gina 0.5.13 → 0.5.14

package/framework/{v0.5.13 → v0.5.14}/core/plugins/lib/validator/src/form-validator.js

@@ -156,6 +156,16 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         'isApiError': 'Condition not satisfied',
         'isInList': 'Must be one of: %s'
     };
+    /**
+     * Rules already warned about by `replace()`'s fail-soft guard, so one mistyped label
+     * emits one warning and not one per debounced keystroke. Scoped to this engine
+     * instance on purpose: `validate()` builds a fresh engine per pass, but a
+     * module-scoped cache would suppress a second bundle's warning on the server, where
+     * the module is shared across bundles and requests.
+     * @inner
+     * @type {Object.<string, boolean>}
+     */
+    var _labelWarnings = {};
     local.errorLabels = _defaultErrorLabels;
     // #i18n (server) — resolve built-in rule labels from the bundle catalog's
     // `_validator.<rule>` namespace for the negotiated `culture`. Mirrors the client
@@ -284,6 +294,13 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
     var compileError = function(error, data) {
         var varArr = error.match(/\{\{([^{{}}]+)\}\}/g );
+        // `String.match` with a /g regex yields `null` — not [] — when nothing matches, so a
+        // backend field error carrying no `{{placeholder}}` (the common shape, e.g. "Already
+        // taken") used to die on `varArr.length` before it could be rendered. Nothing along
+        // the only call path catches it, and the throw kills the whole validation pass.
+        if (!varArr) {
+            return error;
+        }
         for (let v=0, vLen=varArr.length; v<vLen; v++) {
             let localValue = varArr[v]
                                 .replace(/\[/g, '["')
@@ -390,7 +407,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                 this.error = errorMessage = cachedErrors[this.name].query[this.value].slice(0);
                 hasCachedErrors = true;
             }
-            errors['query'] = replace( this.error || errorMessage || local.errorLabels['query'], this);
+            errors['query'] = replace( this.error || errorMessage || local.errorLabels['query'], this, 'query');
             console.debug('[2] potential cached error detected !! ', hasCachedErrors, cachedErrors, ' vs ', errors['query']);
 
             if (hasCachedErrors) {
@@ -554,7 +571,13 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                     if ( typeof(errorFields[_this.name]) != 'undefined') {
 
                         // compiling against rules[field].query.data
-                        local.errorLabels['query'] = compileError(errorFields[_this.name], options.data);
+                        // Only a string can be compiled — `compileError` runs `error.match()`.
+                        // A non-string field error from the backend leaves the resolved
+                        // `query` label in place (localized, else the English default)
+                        // rather than taking the pass down.
+                        if ( typeof(errorFields[_this.name]) === 'string' ) {
+                            local.errorLabels['query'] = compileError(errorFields[_this.name], options.data);
+                        }
 
 
                     } else if ( typeof(result.error) != 'undefined' && /^5/.test(result.status) ) {
@@ -564,7 +587,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                     // Fixed added on 2023-01-10
                     // We want `local.errorLabels['query']` before the generic|user defined `rule` error
                     var optionError = ( typeof(options['error']) != 'undefined' ) ? options['error'] : null;
-                    errors['query'] = replace(systemError || _this['error'] || optionError || local.errorLabels['query'],  _this);
+                    errors['query'] = replace(systemError || _this['error'] || optionError || local.errorLabels['query'], _this, 'query');
 
                     console.debug('[1] query error detected !! ', result, errorFields, errors['query']);
                 }
@@ -1164,7 +1187,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
 
             if (!isValid) {
-                errors[alias] = replace(this.error || errorMessage || local.errorLabels[alias], this);
+                errors[alias] = replace(this.error || errorMessage || local.errorLabels[alias], this, alias);
                 if ( typeof(errorStack) != 'undefined' )
                     errors['stack'] = errorStack;
             }
@@ -1217,7 +1240,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
 
             if (!isValid) {
-                errors['isEmail'] = replace(this['error'] || local.errorLabels['isEmail'], this)
+                errors['isEmail'] = replace(this['error'] || local.errorLabels['isEmail'], this, 'isEmail')
             }
             // if error tagged by a previous vlaidation, remove it when isValid == true
             else if ( isValid && typeof(errors['isEmail']) != 'undefined' ) {
@@ -1259,7 +1282,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
 
             if (!isValid) {
-                errors['isJsonWebToken'] = replace(this['error'] || local.errorLabels['isJsonWebToken'], this)
+                errors['isJsonWebToken'] = replace(this['error'] || local.errorLabels['isJsonWebToken'], this, 'isJsonWebToken')
             }
             // if error tagged by a previous vlaidation, remove it when isValid == true
             else if ( isValid && typeof(errors['isJsonWebToken']) != 'undefined' ) {
@@ -1307,7 +1330,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             var isValid = (val !== null) ? true : false;
 
             if (!isValid) {
-                errors['isBoolean'] = replace(this.error || local.errorLabels['isBoolean'], this)
+                errors['isBoolean'] = replace(this.error || local.errorLabels['isBoolean'], this, 'isBoolean')
             }
             // if error tagged by a previous vlaidation, remove it when isValid == true
             else if ( isValid && typeof(errors['isBoolean']) != 'undefined' ) {
@@ -1352,7 +1375,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                 }
 
