gina 0.5.1-alpha.2 → 0.5.1-alpha.3

package/CONVENTIONS.md

@@ -391,6 +391,7 @@ exports.setUp = function(done) {
 - Test names use `[ category ] description` format for grouping
 - Setup guards (`if (initialized) return done()`) prevent re-execution across test suites
 - New unit tests go in `test/core/` with numeric prefix for ordering
+- **Test counts in docs and changelogs are measured, never estimated.** Don't write an "N unit tests" claim before running the test — estimating from section count consistently undercounts (behaviour sections run 10-15 tests, not ~5). The corrective is mechanical: run `node --test test/core/<file>.test.js 2>&1 | tail -10`, copy the `ℹ tests N` line, and write that exact N. Use `TODO_test_count` placeholders in drafts and fill from the actual output before staging.
 
 **Recommendation:**
 Migrate to `node:test` (built-in, Node 18+) for all new test files — `nodeunit` is unmaintained. Do not convert existing tests; add `node:test` tests alongside. The HTTP/2 client mock harness (#UT1) should use `node:test + node:assert` natively.

package/framework/v0.5.1-alpha.3/VERSION

@@ -0,0 +1 @@
+0.5.1-alpha.3

package/framework/{v0.5.1-alpha.2 → v0.5.1-alpha.3}/core/controller/controller.js

@@ -3318,11 +3318,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 		// proxy_set_header X-Ingress-IP $server_addr
 		// proxy_set_header X-Forwarded-For $remote_addr;
 		// # EO - Specific headers for Gina
-        if ( typeof(local.req.headers['x-client-ip']) != 'undefined' && local.req.headers['x-client-ip'] != options.headers['x-client-ip'] ) {
+        if ( local.req != null && typeof(local.req.headers['x-client-ip']) != 'undefined' && local.req.headers['x-client-ip'] != options.headers['x-client-ip'] ) {
             options.headers['x-client-ip'] = local.req.headers['x-client-ip']
         }
 
-        if ( typeof(local.req.headers['x-ingress-ip']) != 'undefined' && local.req.headers['x-ingress-ip'] != options.headers['x-ingress-ip'] ) {
+        if ( local.req != null && typeof(local.req.headers['x-ingress-ip']) != 'undefined' && local.req.headers['x-ingress-ip'] != options.headers['x-ingress-ip'] ) {
             options.headers['x-ingress-ip'] = local.req.headers['x-ingress-ip']
         }
 
@@ -3859,15 +3859,29 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
         } = browser.constants;
 
 
-        if ( typeof(local.req.headers['x-requested-with']) != 'undefined' ) {
+        // #B33 — every retry re-entry (setTimeout → handleHTTP2ClientRequest) re-executes
+        // these forwards, and a terminal exit (e.g. redirect-then-continue) may have
+        // released local.req in between: each forward is null-guarded with query()'s own
+        // idiom. Skipping a forward on a released request is a no-op, not a behavior
+        // change — options.headers already carries the attempt-1 values (the same options
+        // object travels through every retry).
+        if ( local.req != null && typeof(local.req.headers['x-requested-with']) != 'undefined' ) {
             options.headers['x-requested-with'] = local.req.headers['x-requested-with']
         }
 
-        if ( typeof(local.req.headers['access-control-allow-credentials']) != 'undefined' ) {
+        if ( local.req != null && typeof(local.req.headers['access-control-allow-credentials']) != 'undefined' ) {
             options.headers['access-control-allow-credentials'] = local.req.headers['access-control-allow-credentials']
         }
 
