development too, matching production (dev/prod parity). The manual overlay is retained only for non-dialog popin mode.
+* Dialogs opened via the new `data-gina-dialog` API default to non-modal (the native `<dialog>.show()` path). Set `data-gina-dialog-modal` on a trigger, or `gina.config.popin.modal: true` project-wide (then opt individual dialogs out with `data-gina-dialog-modal="false"`), to make them modal. Legacy `data-gina-popin-*` popins are unaffected and still open modal. Non-modal dialogs ship the accessibility affordances that native `showModal()` provides for free but `show()` does not — Escape-to-close, body scroll-lock, background inert, and initial focus — plus native open/close and backdrop transitions via `@starting-style` and `transition: ... allow-discrete` (replacing the Safari repaint hack), gated behind prefers-reduced-motion.
+* Bumped the `@rhinostone/swig` dependency from `^2.6.0` to `^2.7.0` in both manifests. The template-engine runtime is unchanged from 2.6.0 — 2.7.0 only adds the separate `@rhinostone/swig-django` package (not used by gina) plus a changelog-only fix — so this is a version-currency update.
+### Fixed
+* Fixed the getWebroot template filter (swig and nunjucks engines): it threw a TypeError on every invocation because it resolved bundle config from an undefined object reference. Cross-bundle absolute webroot links now resolve correctly through the bundle env config.
+* Offline project-asset CLI commands (bundle:list, secrets:scan, i18n:scan, and similar) no longer abort when a single registered project is stale (its directory exists but its manifest.json is gone). The stale project is now warned and skipped instead of crashing the whole command.
+* Async template-loader renders (settings.template.swig.loader / settings.template.nunjucks.loader) no longer leak per-request context — web root, generated URLs and locale — between concurrent requests that share a template engine. The context-bearing template filters now resolve each request's context through a per-request AsyncLocalStorage store at call time, so interleaved async renders can no longer overwrite one another mid-render.
+* `gina project:add` no longer crashes with a `TypeError` when registering a project alias while another already-registered project's bundles are present on disk (for example, the same path registered under a second alias). The bundle-asset loader's per-bundle default-environment write indexed the bundle map by the active project name instead of the loop's current project; it now uses the loop variable, matching every sibling write.
+* Fixed the browser form-validator sending JSON request bodies with an application/x-www-form-urlencoded Content-Type. The server body parser url-decoded the JSON payload (replace + with space, then decodeURIComponent) before JSON.parse, corrupting + and % inside string values such as gmail-style email "+aliases" (alias+test@x became alias test@x). The non-binary submit path now sends application/json for a JSON body while still honoring an explicit form enctype, and the file-removal request defaults its JSON body to application/json. Browser bundle rebuilt.
+* `application/json` request bodies are now parsed as JSON verbatim. Previously POST, PUT and PATCH JSON bodies were URL-decoded and form-coerced the same way as `application/x-www-form-urlencoded` data: a string value of "true", "false" or "null" was turned into a boolean or null, and a percent-escape such as %20 inside a string value was decoded, both of which could corrupt JSON payloads. JSON bodies now preserve the client's exact types and string contents; form-urlencoded handling is unchanged.
+* A bundle whose `connectors.json` declares no actual connector — only the `$schema` annotation that `gina bundle:add` scaffolds, or an empty `{}` — failed to finish starting up: the model loader never invoked its completion callback, so the server never began listening (`gina bundle:start` reported "taking too long"). Such bundles now start correctly. Bundles that declare a real connector, or omit `connectors.json` entirely, are unaffected.
+* Fixed self.query() POST, PUT and PATCH requests with a non-empty body to application/json routes, which returned HTTP 500 (POST/PATCH) or silently dropped the body (PUT). The built-in client percent-encoded the JSON body while the server parsed it verbatim; the client now sends raw JSON, and the server also tolerantly accepts a percent-encoded body as a fallback for backward compatibility.
