gina 0.5.14 → 0.5.15

package/CHANGELOG.md

@@ -6,6 +6,24 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.15 - 2026-07-11
+### Added
+* A popin/dialog trigger can now opt out of the hover/focus preload with `data-gina-dialog-preload="false"` (honored on legacy `data-gina-popin-url` triggers too; the value is matched case-insensitively so a templated "False" cannot fail open): the warm-up GET no longer fires on hover or focus for that trigger, and its click loads normally, at click time. Declare it on any trigger whose GET has server-side effects — the preload otherwise assumes GET is safe to fire early, per HTTP semantics.
+* Client-side components — standards-based Web Components conventions with zero dependencies: `gina view:add` scaffolds now ship a reference custom element (a server-rendered light-DOM partial paired with a behavior-only class — HTML and JS stay separated, repeatable markup clones from a server-rendered `<template>`), and the conventions are documented end-to-end (placement in `public/js/` + one `templates.json` entry, SSR hydration via attributes + a JSON `data-*` payload, data-down/events-up communication, SEO-first light DOM, strict-CSP compatibility, the reserved `gina-*` tag prefix). Components upgrade automatically inside popin/XHR-injected content — no rebinding; e2e coverage locks the popin auto-upgrade, strict-CSP, SSR-hydration, and no-JS crawler-equivalence contracts.
+* Dev Inspector component observability: the View tab now shows a component census — instances per custom-element tag, with a red indicator for undefined components awaiting upgrade (a typo'd tag name or a missing/failed definition script is no longer a silent failure) — and the Events tab surfaces client-side component protocol events (composed bubbling `<tag>:<verb>` CustomEvents) captured by a dev-only statusbar dispatchEvent wrap: event name, emitting element and timestamp always; `detail` values only when `settings.inspector.events.captureArgs` is opted in (the existing server-side knob, now whispered to the browser) and always passed through the Inspector's redaction rules. The census and events follow XHR/popin fragment renders over the per-tab Inspector channel.
+* FormValidator now recognises form-associated custom elements (FACEs). A custom element declaring `static formAssociated = true` with a `name` attribute and a `.value` getter now participates in a bound form like a native control: it is picked up by the bind layer (auto-id, dirty tracking, live-check on its composed bubbling `change`), validated against a rule keyed to its name at both live-check and submit, has its errors rendered, and its value rides the XHR payload. Native controls are unaffected.
+### Fixed
+* Server-side auto-validation now works: gina.plugins.Validator(<rules>, data, formId[, culture]) used to crash on its first field with a null-$fields TypeError, so validating a data object against a rules object had never worked server-side. Plain rules now validate and return { isValid(), error, data }, and the trailing culture localises the error labels from the bundle catalog. The same guard lets a rule field that is missing from the client form collection reach the intended console warning instead of throwing. Conditional (_case_) rules remain client-only.
+* A form submit whose response redirected into a popin could open that popin before its content arrived. The validator now opens the popin through the load handle, so the response body is injected first, and a failed load no longer opens an empty popin. A redirect that targets a different popin than the one currently open also closes the original popin, as intended.
+* Fixed the published `gina.popin` accessors being bound to the first Popin instance's registry: `getPopinByName`/`getPopinById` resolved only the boot popin and `gina.popin.activePopinId` never updated, so a form submit redirecting into a different popin always failed with a 422 `Popin not found` error. The popin registry is now module-shared across every `new Popin()` (with `gina.popin` published once as a live object and the active-popin id written through from every instance), so the published accessors resolve every registered popin, click-time in-page dialog registrations are visible to `getActivePopin()`, and cross-popin form redirects work end-to-end.
+* The documented data-gina-form-upload-<reset|delete>-trigger id override now resolves — the attribute name was built incorrectly so the override could never match — and the trigger-not-found warning suggests the correct element id.
+* Upload preview reset/delete now actually removes the preview image and its trigger link — the cleanup tail was dead code behind an undefined identifier, so every reset/delete click threw a ReferenceError, previews were only inline-hidden, and re-uploads accumulated duplicate trigger ids (a second cycle surfaced a removeListener TypeError). Multi-file removal passes iterate a static snapshot so they no longer crash mid-iteration, and the form click proxy tolerates a click target removed during its own dispatch.
+* Removing an uploaded file now restores a class-hidden add-affordance (new optional data-gina-form-upload-hidden-class attribute names the class to lift from the input and its parent) and dispatches the new data-gina-form-upload-on-reset / data-gina-form-upload-on-delete callbacks — a bare identifier registered on window, like data-gina-form-upload-on-success — once per removal action, after the removal request goes out, with { $upload, bindingType, files }; the restore no longer aborts the removal pass when the parent was inline-hidden.
+* Static-asset 404s and framework error responses no longer bypass X-Powered-By suppression: settings.json server.hidePoweredBy now gates the per-request emission on both engines (previously it covered only the Isaac /_gina/* sites), and env.json server.response.header overrides now reach HTTP/1.1 error responses (the flush previously ran before the override loop, so the loop was skipped)
+* The programmatic `$form.send(FormData)` submit path now nests bracket-notation field names (e.g. `item[0][id]`) into objects/arrays before posting, matching the declarative submit path — previously they were transmitted as literal JSON keys, so the server exposed `item[0][id]` as an un-nested key. File uploads and plain-object `send()` payloads are unchanged.
+* A multipart/form-data POST carrying only text fields (no file parts) no longer hangs until a front-proxy timeout. The request-lifecycle continuation previously resumed only from inside the per-file write-stream finish loop, so a body with zero file parts ran that loop zero times and never resumed; it now resumes directly when there are no file parts. Non-file fields remain dropped from req.post (the documented multipart limitation) — only the hang is fixed. The parse runs before routing, so any path was affected, unauthenticated.
+* A malformed, empty, or non-multipart request body sent with a multipart/form-data content-type no longer takes the bundle down. The parser error (previously unhandled — it surfaced as an uncaughtException that triggered a SIGTERM shutdown, so a single unauthenticated request could kill a worker) is now caught and answered with HTTP 400. Server-side path shared by both engines.
+
 ## 0.5.14 - 2026-07-09
 ### Added
 * Stable publishes now assert README.md carries exactly one "What's in <version>" section, naming the version being released (script/check_readme_freshness.js, wired into the release prepare step). The publish aborts when the section is missing, duplicated, or names a different version. Previously the gate only asserted that README.md had been touched since the previous stable tag, which is blind to a wrong edit: adding a new section while leaving the prior one in place touches the file, so the gate passed while shipping a README whose newest release was buried under older ones. The version-match assertion is skipped on prerelease targets, where the drafted stable heading legitimately precedes the version bump. Alpha publishes skip the gate entirely.