             } catch (err) {
-                errors['isNumber'] = replace(this.error || local.errorLabels['isNumber'], this);
+                errors['isNumber'] = replace(this.error || local.errorLabels['isNumber'], this, 'isNumber');
                 this.valid = false;
                 if ( errors.count() > 0 )
                     this['errors'] = errors;
@@ -1378,14 +1401,14 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             if ( !isValid || !isMinLength || !isMaxLength ) {
 
                 if ( !isValid )
-                    errors['isNumber'] = replace(this.error || local.errorLabels['isNumber'], this);
+                    errors['isNumber'] = replace(this.error || local.errorLabels['isNumber'], this, 'isNumber');
                 if ( !isMinLength || !isMaxLength ) {
                     if ( !isMinLength )
-                        errors['isNumberLength'] = replace(this.error || local.errorLabels['isNumberMinLength'], this);
+                        errors['isNumberLength'] = replace(this.error || local.errorLabels['isNumberMinLength'], this, 'isNumberMinLength');
                     if ( !isMaxLength )
-                        errors['isNumberLength'] = replace(this.error || local.errorLabels['isNumberMaxLength'], this);
+                        errors['isNumberLength'] = replace(this.error || local.errorLabels['isNumberMaxLength'], this, 'isNumberMaxLength');
                     if ( minLength === maxLength )
-                        errors['isNumberLength'] = replace(this.error || local.errorLabels['isNumberLength'], this);
+                        errors['isNumberLength'] = replace(this.error || local.errorLabels['isNumberLength'], this, 'isNumberLength');
                 }
 
                 isValid = false;
@@ -1416,7 +1439,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                     val = this.value = local.data[this.name] = Math.round(val);
                 } catch (err) {
 
-                    errors['toInteger'] = replace(this.error || local.errorLabels['toInteger'], this);
+                    errors['toInteger'] = replace(this.error || local.errorLabels['toInteger'], this, 'toInteger');
                     this.valid = false;
                     if ( errors.count() > 0 )
                         this['errors'] = errors;
@@ -1454,22 +1477,22 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             if ( !isValid || !isMinLength || !isMaxLength ) {
 
                 if ( !isValid )
-                    errors['isInteger'] = replace(this.error || local.errorLabels['isInteger'], this);
+                    errors['isInteger'] = replace(this.error || local.errorLabels['isInteger'], this, 'isInteger');
 
                 if ( !isMinLength || !isMaxLength ) {
 
                     if ( !isMinLength ) {
-                        errors['isIntegerLength'] = replace(this.error || local.errorLabels['isIntegerMinLength'], this);
+                        errors['isIntegerLength'] = replace(this.error || local.errorLabels['isIntegerMinLength'], this, 'isIntegerMinLength');
                         isValid = false;
                     }
 
                     if ( !isMaxLength ) {
-                        errors['isIntegerLength'] = replace(this.error || local.errorLabels['isIntegerMaxLength'], this);
+                        errors['isIntegerLength'] = replace(this.error || local.errorLabels['isIntegerMaxLength'], this, 'isIntegerMaxLength');
                         isValid = false;
                     }
 
                     if ( minLength === maxLength ) {
-                        errors['isIntegerLength'] = replace(this.error || local.errorLabels['isIntegerLength'], this);
+                        errors['isIntegerLength'] = replace(this.error || local.errorLabels['isIntegerLength'], this, 'isIntegerLength');
                         isValid = false;
                     }
                 }
@@ -1526,14 +1549,14 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                         }
                     } catch(err) {
                         isValid = false;
-                        errors['toFloat'] = replace(this.error || local.errorLabels['toFloat'], this);
+                        errors['toFloat'] = replace(this.error || local.errorLabels['toFloat'], this, 'toFloat');
                         this.valid = false;
                         if ( errors.count() > 0 )
                             this['errors'] = errors;
                     }
                 } else {
                     isValid = false;
-                    errors['toFloat'] = replace(this.error || local.errorLabels['toFloatNAN'], this)
+                    errors['toFloat'] = replace(this.error || local.errorLabels['toFloatNAN'], this, 'toFloatNAN')
                 }
             }
 
@@ -1621,7 +1644,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
 
             if (!isValid) {
-                errors['isFloat'] = replace(this.error || local.errorLabels['isFloat'], this)
+                errors['isFloat'] = replace(this.error || local.errorLabels['isFloat'], this, 'isFloat')
             }
 
             // #B78 - keep .valid consistent with a surviving isRequired error.
@@ -1687,7 +1710,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
 
             if (!isValid) {
-                errors['isRequired'] = replace(this.error || local.errorLabels['isRequired'], this)
+                errors['isRequired'] = replace(this.error || local.errorLabels['isRequired'], this, 'isRequired')
             }
             // if error tagged by a previous vlaidation, remove it when isValid == true
             else if ( isValid ) {
@@ -1771,11 +1794,11 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                     isValid = false;
 
                     if ( !isMinLength )
-                        errors['isStringLength'] = replace(this['error'] || local.errorLabels['isStringMinLength'], this);
+                        errors['isStringLength'] = replace(this['error'] || local.errorLabels['isStringMinLength'], this, 'isStringMinLength');
                     if ( !isMaxLength )
-                        errors['isStringLength'] = replace(this['error'] || local.errorLabels['isStringMaxLength'], this);
+                        errors['isStringLength'] = replace(this['error'] || local.errorLabels['isStringMaxLength'], this, 'isStringMaxLength');
                     if (minLength === maxLength)
-                        errors['isStringLength'] = replace(this['error'] || local.errorLabels['isStringLength'], this);
+                        errors['isStringLength'] = replace(this['error'] || local.errorLabels['isStringLength'], this, 'isStringLength');
                 }
 
             }
@@ -1806,7 +1829,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             if (!val || val == '' || /NaN|Invalid Date/i.test(val) ) {
                 if ( /NaN|Invalid Date/i.test(val) ) {
                     console.warn('[FormValidator::isDate] Provided value for field `'+ this.name +'` is not allowed: `'+ val +'`');
-                    errors['isDate'] = replace(this.error || local.errorLabels['isDate'], this);
+                    errors['isDate'] = replace(this.error || local.errorLabels['isDate'], this, 'isDate');
 
