gina 0.5.15 → 0.5.16

package/CHANGELOG.md

@@ -6,6 +6,16 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.16 - 2026-07-12
+### Added
+* Multipart text fields are now captured into the request body: `request.body` (and `request.post`/`request.put`/`request.patch`) carries the non-file fields of a `multipart/form-data` request — bracket-notation names arrive nested and values verbatim (no url-decode, no boolean/null coercion), capped by the new `upload.maxTextFields` (default 1000) and `upload.maxTextFieldSize` (default 1MB) settings with a 400 on breach. Previously every text field of a multipart request was silently dropped.
+### Fixed
+* `$form.send(FormData)` no longer drops the non-file fields when the payload also carries files — they ride the multipart body as standard text parts and reach the server nested exactly as on the JSON (fileless) path.
+* A routing rule's `param.title` now reaches `page.view.title` — the routing-param title promotion had been silently inert since its introduction, so the browser-tab title always showed the route name; the stripped route name remains the fallback for title-less rules, and a controller-set title still wins. The `view:add` layout boilerplate now reads `page.view.title` / `page.view.lang` instead of the never-populated `page.title` / `page.lang`, so freshly scaffolded pages get a real tab title and lang attribute.
+* `settings.i18n.cookieName` is now honoured by the per-request locale negotiation — the cookie name was hardcoded to `gina_culture` and the shipped setting silently ignored; a bundle can now rename the locale-persistence cookie, and an explicit `null` disables cookie-based negotiation as documented. Absent or empty values keep the historical default.
+* The controller locale-DB fallback is guarded — a bundle without a `region` settings block no longer answers 500 when a request's language is missing from the region data, and the fallback language now resolves deterministically (`region.isoShort` → legacy `region.shortCode` → `en`) instead of silently returning the first region record with an `undefined` in the warn.
+* The `gina help i18n` text no longer claims `--output` works for `scan --format=json` — the flag applies to `export` only (scan prints to stdout).
+
 ## 0.5.15 - 2026-07-11
 ### Added
 * A popin/dialog trigger can now opt out of the hover/focus preload with `data-gina-dialog-preload="false"` (honored on legacy `data-gina-popin-url` triggers too; the value is matched case-insensitively so a templated "False" cannot fail open): the warm-up GET no longer fires on hover or focus for that trigger, and its click loads normally, at click time. Declare it on any trigger whose GET has server-side effects — the preload otherwise assumes GET is safe to fire early, per HTTP semantics.

