gina 0.5.11 → 0.5.12

package/framework/{v0.5.11 → v0.5.12}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -2854,8 +2854,12 @@ if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
  * @param {object} [ $fields ] - isGFFCtx only
  * @param {object} [ xhrOptions ] - isGFFCtx only
  * @param {object} [ fieldsSet ] - isGFFCtx only; required for when ginaFormLiveCheckEnabled
+ * @param {string} [ culture ] - !isGFFCtx (server) only; per-request culture (e.g. "fr_FR").
+ *      When a string, built-in rule labels resolve from the bundle catalog's
+ *      `_validator.<rule>` namespace (catalog wins per key, English defaults fill).
+ *      A non-string (e.g. the routing-mode rule object) is ignored by the overlay guard.
  * */
-function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
+function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
     var isGFFCtx        = ( ( typeof(module) !== 'undefined' ) && module.exports ) ? false : true;
 
@@ -2866,6 +2870,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
     var helpers         = (isGFFCtx) ? {} : require('../../../../../helpers');
     var dateFormat      = (isGFFCtx) ? require('helpers/dateFormat') : helpers.dateFormat;
     var routing         = (isGFFCtx) ? require('lib/routing') : require('../../../../../lib/routing');
+    // #i18n (server only) - bundle catalog access for built-in-label localization.
+    var i18n            = (isGFFCtx) ? null : require('../../../../../lib/i18n');
 
     /**
      * #CSRF2 follow-up — read the gina-csrf-token cookie set by the Csrf plugin.
@@ -2957,7 +2963,15 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
         'excluded': []
     };
 