                 }
                 this.valid = isValid;
@@ -1893,7 +1916,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                     if ( !errors['isRequired'] && this.value == '' ) {
                         isValid = true
                     } else {
-                        errors['isDate'] = replace(this.error || local.errorLabels['isDate'], this);
+                        errors['isDate'] = replace(this.error || local.errorLabels['isDate'], this, 'isDate');
                     }
 
                     this.valid = isValid;
@@ -1961,7 +1984,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
             if (!isValid) {
                 this['size'] = allowedValues.join(', ');
-                errors['isInList'] = replace(this.error || local.errorLabels['isInList'], this);
+                errors['isInList'] = replace(this.error || local.errorLabels['isInList'], this, 'isInList');
             } else if ( typeof(errors['isInList']) != 'undefined' ) {
                 delete errors['isInList'];
             }
@@ -2244,8 +2267,55 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         return local.data
     }
 
+    /**
+     * Interpolate the `%l`/`%n`/`%s` tokens of an error label against a field object.
+     *
+     * `target` reaches here from four independent sources, none of which the framework
+     * controls: a bundle catalog's `_validator.<rule>` label, a runtime
+     * `gina.validator.setErrorLabels()` override, a rule's `errorMessage` argument
+     * (`is: ["$a === $b", <errorMessage>]`), and a per-field `error` (plus the `query`
+     * rule's `systemError`/`optionError`). Only the first is linted at boot.
+     *
+     * A non-string `target` used to throw here, and the throw is unrecoverable: it
+     * escapes `validate()`, so the submit-validation callback never runs and the form
+     * silently refuses to submit, and a boot-time pass aborts the whole form-binding
+     * loop. So degrade instead of dying — an authoring mistake must never cost a form.
+     *
+     * @inner
+     * @param   {*}      target     - The unresolved label. Fail-soft when not a string.
+     * @param   {object} fieldObj   - Field the label is rendered for; supplies the tokens.
+     * @param   {string} [rule]     - Rule the label belongs to. OPTIONAL: `replace` is
+     *      re-exported to app-defined validators through `getValidationContext()`, which
+     *      call it with two arguments. Absent, a non-string label degrades to an empty
+     *      message rather than to the rule's English default.
+     * @returns {string} The interpolated label; never throws.
+     *
+     * @example
+     *   replace('Should be at least %s characters', { size: 5 })  // -> 'Should be at least 5 characters'
+     *   replace({ message: 'oops' }, field, 'isRequired')         // -> 'Cannot be left empty' (+ one warn)
+     */
     /**@js_externs replace*/
-    var replace = function(target, fieldObj) {
+    var replace = function(target, fieldObj, rule) {
+        if ( typeof(target) !== 'string' ) {
+            // Prefer the rule's resolved label (it may be localised) over the English
+            // default — the resolved label is only unusable when it IS the bad value,
+            // in which case the `typeof` test below skips it and English wins.
+            var _fallback = ( rule && typeof(local.errorLabels[rule]) === 'string' )
+                ? local.errorLabels[rule]
+                : ( rule && typeof(_defaultErrorLabels[rule]) === 'string' )
+                    ? _defaultErrorLabels[rule]
+                    : '';
+            var _warnKey = rule || '(unknown rule)';
+            if ( !_labelWarnings[_warnKey] ) {
+                _labelWarnings[_warnKey] = true;
+                console.warn('[FormValidator] error label for rule `' + _warnKey + '` must be a string'
+                    + ' — got ' + ( target === null ? 'null' : typeof(target) ) + '.'
+                    + ' Falling back to ' + ( _fallback ? '`' + _fallback + '`' : 'an empty message' ) + '.'
+                    + ' Check the bundle catalog\'s `_validator` node, `setErrorLabels()`, the rule\'s'
+                    + ' `errorMessage` argument, and the field\'s `error`.');
+            }
+            target = _fallback;
+        }
         var keys = target.match(/%[a-z]+/gi);
         if (keys) {
             for (var k = 0, len = keys.length; k < len; ++k) {

package/framework/{v0.5.13 → v0.5.14}/core/plugins/lib/validator/src/main.js

@@ -922,9 +922,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         //     }
                         // }
                         for (var e in errors[name]) {
-                            $msg = document.createElement('p');
-                            $msg.appendChild( document.createTextNode(errors[name][e]) );
-                            $err.appendChild($msg);
+                            if (e != 'stack') { // ignore stack for display (parity with the first-error branch, #B89)
+                                $msg = document.createElement('p');
+                                $msg.appendChild( document.createTextNode(errors[name][e]) );
+                                $err.appendChild($msg);
+                            }
 
                             if ( envIsDev ) {
                                 if (!formsErrors) formsErrors = {};
@@ -947,6 +949,22 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 if ( !isWarning && $el.type != 'hidden' ) {
                     $el.setAttribute('aria-invalid', 'true');
                 }
+
+                // #B89 — re-announce the REFRESHED message through the live region. The
+                // first-error branch announces, but this refresh branch rebuilt $err with a
+                // NEW message (the value now fails a different rule, or a late setErrorLabels
+                // overlay changed the label) and, without this, assistive tech kept announcing
+                // the first message. Same guard as the first-error announce: committed (not
+                // soft-warning) errors, per-field/blur path, once focus has left the field.
+                // aria-live=polite + textContent-replace re-announces because the string changed.
+                if (
+                    !isWarning
+                    && typeof(fieldName) != 'undefined'
+                    && $err
+                    && $el !== document.activeElement
+                ) {
+                    announceA11yError($form, $err.textContent);
+                }
             }
 