package/README.md

@@ -42,12 +42,17 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.5.14
-
-- **Fixed — a non-string validator error label no longer takes the form down.** The validator engine discards it, warns once naming the rule, and renders that rule's English default instead — covering all four sources a label can arrive from: a bundle catalog's `_validator` node, a `gina.validator.setErrorLabels()` override, a rule's `errorMessage` argument, and a field's `error`. Previously the engine threw `TypeError: target.match is not a function`, which aborted the validation pass — no message rendered, the form never submitted through Gina, and every later form on the page was left unbound and silently fell back to a native browser submit with no client-side validation. `compileError()` also no longer throws when a backend field error carries no `{{placeholder}}`, and the `query` rule keeps its resolved label when a backend field error is not a string.
-- **Fixed — a field validation error no longer exposes a raw server stack trace to the browser.** When an `ApiError` is built for a client field and the underlying error has no message (so the framework falls back to its stack) — or an application passes a stack string directly — the per-field message is replaced with a neutral one (`An error occurred`) outside local scope; the full stack is kept in local scope for debugging. This closes the one channel the JSON error-body stack strip could not reach: the per-field message map the form validator renders verbatim.
-- **Fixed — a changing validator message on a still-invalid field is re-announced to assistive technology.** When a field stays in error while its message changes — a different rule now fails, the message is value-dependent, or a late `setErrorLabels()` overlay changed the label — the new message is re-announced through the form's ARIA live region, so screen readers no longer keep announcing the first message. The visible message already refreshed; this fixes the announcement to match.
-- **Added — stable publishes assert the README carries exactly one, correctly-named "What's in" section.** The release step now aborts a stable publish when the section is missing, duplicated, or names a different version — previously it only checked that the file had been touched, which is blind to a wrong edit.
+## What's in 0.5.15
+
+- **Added — client-side components (Web Components).** Standards-based, zero-dependency conventions for stateful client widgets: `gina view:add` scaffolds a reference custom element (a server-rendered light-DOM partial paired with a behavior-only class, HTML and JS kept separate), components upgrade automatically inside popin/XHR-injected content with no rebinding, and the whole pattern is SEO/GEO-first (meaningful content ships in the initial server-rendered HTML) and strict-CSP compatible. Form-associated custom elements (`static formAssociated = true` + a `name` + a `.value` getter) participate in `FormValidator` like native controls — collected, live-checked, validated, serialized into the AJAX payload, and error-rendered. Live-data components ride the `connectedCallback`/`disconnectedCallback` lifecycle over `method:"ws"` routes or SSE. The dev Inspector gains a component census (with a red indicator for undefined components awaiting upgrade) and captures client-side `<tag>:<verb>` component events.
+- **Added — a popin/dialog trigger can opt out of the hover/focus preload.** Declare `data-gina-dialog-preload="false"` on any trigger whose GET has server-side effects and the warm-up GET no longer fires on hover or focus; the click loads normally, at click time. Existing triggers are unaffected.
+- **Fixed — `gina.popin` sees every popin.** The popin registry is now shared across every `Popin` instance, so `getPopinByName()` / `getPopinById()` / `activePopinId` resolve every registered popin — a form submitted from a popin whose response redirects into a *different* popin no longer fails with a 422 `Popin not found` error.
+- **Fixed — a redirect into a popin opens content-first.** The popin's body is injected before it opens, so a slow or failed load no longer flashes (or leaves open) an empty popin.