-    local.errorLabels = {
+    // Built-in rule labels default to English. When the browser has a negotiated
+    // culture on `gina.config.culture` AND the app registered per-culture overrides
+    // via `gina.validator.setErrorLabels()`, overlay that culture's labels over the
+    // English defaults (app label wins per key, English fills gaps — same merge
+    // direction as `setErrorLabels()` below). Fallback: exact culture (`fr_FR`) ->
+    // base language (`fr`) -> English. Server-side (`!isGFFCtx`) and when nothing is
+    // registered, English is used verbatim. A per-field/rule `error` still wins over
+    // all of this (see `this.error || local.errorLabels[...]` at each rule).
+    var _defaultErrorLabels = {
         'is': 'Condition not satisfied',
         'isEmail': 'A valid email is required',
         'isRequired': 'Cannot be left empty',
@@ -2985,6 +2999,63 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
         'isApiError': 'Condition not satisfied',
         'isInList': 'Must be one of: %s'
     };
+    local.errorLabels = _defaultErrorLabels;
+    // #i18n (server) — resolve built-in rule labels from the bundle catalog's
+    // `_validator.<rule>` namespace for the negotiated `culture`. Mirrors the client
+    // overlay below (catalog wins per key, English defaults fill gaps — target-wins
+    // merge). Existence-guarded via i18n.resolveKey (undefined on miss, never `t()`
+    // which echoes the raw key). A per-field/rule `error` still wins (see
+    // `this.error || local.errorLabels[...]` at each rule).
+    if ( !isGFFCtx && i18n && typeof(culture) === 'string' && culture ) {
+        var _vBundle = getContext('bundle');
+        if (_vBundle) {
+            var _vChain = i18n.walkFallback(culture), _vNode = null;
+            for (var _vi = 0; _vi < _vChain.length; _vi++) {
+                var _vCat = i18n.getCatalog(_vBundle, _vChain[_vi]);
+                if (_vCat) {
+                    var _vFound = i18n.resolveKey(_vCat, '_validator');
+                    if (_vFound && typeof(_vFound) === 'object') { _vNode = _vFound; break; }
+                }
+            }
+            if (_vNode) { local.errorLabels = merge(JSON.clone(_vNode), _defaultErrorLabels); }
+        }
+    }
+    // #i18n (client) — overlay built-in rule labels for the negotiated culture.
+    // Precedence (highest first): app `setErrorLabels()` overrides
+    // (`gina.validator._errorLabelsByCulture[<culture>]`) > server-whispered bundle
+    // catalog subset (`gina.config.validatorLabels`, resolved server-side for
+    // `gina.config.culture`) > English defaults. Each layer is applied by a
+    // target-wins/source-fills merge over the running `local.errorLabels`, so a
+    // higher layer wins per key and lower layers fill gaps. Client only (isGFFCtx);
+    // a per-field/rule `error` still wins over all of this.
+    if (
+        isGFFCtx
+        && typeof(gina) != 'undefined'
+        && typeof(gina.config) != 'undefined'
+    ) {
+        var _culture       = gina.config.culture;
+        var _baseLang      = ( _culture && _culture.indexOf('_') > 0 ) ? _culture.substr(0, _culture.indexOf('_')) : _culture;
+        // layer 3 (highest) — app-registered per-culture overrides (setErrorLabels)
+        var _cultureLabels = ( typeof(gina.validator) != 'undefined' && gina.validator._errorLabelsByCulture && _culture )
+            ? ( gina.validator._errorLabelsByCulture[_culture]
+                || ( _baseLang ? gina.validator._errorLabelsByCulture[_baseLang] : null )
+                || null )
+            : null;
+        // layer 2 — server-whispered bundle catalog subset (culture-resolved server-side)
+        var _catalogLabels = null;
+        if ( gina.config.validatorLabels && typeof(gina.config.validatorLabels) == 'object' ) {
+            for (var _clk in gina.config.validatorLabels) {
+                if ( gina.config.validatorLabels.hasOwnProperty(_clk) ) { _catalogLabels = gina.config.validatorLabels; break; }
+            }
+        }
+        // apply lowest-precedence layer first, then let each higher layer win per key
+        if (_catalogLabels) {
+            local.errorLabels = merge(JSON.clone(_catalogLabels), local.errorLabels);
+        }
+        if (_cultureLabels) {
+            local.errorLabels = merge(JSON.clone(_cultureLabels), local.errorLabels);
+        }
+    }
     var self  = null;
     if (!data) {
         throw new Error('missing data param')
@@ -3864,31 +3935,42 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                                 var _SCS_BINARY_RE = /^\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;
                                 var _scsBinMatch = (typeof(compiledCondition) == 'string') ? compiledCondition.match(_SCS_BINARY_RE) : null;
                                 if (!_scsBinMatch) {
-                                    throw new Error('Could not evaluate condition `' + compiledCondition + '`.\n(grammar: <operand><op><operand>; operand ∈ number | "string" | true | false | null | undefined; op ∈ === !== == != < > <= >=)');
-                                }
-                                var _scsParseOperand = function(s) {
-                                    var _t = s.replace(/^\s+|\s+$/g, '');
-                                    if (_t === 'null')      return null;
-                                    if (_t === 'undefined') return undefined;
-                                    if (_t === 'true')      return true;
-                                    if (_t === 'false')     return false;
-                                    if (/^"[^"]*"$/.test(_t)) return _t.slice(1, -1);
-                                    var _n = Number(_t);
-                                    if (!isNaN(_n) && _t !== '') return _n;
-                                    throw new Error('Invalid operand: `' + s + '`');
-                                };
-                                var _scsLeft  = _scsParseOperand(_scsBinMatch[1]);
-                                var _scsOp    = _scsBinMatch[2];
-                                var _scsRight = _scsParseOperand(_scsBinMatch[3]);
-                                switch (_scsOp) {
-                                    case '===': isValid = _scsLeft === _scsRight; break;
-                                    case '!==': isValid = _scsLeft !== _scsRight; break;
-                                    case '==':  isValid = _scsLeft ==  _scsRight; break;
-                                    case '!=':  isValid = _scsLeft !=  _scsRight; break;
-                                    case '<':   isValid = _scsLeft <   _scsRight; break;
-                                    case '>':   isValid = _scsLeft >   _scsRight; break;
-                                    case '<=':  isValid = _scsLeft <=  _scsRight; break;
-                                    case '>=':  isValid = _scsLeft >=  _scsRight; break;
+                                    // A condition that doesn't fit the grammar (e.g. a dangling
+                                    // operator left by an empty cross-field reference) must FAIL
+                                    // THE FIELD, not throw: is() runs on every keystroke during
+                                    // live-check, and an uncaught throw propagates out of the
+                                    // whole-form validity pass (main.js checkFieldAgainstRules
+                                    // re-wraps + re-throws it), leaving the submit trigger ungated.
+                                    // A genuine authoring typo stays visible via the warning
+                                    // without killing live validation. Fail-closed: the field is
+                                    // treated as invalid on both the client and the server.
+                                    console.warn('[FormValidator] Could not evaluate condition `' + compiledCondition + '` - treating field as invalid.\n(grammar: <operand><op><operand>; operand ∈ number | "string" | true | false | null | undefined; op ∈ === !== == != < > <= >=)');
+                                    isValid = false;
+                                } else {
+                                    var _scsParseOperand = function(s) {
+                                        var _t = s.replace(/^\s+|\s+$/g, '');
+                                        if (_t === 'null')      return null;
+                                        if (_t === 'undefined') return undefined;
+                                        if (_t === 'true')      return true;
+                                        if (_t === 'false')     return false;
+                                        if (/^"[^"]*"$/.test(_t)) return _t.slice(1, -1);
+                                        var _n = Number(_t);
+                                        if (!isNaN(_n) && _t !== '') return _n;
+                                        throw new Error('Invalid operand: `' + s + '`');
+                                    };
+                                    var _scsLeft  = _scsParseOperand(_scsBinMatch[1]);
+                                    var _scsOp    = _scsBinMatch[2];
+                                    var _scsRight = _scsParseOperand(_scsBinMatch[3]);
+                                    switch (_scsOp) {
+                                        case '===': isValid = _scsLeft === _scsRight; break;
+                                        case '!==': isValid = _scsLeft !== _scsRight; break;
+                                        case '==':  isValid = _scsLeft ==  _scsRight; break;
+                                        case '!=':  isValid = _scsLeft !=  _scsRight; break;
+                                        case '<':   isValid = _scsLeft <   _scsRight; break;
+                                        case '>':   isValid = _scsLeft >   _scsRight; break;
+                                        case '<=':  isValid = _scsLeft <=  _scsRight; break;
+                                        case '>=':  isValid = _scsLeft >=  _scsRight; break;
+                                    }
                                 }
                             }
 
