gina 0.5.17 → 0.5.18

package/CHANGELOG.md

@@ -6,6 +6,41 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.18 - 2026-07-16
+### Added
+* Bundle-wide `sliding` and `maxAge` cache defaults: `server.cache` now supplies `sliding` and `maxAge` fallbacks that a route inherits when it omits them, mirroring the existing `ttl` fallback — so sliding-window caching can be enabled for a whole bundle from one place. Per-route values still win (an explicit `sliding: false` overrides a bundle-wide `true`), and behaviour is unchanged for bundles that do not set these keys. Applies to cached HTML (swig, nunjucks) and JSON responses.
+* Pluggable render/output-cache backend strategy: `server.cache.type` sets the default cache backend (`memory` or `fs`) for a whole bundle, and a route with `cache` set but no `type` now inherits it — mirroring the existing `ttl` / `sliding` / `maxAge` fallbacks. A per-route `cache.type` still wins. New bundles default to `memory`; behaviour is unchanged for existing installs (a route with no effective `type` is not cached, exactly as before). The memory and fs backends now share one strategy dispatcher (`lib/render-cache`) that the render controllers and the server read path go through, providing the seam for additional backends.
+* Added a native schema/DTO builder (gina.dto): author a data shape once and project it to dialect-aware JSON Schema (.toJsonSchema, draft-07 or 2020-12), the live form-validator rules-object (.toRules), and a stable name for the type generator. Also adds a routing-introspect helper that un-collapses inline validator:: requirements into real JSON Schema. Foundation for the #DTO validation pipe and richer OpenAPI/MCP request/response schemas.
+* Added a POST /_gina/cache/clear admin endpoint (both server engines, loopback-gated like /_gina/cache/stats) that flushes the rendered-output cache — the static: (HTML) and data: (JSON) namespaces, with an optional ?bundle=<name> filter — without ever touching compiled templates or HTTP/2 sessions. It is backed by a namespace-scoped renderCache.clear(bundle) (which runs each entry cleanup so fs bodies + their .meta sidecars are removed) and a new keys() accessor on the in-process cache primitive. A new gina cache:clear [<bundle>] @<project> CLI drives it — an offline reclaim of the on-disk render-output dirs for the bundle (including orphaned prior-release dirs, preserving the config/swig infra caches) plus the in-heap flush via the endpoint — with --dry-run and --format=json output.
+* `bundle:openapi` and `bundle:mcp` now emit real request/response schemas from a route's `param.dto` / `param.responseDto`. A bundle DTO module at `dtos/<Name>.js` — a factory `module.exports = function (dto) { return dto.object({ ... }); }` — projects to an OpenAPI 3.1 requestBody plus a 422 response, or an MCP tool inputSchema.body plus outputSchema. An inline `validator::{ ... }` routing requirement is also un-collapsed into a real parameter schema instead of the previous `.*`.
+* Default-on request validation from a route DTO: a routing.json rule declaring `param.dto` now has its payload validated against that DTO before the controller action runs, answering a clean 422 (field -> rule -> message, localised) on failure and handing the action a type-coerced payload on success. `param.responseDto` now also shapes the outgoing JSON, so a field marked `.exclude()` never reaches the wire. DTOs are resolved and registered at bundle boot, so a missing or un-evaluable DTO fails the boot instead of silently disabling validation. Routes that declare no DTO are unaffected.
+* Evict by event from outside the bundle: `POST /_gina/cache/clear?event=<name>` (both engines) and `gina cache:clear --event=<name>`. A controller's `self.cache.invalidateByEvent()` only reaches its own process, so this is how one bundle's write invalidates another bundle's cached pages. Both report the number of entries evicted. Note `?event=` previously went unread, so passing it flushed EVERY bundle's output cache instead of evicting that event's entries; it is now honoured and takes precedence over `?bundle=`.
+* `gina bundle:types <bundle> @<project>` emits TypeScript declarations from a bundle's DTOs — the fourth projection of a DTO, alongside runtime validation, response shaping and the OpenAPI / MCP schemas, so a shape authored once is also the shape your editor and `tsc` see. Written to `<bundle>/dtos/index.d.ts` by default (`--output` overrides). Each DTO emits TWO types, because its declared shape and the shape the server actually holds are not the same: `<Name>` is what the client sends (and what the OpenAPI schema documents), while `<Name>Projected` is what the action reads on `req.dto` and what a `param.responseDto` puts on the wire — with the `.exclude()`d fields dropped. Value bounds (`.min()` / `.max()`) are carried as documentation only, and a `date` field is typed `string` rather than `Date`, because that is what the validator actually hands the action.