package/README.md

@@ -42,17 +42,13 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.5.15
-
-- **Added — client-side components (Web Components).** Standards-based, zero-dependency conventions for stateful client widgets: `gina view:add` scaffolds a reference custom element (a server-rendered light-DOM partial paired with a behavior-only class, HTML and JS kept separate), components upgrade automatically inside popin/XHR-injected content with no rebinding, and the whole pattern is SEO/GEO-first (meaningful content ships in the initial server-rendered HTML) and strict-CSP compatible. Form-associated custom elements (`static formAssociated = true` + a `name` + a `.value` getter) participate in `FormValidator` like native controls — collected, live-checked, validated, serialized into the AJAX payload, and error-rendered. Live-data components ride the `connectedCallback`/`disconnectedCallback` lifecycle over `method:"ws"` routes or SSE. The dev Inspector gains a component census (with a red indicator for undefined components awaiting upgrade) and captures client-side `<tag>:<verb>` component events.
-- **Added — a popin/dialog trigger can opt out of the hover/focus preload.** Declare `data-gina-dialog-preload="false"` on any trigger whose GET has server-side effects and the warm-up GET no longer fires on hover or focus; the click loads normally, at click time. Existing triggers are unaffected.
-- **Fixed — `gina.popin` sees every popin.** The popin registry is now shared across every `Popin` instance, so `getPopinByName()` / `getPopinById()` / `activePopinId` resolve every registered popin — a form submitted from a popin whose response redirects into a *different* popin no longer fails with a 422 `Popin not found` error.
-- **Fixed — a redirect into a popin opens content-first.** The popin's body is injected before it opens, so a slow or failed load no longer flashes (or leaves open) an empty popin.
-- **Fixed — server-side validation of a data object against a rules object works.** `gina.plugins.Validator(rules, data, formId[, culture])` used to crash on its first field; plain rules now validate and return `{ isValid(), error, data }`, with the optional `culture` localising labels from the bundle catalog. Conditional (`_case_`) rules remain client-only.
-- **Fixed — `$form.send(FormData)` nests bracket-notation field names.** `item[0][id]`-style names now nest into objects/arrays before posting (matching the declarative submit path), instead of being transmitted as literal JSON keys.
-- **Fixed — a fields-only multipart POST no longer hangs, and a malformed multipart body no longer crashes the bundle.** A `multipart/form-data` POST with no file parts previously hung until a front-proxy timeout, and a malformed/empty multipart body could take a worker down via an uncaught parser error (an unauthenticated single-request DoS); both are fixed — the fields-only case resumes directly, and the parser error is answered with HTTP 400.
-- **Fixed — `X-Powered-By` suppression reaches static and error responses.** `settings.json > server.hidePoweredBy: true` now suppresses the header on every response gina originates (routed pages, static serves, static/traversal 404s, framework error pages) on both engines, and an `env.json` `X-Powered-By` override now replaces the value on HTTP/1.1 error responses too.
-- **Fixed — upload reset/delete removes the preview, restores class-hidden inputs, and gains removal callbacks.** Clicking a preview's **Reset**/**Delete** link now actually removes the preview image, its trigger link, and the generated hidden fields (the cleanup was previously dead code that threw a `ReferenceError`); the add-affordance restore lifts a `data-gina-form-upload-hidden-class`, the `-reset-trigger`/`-delete-trigger` id override now resolves, and new `data-gina-form-upload-on-reset` / `-on-delete` callbacks fire once per removal.
+## What's in 0.5.16
+
+- **Added — multipart text fields are captured into the request body.** A `multipart/form-data` request's non-file fields now populate `request.body` (and `request.post`/`request.put`/`request.patch`) — bracket-notation names arrive nested and values verbatim (no url-decode, no boolean/null coercion), capped by the new `upload.maxTextFields` (default 1000) and `upload.maxTextFieldSize` (default 1MB) settings with a 400 on breach. Previously every text field of a multipart request was silently dropped.
+- **Fixed — `$form.send(FormData)` keeps its non-file fields.** When the payload also carries files, the non-file fields now ride the multipart body as standard text parts and reach the server nested exactly as on the JSON (fileless) path, instead of being dropped.
+- **Fixed — a routing rule's `param.title` reaches the browser-tab title.** The routing-param title promotion had been silently inert since its introduction, so the tab title always showed the route name; a rule's `param.title` now sets `page.view.title` (the stripped route name remains the fallback for title-less rules, and a controller-set title still wins). The `view:add` layout boilerplate now reads `page.view.title` / `page.view.lang`, so freshly scaffolded pages get a real tab title and lang attribute.
+- **Fixed — `settings.i18n.cookieName` is now honoured.** The per-request locale negotiation reads the cookie named by the setting (default `gina_culture`), and an explicit `null` disables cookie-based negotiation. Previously the shipped key was silently ignored — the cookie name was hardcoded.
+- **Fixed — the locale-DB fallback no longer 500s or falls back by accident.** When a request's language is missing from the region data, the fallback now resolves deterministically (`region.isoShort` → legacy `region.shortCode` → `en`) with every step guarded. Previously a bundle without a `region` settings block could answer 500, and schema-valid bundles silently received the first region record while the warn printed `undefined`.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -40,6 +40,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.13` ✅ | Unrenderable `_validator` catalog labels are caught at bundle boot — an unknown `%`-token (anything but `%l` / `%n` / `%s`, including a literal percent glued to letters as in `20%sur le prix`), a non-string label, or a non-object `_validator` section now warns and names the offending rule and catalog file. Warn-only: the catalog still loads, so a translation typo surfaces in the boot log instead of in production copy |
 | **Q3 2026** | `0.5.14` ✅ | Validator + error-handling robustness — a non-string validator error label now degrades to the rule's English default instead of throwing (the throw had aborted validation and left every later form on the page unbound), across all four label sources · a per-field `ApiError` message no longer leaks a raw server stack trace to the browser outside local scope · a changing validator message on a still-invalid field re-announces through the ARIA live region · release: stable publishes assert a single, correctly-named README "What's in" section |
 | **Q3 2026** | `0.5.15` ✅ | Client-side components (Web Components) — standards-based, zero-dependency conventions for stateful client widgets: `gina view:add` scaffolds a reference custom element (server-rendered light-DOM partial + behavior-only class), components upgrade automatically in popin/XHR-injected content with no rebinding, form-associated custom elements participate in `FormValidator`, live-data components ride the connect/disconnect lifecycle over `method:"ws"` routes or SSE, and the dev Inspector gains a component census + client component-event capture · a popin/dialog trigger can opt out of the hover/focus preload (`data-gina-dialog-preload="false"`) · **Fixed**: `gina.popin` sees every popin so a form can redirect into a different one (#B90), a redirect into a popin opens content-first (#B79), server-side validation of a data object against a rules object works (#B85), `$form.send(FormData)` nests bracket-notation field names (#B92), a fields-only multipart POST no longer hangs (#B93) and a malformed multipart body no longer crashes the bundle (#B97), `X-Powered-By` suppression reaches static and error responses (#B96), and upload reset/delete removes the preview, restores class-hidden inputs, and gains removal callbacks (#B94/#B95) |
+| **Q3 2026** | `0.5.16` ✅ | **Added**: a `multipart/form-data` request's non-file text fields are now captured into `request.body` (bracket-notation nested, values verbatim, capped by `upload.maxTextFields` / `upload.maxTextFieldSize` with a 400 on breach) — previously silently dropped · **Fixed**: `$form.send(FormData)` keeps its non-file fields when the payload also carries files (#B92), and a routing rule's `param.title` now reaches the browser-tab title (`page.view.title`) instead of always showing the route name, with the route name as the fallback (#B98) |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 