             if (

package/framework/{v0.5.13 → v0.5.14}/helpers/plugins/src/api-error.js

@@ -2,6 +2,18 @@
 var merge = require('./../../../lib/merge');
 var statusCodes = requireJSON(__dirname + '/../../../core/status.codes');
 //var statusCodes = requireJSON( _( getPath('gina').core + '/status.codes') );
+
+// #B88 — a raw stack trace has the shape `<message>\n    at <frame>`; this matches it.
+var STACK_SHAPE_RE = /\n\s+at\s/;
+// Neutral field message rendered outside local scope in place of a leaked stack trace
+// (see formatClientError). Apps that want their own copy pass a real (non-stack) message.
+var GENERIC_FIELD_ERROR = 'An error occurred';
+// Read at call time (NOT module-load) so it honours NODE_SCOPE_IS_LOCAL regardless of
+// whether this helper was required before gna.js set it. Fail-closed: unset/false → not
+// local → strip (production-safe). Mirrors controller.js's `_isLocalScope`.
+function _scopeIsLocal() {
+    return !!process.env.NODE_SCOPE_IS_LOCAL && process.env.NODE_SCOPE_IS_LOCAL.toLowerCase() === 'true';
+}
 /**
  *
  * Usage:
@@ -102,6 +114,15 @@ function ApiError(errorMessage, fieldName, errorStatus) {
 
     var formatClientError = function(ctx, error, errorMessage, fieldName) {
         error.fields[fieldName] = errorMessage;
+        // #B88 — `fields[fieldName]` is the sole channel carrying a value to the browser
+        // (both validator render paths read it), and the controller.js root-`stack` wire
+        // strip cannot reach it. A message-less Error makes ApiError fall back to `e.stack`
+        // above (`e.message || e.stack`), and an app may pass a stack string directly — so
+        // outside local scope, replace a stack-shaped field message with a neutral one. Kept
+        // in local scope for debugging, mirroring controller.js's fail-closed wire strip.
+        if ( !_scopeIsLocal() && typeof(error.fields[fieldName]) == 'string' && STACK_SHAPE_RE.test(error.fields[fieldName]) ) {
+            error.fields[fieldName] = GENERIC_FIELD_ERROR;
+        }
         var bundleName      = ctx.bundle
             , stackObj      = __stack[2]
         ;
@@ -131,7 +152,11 @@ function ApiError(errorMessage, fieldName, errorStatus) {
                 //error.fields[fieldName][funcName] = errorMessage;
             } catch (err) {
                 error.tag   = 'N/A';
-                error.stack = err.stack;
+                // #B88 — this stack (the introspection failure) serialises to the wire via
+                // renderJSON, which does no stripping; only expose it in local scope.
+                if ( _scopeIsLocal() ) {
+                    error.stack = err.stack;
+                }
             }
         } else {
             //error.fields[fieldName]['isApiError'] = errorMessage;

package/framework/{v0.5.13 → v0.5.14}/lib/i18n/src/main.js

@@ -240,15 +240,17 @@ function splitCulture(culture) {
  * The engine substitutes every token matching {@link VALIDATOR_TOKEN_RE} it finds
  * in a label, looking each one up verbatim in its `local.keys` map. An unknown
  * token — `%d`, `%L`, or a bare percent glued to letters as in `20%sur le prix` —
- * resolves to `undefined` and is spliced into user-facing copy; a non-string label
- * makes the engine's `replace()` throw (`target.match is not a function`). Both are
+ * resolves to `undefined` and is spliced into user-facing copy; a non-string label is
+ * discarded by the engine, which renders the rule's English default instead. Both are
  * catalog-authoring mistakes, and the catalog is parsed only here, so this is the
  * one place to surface them before a request renders them.
  *
  * Warns once per offending label at boot and never throws — a translation typo
  * must not take a bundle down. This covers the client too: the browser's
  * `gina.config.validatorLabels` is a subset of this same boot-loaded catalog.
- * It does NOT cover labels supplied at runtime via `gina.validator.setErrorLabels()`.
+ * It does NOT cover labels supplied at runtime via `gina.validator.setErrorLabels()`,
+ * nor a rule's `errorMessage` argument — for those, the engine's own fail-soft guard
+ * warns at the point of degradation.
  *
  * @memberof module:gina/lib/i18n
  * @inner
@@ -279,7 +281,7 @@ function warnOnSuspectValidatorLabels(catalog, filePath) {
         var label = node[rule];
         if ( typeof label !== 'string' ) {
             console.warn('[i18n] `' + VALIDATOR_NAMESPACE + '.' + rule + '` in ' + filePath
-                + ' must be a string — the validator throws when it renders a non-string label');
+                + ' must be a string — the validator discards it and renders the English default');
             count++;
             continue;
         }

package/framework/{v0.5.13 → v0.5.14}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.5.13",
+  "version": "0.5.14",
   "dependencies": {
     "@rhinostone/swig": "^2.7.2",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.5.13/core/gna');
+var _gna = require('./framework/v0.5.14/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.5.13/core/controller');
-var EntitySuper     = require('./framework/v0.5.13/core/model/entity');
+var SuperController = require('./framework/v0.5.14/core/controller');
+var EntitySuper     = require('./framework/v0.5.14/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.5.13/lib/uuid');
+var uuid = require('./framework/v0.5.14/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -973,7 +973,7 @@ Dev-mode query instrumentation captures every database query tied to the current
 
