gina 0.5.11 → 0.5.12

package/CHANGELOG.md

@@ -6,6 +6,31 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.12 - 2026-07-08
+### Added
+* FormValidator built-in rule error messages can now be localised per culture on the client. The negotiated request culture is exposed to the browser as `gina.config.culture`, and an app registers its own per-culture label overrides via `gina.validator.setErrorLabels(labels[, culture])`; English defaults fill any untranslated rule, with a culture -> base-language -> English fallback. This matches the framework per-bundle i18n model — custom rule messages were already localisable, and this closes the gap for the built-in labels without the framework shipping translations. Server-side rendering keeps the English defaults for now.
+* Per-bundle i18n message catalogs (`bundle/locales/<culture>.json`) are now loaded at bundle boot, activating URL-prefix, cookie, and Accept-Language culture negotiation and `t()` / the `t` template filter for any bundle that ships a `locales/` directory. Loading is opt-in and non-fatal: a bundle with no `locales/` directory is unaffected, and a malformed catalog is warned rather than blocking boot.
+* Forms declaring `data-gina-form-rule` with a matching rule set now validate in the browser automatically at page load — the client bundle boots the form validator itself, so no per-page boot code is required (the same batteries-included behaviour the built-in `data-gina-dialog` popin already has). Bundle code constructs the validator explicitly only to attach submit/lifecycle handlers; that still works and is idempotent with the auto-boot.
+* Server-side FormValidator built-in rule error labels now localise from the bundle catalog, mirroring the client side. Pass the negotiated culture to the validator and the built-in labels (isEmail, isRequired, and the rest) resolve from `bundle/locales/<culture>.json` under the `_validator.<rule>` namespace, with the English defaults filling any gaps and a culture -> base-language -> English fallback. A per-field or per-rule error message still takes precedence.
+* Client-side FormValidator built-in rule error labels now localise from the bundle catalog automatically, without an app calling `gina.validator.setErrorLabels()`. The negotiated culture's `_validator.<rule>` subset from `bundle/locales/<culture>.json` is whispered to the browser and overlaid over the English defaults (catalog wins per key, English fills gaps). An explicit `setErrorLabels()` override still takes precedence, so the order is setErrorLabels > bundle catalog > English. A per-field or per-rule error message still wins over all of this.
+### Fixed
+* CLI: an @<project> token starting with a character outside [a-z0-9_.] (an uppercase letter, a dash, or a bare @) was silently ignored by the shared command bootstrap — the command then ran against the current-directory project or all projects with exit code 0, and a mutating task like bundle:add could target the wrong project while reporting success. Such tokens are now rejected with the standard `is not a valid project name` error and exit code 1, across all command groups.
+* project:add exited 1 after a successful registration whenever the framework home was overridden (GINA_HOMEDIR): the CLI bootstrap strips GINA_* from process.env, so the spawned link child resolved the default home, missed the just-registered project, and failed the node_modules/gina symlink step. The child now receives the parent's home explicitly (the Shell helper gains an opt-in env option), and a genuine link failure surfaces the tail of the child's captured output in the error instead of discarding it.
+* Fixed project:add --scope/--env: the scope:add/env:add child commands now invoke the running install's own CLI with the framework home re-exported — a GINA_HOMEDIR override no longer writes the scope or environment into the default home, a host without gina on PATH no longer fails the scaffold, and a successful child is no longer misreported as "could not be set" with exit code 1.
+* Fixed home-override blindness in the remaining CLI child invocations: the auto-link commands run on project/bundle start/stop/restart and the project:start/stop/restart bundle delegations now re-export GINA_HOMEDIR to their children — under a home override they no longer act on the default home (previously they silently created node_modules links and scaffold artifacts there and exited 0).