package/framework/v0.5.16/VERSION

@@ -0,0 +1 @@
+0.5.16

package/framework/{v0.5.15 → v0.5.16}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -9863,6 +9863,24 @@ function DataHelper(){
         return obj;
     }
 
+    /**
+     * Framework-global alias of parseLocalObj (#B92-adjacent) — nests ONE
+     * bracket-notation key path into an accumulator, leaf value assigned
+     * verbatim. Exposed like formatDataFromString above so the server's
+     * multipart text-field capture (core/server.js) reuses the SAME nesting
+     * layer as the urlencoded path instead of a second copy. The client-side
+     * form-validator carries a byte-faithful port under the same name (the
+     * browser bundle cannot reach server helpers).
+     *
+     * @global
+     * @param {object|array} obj - accumulator (mutated and returned)
+     * @param {array} key - bracket-split key path, e.g. `item[0][id]` -> ['item','0','id']
+     * @param {number} k - current depth (callers pass 0)
+     * @param {*} value - leaf value, assigned verbatim
+     * @returns {object|array} the accumulator
+     */
+    nestBracketNotationKey = parseLocalObj;
+
 } //EO DataHelper
 
 if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
@@ -11903,8 +11921,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             // We need a separator to define each part of the request
                             var boundary = '--ginaWKBoundary' + uuid();
 
-
-                            return processFiles(binaries, boundary, '', 0, function onComplete(err, data, done) {
+                            // #B92-adjacent — non-file fields ride the multipart body as
+                            // standard text parts. They were silently dropped on this branch:
+                            // processFiles() assembles file parts only, and newData was never
+                            // consumed once the FormData carried a File.
+                            return processFiles(binaries, boundary, buildMultipartFieldParts(data, boundary), 0, function onComplete(err, data, done) {
 
                                 if (err) {
                                     //throw err
@@ -12510,6 +12531,43 @@ function ValidatorPlugin(rules, data, formId, culture) {
     }
 
 
+    /**
+     * buildMultipartFieldParts
+     *
+     * #B92-adjacent — serializes a FormData's NON-file entries into standard
+     * multipart text parts so they ride the hand-assembled upload body
+     * (`processFiles()` builds file parts only; before this helper every
+     * non-file field was silently dropped whenever the FormData carried a
+     * File). Part names keep the caller's ORIGINAL bracket notation
+     * (`item[0][id]`) — the server nests them on capture, so the fields arrive
+     * shaped exactly as on the JSON (fileless) path. Values are appended
+     * verbatim; FormData guarantees non-file values are strings (a Blob append
+     * becomes a File).
+     *
+     * @param {FormData} data - the form data being sent
+     * @param {string} boundary - the multipart boundary (as used by processFiles)
+     *
+     * @returns {string} zero or more `--<boundary>` text parts; '' when the
+     *  FormData carries no non-file entry
+     */
+    var buildMultipartFieldParts = function(data, boundary) {
+        var parts = '';
+        for (var [fieldKey, fieldValue] of data.entries()) {
+            if (fieldValue instanceof File) {
+                continue;
+            }
+            // RFC 7578 §5.1.1 name escaping (the browser convention): percent-encode
+            // CR / LF / double-quote; anything else — bracket notation included — is
+            // legal inside the quoted-string as-is.
+            var safeName = String(fieldKey).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+            parts += '--' + boundary + '\r\n'
+                + 'Content-Disposition: form-data; name="' + safeName + '"\r\n'
+                + '\r\n'
+                + fieldValue + '\r\n';
+        }
+        return parts;
+    };
+
     var processFiles = function(binaries, boundary, data, f, onComplete) {
 
         var reader = new FileReader();