-        if ( typeof(local.req.headers['content-type']) != 'undefined' && local.req.headers['content-type'] != options.headers['content-type'] ) {
+        // #FORMCT2 — never clobber an `application/json` outbound Content-Type with the
+        // INCOMING request's. query() serializes the inter-bundle body as raw JSON
+        // (queryData = JSON.stringify) and labels it application/json; forwarding the
+        // incoming CT here re-labels that JSON body (e.g. as urlencoded when the browser
+        // request was a plain form POST — canonical case: a haltedRequest resume), and the
+        // receiving bundle's urlencoded parse then corrupts `+`/`%XX` inside JSON string
+        // values (same corruption #FORMCT fixed in the browser validator). The forward is
+        // kept for non-JSON outbound bodies (e.g. the MSIE text/plain override).
+        if ( local.req != null && typeof(local.req.headers['content-type']) != 'undefined' && local.req.headers['content-type'] != options.headers['content-type'] && !/application\/json/i.test(options.headers['content-type']) ) {
             options.headers['content-type'] = local.req.headers['content-type']
         }
 
@@ -3877,11 +3891,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 		// proxy_set_header X-Ingress-IP $server_addr
 		// proxy_set_header X-Forwarded-For $remote_addr;
 		// # EO - Specific headers for Gina
-        if ( typeof(local.req.headers['x-client-ip']) != 'undefined' && local.req.headers['x-client-ip'] != options.headers['x-client-ip'] ) {
+        if ( local.req != null && typeof(local.req.headers['x-client-ip']) != 'undefined' && local.req.headers['x-client-ip'] != options.headers['x-client-ip'] ) {
             options.headers['x-client-ip'] = local.req.headers['x-client-ip']
         }
 
-        if ( typeof(local.req.headers['x-ingress-ip']) != 'undefined' && local.req.headers['x-ingress-ip'] != options.headers['x-ingress-ip'] ) {
+        if ( local.req != null && typeof(local.req.headers['x-ingress-ip']) != 'undefined' && local.req.headers['x-ingress-ip'] != options.headers['x-ingress-ip'] ) {
             options.headers['x-ingress-ip'] = local.req.headers['x-ingress-ip']
         }
 
@@ -4198,7 +4212,10 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
                 try {
                     // Intercepting fallback redirect (3xx)
-                    if (data.status && /^3/.test(data.status) && typeof data.headers !== 'undefined') {
+                    // #B33 — local.res may be null when the response lands after a terminal
+                    // exit released the triplet; skip the intercept and fall through to the
+                    // non-2xx handling (whose throwError no-ops on a released response).
+                    if (local.res != null && data.status && /^3/.test(data.status) && typeof data.headers !== 'undefined') {
                         local.res.writeHead(data.status, data.headers);
                         return local.res.end();
                     }
@@ -4270,7 +4287,10 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     }
                 }
 
-                if (data.status && /^3/.test(data.status) && typeof data.headers !== 'undefined') {
+                // #B33 — same released-response skip as the callback-mode intercept above;
+                // emitter mode falls through to the query#complete emit so listeners
+                // still learn the outcome.
+                if (local.res != null && data.status && /^3/.test(data.status) && typeof data.headers !== 'undefined') {
                     self.removeAllListeners(['query#complete']);
                     local.res.writeHead(data.status, data.headers);
                     return local.res.end();
@@ -4937,6 +4957,12 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
     var getSession = function() {
         var session = null;
+        // #B33 — local.req is null after a terminal exit released the triplet; callers
+        // like isHaltedRequest() run from HTTP/2 response handlers that can fire on a
+        // released request (retry/late-response paths). No session on a released request.
+        if ( local.req == null ) {
+            return null;
+        }
         if ( typeof(local.req.session) != 'undefined') {
             session = local.req.session;
         }

package/framework/{v0.5.1-alpha.2 → v0.5.1-alpha.3}/core/router.js

@@ -129,9 +129,38 @@ function Router(env, scope) {
         SuperController = require(_(corePath +'/controller/index.js', true));
 
         if (_hotReload) _hotReload.core = false; // #M6 — clear flag after eviction
+
+        pruneDeadModuleChildren();
         corePath = null;
     }
 