+* Per-form legacy opt-in `data-gina-form-checkbox-value-as-state="true"` (deprecated, transitional) preserving the pre-fix value-driven checkbox ticking while markup migrates to the `checked` attribute; a once-per-field console warning now flags checkboxes whose `value` used to imply the checked state
+* Render cache: a redis-backed L2 tier — rendered output is cached in a shared redis so multiple replicas serve the same rendered page, and a freshly-started replica serves content a peer already rendered (cross-replica cold-start). Enable it with a bundle-wide default in settings.json — `cache: { type: "redis", store: "<name>" }`, where `store` names a `connectors.json` redis connector — or per route via `cache: { type: "redis", ttl: <seconds> }`. Writes go to the in-process L1 synchronously and to redis fire-and-forget (the response never waits on redis); a request that misses L1 warms it back from redis with the authoritative remaining PTTL and re-registers the route's invalidateOnEvents; invalidation (delete / clear / invalidateByEvent) propagates to redis; a down or failing redis degrades to per-replica caching (fail-open) with a once-per-process diagnostic warning. The bundle validates its cache configuration at boot and refuses to start on an unsupported shape (redis with `sliding`, a redis route with neither a ttl nor invalidateOnEvents, or a redis strategy with no `store`) — give every redis route a ttl (or invalidateOnEvents), since a non-expiring key is orphaned on a release-namespace change.
+* bundle:build and project:build now stamp a source-tree fingerprint (fingerprint, builtAt, fpSpec) into the project manifest release records — the substrate for stale built-release detection on local production rehearsals (releaseWatch groundwork)
+* Two-tier render-cache observability: every cache hit's Cache-Status header now carries an RFC 9211 detail parameter naming the physical tier that served the bytes — detail=memory for the in-process L1, detail=redis for a shared-L2 warm (the cross-replica cold-start visible per request), detail=fs for a disk read-back after a restart — and /_gina/cache/stats gains an additive l2 block on both engines reporting the redis store connection health (status, mode, key prefix, connection-error count and last error), with no network round-trip on the admin path.
+* releaseWatch — opt-in stale built-release watch for local production rehearsals (#RWATCH): `server.releaseWatch` in settings.json arms a source-tree fingerprint watch on local-scope non-dev bundles; staleness surfaces on `GET /_gina/release/status` and the `GET /_gina/release/events` SSE stream, and `POST /_gina/release/rebuild` rebuilds with an idle-gated restart honouring in-flight requests and `gina.registerBusyProbe` application probes (notify default, opt-in auto mode)
+* releaseWatch — a live stale-release banner (#RWATCH): with `server.releaseWatch` enabled on a local-scope non-dev bundle, rendered HTML pages carry a self-contained bottom-bar banner that surfaces build/restart staleness live over the `/_gina/release/events` SSE stream and offers a one-click rebuild-and-reload (idle-gated restart for server-code changes, build-only for static assets, contextual force-restart while waiting on idle); shadow-DOM isolated, CSP-nonce aware, injected server-side into both the swig and nunjucks render paths, and byte-inert on every other scope/env
+* releaseWatch — a `server.releaseWatch.restartMode` option (#RWATCH): `daemon` (default) drains and spawns `gina bundle:restart`; `supervisor` drains and then exits(0) so an external orchestrator respawns the process on the rebuilt release — the daemonless `gina-container` launch path, which has no framework daemon to spawn a restart (requires a restart-on-clean-exit policy, e.g. a k8s Deployment or `docker run --restart=always`). It is an explicit operator opt-in, never auto-detected: a bundle is spawned detached and legitimately outlives its daemon, so probing for a daemon would risk exiting a healthy process after a routine `gina stop`
+### Changed
+* Release-namespaced render/output-cache keys — a framework upgrade (or a per-deploy `GINA_CACHE_NAMESPACE` bump) now auto-invalidates the render/output cache, so a new build never serves a page cached by old code. The cache key AND the `fs` cache path carry a release namespace: `GINA_CACHE_NAMESPACE` (an operator-set id such as a git SHA or build number) when set, otherwise the framework version (`GINA_VERSION`, which is set at runtime). The key format is centralized in ONE builder shared by the three render controllers and the server read path, so the writer and reader keys can never drift. `fs`-cached files now live under a `<namespace>` directory (`<cache.path>/<bundle>/<namespace>/…`); files from a superseded namespace are orphaned on disk until they are cleared (a cross-strategy flush is a follow-up). Dev mode is unaffected (it runs cacheless).