@@ -3971,7 +4053,9 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
             var isValid     = rgx.test(this['value']) ? true : false;
             var errors      = self[this['name']]['errors'] || {};
 
-            if ( !errors['isRequired'] && this.value == '' ) {
+            // #B78 - an empty value is adjudicated by isRequired alone: bypass on empty so a
+            // required+empty field records only isRequired, not a second 'invalid' message.
+            if ( this.value == '' ) {
                 isValid = true;
             }
 
@@ -3984,7 +4068,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                 //delete errors['stack'];
             }
 
-            this.valid = isValid;
+            // #B78 - keep .valid consistent with a surviving isRequired error.
+            this.valid = isValid && !errors['isRequired'];
 
             if ( errors.count() > 0 )
                 this['errors'] = errors;
@@ -4010,7 +4095,9 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
             var isValid     = rgx.test(this['value']) ? true : false;
             var errors      = self[this['name']]['errors'] || {};
 
-            if ( !errors['isRequired'] && this.value == '' ) {
+            // #B78 - an empty value is adjudicated by isRequired alone: bypass on empty so a
+            // required+empty field records only isRequired, not a second 'invalid' message.
+            if ( this.value == '' ) {
                 isValid = true;
             }
 
@@ -4023,7 +4110,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                 //delete errors['stack'];
             }
 
-            this.valid = isValid;
+            // #B78 - keep .valid consistent with a surviving isRequired error.
+            this.valid = isValid && !errors['isRequired'];
 
             if ( errors.count() > 0 )
                 this['errors'] = errors;
@@ -4369,7 +4457,9 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                 isValid = false
             }
 