 221. **FormValidator marks an invalid submit trigger with `aria-disabled` + `.gina-form-submit-disabled`, NOT native `disabled` (#B76, 2026-07-06).** `updateSubmitTriggerState`'s invalid + live-check-on branch used to set the submit `<button>`'s native `.disabled = true`, but a natively-disabled `<button>` emits no click event — so the form-level `validate.<id>` guard (which renders every field's errors + focuses the first invalid field, and only `send()`s when `isValid()`) never fired, and the button was a dead no-op with zero feedback. The HIDE branch now sets `aria-disabled="true"` + adds the class `gina-form-submit-disabled` (keeping the trigger OPERABLE so the click still runs the guard) while `isValid()` stays the real send gate; the SHOW branch KEEPS clearing native `disabled` so a `<button disabled>` in markup still enables on valid / when live-check is off. Tag-agnostic (works for `<button>` and `<a>`; `.disabled=false` on an anchor is a harmless expando). The Enter-key/native-submit DOMParser proxy that read `submitTrigger.disabled` off a re-parsed copy simply never cancels on the invalid path now — harmless: the native submit is still cancelled by the `withRules || isBinded` branch and the `isValid()` gate still blocks the send. **Consumers must style the `[aria-disabled="true"]` / `.gina-form-submit-disabled` submit-trigger state — the framework ships no button CSS.** `main.js` is browser-bundled → a prod dist rebuild is required. Two testing gotchas: jsdom does NOT model "a disabled control emits no click" (it dispatches click on disabled buttons), so the bug is asserted via the pre-fix disabled STATE in a subtract replica; and the consumer-styling comment names the class, so pin the `classList.(add|remove)('gina-form-submit-disabled')` code form (==2), not a bare string count (==3). Tests: `validator-submit-trigger-state.test.js` (18).
 