+* The Cache-Status miss form is now the RFC 9211 grammar gina-cache; fwd=uri-miss (previously the bare gina-cache; uri-miss, which read as an unregistered parameter to RFC-aware tooling), and the engine-agnostic read path now emits it on a genuine both-tier miss — giving Express bundles their first cache-miss signal on the wire.
+### Fixed
+* A framework error raised from a detached context — a scheduled cron/timer, a worker, or a bootstrap-time `getLib()` call — no longer crashes the process with `TypeError: next is not a function`. The internal `throwError` helper treated the per-request router context (stored globally and never cleared) as if a live request were in flight and invoked a stale, non-callable `next()`, which additionally masked the original error. It now writes an error response only when a live response is still writable, hands back to the middleware chain only when `next` is genuinely callable, and otherwise surfaces the real error (emerg-logged for fatal calls, thrown otherwise). Live-request error handling is unchanged.
+* The `fs` render-cache backend now survives a server restart. Previously an `fs`-cached response written to disk was orphaned on the next boot (the in-process index starts empty), so it was never served again and its file was never cleaned up — `fs` behaved no better than `memory` across a restart. The server read path now falls back to disk on an index miss, replaying the entry from a sibling `<file>.meta` JSON sidecar and preserving the ORIGINAL absolute expiry: a restart never extends a TTL (a non-sliding entry still expires at its original creation time plus `ttl`; a sliding entry keeps its absolute `maxAge` ceiling). The `memory` backend stays volatile (cleared on restart), unchanged.
+* getLib() and getConfig() no longer crash with an opaque "Cannot read properties of undefined (reading 'conf')" when the framework configuration build aborts partway (for example a fail-closed secret resolution on an unset ${secret:KEY}) and bundle code, a cron, a worker, or module-load-time bootstrap reads configuration before the build has finished. The resolvers now fall back to the equivalent per-bundle/env configuration when the fully-built container is not yet available, or fail cleanly, so the real underlying boot error surfaces instead of a masking crash.
+* Event-driven cache invalidation now works. A route's `cache.invalidateOnEvents` was registered but nothing ever fired it, so the documented `self.cache.invalidateByEvent()` did not exist and configured routes served stale content until their TTL expired. `self.cache` now exists on the controller and returns the number of entries evicted. Three further defects in the same path are fixed: re-registering a key that carries a querystring THREW (the registry ran cache keys through a condition evaluator, and `?`/`=` parse as operator tokens) — under the swig engine that throw unwound to the top-level render error handler, which answered 500 and discarded a page that had already rendered; registrations were never reclaimed, so the registry grew one row per cache-miss re-render; and an `fs`-cached entry read back after a restart came back with no registration at all, so firing its event silently failed to evict it.
+* A failed cache write no longer discards a page that rendered correctly. Under the swig engine a cache-write error unwound to the top-level render error handler, which answered 500 — throwing away a perfectly good response. It now degrades exactly as the nunjucks and JSON renderers already did: the response is served, the failure is logged, and the next cache miss retries the write.
+* A checkbox's `value` attribute no longer decides its `checked` state: the HTML `checked` attribute alone drives the initial rendering, and the posted boolean is derived from the live checked state instead of the value string — so a consent-style checkbox rendered with `value="true"` is no longer silently pre-ticked, `value="false"` no longer un-ticks a server-checked box, a checkbox unticked from consumer script no longer posts `true` off its stale value, and a neutral-valued checkbox with an `isBoolean` rule posts real booleans instead of going dead (#49)
+* The published TypeScript declarations now describe the runtime: the main entry declares a value (previously 'import gina from "gina"; gina.lib' failed to typecheck for every consumer), the module surface carries all 78 runtime members including 'gina.dto', 'SuperController' gains its i18n / jobs / trailers / events / template-override methods plus 'GinaRequest<TDto>' and 'req.dto' typing for route DTOs, fictional declarations were removed, and a two-part gate (a consumer fixture compiled by tsc through the package exports map + a runtime-parity test) keeps the declarations and the runtime in sync.
+* Restored error diagnostics that a bitwise `|` was silently destroying at nine sites across the HTTP server, the browser client bundle, and three CLI commands. `err.stack|err.message|err` coerced the Error to the number `0` (because `+` binds tighter than `|`), so a rendered 500 page body, the express-middleware error handler, and the `protocol:set` / `port:reset` / `project:add` CLI error output all reported `0` instead of the cause. They now use a logical `||` and surface the real error stack/message.