+- **Fixed — server-side validation of a data object against a rules object works.** `gina.plugins.Validator(rules, data, formId[, culture])` used to crash on its first field; plain rules now validate and return `{ isValid(), error, data }`, with the optional `culture` localising labels from the bundle catalog. Conditional (`_case_`) rules remain client-only.
+- **Fixed — `$form.send(FormData)` nests bracket-notation field names.** `item[0][id]`-style names now nest into objects/arrays before posting (matching the declarative submit path), instead of being transmitted as literal JSON keys.
+- **Fixed — a fields-only multipart POST no longer hangs, and a malformed multipart body no longer crashes the bundle.** A `multipart/form-data` POST with no file parts previously hung until a front-proxy timeout, and a malformed/empty multipart body could take a worker down via an uncaught parser error (an unauthenticated single-request DoS); both are fixed — the fields-only case resumes directly, and the parser error is answered with HTTP 400.
+- **Fixed — `X-Powered-By` suppression reaches static and error responses.** `settings.json > server.hidePoweredBy: true` now suppresses the header on every response gina originates (routed pages, static serves, static/traversal 404s, framework error pages) on both engines, and an `env.json` `X-Powered-By` override now replaces the value on HTTP/1.1 error responses too.
+- **Fixed — upload reset/delete removes the preview, restores class-hidden inputs, and gains removal callbacks.** Clicking a preview's **Reset**/**Delete** link now actually removes the preview image, its trigger link, and the generated hidden fields (the cleanup was previously dead code that threw a `ReferenceError`); the add-affordance restore lifts a `data-gina-form-upload-hidden-class`, the `-reset-trigger`/`-delete-trigger` id override now resolves, and new `data-gina-form-upload-on-reset` / `-on-delete` callbacks fire once per removal.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -39,6 +39,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.12` ✅ | FormValidator built-in rule labels localise from the per-bundle i18n catalog (`_validator.<rule>`) on both the client and server, with a `gina.validator.setErrorLabels()` per-key override · per-bundle i18n catalogs activate URL-prefix / cookie / `Accept-Language` culture negotiation and `t()` at boot, and the negotiated culture now reaches every request (it previously resolved to `en`/empty #B83, and was dropped on warm/cached reloads #B84) · `data-gina-form-rule` forms auto-boot the client validator · **Fixed**: validator correctness (empty-required single message #B78, cross-field `is` empty operand #B82, submit trigger stays operable via `aria-disabled` #B76), popin / redirect robustness (#B80 / #B77 / #B75, static directory-to-index 301 outside dev), and CLI robustness (malformed `@<project>` rejected #B69, `GINA_HOMEDIR` re-export across child commands, `project:start` / `service:start` delegation, zero-bundle bulk commands, `framework:add` install hint #B81) |
 | **Q3 2026** | `0.5.13` ✅ | Unrenderable `_validator` catalog labels are caught at bundle boot — an unknown `%`-token (anything but `%l` / `%n` / `%s`, including a literal percent glued to letters as in `20%sur le prix`), a non-string label, or a non-object `_validator` section now warns and names the offending rule and catalog file. Warn-only: the catalog still loads, so a translation typo surfaces in the boot log instead of in production copy |
 | **Q3 2026** | `0.5.14` ✅ | Validator + error-handling robustness — a non-string validator error label now degrades to the rule's English default instead of throwing (the throw had aborted validation and left every later form on the page unbound), across all four label sources · a per-field `ApiError` message no longer leaks a raw server stack trace to the browser outside local scope · a changing validator message on a still-invalid field re-announces through the ARIA live region · release: stable publishes assert a single, correctly-named README "What's in" section |