-            if ( !errors['isRequired'] && this.value == '' ) {
+            // #B78 - an empty value is adjudicated by isRequired alone: bypass on empty so a
+            // required+empty field records only isRequired, not a second 'invalid' message.
+            if ( this.value == '' ) {
                 isValid = true
             }
 
@@ -4377,7 +4467,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                 errors['isFloat'] = replace(this.error || local.errorLabels['isFloat'], this)
             }
 
-            this.valid = isValid;
+            // #B78 - keep .valid consistent with a surviving isRequired error.
+            this.valid = isValid && !errors['isRequired'];
             if ( errors.count() > 0 )
                 this['errors'] = errors;
 
@@ -4513,7 +4604,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
 
                 if (!isValid && errors['isRequired'] && val == '') {
                     isValid = false;
-                    errors['isString'] = replace(this['error'] || local.errorLabels['isString'], this);
+                    // #B78 - required+empty is adjudicated by isRequired alone; keep the field
+                    // invalid (isValid stays false) but do NOT pile on a second 'must be a string' message.
                 } else if (!isValid && !errors['isRequired']) {
                     isValid = true;
                 }
@@ -4703,7 +4795,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
             var val     = local.data[this.name] = this.value;
             var isValid = false;
 
-            if ( !errors['isRequired'] && (val === '' || val == null) ) {
+            // #B78 - an empty/null value is adjudicated by isRequired alone.
+            if ( (val === '' || val == null) ) {
                 isValid = true;
             } else if ( allowedValues.indexOf(val) > -1 ) {
                 isValid = true;
@@ -4716,7 +4809,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                 delete errors['isInList'];
             }
 
-            this.valid = isValid;
+            // #B78 - keep .valid consistent with a surviving isRequired error.
+            this.valid = isValid && !errors['isRequired'];
             if ( errors.count() > 0 ) {
                 this['errors'] = errors;
             }
@@ -9727,8 +9821,15 @@ if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
  * @param {object} rule
  * @param {object} [ data ] // from request
  * @param {string} [ formId ]
+ * @param {string} [ culture ] // #i18n — per-request culture (e.g. "fr_FR"). On the
+ *      server (`!isGFFCtx`) form-body path it is threaded to FormValidator so built-in
+ *      rule labels resolve from the bundle catalog's `_validator.<rule>` namespace.
+ *      The routing-mode call (`new Validator('routing', _data, null, _rule)`) lands its
+ *      inert rule object in this slot; the overlay's `typeof culture === 'string'` guard
+ *      ignores non-strings, and route-matching runs before culture negotiation, so
+ *      routing-requirement labels stay English by design.
  * */
-function ValidatorPlugin(rules, data, formId) {
+function ValidatorPlugin(rules, data, formId, culture) {
 
     this.plugin = 'validator';
 
@@ -9827,7 +9928,9 @@ function ValidatorPlugin(rules, data, formId) {
         'validateFormById'  : null,
         'setOptions'        : null,
         'resetErrorsDisplay': null,
-        'resetFields'       : null
+        'resetFields'       : null,
+        'setErrorLabels'    : null,
+        '_errorLabelsByCulture' : {}
     };
 
     // validator proto
@@ -9972,7 +10075,7 @@ function ValidatorPlugin(rules, data, formId) {
      * @param {object} rules
      * @param {object} [customRule]
      * */
-    var backendInit = function (rules, data, formId) {
+    var backendInit = function (rules, data, formId, culture) {
 
         var $form = ( typeof(formId) != 'undefined' ) ? { 'id': formId } : null;
         var fields = {};
@@ -9994,11 +10097,11 @@ function ValidatorPlugin(rules, data, formId) {
 
             backendProto.rules = instance.rules;
 
-            return validate($form, fields, null, instance.rules)
+            return validate($form, fields, null, instance.rules, null, culture)
 
         } else {
             // without rules - by hand
-            return new FormValidator(fields)
+            return new FormValidator(fields, undefined, undefined, undefined, culture)
         }
     }
 