+* A server-side form-validator query rule no longer re-points the framework's process-wide cache onto a second Map: the rule's hand-built controller now reuses the live server instance (published at server start), so concurrent renders keep reading their cached entries and pooled HTTP/2 sessions land in the real server's cache instead of an orphan store on the bundle's config dict
+* Fixed bundle:openapi and bundle:mcp advertising .exclude()d DTO fields in response schemas — the 200 content schema and the MCP tool outputSchema now emit the response projection (toJsonSchema with dropExcluded), dropping fields the wire can never carry from properties and required[]; request-side requestBody / inputSchema.body keep the declared shape (#B110)
+* Fixed log messages containing a $ being mangled by the text formatter — the %-token splice used a string replacement, which dollar-expands $-sequences in the message (a $ followed by a backtick was replaced by the rendered log prefix itself, recurring at each occurrence); the formatter now uses a function replacer so messages render verbatim across all levels and all sinks (stdout, mq, file) (#B108)
+* The in-process render/output cache no longer orphans `fs`-strategy files on TTL expiry: an entry expiring on its timer previously skipped the eviction cleanup, leaving its cached body and `.meta` sidecar on disk and its event registrations stranded. Timer expiry now runs the same cleanup as a manual eviction (#B113).
+* The validator's forced rule self-injection for boolean-classified checkboxes (and boolean-valued radios) now appends `isRequired` before `isBoolean`, so the engine's false-value rescue applies and an unchecked box whose rule declared neither key no longer fails validation with "Cannot be left empty"
+
 ## 0.5.17 - 2026-07-13
 ### Fixed
 * Cleaning up a stale project registration is now reliable. `gina project:rm @<project> --force` (the `:rm` alias) removes the entry instead of erroring — the alias had failed an internal `--force` guard that only the full `project:remove` form passed. And `gina project:remove` / `project:rm @<project> --force` no longer crashes with an `ENOENT` error when the stale project's path can no longer be created (a top-level path such as `/app`, or any path under a read-only parent): it skips the now-pointless project-directory re-creation and goes straight to registry-only removal, cleaning both `~/.gina/projects.json` and its state-store mirror plus the project's port assignments — without resurrecting an empty skeleton directory.

package/README.md

@@ -1,6 +1,6 @@
 # Gina
 
-[![npm version](https://img.shields.io/npm/v/gina)](https://www.npmjs.com/package/gina) [![npm downloads](https://img.shields.io/npm/dm/gina)](https://www.npmjs.com/package/gina) [![GitHub stars](https://img.shields.io/github/stars/gina-io/gina)](https://github.com/gina-io/gina/stargazers) [![Tests](https://github.com/gina-io/gina/actions/workflows/test.yml/badge.svg)](https://github.com/gina-io/gina/actions/workflows/test.yml) [![Socket Badge](https://socket.dev/api/badge/npm/package/gina)](https://socket.dev/npm/package/gina) [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D%2022-brightgreen)](https://nodejs.org) [![Bun >= 1.2](https://img.shields.io/badge/Bun-%3E%3D%201.2-brightgreen)](https://bun.sh) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![npm version](https://img.shields.io/npm/v/gina)](https://www.npmjs.com/package/gina) [![npm downloads](https://img.shields.io/npm/dm/gina)](https://www.npmjs.com/package/gina) [![GitHub stars](https://img.shields.io/github/stars/gina-io/gina)](https://github.com/gina-io/gina/stargazers) [![Tests](https://github.com/gina-io/gina/actions/workflows/test.yml/badge.svg)](https://github.com/gina-io/gina/actions/workflows/test.yml) [![Socket](https://img.shields.io/badge/Socket-view%20analysis-blue)](https://socket.dev/npm/package/gina) [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D%2022-brightgreen)](https://nodejs.org) [![Bun >= 1.2](https://img.shields.io/badge/Bun-%3E%3D%201.2-brightgreen)](https://bun.sh) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
 > **Documentation:** [gina.io/docs](https://gina.io/docs/) · **Issues:** [GitHub](https://github.com/gina-io/gina/issues) · **Changelog:** [CHANGELOG.md](./CHANGELOG.md)
 
@@ -42,11 +42,21 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.5.17
-
-- **Fixed — `npm install -g gina` works under the npm 12 `--allow-scripts=gina` remedy.** With the npm 12 install-script allowance set (the `--allow-scripts=gina` flag, or `npm config set allow-scripts=gina --location=user`), the global install no longer fails with `EALLOWSCRIPTS`: the nested framework-dependency install inside post-install now drops the inherited `npm_config_allow_scripts` for its duration (those dependencies carry no install scripts, so nothing is lost). This makes `0.5.17` the first Gina version installable on npm 12, where install scripts are blocked by default and the allowance is required. (#B106)
-- **Fixed — stale project cleanup is reliable.** `gina project:rm @<project> --force` (the `:rm` alias) now removes the registration instead of erroring, and neither `project:remove` nor `project:rm --force` crashes with `ENOENT` when a stale project's path can no longer be created (a top-level path, or one under a read-only parent) — it goes straight to registry-only removal, cleaning `~/.gina/projects.json`, its state-store mirror, and the project's port assignments without resurrecting an empty skeleton directory. (#B104 / #B105)
-- **Fixed — `gina bundle:start` honours a bundle's configured default scope.** A typo in the scope-resolution expression returned an undefined property, so a bundle that declared a default scope in its manifest started with an undefined scope; the command now reads the correct property. (Bundles with no configured default scope were unaffected — they already fell back to the framework default scope.)