+* Fixed the development Inspector showing a stale value (such as the template-engine version badge) after a bundle restart. When the inspected page is reached through a window.opener tab that predates the restart, the Inspector now keeps the live agent (SSE/WebSocket) data instead of letting that stale-process snapshot override it, so the badge and environment reflect the running bundle.
+* Fixed a crash where a single request carrying a malformed percent-escape in its URL or query string could take the whole bundle down. A bare "%", an invalid escape such as "%zz", or an "inheritedData" value containing a literal "%" (for example {"x":"50%off"}) made an unguarded decodeURIComponent/decodeURI throw URIError, which escalated to an uncaught exception and shut the bundle down — including from inside the error handler itself, so even a malformed-percent URL to a missing asset could crash the process instead of returning a normal 404. Such values are now decoded tolerantly — a malformed escape falls back to the raw value instead of throwing — and the redundant second decode of already-decoded query parameters on the GET and HEAD paths has been removed. A single malformed request no longer crashes the server, on either engine.
+* project:add now links gina into the project by invoking the running install's own CLI instead of a PATH-resolved binary, and reports the failure instead of printing success when the node_modules/gina symlink could not be created — a scaffolded bundle no longer crashes at boot with MODULE_NOT_FOUND when gina is not on the PATH (repo checkouts, non-global installs).
+* Fixed the dev-mode Inspector statusbar and its launch link disappearing on content-heavy pages. The framework spliced its inline dev scripts before the closing body tag with a plain-string String.replace, so special dollar patterns in the injected content (a backtick or quote in the statusbar template, or SQL dollar placeholders in the captured flow log) expanded and corrupted the injected script. The affected splices now use function replacers.
+* framework:link's stale-node_modules repair path now invokes the running install's own CLI for link-node-modules instead of a PATH-resolved binary, and a failure is reported through the command's error path instead of crashing as an uncaught throw (the previous error check was dead code — execSync throws on failure rather than returning an Error).
+* The remaining framework self-invocations no longer resolve the gina binary from the PATH: the CmdHelper auto-link step (link-node-modules and link on project/bundle start, stop and restart) now invokes the running install's own CLI in a try/catch (its previous error check was dead code — execSync throws rather than returning an Error), and framework start/restart/stop plus the running-bundles restart loop now invoke the install's own bin/gina wrapper resolved from the framework location, preserving the detached-daemon spawn semantics.
+### Security
+* Removed the dead external Cross-Origin Resource Sharing (CORS) proxy (`corsacme.herokuapp.com`) that the popin and link loaders rewrote cross-origin request URLs through. It was an unmaintained third-party host that would have routed user traffic — including any credentials — through it, and no longer resolves. Cross-origin requests now go directly to the target server and rely on its own CORS headers; credentials are dropped on cross-origin requests unless explicitly opted in.
+* The default Swig render path now keeps the swig-core CVE-2023-25345 path-traversal confinement active: `{% include %}` / `{% extends %}` / `{% import %}` resolution is confined to the bundle templates root, so a traversal target such as `{% include "../../../etc/passwd" %}` is rejected by the loader. To restore that confinement without an opt-out, the processed-layout cache was relocated under the bundle templates root (a `.gina-layout-cache` directory, auto-ignored via a generated `.gitignore` so it never surfaces in a project repo) and the dev inspector statusbar is now inlined into the layout instead of being included from outside the root.
+* Bumped the `@rhinostone/swig` floor from `^2.7.0` to `^2.7.2` in both manifests, so every install is guaranteed swig-core 2.7.2 — the version that carries the CVE-2023-25345 path-traversal loader confinement (added in 2.7.1) and also repairs a 2.7.1 regression in which a relative loader basepath made the confinement wrongly reject every in-root `{% include %}` / `{% extends %}` / `{% import %}`. The prior `^2.7.0` range still permitted the unpatched 2.7.0 (a clean install resolved higher, but a stale lockfile or a deduped 2.7.0 in the tree would not); gina relies on the swig-core loader confinement on its default render path, so the floor guarantees both the path-traversal fix and the relative-basepath repair.
+
 ## 0.4.5 - 2026-06-06
 