-222. **FormValidator built-in rule labels localise per culture from ONE per-bundle catalog on BOTH client and server — app-owned, the framework ships NO translations (0.5.x, validator i18n Slices 1–3).** The 26 English defaults live in `form-validator.js` as `_defaultErrorLabels`; each rule resolves `this.error || local.errorLabels[rule]` (per-field app override wins, else the default), and the engine seeds `local.errorLabels` from the defaults then overlays the negotiated culture's labels from the same `_validator.<rule>` catalog namespace both sides read. **CLIENT overlay** (`isGFFCtx`-gated) applies two layers over English with precedence **app `setErrorLabels()` > server-whispered bundle catalog > English**: layer 3 reads the `setErrorLabels()` registry `gina.validator._errorLabelsByCulture[gina.config.culture]` (exact `fr_FR` → base `fr` fallback); layer 2 reads `gina.config.validatorLabels` — the culture's `_validator` subset from `bundle/locales/<culture>.json` whispered by the render path (`controller.js` resolves it via `lib.i18n` walkFallback→getCatalog→resolveKey, `encodeRFC5987ValueChars`-encoded into `page.environment.validatorLabels`; `loader.js` reads it into `gina.config.validatorLabels` with a GUARDED `JSON.parse(decodeURIComponent(…))` IIFE — NOT a bare parse like `routing`, an empty whisper would throw and kill `onGinaLoaded` → whole-page JS dead — plus `@js_externs validatorLabels`). Each layer is `merge(JSON.clone(layer), local.errorLabels)` (lib/merge is target-wins/source-fills, so a higher layer wins per key and lower layers fill), catalog applied FIRST then registry; an empty `{}` catalog is skipped (own-key guard) so it degrades to registry/English. **SERVER overlay** (`!isGFFCtx`): passing a string `culture` to `gina.plugins.Validator` resolves the same `_validator` node (same walkFallback→getCatalog→resolveKey chain) and merges it over English. Apps register client overrides through the public `gina.validator.setErrorLabels(labels[, culture])`. Matches the framework's per-bundle "app owns catalogs" i18n stance (`bundle/locales` + `t()`); custom user rules already carry app messages and are untouched; a per-field/rule `error` still wins. **Two SERVER constraints (measured):** routing.json `validator::{}` requirement labels stay English (those validators run during route-matching, BEFORE culture negotiation → `req.culture` undefined there), and the auto-validation path (pass a rules object) has a pre-existing null-`$fields` crash at `forEachField` orthogonal to i18n — so the working server path is the MANUAL `new gina.plugins.Validator({}, data, formId, req.culture)` + `v.field.rule(...)`. **`%`-token contract (measured 2026-07-08).** `replace()` substitutes tokens in the MERGED `local.errorLabels`, so a CATALOG label interpolates exactly like an English default — load-bearing because length bounds arrive as ARRAY args (`"isString": [5]`, spread through `apply()` in `main.js`) and therefore reach `isStringMinLength`/`isStringMaxLength`, keys no rule file ever names (grepping rule files for them returns 0 and wrongly reads as dead). The vocabulary is CLOSED and CASE-SENSITIVE: `replace()` matches `/%[a-z]+/gi` GREEDILY and looks each hit up verbatim in `local.keys` (`%l`→label, `%n`→name, `%s`→size), so an unknown token (`%d`, `%L`) — or a literal percent glued to letters (`20%sur le prix` matches `%sur`) — splices the literal string `undefined` into user-facing copy, and a NON-STRING label makes `replace()` throw `target.match is not a function`. `%l` is frontend-only (it reads the DOM `data-gina-form-field-label`), so a catalog label using it renders EMPTY server-side rather than `undefined`. `lib/i18n loadCatalogs` LINTS the `_validator` node at boot (warns per offending label, never throws, catalog still loads); it covers the client too (the whisper is a subset of the same boot-loaded catalog) but NOT runtime `setErrorLabels()` labels, and its token set is drift-pinned against `local.keys`. **Labels are LATE-BOUND per validation pass (measured).** The overlay lives in the `FormValidatorUtil` CONSTRUCTOR, and `validate()` builds a FRESH engine on every pass (`main.js` ~`:7145`/`:7154`/`:7157`) — not once at bind time — so `setErrorLabels()` called AFTER `new FormValidator(...)`, canonically inside a `ready` handler (which fires immediately after `gina.validator = instance`), applies from the NEXT pass; it does NOT retroactively change a pass already in flight, since the message string is interpolated at rule-evaluation time. **Catalog-load signal (measured correction).** A `locales/*.json` filename failing `CULTURE_FILENAME` (`fr-FR.json`, `fr_fr.json`) DOES warn and is skipped; the genuinely SILENT case is a MISSING `locales/` dir (`config.js` `fs.existsSync` with no `else`) — opt-in by design. Catalogs are boot-loaded with no hot reload, so a catalog edit needs a bundle restart. Closure keeps the cross-module property names via the quoted-literal-decl + dot-read + `@js_externs` pattern; both validator files browser-bundled → any edit needs a prod dist rebuild (the 4 `gina.*` + 3 `gina.onload.*`), but `lib/i18n` is server-only so the boot lint needs none. Tests: `test/lib/validator-label-i18n.test.js` (client registry layer) + `test/lib/validator-label-i18n-server.test.js` (server) + `test/lib/validator-label-i18n-client-catalog.test.js` (client catalog + 3-layer precedence) + `test/lib/validator-label-i18n-runtime.test.js` (%-token interpolation from a catalog label, the boot lint, late binding).
+222. **FormValidator built-in rule labels localise per culture from ONE per-bundle catalog on BOTH client and server — app-owned, the framework ships NO translations (0.5.x, validator i18n Slices 1–3).** The 26 English defaults live in `form-validator.js` as `_defaultErrorLabels`; each rule resolves `this.error || local.errorLabels[rule]` (per-field app override wins, else the default), and the engine seeds `local.errorLabels` from the defaults then overlays the negotiated culture's labels from the same `_validator.<rule>` catalog namespace both sides read. **CLIENT overlay** (`isGFFCtx`-gated) applies two layers over English with precedence **app `setErrorLabels()` > server-whispered bundle catalog > English**: layer 3 reads the `setErrorLabels()` registry `gina.validator._errorLabelsByCulture[gina.config.culture]` (exact `fr_FR` → base `fr` fallback); layer 2 reads `gina.config.validatorLabels` — the culture's `_validator` subset from `bundle/locales/<culture>.json` whispered by the render path (`controller.js` resolves it via `lib.i18n` walkFallback→getCatalog→resolveKey, `encodeRFC5987ValueChars`-encoded into `page.environment.validatorLabels`; `loader.js` reads it into `gina.config.validatorLabels` with a GUARDED `JSON.parse(decodeURIComponent(…))` IIFE — NOT a bare parse like `routing`, an empty whisper would throw and kill `onGinaLoaded` → whole-page JS dead — plus `@js_externs validatorLabels`). Each layer is `merge(JSON.clone(layer), local.errorLabels)` (lib/merge is target-wins/source-fills, so a higher layer wins per key and lower layers fill), catalog applied FIRST then registry; an empty `{}` catalog is skipped (own-key guard) so it degrades to registry/English. **SERVER overlay** (`!isGFFCtx`): passing a string `culture` to `gina.plugins.Validator` resolves the same `_validator` node (same walkFallback→getCatalog→resolveKey chain) and merges it over English. Apps register client overrides through the public `gina.validator.setErrorLabels(labels[, culture])`. Matches the framework's per-bundle "app owns catalogs" i18n stance (`bundle/locales` + `t()`); custom user rules already carry app messages and are untouched; a per-field/rule `error` still wins. **Two SERVER constraints (measured):** routing.json `validator::{}` requirement labels stay English (those validators run during route-matching, BEFORE culture negotiation → `req.culture` undefined there), and the auto-validation path (pass a rules object) has a pre-existing null-`$fields` crash at `forEachField` orthogonal to i18n — so the working server path is the MANUAL `new gina.plugins.Validator({}, data, formId, req.culture)` + `v.field.rule(...)`. **`%`-token contract (measured 2026-07-08).