@@ -16227,14 +16330,31 @@ function ValidatorPlugin(rules, data, formId) {
         ) {
             console.warn('This might be normal, so do not worry if this form is handled by your javascript: `'+ $formInstance.id +'`\nGina could not complete `updateSubmitTriggerState()`: `submitTrigger` might not be attached to form instance `'+ $formInstance.id +'`\nTo disable this warning, You just need to disable `Form Live Checking on your form by adding to your <form>: `data-gina-form-live-check-enabled=false``')
         } else if ( document.getElementById($formInstance.submitTrigger) ) {
+            // Represent the "invalid + live-check-on" state with aria-disabled + a class
+            // INSTEAD of the native `disabled` property. A natively-disabled <button>
+            // emits no click event, so the form-level click -> validate -> show-all-errors
+            // -> focus-first guard (the `validate.<id>` listener) never fires: the button
+            // looks dead and gives zero feedback. aria-disabled keeps the trigger operable,
+            // so the click still runs validation (revealing every invalid field + focusing
+            // the first) while `isValid()` (the real gate) still blocks the send. Mirrors
+            // gina's own <a>-tag submit-trigger handling, which already uses aria-disabled
+            // in-flight. The show branch KEEPS clearing native `disabled` so a trigger
+            // rendered `disabled` in markup still enables on valid / when live-check is off.
+            // Tag-agnostic: setAttribute/classList work for both <button> and <a> submit
+            // triggers. Consumers must style the [aria-disabled="true"] /
+            // .gina-form-submit-disabled state (the framework ships no button CSS).
+            var $submitTrigger = document.getElementById($formInstance.submitTrigger);
             if (
                 /^true$/i.test(isFormValid)
                 ||
                 !/^(true)$/i.test($formInstance.target.dataset.ginaFormLiveCheckEnabled)
-            ) { // show submitTrigge
-                document.getElementById($formInstance.submitTrigger).disabled = false;
-            } else { // hide submitTrigger
-                document.getElementById($formInstance.submitTrigger).disabled = true;
+            ) { // show submitTrigger
+                $submitTrigger.disabled = false;
+                $submitTrigger.removeAttribute('aria-disabled');
+                $submitTrigger.classList.remove('gina-form-submit-disabled');
+            } else { // hide submitTrigger (perceivable but not operable, NOT native-disabled)
+                $submitTrigger.setAttribute('aria-disabled', 'true');
+                $submitTrigger.classList.add('gina-form-submit-disabled');
             }
         }
     }
@@ -16405,12 +16525,28 @@ function ValidatorPlugin(rules, data, formId) {
 
     var getCastedValue = function(ruleObj, fields, fieldName, isOnDynamisedRulesMode) {
 
+        var isOnDynamisedRules = (
+            typeof(isOnDynamisedRulesMode) != 'undefined'
+            && /^true$/i.test(isOnDynamisedRulesMode)
+        );
+
         if (
             // do not cast if no rule linked to the field
             typeof(ruleObj[fieldName]) == 'undefined'
             // do not cast if not defined or on error
             || /^(null|NaN|undefined|\s*)$/i.test(fields[fieldName])
         ) {
+            // In dynamised-rules mode this value is spliced verbatim into a stringified
+            // condition (e.g. `$a === $b`). An empty/whitespace value MUST become a quoted
+            // empty string ("") so the condition stays a parseable binary comparison —
+            // returning the raw empty value leaves a DANGLING operator (`"x" === `) that
+            // `is()` then rejects, and the resulting throw aborts the whole-form validity
+            // pass so the submit trigger never gets gated. Mirrors the sibling substitution
+            // default in getDynamisedRules (`... : '\\"\\"'`). `null`/`undefined` stay raw:
+            // they are already valid grammar operands, so only empty/whitespace needs quoting.
+            if ( isOnDynamisedRules && /^\s*$/.test(fields[fieldName]) ) {
+                return '\\"\\"';
+            }
             return fields[fieldName]
         }
 
@@ -16435,10 +16571,7 @@ function ValidatorPlugin(rules, data, formId) {
             return (/^true$/i.test(fields[fieldName])) ? true : false;
         }
 