 _Additive release — opt-in structured (JSON) logging with per-request `requestId` / `durationMs` correlation, plus public SDK-handle accessors (`getCluster()` on Couchbase, `getClient()` on MongoDB) for driver-level features such as multi-document transactions. No breaking changes, no settings reset._

package/CONTRIBUTING.md

@@ -74,7 +74,7 @@ The test suite uses Node's built-in `node:test` runner — no additional test de
 
 ```bash
 # Run all tests
-node --test test/**/*.test.js
+node --test test/**/*.test.js framework/v*/test/unit/*.test.js
 
 # Run a single file
 node --test test/core/controller.test.js
@@ -193,7 +193,7 @@ Pick the kind (`Added`, `Changed`, `Fixed`, `Removed`, `Security`) and write the
 
 Before opening a PR against `develop`:
 
-- [ ] Tests pass — `node --test test/**/*.test.js`
+- [ ] Tests pass — `node --test test/**/*.test.js framework/v*/test/unit/*.test.js`
 - [ ] New behaviour is covered by a test (or an explanation is provided for why it cannot be)
 - [ ] A `changie new` entry exists for any user-facing change
 - [ ] Commit messages follow the style above

package/README.md

@@ -1,6 +1,6 @@
 # Gina
 
-[![npm version](https://badge.fury.io/js/gina.svg)](https://badge.fury.io/js/gina) [![npm downloads](https://img.shields.io/npm/dm/gina)](https://www.npmjs.com/package/gina) [![GitHub stars](https://img.shields.io/github/stars/gina-io/gina)](https://github.com/gina-io/gina/stargazers) [![GitHub version](https://badge.fury.io/gh/gina-io%2Fgina.svg)](https://badge.fury.io/gh/gina-io%2Fgina) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D%2022-brightgreen)](https://nodejs.org) [![Tests](https://github.com/gina-io/gina/actions/workflows/test.yml/badge.svg)](https://github.com/gina-io/gina/actions/workflows/test.yml) [![Socket Badge](https://socket.dev/api/badge/npm/package/gina)](https://socket.dev/npm/package/gina)
+[![npm version](https://img.shields.io/npm/v/gina)](https://www.npmjs.com/package/gina) [![npm downloads](https://img.shields.io/npm/dm/gina)](https://www.npmjs.com/package/gina) [![GitHub stars](https://img.shields.io/github/stars/gina-io/gina)](https://github.com/gina-io/gina/stargazers) [![Tests](https://github.com/gina-io/gina/actions/workflows/test.yml/badge.svg)](https://github.com/gina-io/gina/actions/workflows/test.yml) [![Socket Badge](https://socket.dev/api/badge/npm/package/gina)](https://socket.dev/npm/package/gina) [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D%2022-brightgreen)](https://nodejs.org) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
 > **Documentation:** [gina.io/docs](https://gina.io/docs/) · **Issues:** [GitHub](https://github.com/gina-io/gina/issues) · **Changelog:** [CHANGELOG.md](./CHANGELOG.md)
 
@@ -22,7 +22,7 @@ Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope
 | ORM / entities | EventEmitter-based entity system; SQL files auto-wired to entity methods |
 | Connectors | Couchbase, MongoDB, ScyllaDB / Cassandra, MySQL, PostgreSQL, Redis, SQLite, AI (LLM) — loaded from project `node_modules` |
 | AI connector | Any LLM provider via named protocol (`anthropic://`, `openai://`, `ollama://`, …) |
-| Template engine | [`@rhinostone/swig`](https://github.com/gina-io/swig) 2.6.0 — maintained fork with CVE-2023-25345 patched; streaming SSE/chunked via `renderStream()`. Nunjucks supported as opt-in via `render.engine = "nunjucks"` |
+| Template engine | [`@rhinostone/swig`](https://github.com/gina-io/swig) 2.7.2 — maintained fork with CVE-2023-25345 patched; streaming SSE/chunked via `renderStream()`. Nunjucks supported as opt-in via `render.engine = "nunjucks"` |
 | Internationalisation | Per-bundle JSON catalogs, `t()` helper, swig + nunjucks `t` filter, CLDR plurals, ICU MessageFormat opt-in via `t.icu()` |
 | Observability | Built-in `/_gina/metrics` Prometheus endpoint (opt-in, IP-allowlisted) — Node.js process metrics + HTTP counter / duration histogram with cardinality-safe route labels |
 | Hot reload | WatcherService evicts `require.cache` only on file change — zero per-request overhead in dev |
@@ -39,12 +39,14 @@ gina bundle:start api @myproject
 open https://localhost:3100
 ```
 