** `replace()` substitutes tokens in the MERGED `local.errorLabels`, so a CATALOG label interpolates exactly like an English default — load-bearing because length bounds arrive as ARRAY args (`"isString": [5]`, spread through `apply()` in `main.js`) and therefore reach `isStringMinLength`/`isStringMaxLength`, keys no rule file ever names (grepping rule files for them returns 0 and wrongly reads as dead). The vocabulary is CLOSED and CASE-SENSITIVE: `replace()` matches `/%[a-z]+/gi` GREEDILY and looks each hit up verbatim in `local.keys` (`%l`→label, `%n`→name, `%s`→size), so an unknown token (`%d`, `%L`) — or a literal percent glued to letters (`20%sur le prix` matches `%sur`) — splices the literal string `undefined` into user-facing copy. **A NON-STRING label FAIL-SOFTS (0.5.14).** `replace(target, fieldObj, rule)` takes the rule name as an OPTIONAL 3rd argument — optional because `replace` is re-exported to app-defined validators through `getValidationContext()`, which call it with two — and when `target` is not a string it warns once per rule per engine instance (per-instance, NOT module-scoped: the module is shared across bundles + requests on the server) and falls back **resolved label → that rule's English default → empty string**. All 26 call sites pass the same key they read from `local.errorLabels`, and every one of those keys has an English default, so "degrade to English" holds at 26/26; the dynamic `is()` site passes `alias`, which is always `'is'` (the `is<N>` alias branch in the plugin's `main.js` is unreachable — its `continue` on non-function rules precedes it). Pre-0.5.14 this threw `target.match is not a function`, and NOTHING on the path catches it (`main.js`'s only `try` rethrows as `[ ginaFormValidator ] could not evaluate …`): measured in a real browser, the validator instance never finished initialising, the first form bound only partially, **every later form on the page was never bound at all** (the `bindForm` loop is unguarded), no error message rendered, and the page fell back to NATIVE browser submits with zero client-side validation. Note the submit trigger is never natively `disabled` — `updateSubmitTriggerState` only ever CLEARS `disabled`, using `aria-disabled` + `.gina-form-submit-disabled` for the invalid state — so "the button looks alive" is not evidence the pass ran. `%l` is frontend-only (it reads the DOM `data-gina-form-field-label`), so a catalog label using it renders EMPTY server-side rather than `undefined`. `lib/i18n loadCatalogs` LINTS the `_validator` node at boot (warns per offending label, never throws, catalog still loads); it covers the client too (the whisper is a subset of the same boot-loaded catalog) but NOT runtime `setErrorLabels()` labels, NOR a rule's `errorMessage` argument (`is: ["$a === $b", <non-string>]` — the lint never reads form-rule JSON), NOR a field's `error` — for those three the engine's own fail-soft guard is the only net, which is why it warns at the point of degradation. **`compileError()` is one line UPSTREAM of `replace()` on the `query` path** and carried the same class of defect: `error.match(/\{\{…\}\}/g)` returns `null` (not `[]`) when a backend field error carries no `{{placeholder}}` — the ordinary shape, e.g. `"Already taken"` — so `varArr.length` threw before any label could render; it now returns the error verbatim, and the `query` call site only compiles a string (a non-string backend field error keeps the resolved label instead of reaching `compileError`). **Labels are LATE-BOUND per validation pass (measured).** The overlay lives in the `FormValidatorUtil` CONSTRUCTOR, and `validate()` builds a FRESH engine on every pass (`main.js` ~`:7145`/`:7154`/`:7157`) — not once at bind time — so `setErrorLabels()` called AFTER `new FormValidator(...)`, canonically inside a `ready` handler (which fires immediately after `gina.validator = instance`), applies from the NEXT pass; it does NOT retroactively change a pass already in flight, since the message string is interpolated at rule-evaluation time. **Catalog-load signal (measured correction).** A `locales/*.json` filename failing `CULTURE_FILENAME` (`fr-FR.json`, `fr_fr.json`) DOES warn and is skipped; the genuinely SILENT case is a MISSING `locales/` dir (`config.js` `fs.existsSync` with no `else`) — opt-in by design. Catalogs are boot-loaded with no hot reload, so a catalog edit needs a bundle restart. Closure keeps the cross-module property names via the quoted-literal-decl + dot-read + `@js_externs` pattern; both validator files browser-bundled → any edit needs a prod dist rebuild (the 4 `gina.*` + 3 `gina.onload.*`), but `lib/i18n` is server-only so the boot lint needs none. Tests: `test/lib/validator-label-i18n.test.js` (client registry layer) + `test/lib/validator-label-i18n-server.test.js` (server) + `test/lib/validator-label-i18n-client-catalog.test.js` (client catalog + 3-layer precedence) + `test/lib/validator-label-i18n-runtime.test.js` (%-token interpolation from a catalog label, the boot lint, late binding). **#B88 fields-slot stack disclosure (0.5.14).** The reachability that renders a backend `fields[<field>]` value is FRAMEWORK-produced, not app-specific: `gna.ApiError` (`helpers/plugins/src/api-error.js`) merges `{tag,fields,path}` over the error so `error`+`fields` land at the response root — a consumer hits `compileError`'s gate with NO literal `fields:` in its source (grep = structural false negative). A raw stack enters that slot via ApiError's own `e.message || e.stack` fallback on a message-less Error, or an app passing a stack string; post-#B86 `compileError` returned it VERBATIM → it rendered into the user-facing field message (info disclosure — the DOM write is `createTextNode`, NOT XSS). FIXED AT THE SOURCE, not `compileError`: `formatClientError` scope-gates a stack-shape (`/\n\s+at\s/`) strip on `fields[fieldName]` (generic message outside local scope, full stack kept in local; call-time `NODE_SCOPE_IS_LOCAL` read, fail-closed), the sibling of `controller.js`'s fail-closed root-`stack` wire strip — which CANNOT reach the fields slot (merge drops the non-enumerable root `.stack`, so the slot is the sole carrier). One source site covers BOTH browser render paths, which each read `result.fields[<field>]`: the live-check `compileError`→`replace` path AND the form-submit `main.js` `isApiError`→`handleErrorsDisplay` path (renders verbatim, pre-dates #B86). Server-side → NO dist rebuild. The same commit scope-gates the `formatClientError` catch-branch root `.stack` (it serialises via renderJSON, which does no stripping). DEFERRED (unreported): a `{error,fields}` response hand-built WITHOUT ApiError bypasses the source strip → escalation is the same strip at the render chokepoint `handleErrorsDisplay` (browser, needs a dist rebuild). Tests: `test/lib/api-error-field-stack.test.js` (real ApiError, both sub-cases × scope, catch-branch gate, subtract). **#B89 aria-live re-announce on message refresh (0.5.14).** `handleErrorsDisplay` has three per-field branches: first-error (parent not yet marked) builds the message div AND announces via the form's `aria-live=polite` region; clear (field valid) removes it; refresh (still-errored, `data-gina-form-errors` truthy) REBUILDS the message div from the fresh `errors[name]`. The refresh branch updated the VISIBLE text but never re-announced, so a screen reader kept announcing the FIRST message when a continuously-errored field's message changed (a different failing rule, a value-dependent message, or a late `setErrorLabels()`). FIXED: a guarded `announceA11yError($form, $err.textContent)` on the refresh branch (same guard as the first-error branch — committed not soft-warning, per-field/blur path, once focus has left the field) + an `e != 'stack'` skip on its message loop (parity with the first-error branch — no stray stack `<p>` feeding the announce). `announceA11yError` writes `_live.textContent` (a REPLACE) on the form's one `gina-aria-live-<formId>` polite region, so a CHANGED string re-announces. On a blur the live-check runs a per-field validate (first-error → Branch A announce) THEN a global pass that sets `data-gina-form-errors` truthy and re-calls `handleErrorsDisplay` for the touched field (Branch C), so a second blur with a different message reliably hits the refresh branch. Browser-bundled → prod dist rebuilt; live-verified in a real headless browser (subtract: the pre-fix bundle keeps the stale announce while the visible text updates, the post-fix re-announces). DEFERRED (message-timing, LOW): which field a per-field pass refreshes is `errAttr`-gated (reset then set only after a completed pass), so a late `setErrorLabels()` before a field's first validation — or with `gina.config.culture` unset (the client culture overlay is skipped on a falsy culture) — can leave an already-errored field's message stale until it clears; register culture-keyed labels before first validation. Test: `test/core/validator-a11y-reannounce.test.js`.
 