-        return (
-            typeof(isOnDynamisedRulesMode) != 'undefined'
-            && /^true$/i.test(isOnDynamisedRulesMode)
-        ) ? '\\"'+ fields[fieldName] +'\\"' : fields[fieldName];
+        return isOnDynamisedRules ? '\\"'+ fields[fieldName] +'\\"' : fields[fieldName];
     }
 
     /**
@@ -16534,8 +16667,9 @@ function ValidatorPlugin(rules, data, formId) {
      * @param {object} $fields
      * @param {object} rules
      * @param {callback} cb
+     * @param {string} [culture] // #i18n — server form-body path only; forwarded to FormValidator
      */
-    var validate = function($formOrElement, fields, $fields, rules, cb) {
+    var validate = function($formOrElement, fields, $fields, rules, cb, culture) {
 
         delete fields['_length']; //cleaning
 
@@ -16824,7 +16958,7 @@ function ValidatorPlugin(rules, data, formId) {
                 d = new FormValidator(fields, $fields, xhrOptions, instance.$forms[id].fieldsSet);
             }
         } else {
-            d = new FormValidator(fields, null, xhrOptions);
+            d = new FormValidator(fields, null, xhrOptions, undefined, culture);
         }
 
 
@@ -17470,6 +17604,40 @@ function ValidatorPlugin(rules, data, formId) {
             return forEachField($formOrElement, allFields, allRules, fields, $fields, rules, cb, 0);
     }
 
+    /**
+     * setErrorLabels — register per-culture overrides for gina's built-in rule
+     * error labels (browser only). Global to the validator: all bound forms share
+     * the built-in label catalog. Call once, typically keyed off gina.config.culture
+     * (whispered from the request's negotiated culture):
+     *   gina.validator.setErrorLabels({ isRequired: '...' });          // current culture
+     *   gina.validator.setErrorLabels({ isRequired: '...' }, 'fr_FR'); // explicit culture
+     * English defaults fill any rule the app does not translate; a per-field/rule
+     * `error` string still wins. Custom user-defined rules already carry app messages
+     * and are untouched.
+     *
+     * @param   {object} labels      - { ruleName: message } for one culture.
+     * @param   {string} [culture]   - Target culture; defaults to gina.config.culture.
+     * @returns {object} the validator instance (chainable).
+     * */
+    var setErrorLabels = function (labels, culture) {
+        if ( !labels || typeof(labels) != 'object' ) {
+            return instance;
+        }
+        if ( !culture ) {
+            culture = ( typeof(gina) != 'undefined' && gina.config && gina.config.culture )
+                ? gina.config.culture
+                : 'en';
+        }
+        if ( !instance._errorLabelsByCulture ) {
+            instance._errorLabelsByCulture = {};
+        }
+        instance._errorLabelsByCulture[culture] = merge(
+            JSON.clone(labels),
+            instance._errorLabelsByCulture[culture] || {}
+        );
+        return instance;
+    };
+
     var setupInstanceProto = function() {
 
         instance.target                 = document;
@@ -17480,13 +17648,14 @@ function ValidatorPlugin(rules, data, formId) {
         instance.resetFields            = resetFields;
         instance.handleErrorsDisplay    = handleErrorsDisplay;
         instance.send                   = send;
+        instance.setErrorLabels         = setErrorLabels;
         //instance.handleXhrResponse      = handleXhrResponse;
     }
 
     if (isGFFCtx) {
         return init(rules)
     } else {
-        return backendInit(rules, data, formId)
+        return backendInit(rules, data, formId, culture)
     }
 