-## What's in 0.4.5
+## What's in 0.4.6
 
-- **Opt-in structured (JSON) logging.** Set `GINA_LOG_FORMAT=json` to emit one machine-parseable JSON object per log line (`{ts, level, bundle, message}`) for collectors such as Loki, Datadog, Fluentd or CloudWatch. The default stays the coloured, human-readable format, so interactive `docker logs` output is unchanged unless you opt in.
-- **Per-request `requestId` / `durationMs` in JSON logs.** When JSON logging is on, every log line emitted during a request carries a request id (an inbound `X-Request-Id` is honoured when well-formed, otherwise one is generated) and the elapsed milliseconds since the request began, so a single request's lines can be correlated in your collector. Default text logging is unchanged and pays no overhead.
-- **Public SDK Cluster accessor on Couchbase entities.** `getCluster()` returns the underlying SDK `Cluster` handle, so you can use SDK-level features the entity layer does not wrap — notably multi-document transactions via `cluster.transactions().run(...)` — without reaching into private connection internals.
-- **Public MongoClient accessor on MongoDB entities.** `getClient()` returns the underlying driver `MongoClient`, so you can reach driver-level features the entity layer does not wrap — notably multi-document transactions via `client.startSession()` / `session.withTransaction(...)` (which additionally require a replica-set or sharded deployment).
+- **Async template loaders (opt-in).** `settings.template.swig.loader` / `settings.template.nunjucks.loader` render templates from a custom backend instead of the local filesystem — built-in `memory` and `http` loaders (for templates served from a CDN, object storage or a template service), per-bundle isolated engines, full client-runtime injection on the async path, and an opt-in compiled-template cache (`loader.cache`) for production.
+- **Native dialog API.** `data-gina-dialog="ID"` opens an in-page `<dialog>`, `data-gina-dialog-src="URL"` loads its content over AJAX; non-modal by default, with per-trigger (`data-gina-dialog-modal`) or project-wide modal opt-in. Dialog popins now render as native modals in development too (dev/prod parity), and the popin plugin gains an opt-in `preOpen` loading skeleton.
+- **`request.rawBody`.** The exact unparsed request body is preserved before parsing, so controllers and middlewares can verify inbound webhook signatures (an HMAC computed over the raw bytes).
+- **JSON bodies parsed verbatim.** `application/json` POST / PUT / PATCH bodies are no longer URL-decoded and form-coerced — string values such as `"true"` or `"50%20off"` survive exactly as sent. Urlencoded handling is unchanged, and the browser form-validator now sends its JSON bodies with the matching `application/json` Content-Type.
+- **Hardening.** A single request carrying a malformed percent-escape (a bare `%`, `%zz`) can no longer crash a bundle; the default Swig render path keeps the swig-core CVE-2023-25345 path-traversal confinement active; the `@rhinostone/swig` floor moved to `^2.7.2`; and the dead third-party CORS proxy was removed from the popin and link loaders.
+- **CLI & DX.** `gina version` reports the bundled template engine; offline project commands skip a stale registered project instead of aborting; `project:add` and the framework's self-invocations no longer depend on a PATH-resolved gina binary.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 
@@ -67,7 +69,7 @@ Full installation guide, tutorials, configuration reference, and API docs at **[
 