+| **Q3 2026** | `0.5.15` ✅ | Client-side components (Web Components) — standards-based, zero-dependency conventions for stateful client widgets: `gina view:add` scaffolds a reference custom element (server-rendered light-DOM partial + behavior-only class), components upgrade automatically in popin/XHR-injected content with no rebinding, form-associated custom elements participate in `FormValidator`, live-data components ride the connect/disconnect lifecycle over `method:"ws"` routes or SSE, and the dev Inspector gains a component census + client component-event capture · a popin/dialog trigger can opt out of the hover/focus preload (`data-gina-dialog-preload="false"`) · **Fixed**: `gina.popin` sees every popin so a form can redirect into a different one (#B90), a redirect into a popin opens content-first (#B79), server-side validation of a data object against a rules object works (#B85), `$form.send(FormData)` nests bracket-notation field names (#B92), a fields-only multipart POST no longer hangs (#B93) and a malformed multipart body no longer crashes the bundle (#B97), `X-Powered-By` suppression reaches static and error responses (#B96), and upload reset/delete removes the preview, restores class-hidden inputs, and gains removal callbacks (#B94/#B95) |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 
@@ -56,6 +57,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | ✅ | **Per-bundle framework version** — Declare `"gina_version": "0.1.8"` on any bundle entry in `manifest.json` to pin that bundle to a specific installed framework version. The socket server continues running its own version; only the spawned bundle process uses the declared version. Validated against the tracked version list in `main.json` before start. `--gina-version=X.Y.Z` flag on `bundle:start` provides the same override without touching config files. | `0.3.0` | 2026-03-31 |
 | ✅ | **PATCH method** — `req.patch` populated with the parsed request body (JSON or form-encoded). `req.body` aliases `req.patch`. URI params merged. `"method": "PATCH"` valid in `routing.json`. Use PATCH for partial updates (only sent fields change) vs PUT which replaces the full resource. | `0.3.0` | 2026-03-31 |
 | ✅ | **HEAD method** — `req.head` populated with query-string and URI params. Full controller action runs so all response headers are set correctly; body is suppressed before writing to the wire. Both `render()` and `renderJSON()` honour HEAD. Routes declared as `GET` automatically accept HEAD — no extra routing rule needed. | `0.3.0` | 2026-03-31 |
+| ✅ | **Client-side components (Web Components)** — Standards-based conventions for stateful client widgets: custom elements v1, zero dependency, no build tooling. Server-rendered light-DOM authoring keeps HTML (designer) and JS (developer) separated — the behavior-only class binds its own server-rendered subtree and holds no markup strings (repeatable markup clones from a server-rendered `<template>`). Components upgrade automatically in popin/XHR-injected content with no rebinding; SEO/GEO-first (meaningful content ships in the initial server-rendered HTML). `gina view:add` scaffolds a reference component (engine partial + behavior-only class); e2e coverage locks popin auto-upgrade, strict-CSP compatibility (real nonce'd header, no `unsafe-inline`), SSR hydration from attributes + a JSON `data-*` payload, and no-JS crawler equivalence. The `gina-*` tag prefix is reserved for framework components. Form-associated custom elements participate in FormValidator — a named component exposing a `.value` getter is collected, validated, serialized into the AJAX payload, and error-rendered like a native control (client-side live-check on its composed bubbling `change`, dirty-tracking, and auto-id), so long as it declares `static formAssociated = true`, carries a `name`, and fires a composed `change` on commit. Live-data components ride the same lifecycle — open the connection in `connectedCallback`, close it in `disconnectedCallback` (popin close then tears it down automatically) — paired with `method:"ws"` routes or SSE via `renderStream()`, with per-animation-frame batching guidance for high-frequency streams; the lifecycle contract is executed against a live HTTP/2 extended-CONNECT loopback in the test suite. Dev-mode Inspector observability: the View tab carries a component census with a red undefined-components indicator (a typo'd tag or a missing definition script is no longer a silent failure), and the Events tab surfaces client-side `<tag>:<verb>` component events — metadata always, `detail` values only behind the existing `inspector.events.captureArgs` opt-in. | `0.5.15` | 2026-07-11 |
 