+* Fixed the static directory-to-index redirect on HTTP/1.x: outside dev mode, a request for a directory URL containing an index.html answered 200 with a Location header — browsers rendered a blank page instead of following it. The branch now sends 301 unconditionally, matching the HTTP/2 path; the no-cache headers remain dev-only.
+* Fixed bulk bundle:start/stop/restart (the no-name form and the project:start/stop/restart delegations) on a project that has no bundles yet: the commands indexed an undefined bundle — stop reported a phantom undefined@<project> bundle, restart crashed with a TypeError, and start's crash inside the framework daemon took the daemon down for every project on the host. All three now answer with a clear message (stop exits 0; start/restart point at gina bundle:add and use the error path), and bundle:restart with an unregistered bundle name now gets the clean "is not registered" message instead of the same crash.
+* CLI: `project:start @<project>` and `service:start @<project>` never delegated. The shared start-action version gate parsed the `@<project>` reference as a framework version, printed `Wrong version: <name>`, and then — with the CLI message-queue listener holding the event loop — hung forever, or exited 0 without delegating when invoked through the `gina` wrapper. The version override is now scoped to the framework topic, so a project or service reference falls through to its own handler and delegates as documented. The version-reject paths — both here and in the `gina stop @<version>` / `gina restart @<version>` handlers — now flush their message and exit with a non-zero code instead of a bare return that could hang the CLI, and an unknown short version reports `Version not installed` rather than crashing.
+* Proxied XHR and popin (`isXhrRedirect`) redirect responses now carry the same `no-store` cache directives as plain redirects, so a browser or intermediary cache cannot serve a stale proxy-derived target host. Also guards a session-less bundle against a 500 when an XHR redirect carries request parameters.
+* FormValidator no longer natively disables a form's submit `<button>` while live-checking reports the form invalid. A natively-disabled `<button>` emits no click event, so the trigger became a dead no-op with no feedback. The invalid submit trigger is now marked `aria-disabled="true"` plus the class `gina-form-submit-disabled` and stays operable, so a click still surfaces every field error and focuses the first invalid field — while the actual submit stays gated on validity. Consumers should style the `[aria-disabled="true"]` / `.gina-form-submit-disabled` submit-trigger state (the framework ships no button CSS). A submit button rendered `disabled` in markup still enables on valid input or when live-check is off.
+* A popin (or `data-gina-dialog`) redirect that tunnels back to the same target (`_self`) no longer intermittently opens the popin against an empty, not-yet-loaded body. The redirect handler used to issue the follow-up load and then force the popin open after a fixed 50 ms delay; when that load took longer than 50 ms, the popin could open before its content arrived. It now issues the load and lets the popin open once the content is in place (the framework already opens it content-first). Redirects to other targets (`_blank` / `_parent` / `_top`) are unaffected.
+* A required form field left empty no longer shows two validation messages at once (e.g. "is required" AND "is not valid"). An empty value is now decided by the `isRequired` rule alone, so `isEmail` / `isJsonWebToken` / `isFloat` / `isInList` / `isString` no longer add a second "invalid" message on top of "is required". Optional empty fields still pass, and a filled-but-invalid value still reports its own rule error.
+* A hover- or focus-warmed AJAX popin trigger (`data-gina-dialog-src` / legacy `data-gina-popin-url`) whose GET returned an XHR redirect (an `application/json` `{isXhrRedirect, location}` response) opened the popin showing the raw JSON as its body instead of following the redirect. The hover/focus preload now declines JSON responses, so the click defers to the standard load path that handles the redirect/reload exactly as a non-preloaded click (such a trigger re-fetches once on click).