 ## Governance
 
-Gina is co-authored by **Martin Luther** ([Rhinostone](https://rhinostone.com)) and **Fabrice DELANEAU** ([fdelaneau.com](https://fdelaneau.com)). Final decisions on direction, API design, and releases rest with Martin Luther. Community contributions and RFCs are welcome and taken seriously. See [GOVERNANCE.md](./GOVERNANCE.md) for details.
+Gina is co-authored by **Martin Luther ETOUMAN NDAMBWE** ([Rhinostone](https://rhinostone.com)) and **Fabrice DELANEAU** ([fdelaneau.com](https://fdelaneau.com)). Final decisions on direction, API design, and releases rest with Martin Luther. Community contributions and RFCs are welcome and taken seriously. See [GOVERNANCE.md](./GOVERNANCE.md) for details.
 
 ## License (MIT)
 

package/ROADMAP.md

@@ -119,8 +119,8 @@ Stub commands confirmed in source — handler files exist but are empty or comme
 | --- | --- | --- | --- |
 | 📋 | **ESM compatibility layer** — Dual CJS/ESM entry points via `"exports"` in `package.json`. Framework internals stay CJS; public API gets ESM re-exports. | `0.5.0` | Q1 2027 |
 | 🚧 | **Pluggable template engine** — **Partially shipped in `0.3.7`**: opt-in `render.engine = "nunjucks"` dispatch per bundle. The project installs `nunjucks` itself (no framework dep); Gina loads it via `lib/nunjucks-resolver` and routes through `controller.render-nunjucks.js`. Swig remains the default, runs unchanged. Inspector dev payload, HTTP/2 `stream.respond()` direct path, and error-page template routing all shipped in `0.3.7-alpha.2`. **Closing the parity gap on the `0.3.7` ASAP track** (see Nunjucks Parity below): filter registry port, `setResources` / `<gina>` layout placeholders, static HTML cache parity, Early Hints 103 auto-send. **Remaining `0.5.0` scope**: within-Inspector sub-items (`statusbar.html` include + flow/queries pipelines); per-template-extension dispatch so a single bundle can mix engines (`.swig` / `.njk`); optional auto-detect on `.njk` presence. Breaking syntax differences (`{% parent %}` → `{{ super() }}`, filter renames, `autoescape` default, `date` format strings, no `{% spaceless %}`) are nunjucks's own — Gina doesn't paper over them. | `0.5.0` | Q1 2027 |
-| 🚧 | **Structured logging** — **Opt-in JSON output shipped**: set `GINA_LOG_FORMAT=json` for one machine-parseable object per log line (`{ ts, level, bundle, message }`); the coloured, human-readable format stays the default, so `docker logs` is unchanged. Additive — existing consumers are unaffected. Enables log aggregation (Loki, Datadog, CloudWatch). Per-request fields (`requestId`, `durationMs`) pending request-context research. | `0.5.0` | Q1 2027 |
-| 📋 | **Research `AsyncLocalStorage` for request context** — Evaluate `node:async_hooks` `AsyncLocalStorage` as a replacement for the `local` closure pattern, giving true async isolation across `setTimeout`, Promises, and `async/await` chains without any closure threading. Output: decision doc + proof-of-concept branch. | `0.5.0` | Q1 2027 |
+| ✅ | **Structured logging** — **Shipped in `0.4.5`**: set `GINA_LOG_FORMAT=json` for one machine-parseable object per log line (`{ ts, level, bundle, message }`); the coloured, human-readable format stays the default, so `docker logs` is unchanged. Additive — existing consumers are unaffected. Enables log aggregation (Loki, Datadog, CloudWatch). When JSON output is on, every line emitted during a request also carries per-request `requestId` (honouring an inbound `X-Request-Id` when well-formed, else generated) and `durationMs` for correlation. | `0.4.5` | 2026-06-06 |
+| ✅ | **Research `AsyncLocalStorage` for request context** — Concluded (2026-06-06): a full `local`→`AsyncLocalStorage` migration was evaluated and **declined** (per-request isolation already exists via per-request controller instances; the hot closure paths get *more* fragile under `getStore()`). The one win — a narrow always-on `{ requestId, startMs }` context — shipped in `0.4.5` as the substrate for the per-request log fields above. | `0.4.5` | 2026-06-06 |
 