 ---
 

package/framework/v0.5.15/VERSION

@@ -0,0 +1 @@
+0.5.15

package/framework/{v0.5.14 → v0.5.15}/core/asset/plugin/dist/vendor/gina/html/statusbar.html

@@ -158,6 +158,109 @@
         return _rdcWalk(value, 0, [], domHits);
     }
 
+    // ── Component observability (#CC6) ────────────────────────────────────
+    // Census: instances per custom-element tag, split defined/awaiting-upgrade.
+    // An undefined custom tag (typo'd name, missing or failed definition
+    // script) is otherwise a perfectly silent failure — an inert inline
+    // element. Collected in-page because the Inspector SPA has no DOM access
+    // in bound/COOP mode; rides additively as user.view.components.
+    function _ginaComponentCensus() {
+        var census = { defined: {}, undefined: {}, undefinedCount: 0 };
+        try {
+            var totals = {};
+            var all = document.querySelectorAll('*');
+            for (var ci = 0; ci < all.length; ci++) {
+                var tag = all[ci].tagName ? all[ci].tagName.toLowerCase() : '';
+                if (tag.indexOf('-') === -1) continue;
+                totals[tag] = (totals[tag] || 0) + 1;
+            }
+            // the platform's own awaiting-upgrade selector
+            var pending = document.querySelectorAll(':not(:defined)');
+            for (var cp = 0; cp < pending.length; cp++) {
+                var ptag = pending[cp].tagName ? pending[cp].tagName.toLowerCase() : '';
+                if (ptag.indexOf('-') === -1) continue;
+                census.undefined[ptag] = (census.undefined[ptag] || 0) + 1;
+                census.undefinedCount++;
+            }
+            for (var ct in totals) {
+                var pendingCount = census.undefined[ct] || 0;
+                if (totals[ct] > pendingCount) census.defined[ct] = totals[ct] - pendingCount;
+            }
+        } catch (e) { /* best-effort — never break the page */ }
+        return census;
+    }
+    function _ginaAttachCensus() {
+        try {
+            var u = window.__ginaData && window.__ginaData.user;
+            if (u && u.view && typeof u.view === 'object') {
+                u.view.components = _ginaComponentCensus();
+            }
+        } catch (e) {}
+    }
+    var _ginaCensusTimer = null;
+    // XHR/popin updates publish BEFORE the fragment lands in the DOM — refresh
+    // the census (and republish) once, shortly after, so injected components
+    // and their upgrade state are reflected.
+    function _ginaScheduleCensusRefresh() {
+        if (_ginaCensusTimer) return;
+        _ginaCensusTimer = setTimeout(function () {
+            _ginaCensusTimer = null;
+            _ginaAttachCensus();
+            _ginaPublish();
+        }, 150);
+    }
+
+    // ── Component protocol events (#CC6) ──────────────────────────────────
+    // Dev-only visibility of composed, bubbling CustomEvents following the
+    // component convention `<tag>:<verb>` (dashed tag prefix — the framework's
+    // own dot-namespaced internal events never match). Event name + target +
+    // timestamp always ride; the event `detail` VALUES ride only when the
+    // events capture gate is opted in server-side (whispered as
+    // gina.inspectorEventsCaptureArgs) — arbitrary detail cannot be
+    // auto-redacted, so values stay off by default, and captured values still
+    // pass the redaction walk above.
+    var _ginaEvtBuf = [];
+    var _ginaEvtMax = 200;
+    var _ginaEvtCaptureDetail = !!(d.gina && d.gina.inspectorEventsCaptureArgs === true);
+    var _ginaEvtName = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)+:./;
+    var _ginaEvtTimer = null;
+    function _ginaEvtPublish() {
+        if (_ginaEvtTimer) return;
+        _ginaEvtTimer = setTimeout(function () {
+            _ginaEvtTimer = null;
+            try {
+                var u = window.__ginaData && window.__ginaData.user;
+                if (u) u.clientEvents = _ginaEvtBuf;
+                _ginaPublish();
+            } catch (e) {}
+        }, 250);
+    }
+    try {
+        var _ginaNativeDispatch = EventTarget.prototype.dispatchEvent;
+        EventTarget.prototype.dispatchEvent = function (ev) {
+            try {
+                if (ev && ev.bubbles && ev.composed && typeof ev.type === 'string'
+                    && _ginaEvtName.test(ev.type)) {
+                    var _evEntry = {
+                        name   : ev.type,
+                        t      : Date.now(),
+                        target : (this && this.tagName)
+                            ? String(this.tagName).toLowerCase() + (this.id ? '#' + this.id : '')
+                            : 'non-element'
+                    };
+                    if (_ginaEvtCaptureDetail && typeof ev.detail !== 'undefined') {
+                        try { _evEntry.meta = _rdc_redact(ev.detail, null); }
+                        catch (x) { _evEntry.meta = '[uncapturable]'; }
+                    }
+                    _ginaEvtBuf.push(_evEntry);
+                    if (_ginaEvtBuf.length > _ginaEvtMax) _ginaEvtBuf.shift();
+                    _ginaEvtPublish();
+                }
+            } catch (e) { /* observability must never break dispatch */ }
+            return _ginaNativeDispatch.apply(this, arguments);
+        };
+    } catch (e) { /* prototype not writable — skip the wrap */ }
+
     // ── ginaToolbar shim ──────────────────────────────────────────────────
     // gina.min.js is a stale build that creates its own window.ginaToolbar
     // with a loadData function that accesses removed DOM elements
@@ -201,6 +304,11 @@
                 }
             }
 