+* Fixed the CLI framework-not-installed guard messages, which told users to run a non-existent `gina framework:install <version>` command; they now point at the real `gina framework:add <version>` command.
+* FormValidator: a cross-field `is` rule (e.g. `"is": "$a === $b"`) no longer throws when the referenced field is empty. The uncaught error had aborted the whole-form validity pass, leaving the submit trigger ungated on an invalid form — which broke the documented value-confirmation pattern (`is` paired with `isRequired`) the entire time the confirm field was still blank. An empty referenced operand is now rendered as a parseable empty string (a normal mismatch), and an unparseable condition fails the field instead of throwing so a per-keystroke live check can never abort the gate.
+* Per-request culture negotiation was inert: the negotiated `req.culture` (whispered to the browser as `gina.config.culture`) always resolved to `en` or empty, regardless of the bundle or environment culture. The framework moves `GINA_*` variables off `process.env` at init, so the negotiator environment-default step and the swig/nunjucks `t` filter fallbacks read a variable that was always undefined, and the per-request call never supplied a bundle default. The negotiator now reads the bundle `settings.region.culture` as the default and the `GINA_CULTURE` process default through the live accessor, so a configured culture reaches every request. Precedence: URL prefix, cookie, Accept-Language, then bundle culture, then `GINA_CULTURE`, then `en`.
+* Per-request culture negotiation was skipped on cached routes: the negotiated `req.culture` (whispered to the browser as `gina.config.culture`) was resolved only on the first (uncached) request to a URL and left empty on every subsequent cached request. So a warm page reload lost the negotiated culture, and any client-side culture-gated behaviour (such as localised form-validator labels) reverted to the default. The routing cache serves the second and later hits to a URL from a fast-path that ran before the negotiation step; the culture is now re-negotiated per request on that path too, and is never cached with the route (it varies per request by cookie and Accept-Language). Precedence is unchanged: URL prefix, cookie, Accept-Language, bundle culture, GINA_CULTURE, then en.
+
 ## 0.5.11 - 2026-07-05
 ### Added
 * New `image:build` command — first-class OCI packaging: `gina image:build [<bundle>] @<project>` synthesizes a Containerfile + build context from the project's registered state (bundles, entry, ports, env model, node floor) and executes the build with buildah, natively on Linux or on a container host reached over ssh. Host resolution precedence: `GINA_CONTAINER_HOST=ssh://[user@]host[:port]` env override, then native buildah, then `container.host` in `~/.gina/<shortVersion>/settings.json`; with none available the command fails naming both surfaces. The selected `--env` bakes dev/prod parity — a non-dev env ships the release tree built in-image by `gina bundle:build`, with `GINA_DEV_ENV` kept distinct so the container never runs dev-mode hot-reload; the image boots via `gina-init` + `gina-container` (SIGTERM drain) and the `EXPOSE` port is computed deterministically from the `gina-init` allocator. `${secret:KEY}` config placeholders ride byte-verbatim and resolve from the container environment at runtime — no secret value is ever read or baked at build time. Wire contract: `--emit` prints the synthesized Containerfile + entrypoint + context manifest and builds nothing (`--emit --format=json` emits `{ project, bundle, env, scope, image, tag, exposedPort, containerfile, entrypoint, context }`); `--format=json` one-shot emits `{ project, bundle, image, tag, imageId?, durationMs, host, exposedPort }` on stdout, exit 0; `--stream` emits NDJSON frames — `start` then `step` then `log` lines then a terminal `done` (carrying the one-shot shape) or `error` frame; failures exit 1 with the reason on stdout. Flags: `--env`, `--scope`, `--tag=<ref>` (default `<project>/<bundle>:<env>`), `--platform=linux/arm64|linux/amd64` (default build-host native), `--start-port-from` (default 3100), `--gina-version` (default: the project's registered framework version, installed from the npm registry).