+    /**
+     * Prunes stale `Module` references from every cached module's `children`
+     * array after the eviction cycle above. Each cache-miss `require()` pushes
+     * the fresh `Module` onto the requiring module's `children` (Node only
+     * dedupes on cache hits), so without pruning this long-lived router module
+     * accumulates one dead controller `Module` per request, each pinning its
+     * whole evaluated exports graph — the dev-mode per-request memory leak.
+     *
+     * Local copy of the sweep in `core/server.isaac.js` — the engine-agnostic
+     * router cannot depend on an engine module, and the `lib` registry is
+     * itself evicted per request. Keep both copies in sync.
+     *
+     * @inner
+     * @returns {undefined}
+     */
+    var pruneDeadModuleChildren = function() {
+        var cacheIds = Object.keys(require.cache);
+        for (var i = 0, len = cacheIds.length; i < len; i++) {
+            var cached = require.cache[cacheIds[i]];
+            if (cached && cached.children && cached.children.length > 0) {
+                cached.children = cached.children.filter(function onPruneFilter(child) {
+                    return require.cache[child.id] === child;
+                });
+            }
+        }
+    }
+
     this.setServerInstance = function(serverInstance) {
         serverInstance._http2streamEventInitalized = false;
         self.serverInstance = serverInstance;

package/framework/{v0.5.1-alpha.2 → v0.5.1-alpha.3}/core/server.isaac.js

@@ -243,8 +243,48 @@ var refreshCore = function() {
     delete require.cache[require.resolve(pluginsIndexPath)];
     var freshPlugins = require( pluginsIndexPath );
     require.cache[_(corePath + '/gna.js', true)].exports.plugins = freshPlugins;
+
+    pruneDeadModuleChildren();
 }
 
+/**
+ * Prunes stale `Module` references from every cached module's `children` array.
+ *
+ * Each cache-miss `require()` pushes the freshly created `Module` onto the
+ * requiring module's `children` array — Node only dedupes on cache hits — so the
+ * per-request delete-and-re-require cycles in `refreshCore()` (and the router's
+ * `refreshCoreDependencies()`) make long-lived parents accumulate one dead
+ * `Module` per eviction: this engine module, `router.js`, and any module with a
+ * lazy in-function `require()` of an evicted lib. Every dead `Module` pins its
+ * entire evaluated exports graph. Measured on a minimal bundle in dev mode:
+ * ~1.8 MB of post-GC live heap retained per request, ending in a heap-limit
+ * OOM (SIGABRT) at ~2400 requests.
+ *
+ * Keeping only children whose resolved id still maps to that same instance in
+ * `require.cache` releases the dead graphs. `children` is diagnostic metadata
+ * (nothing in Node's resolution reads it), so pruning never unloads a module
+ * still referenced elsewhere.
+ *
+ * A local copy of the same sweep lives in `core/router.js` — the engine-agnostic
+ * router cannot depend on an engine module, and the `lib` registry is itself
+ * evicted per request. Keep both copies in sync.
+ *
+ * @memberof module:gina/core/server.isaac
+ * @inner
+ * @returns {undefined}
+ */
+var pruneDeadModuleChildren = function() {
+    var cacheIds = Object.keys(require.cache);
+    for (var i = 0, len = cacheIds.length; i < len; i++) {
+        var cached = require.cache[cacheIds[i]];
+        if (cached && cached.children && cached.children.length > 0) {
+            cached.children = cached.children.filter(function onPruneFilter(child) {
+                return require.cache[child.id] === child;
+            });
+        }
+    }
+};
+
 // Express compatibility
 const slice = Array.prototype.slice;
 

package/framework/{v0.5.1-alpha.2 → v0.5.1-alpha.3}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.5.1-alpha.2",
+  "version": "0.5.1-alpha.3",
   "dependencies": {
     "@rhinostone/swig": "^2.7.2",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.5.1-alpha.2/core/gna');
+var _gna = require('./framework/v0.5.1-alpha.3/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.5.1-alpha.2/core/controller');
-var EntitySuper     = require('./framework/v0.5.1-alpha.2/core/model/entity');
+var SuperController = require('./framework/v0.5.1-alpha.3/core/controller');
+var EntitySuper     = require('./framework/v0.5.1-alpha.3/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.5.1-alpha.2/lib/uuid');
+var uuid = require('./framework/v0.5.1-alpha.3/lib/uuid');
 
 module.exports = {