+            // #CC6 — refresh the component census with the update, and again
+            // shortly after (an XHR fragment lands in the DOM after this publish)
+            _ginaAttachCensus();
+            _ginaScheduleCensusRefresh();
+
             // Sync localStorage for the Inspector's fallback channel
             try { localStorage.setItem('__ginaData', JSON.stringify(window.__ginaData)); } catch (e) {}
             _ginaPublish();
@@ -249,6 +357,8 @@
         window.ginaToolbar = _shim;
     }
 
+    // #CC6 — the initial component census rides the first publish
+    _ginaAttachCensus();
     // Publish data for Inspector via localStorage (works regardless of opener)
     try { localStorage.setItem('__ginaData', JSON.stringify(d)); } catch (e) {}
     _ginaPublish();

package/framework/{v0.5.14 → v0.5.15}/core/asset/plugin/dist/vendor/gina/inspector/inspector.css

@@ -1228,6 +1228,18 @@ body {
   border-top: none;
 }
 
+/* #CC6 — component census (View tab) */
+.bm-comp-undefined {
+  margin: 2px 0 4px;
+  font-weight: 600;
+  color: var(--err);
+}
+
+.bm-comp-defined {
+  margin: 2px 0 4px;
+  color: var(--text-dim);
+}
+
 /* Forms tab — accordion card for each form ──────────────────────────────── */
 .bm-form-card {
   background: var(--bg2);

package/framework/{v0.5.14 → v0.5.15}/core/asset/plugin/dist/vendor/gina/inspector/inspector.js

@@ -138,8 +138,8 @@
     /** @constant {RegExp} Matches HTTP/HTTPS URLs */
     var RE_URL  = /^https?:\/\//i;
 
-    /** @constant {Object} Keys to skip when rendering the View tab */
-    var VIEW_SKIP = { scripts: 1, stylesheets: 1 };
+    /** @constant {Object} Keys to skip when rendering the View tab (components renders bespoke — #CC6) */
+    var VIEW_SKIP = { scripts: 1, stylesheets: 1, components: 1 };
     /** @constant {Object} Keys whose children are recursively flattened into PROPERTIES */
     var VIEW_FLATTEN = { html: 1, properties: 1 };
 