package/README.md

@@ -42,6 +42,15 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
+## What's in 0.5.12
+
+- **Added — FormValidator built-in rule labels localise from the i18n catalog, client and server.** The built-in rule messages (`isEmail`, `isRequired`, and the rest) now resolve per culture from `bundle/locales/<culture>.json` under the `_validator.<rule>` namespace, on both the server-rendered and client-side validation paths — English defaults fill any gaps, with a culture → base-language → English fallback. An app can still override per key with `gina.validator.setErrorLabels(labels[, culture])` (precedence: `setErrorLabels` > bundle catalog > English), and a per-field or per-rule message still wins over all of it.
+- **Added — per-bundle i18n catalogs activate culture negotiation and `t()`.** A bundle that ships a `locales/` directory now loads its catalogs at boot, activating URL-prefix / cookie / `Accept-Language` culture negotiation, the `t()` global, and the `t` template filter (opt-in and non-fatal — no `locales/` → unaffected; a malformed catalog warns rather than blocking boot). Two fixes make the negotiated culture actually reach every request: it previously resolved to `en`/empty regardless of configuration (#B83), and was dropped on warm/cached page reloads (#B84).
+- **Added — `data-gina-form-rule` forms auto-boot the client validator.** A form declaring `data-gina-form-rule` with a matching rule set now validates in the browser automatically at page load, with no per-page boot code — the same batteries-included behaviour as `data-gina-dialog` popins. Explicit construction to attach submit/lifecycle handlers still works and is idempotent with the auto-boot.
+- **Fixed — FormValidator correctness.** An empty required field shows a single "is required" message instead of also stacking "invalid" (#B78); a cross-field `is` rule no longer throws (and ungates the form) when the referenced field is still empty (#B82); and an invalid submit trigger is now marked `aria-disabled` + `.gina-form-submit-disabled` instead of natively `disabled`, so a click still surfaces every field error and focuses the first invalid field (#B76) — consumers should style that state (the framework ships no button CSS).
+- **Fixed — popin / redirect robustness.** A hover/focus-warmed popin whose GET returned an XHR redirect no longer shows raw JSON (#B80); a `_self` popin redirect no longer intermittently opens against a not-yet-loaded body (#B77); XHR/popin redirect responses carry the same `no-store` directives as plain redirects (#B75); and the HTTP/1.x static directory-to-index redirect now sends an unconditional 301 outside dev instead of a blank 200.
+- **Fixed — CLI robustness.** A malformed `@<project>` token (uppercase / dash / bare `@`) is now rejected with a clear error and exit 1 instead of silently targeting the wrong project (#B69); `GINA_HOMEDIR` is re-exported to every spawned child command so a home override is honoured; `project:start` / `service:start` delegate instead of hanging on a version-gate misparse; bulk `start` / `stop` / `restart` on a bundle-less project answer cleanly instead of crashing the daemon; and the framework-not-installed hint points at the real `gina framework:add` (#B81).
+
 ## What's in 0.5.11
 
 - **Added — `gina image:build`: first-class OCI packaging.** Package a project bundle as a standard OCI image with one command: it synthesizes a `Containerfile` + build context from the project's registered state (bundles, entry, ports, env model, Node engine floor) and executes the build with buildah — natively on Linux, or on a container host reached over ssh (`GINA_CONTAINER_HOST=ssh://[user@]host[:port]` env override → native buildah → `container.host` in `~/.gina/<shortVersion>/settings.json`). A non-dev `--env` ships the release tree built in-image by `gina bundle:build`, so a production image never runs dev-mode hot-reload; the image boots via `gina-init` + `gina-container` (SIGTERM drain) and the `EXPOSE`d port is computed deterministically from the port allocator. `${secret:KEY}` placeholders ride byte-verbatim and resolve from the container environment at runtime — never baked. `--emit` prints the synthesized artifact without building; `--format=json` emits a one-shot machine-readable result; `--stream` emits NDJSON progress frames for CI/GUI consumers.