 223. **Per-request culture negotiation was INERT framework-wide until 0.5.x — `req.culture` / the whispered `gina.config.culture` always `'en'`/`''` regardless of bundle or environment culture, and `t()` / the `t` template filter returned keys — now activated (#I18N Slice 1).** The #I18N1 catalog + negotiation machinery shipped but three legs were dead: `lib/i18n loadCatalogs` had ZERO runtime callers (so `process.gina._i18nCatalogs` stayed empty → `core/server.js availableCultures` `[]` → `matchAvailable` null on an empty list → URL-prefix / cookie / `Accept-Language` never matched); the per-request `negotiateCulture` call passed `defaultCulture: null` (step-4 bundle default skipped); and 8 sites read `process.env.GINA_CULTURE`, which `utils/helper.js` moves into `process.gina` and DELETEs from `process.env` at init (`getEnvVar` reads `process.gina`), so `negotiateCulture` step 5, the `server.js` catch, both swig + both nunjucks `t`/`tIcu` filter fallbacks, and the `i18n:add` CLI all read an always-undefined var → negotiation fell to step 6 = `'en'`. Fix (server-side, NO dist rebuild): `config.js loadBundleConfig` (after the `secrets.resolve` seam) calls `i18n.loadCatalogs(bundle, <bundleRoot>/locales)` guarded by `fs.existsSync` (opt-in; also avoids loadCatalogs' empty-entry + background ICU-loader side effects) + `try/catch`→`console.warn` (a malformed catalog is warned, not boot-fatal — loadCatalogs THROWS on bad JSON); `server.js` reads the matched bundle `content.settings.region.culture` (format-guarded vs an unresolved `${culture}`) as `defaultCulture`; the 8 dead reads → the live `getEnvVar('GINA_CULTURE')` (`typeof getEnvVar === 'function'`-guarded in the strict global-free `lib/i18n` + the filter modules so an isolated unit-require never ReferenceErrors). Precedence now live: URL / cookie / `Accept-Language` > bundle `settings.region.culture` > operator `GINA_CULTURE` > `'en'`. **`settings.region.culture` is the REAL per-bundle culture key** — bundle scaffold `core/template/boilerplate/bundle/config/settings.json` `"culture":"${culture}"` (full underscore culture resolved at `bundle:add`; the merged config carries it — `server.js`/`controller.js` already read `content.settings.region.{timeZone,shortCode}`), NOT `settings.locale.region` (a country code in the framework `settings.json`'s separate CLDR `locale` block). Blast radius: framework-wide — `req.culture`/`gina.config.culture` now reflect the configured culture, `t()` resolves real strings for any bundle shipping a `locales/` dir (others unaffected via the `existsSync` guard). Makes the #222 client validator-label overlay (gated on a truthy `gina.config.culture`) actually reachable; Slice 1 of the validator + i18n unification. **#B84 (same day) completes the activation on the WARM route path:** Slice 1 negotiated `req.culture` only on the COLD (uncached) path — `core/server.js handle()`'s cached-route fast-path (`if ( hasCachedRoute ) { isRoute = hasCachedRoute; … break; }` ~`:4964`) breaks the routing loop BEFORE the cold-path negotiation site (~`:5115`), and the route cache persists across requests (the module-scoped `routingLib` at `:91` is a stable gen-0 binding — server.js is load-once; `Routing._cached` is set at `:5198` on the cold request and read at `:4964` on every later hit to the same `method:pathname`), so the SECOND hit to any URL is warm and left `req.culture` unset → `controller.js` embeds `''` into `page.environment.culture` → `gina.config.culture === ''` → the #222 client overlay inert on warm reloads (a warm BROWSER reload reproduces; `curl` masks it — a fresh cold-only hit after a restart still negotiates). Fixed by extracting the negotiation into a per-request `var _negotiateReqCulture = function(req, routeBundle)` closure in `handle()` scope, called on BOTH the warm (`( req.routing && req.routing.bundle ) || bundle` — `getCached` already ran `compareUrls`→`checkRouteParams`, so `req.routing` incl. `bundle`/`culturePrefix` is populated) and cold (`routing[name].bundle`) paths. **The resolved culture is NEVER cached with the shared route entry** — it's per-request (cookie / Accept-Language), so pinning it would cross-request-bleed (the #B65/#B66 per-request-vs-worker-global class); the consumer's first suggestion "cache `req.culture` with the route" was rejected for exactly this, their second "re-negotiate on the warm path" shipped. **Rule: any per-request state derived after a route match must be re-derived on the cached fast-path too — `if ( hasCachedRoute ) { … break; }` bypasses everything below it in the loop.** Server-side, NO dist rebuild; surfaced by a consumer report-back that Slice 1's cold-only activation had missed. Tests: `test/core/server-culture-negotiation.test.js` (two-path source pins + a behavioural replica of the fast-path-breaks-before-cold-site structure driving the real `negotiateCulture` + a subtract proving the warm-path call is load-bearing) + a daemonless cold→warm `gina-container` boot (`req.culture === 'xx_XX'` on cold AND warm over real HTTP; `''` pre-fix). Established 2026-07-07.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.5.13",
+  "version": "0.5.14",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -73,12 +73,12 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.5.13/core/gna",
+  "main": "./framework/v0.5.14/core/gna",
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
       "import": "./index.mjs",
-      "require": "./framework/v0.5.13/core/gna.js"
+      "require": "./framework/v0.5.14/core/gna.js"
     },
     "./gna": {
       "types": "./types/gna.d.ts",

package/framework/v0.5.13/VERSION

@@ -1 +0,0 @@
-0.5.13