 };
@@ -18052,7 +18221,13 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                     // firing its own duplicate GET (see consumePreload).
                     var _waiters = preloadWaiters[url] || [];
                     delete preloadWaiters[url];
-                    if ( /^2/.test(xhrPreload.status) ) {
+                    // #B80 — only cache a genuinely HTML fragment. A JSON response (an
+                    // isXhrRedirect / reload / data payload) must NOT be injected as popin
+                    // content: defer it to the click-time popinLoad, whose completion tail
+                    // handles isXhrRedirect/reload/JSON exactly as a non-preloaded click.
+                    // Mirrors popinLoad's own detection (`/application\/json/.test(Content-Type)`).
+                    var _ct = xhrPreload.getResponseHeader('Content-Type');
+                    if ( /^2/.test(xhrPreload.status) && !/application\/json/.test(_ct || '') ) {
                         preloadCache[url] = xhrPreload.responseText;
                         for ( var _w = 0; _w < _waiters.length; ++_w ) { _waiters[_w](xhrPreload.responseText); }
                     } else {
@@ -19404,14 +19579,15 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                                                     popinUrl = result.location;
                                                 }
 
+                                                // was: a blind 50 ms timer that force-opened the popin if it
+                                                // wasn't open yet. Vestigial (v0.1.0, 2021, 4d85d084) race-inducer:
+                                                // a follow-up load slower than 50 ms let the timer open() against
+                                                // a not-yet-injected (skeleton/empty) target. The already-armed
+                                                // `loaded.<id>` listener opens content-first (injects the body,
+                                                // then popinOpen), so the load alone suffices — no blind open.
                                                 $popin
                                                     .load( $popin.name, popinUrl, $popin.options );
-                                                return setTimeout( function onPopinredirect($popin){
-                                                    if (!$popin.isOpen) {
-                                                        $popin.open();
-                                                        return;
-                                                    }
-                                                }, 50, $popin);
+                                                return;
                                             }
 
 
@@ -22716,6 +22892,50 @@ require([
         }
     };
     bootPopinHandler();
+
+    // Boot the validator at page load so the declarative `data-gina-form-rule` API is
+    // active WITHOUT bundle code calling `new gina.validator()` — the sibling of the
+    // popin boot above. Constructing the validator scans every `<form>`, binds the ones
+    // matching a `gina.forms.rules` entry (live-checking + always-XHR submit), and the
+    // `.on('ready')` registration triggers the validator `init` self-fire so
+    // `gina.validator` / `gina.hasValidator` are set. Idempotent: a later explicit
+    // `new gina.validator()` (a bundle's `handlers/*.js`) takes the `gina.hasValidator`
+    // merge path and its own `.on('ready', …)` handler still fires — the same
+    // re-construction path bundle code already relies on when it constructs the
+    // validator more than once (a bundle `main.js` PLUS a per-page handler). Gated on a
+    // NON-EMPTY `gina.forms.rules` so pages with no rules stay byte-identical (no form
+    // scan, no `gina.validator` publish). `gina.forms` is whispered by `onGinaLoaded`,
+    // which sets `isFrameworkLoaded` (synchronously) BEFORE `gina.forms`, so a truthy
+    // `isFrameworkLoaded` observed from the bounded poll guarantees `gina.forms` is
+    // already populated (run-to-completion — no yield splits the whisper).
+    var _validatorBootTries = 0;
+    var bootValidator = function () {
+        try {
+            if ( !window['gina'] || !window['gina']['isFrameworkLoaded'] ) {
+                if ( _validatorBootTries++ < 100 ) {
+                    (window['setTimeout'] || function (fn) { fn(); })(bootValidator, 50);
+                }
+                return;
+            }
+            if ( window['gina']['hasValidator'] ) {
+                return;
+            }
+            var _forms = window['gina']['forms'];
+            var _rules = ( _forms && _forms['rules'] ) ? _forms['rules'] : null;
+            if ( !_rules || !Object.keys(_rules).length ) {
+                return;
+            }
+            var Validator = require('gina/validator');
+            if ( typeof(Validator) == 'function' ) {
+                new Validator(_rules).on('ready', function () {});
+            }
+        } catch (validatorBootErr) {
+            if ( typeof(console) != 'undefined' && console.error ) {
+                console.error('[gina] validator boot failed', validatorBootErr.stack || validatorBootErr);
+            }
+        }
+    };
+    bootValidator();
 });
 
 function getDependencies(gina, cb) {