package/ROADMAP.md

@@ -36,6 +36,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.9` ✅ | **Security**: reverse-proxied deployments no longer disclose a bundle's internal `scheme://host:port` to the browser — the client `gina.config.hostname` and the fetched `/_gina/assets/routing.json` serve a public host-only origin and a host-stripped routing map to proxied clients (direct `host:port` access byte-identical), also fixing cross-bundle client `getRoute(...).toUrl()` which previously resolved to the unreachable internal host (#B66) · **Fixed**: the server-side URL / redirect / config resolvers request-scope the proxy host, so a worker serving mixed proxied + direct traffic (or several public hosts) no longer inherits a stale proxied host (#B66 S2b) · **Fixed**: `connector:add` / `connector:rm` / `connector:migrate --fix` no longer corrupt a comment-headed `connectors.json` · **Fixed**: a latent `ReferenceError` in server-side URL resolution for redirect-flagged routes |
 | **Q3 2026** | `0.5.10` ✅ | **Fixed**: server-side cross-bundle `getRoute('route@bundle').toUrl()` now resolves the public host on reverse-proxied deployments — a controller building a cross-bundle URL server-side (e.g. via `self.redirect`) could emit an unreachable internal host with a doubled web root on a proxied request; it now resolves the public host for both the Isaac and Express engines. Completes the `0.5.9` client-side cross-bundle URL fix on the server side (#B67) |
 | **Q3 2026** | `0.5.11` ✅ | `image:build` — first-class OCI packaging: synthesizes a Containerfile + build context from the project's registered state (bundles, entry, ports, env model, node floor) and builds with buildah, natively on Linux or on a container host over ssh (env override → native → `container.host` settings fallback); dev/prod parity (a non-dev env ships the release tree built in-image), deterministic `EXPOSE`, `${secret:KEY}` placeholders never baked; `--emit` / `--format=json` / `--stream` NDJSON for CI and GUI consumers · **Fixed**: framework-emitted redirects on proxied requests carry no-store cache headers, so a browser never caches a proxy-context-derived redirect (the inter-bundle query 3xx forward path inherits the set; direct production redirects unchanged) |
+| **Q3 2026** | `0.5.12` ✅ | FormValidator built-in rule labels localise from the per-bundle i18n catalog (`_validator.<rule>`) on both the client and server, with a `gina.validator.setErrorLabels()` per-key override · per-bundle i18n catalogs activate URL-prefix / cookie / `Accept-Language` culture negotiation and `t()` at boot, and the negotiated culture now reaches every request (it previously resolved to `en`/empty #B83, and was dropped on warm/cached reloads #B84) · `data-gina-form-rule` forms auto-boot the client validator · **Fixed**: validator correctness (empty-required single message #B78, cross-field `is` empty operand #B82, submit trigger stays operable via `aria-disabled` #B76), popin / redirect robustness (#B80 / #B77 / #B75, static directory-to-index 301 outside dev), and CLI robustness (malformed `@<project>` rejected #B69, `GINA_HOMEDIR` re-export across child commands, `project:start` / `service:start` delegation, zero-bundle bulk commands, `framework:add` install hint #B81) |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 

package/bin/cli

@@ -72,7 +72,7 @@ async function onExec() {
         // registration never runs). The sibling guard further down (resolving
         // GINA_FRAMEWORK_DIR) runs too late — after this require.
         if ( !fs.existsSync(frameworkPath) ) {
-            process.stderr.write('gina: framework version ' + version + ' is not installed (expected at ' + frameworkPath + ').\nInstalled package version is ' + packObj.version + '.\nTry:\n  $ gina framework:install ' + version + '\n');
+            process.stderr.write('gina: framework version ' + version + ' is not installed (expected at ' + frameworkPath + ').\nInstalled package version is ' + packObj.version + '.\nTry:\n  $ gina framework:add ' + version + '\n');
             return process.exit(1);
         }
         var generator   = require(frameworkPath + '/lib/generator');
@@ -282,7 +282,7 @@ async function onExec() {
         }
 
         if ( !fs.existsSync(frameworkPath) ) {
-            console.alert('Could not find version ' + version + '.\nFirst try:\n$ gina framework:install ' + version);
+            console.alert('Could not find version ' + version + '.\nFirst try:\n$ gina framework:add ' + version);
             process.exit(1)
         }
 

package/framework/v0.5.12/VERSION

@@ -0,0 +1 @@
+0.5.12