 ### Nunjucks Parity (`0.3.7` ASAP track)
 

package/framework/v0.4.6/VERSION

@@ -0,0 +1 @@
+0.4.6

package/framework/v0.4.6/core/asset/plugin/dist/vendor/gina/css/gina.min.css

@@ -0,0 +1 @@
+@keyframes gina-popin-skeleton-shimmer{0%{background-position:200%0}to{background-position:-200%0}}@font-face{font-family:"have_heart_oneregular";src:url(fonts/have_heart_one-webfont.woff2)format("woff2"),url(fonts/have_heart_one-webfont.woff)format("woff");font-weight:400;font-style:normal}.gina-popin-container{background:#fff}.gina-popins-overlay,div.gina-popin-container{visibility:hidden;opacity:0;z-index:1;transition:opacity .3s,visibility 0 .3s}.gina-popins-overlay.gina-popin-is-active,div.gina-popin-container.gina-popin-is-active{opacity:1;visibility:visible;transition-delay:0}dialog.gina-popin-container{padding:0;border:0;z-index:1}@media (prefers-reduced-motion:no-preference){dialog.gina-popin-container{opacity:0;transform:translateY(-.5rem);transition:opacity .2s ease,transform .2s ease,overlay .2s ease allow-discrete,display .2s ease allow-discrete}dialog.gina-popin-container[open]{opacity:1;transform:translateY(0)}@starting-style{dialog.gina-popin-container[open]{opacity:0;transform:translateY(-.5rem)}}dialog.gina-popin-container::backdrop{opacity:0;transition:opacity .2s ease,overlay .2s ease allow-discrete,display .2s ease allow-discrete}dialog.gina-popin-container[open]::backdrop{opacity:1}@starting-style{dialog.gina-popin-container[open]::backdrop{opacity:0}}}body[data-gina-popin-scroll-lock]{overflow:hidden}.gina-popins-overlay{position:fixed;left:0;top:0;display:grid;place-items:center;width:100%;height:100%;transition:opacity .3s,visibility .3s;overflow:auto;background:rgba(0,0,0,.75)}.gina-popins-overlay.gina-popin-is-active{backdrop-filter:blur(6px)}dialog::backdrop{background-color:rgba(0,0,0,.75);backdrop-filter:blur(6px)}.gina-popin-skeleton{padding:1.5rem;min-width:18rem;max-width:90vw}.gina-popin-skeleton .gina-popin-skeleton-line{height:.85rem;margin-bottom:.75rem;border-radius:4px;background:linear-gradient(90deg,#ededed 25%,#f7f7f7 50%,#ededed 75%);background-size:200% 100%;animation:gina-popin-skeleton-shimmer 1.4s ease-in-out infinite}.gina-popin-skeleton .gina-popin-skeleton-line:last-child{margin-bottom:0}.gina-popin-skeleton .gina-popin-skeleton-title{height:1.4rem;width:60%;margin-bottom:1.25rem}.gina-popin-skeleton .gina-popin-skeleton-line--short{width:40%}@media (prefers-reduced-motion:reduce){.gina-popin-skeleton .gina-popin-skeleton-line{animation:none}}

package/framework/{v0.4.5 → v0.4.6}/core/asset/plugin/dist/vendor/gina/inspector/inspector.js

@@ -160,6 +160,12 @@
     var paused  = false;
     /** @type {string} JSON.stringify of last processed ginaData — for change detection */
     var lastGdStr = '';
+    /** @type {?(number|string)} `gina pid` of the running bundle as last reported by the
+     *  live agent (SSE/WS) channel; the freshness reference {@link _isStaleSource} compares
+     *  opener/localStorage polls against so a stale-process snapshot (e.g. an opener tab
+     *  rendered before a bundle restart) cannot override live data. Null in pure
+     *  opener/localStorage mode, which leaves the guard inert. */
+    var _livePid = null;
     /** @type {boolean} When true, Data tab renders raw JSON instead of a tree */
     var rawMode = false;
     /** @type {string} Highest severity level received since last clear (drives log-dot) */
@@ -3255,6 +3261,55 @@
         }
     }
 