@@ -633,6 +633,47 @@
             + '</div>';
     }
 
+    /**
+     * #CC6 — render the component census as a View-tab section. The census is
+     * collected in-page by the statusbar (the SPA has no DOM access in bound
+     * or COOP mode) and rides `user.view.components` additively. Undefined
+     * custom elements — a typo'd tag name, a missing or failed definition
+     * script — are otherwise a perfectly silent failure (an inert inline
+     * element), so they surface first, in red.
+     * @inner
+     * @param {Object} census - { defined: {tag: count}, undefined: {tag: count}, undefinedCount: number }
+     * @returns {string} HTML string (empty when the page has no custom elements)
+     */
+    function renderComponentsSection(census) {
+        var defined = (census && census.defined) || {};
+        var pending = (census && census.undefined) || {};
+        var defKeys = Object.keys(defined);
+        var undKeys = Object.keys(pending);
+        if (!defKeys.length && !undKeys.length) { return ''; }
+        var h = '<div class="bm-section">'
+            + '<h2 class="bm-section-title">components</h2>';
+        if (undKeys.length) {
+            var total = (census && typeof census.undefinedCount === 'number')
+                ? census.undefinedCount : undKeys.length;
+            var undParts = [];
+            for (var ui = 0; ui < undKeys.length; ui++) {
+                undParts.push(escHtml('<' + undKeys[ui] + '> ×' + pending[undKeys[ui]]));
+            }
+            h += '<div class="bm-comp-undefined">'
+                + escHtml(String(total)) + ' undefined component' + (total === 1 ? '' : 's')
+                + ' — not upgraded: ' + undParts.join(', ')
+                + '</div>';
+        }
+        if (defKeys.length) {
+            var defParts = [];
+            for (var di = 0; di < defKeys.length; di++) {
+                defParts.push(escHtml('<' + defKeys[di] + '> ×' + defined[defKeys[di]]));
+            }
+            h += '<div class="bm-comp-defined">' + defParts.join(', ') + '</div>';
+        }
+        return h + '</div>';
+    }
+
     // ── Data weight badge ──────────────────────────────────────────────────
 
     /**
@@ -1225,6 +1266,11 @@
             h += renderSection(objectSections[s].name, objectSections[s].data, objectSections[s].gina);
         }
 
+        // #CC6 — component census (statusbar-collected; bespoke red indicator)
+        if (view.components && typeof view.components === 'object') {
+            h += renderComponentsSection(view.components);
+        }
+
         return h;
     }
 
@@ -1868,6 +1914,7 @@
                 // via textContent; return before the innerHTML/fold path. Event
                 // names + metadata are app-controlled but treated as untrusted.
                 renderAppEvents(treeEl, u.events);
+                appendClientEvents(treeEl, u.clientEvents); // #CC6 — component protocol events
                 return;
         }
 
@@ -2047,6 +2094,44 @@
         }
     }
 
+    /**
+     * #CC6 — format the client-side component-event buffer (the statusbar's
+     * dispatchEvent capture: composed bubbling CustomEvents named
+     * `<tag>:<verb>`). One line per event: time, name, emitting element and —
+     * only when the server-side capture gate is opted in — the redacted
+     * `detail` payload.
+     * @inner
+     * @param {?Object[]} arr - `user.clientEvents`, or null.
+     * @returns {string}
+     */
+    function formatClientEventBuffer(arr) {
+        return arr.map(function (e) {
+            var ts = '';
+            try { ts = new Date(e.t).toISOString().substr(11, 12); } catch (x) { ts = ''; }
+            var line = (ts ? ts + '  ' : '') + (e.name || '?') + (e.target ? '  ' + e.target : '');
+            if (typeof e.meta !== 'undefined') {
+                var s;
+                try { s = JSON.stringify(e.meta); } catch (x) { s = '[unserialisable]'; }
+                line += '  ' + s;
+            }
+            return line;
+        }).join('\n');
+    }
+
+    /**
+     * #CC6 — append the client component-event block to the Events pane,
+     * below the server events. Always textContent — event names, targets and
+     * detail payloads are page-controlled and treated as untrusted.
+     * @inner
+     * @param {Element} el - The `#tree-events` pane.
+     * @param {?Object[]} clientEvents - `user.clientEvents`, or null.
+     */
+    function appendClientEvents(el, clientEvents) {
+        if (!el || !clientEvents || !clientEvents.length) { return; }
+        el.textContent += '\n\n── Client component events ──\n'
+            + formatClientEventBuffer(clientEvents);
+    }
+
     /**
      * Render the Data tab in raw JSON mode (pretty-printed `<pre>` block).
      * @inner