+    /**
+     * Extract the running bundle's `gina pid` from a `__ginaData` payload,
+     * reading `gina.environment` first then falling back to `user.environment`.
+     *
+     * @inner
+     * @param   {?Object} gd  A parsed `__ginaData` payload.
+     * @returns {?(number|string)} The `gina pid`, or null when absent.
+     */
+    function _gdPid(gd) {
+        try {
+            var e = (gd && gd.gina && gd.gina.environment)
+                 || (gd && gd.user && gd.user.environment) || null;
+            return e ? (e['gina pid'] || null) : null;
+        } catch (e) { return null; }
+    }
+
+    /**
+     * Record the live bundle pid from an agent-delivered payload. The agent
+     * (SSE/WS) channel always reflects the running process, so its pid is the
+     * freshness reference {@link _isStaleSource} compares polled snapshots against.
+     *
+     * @inner
+     * @param {?Object} gd  A parsed `__ginaData` payload from the agent channel.
+     */
+    function _noteLivePid(gd) {
+        var p = _gdPid(gd);
+        if (p) _livePid = p;
+    }
+
+    /**
+     * Freshness guard for the opener/localStorage poll. Once the live agent
+     * channel has reported the running bundle's pid ({@link _livePid}), a polled
+     * payload carrying a DIFFERENT pid is a snapshot from a prior process — e.g.
+     * an opener tab still open from before a bundle restart. Returning true tells
+     * {@link pollData} to keep the live agent data instead of letting that stale
+     * snapshot override it (most visibly the template-engine version badge).
+     * Inert (returns false) until an agent pid is known, preserving the pure
+     * opener/localStorage behaviour.
+     *
+     * @inner
+     * @param   {?Object} gd  The polled `__ginaData` payload.
+     * @returns {boolean} True when `gd` belongs to a different (stale) process.
+     */
+    function _isStaleSource(gd) {
+        if (!_livePid) return false;
+        var p = _gdPid(gd);
+        return !!(p && p !== _livePid);
+    }
+
     /**
      * Poll the data source for updates. Called on a timer every
      * {@link pollDataMs} milliseconds.
@@ -3298,6 +3353,10 @@
             if (!gd) return;
             var str = JSON.stringify(gd);
             if (str === lastGdStr) return;
+            // Freshness guard — a stale-process opener/localStorage snapshot (its
+            // `gina pid` differs from the live agent's) must not override live data;
+            // see _isStaleSource. Inert until an agent frame establishes _livePid.
+            if (_isStaleSource(gd)) return;
             showLoader();
             lastGdStr = str;
             ginaData = gd;
@@ -3788,6 +3847,7 @@
                     showLoader();
                     lastGdStr = str;
                     ginaData = gd;
+                    _noteLivePid(gd);
                     var env = (gd.user && gd.user.environment) || {};
                     qs('#bm-label').textContent = (env.bundle || '?') + '@' + (env.env || '?');
                     qs('#bm-dot').className = 'bm-dot ok';
@@ -3906,6 +3966,7 @@
                         showLoader();
                         lastGdStr = str;
                         ginaData = gd;
+                        _noteLivePid(gd);
                         var env = (gd.user && gd.user.environment) || {};
                         qs('#bm-label').textContent = (env.bundle || '?') + '@' + (env.env || '?');
                         qs('#bm-dot').className = 'bm-dot ok';
@@ -4024,6 +4085,7 @@
                     showLoader();
                     lastGdStr = str;
                     ginaData = gd;
+                    _noteLivePid(gd);
                     var env = (gd.user && gd.user.environment) || {};
                     qs('#bm-label').textContent = (env.bundle || '?') + '@' + (env.env || '?');
                     qs('#bm-dot').className = 'bm-dot ok';