+## What's in 0.5.18
+
+- **Added — a shared redis L2 for the render cache, and pluggable cache backends.** `server.cache.type` now sets a bundle's default output-cache backend (`memory`, `fs`, or `redis`) and a route with `cache` set inherits it, alongside new bundle-wide `sliding` / `maxAge` fallbacks (per-route values still win). The `redis` tier caches rendered output in a shared store, so several replicas serve the same rendered page and a freshly-started replica serves what a peer already rendered (cross-replica cold-start): writes go to the in-process L1 synchronously and to redis fire-and-forget (the response never waits on redis), an L1 miss warms back from redis with the authoritative remaining TTL, invalidation propagates, and a down or failing redis degrades to per-replica caching (fail-open). The bundle validates its cache configuration at boot and refuses to start on an unsupported shape. New bundles default to `memory`; existing installs are unchanged.
+- **Added — type-safe DTOs and a default-on validation pipe.** `gina.dto` lets you author a data shape once and project it four ways: runtime validation, response shaping, JSON Schema (draft-07 or 2020-12), and TypeScript. A `routing.json` rule declaring `param.dto` has its payload validated before the controller action runs — a clean, localised 422 on failure, a type-coerced payload on success — and `param.responseDto` shapes the outgoing JSON so a field marked `.exclude()` never reaches the wire. `gina bundle:types <bundle> @<project>` emits declarations from those same DTOs, and `bundle:openapi` / `bundle:mcp` now emit real request/response schemas instead of `.*`. DTOs are resolved at bundle boot, so a missing one fails the boot instead of silently disabling validation; routes that declare no DTO are unaffected.
+- **Added — `releaseWatch`, a stale built-release watch for local production rehearsals.** A bundle serving a built release under `local` scope + a non-dev env has no hot-reload, so after you edit source it silently keeps serving the stale build. Opt in via `server.releaseWatch`: the bundle fingerprints its source tree against the manifest release stamp (now written by `bundle:build` / `project:build`), surfaces staleness on `GET /_gina/release/status` and a `GET /_gina/release/events` SSE stream, and rebuilds on `POST /_gina/release/rebuild` with an **idle-gated restart** that waits on in-flight requests and `gina.registerBusyProbe` application probes. Rendered pages carry a live shadow-DOM banner offering one-click rebuild-and-reload, and `restartMode: supervisor` suits a daemonless container launch (drain, then exit(0) for an orchestrator to respawn). Hard-gated on local scope + a non-dev env — byte-inert everywhere else.
+- **Added — flush or event-evict the render cache from outside the bundle.** `POST /_gina/cache/clear` (both engines, loopback-gated) and a new `gina cache:clear [<bundle>] @<project>` CLI flush the rendered-output cache — without ever touching compiled templates or HTTP/2 sessions — with `--dry-run` and `--format=json`. `?event=<name>` evicts by event: a controller's `self.cache.invalidateByEvent()` only reaches its own process, so this is how one bundle's write invalidates another bundle's cached pages. Note `?event=` previously went unread, so passing it flushed *every* bundle's output cache; it is now honoured.
+- **Added — two-tier render-cache observability.** Every cache hit's `Cache-Status` header now carries an RFC 9211 `detail` parameter naming the physical tier that served the bytes — `memory` for the in-process L1, `redis` for a shared-L2 warm (the cross-replica cold-start, visible per request), `fs` for a disk read-back after a restart — and `/_gina/cache/stats` gains an `l2` block reporting the redis store's connection health, with no network round-trip on the admin path.
+- **Changed — render-cache keys are release-namespaced, so an upgrade auto-invalidates.** The cache key *and* the `fs` cache path now carry a release namespace — `GINA_CACHE_NAMESPACE` (an id you set, such as a git SHA or build number) when present, otherwise the framework version — so a new build never serves a page cached by old code. `fs`-cached files from a superseded namespace are orphaned on disk until cleared. Dev mode is unaffected (it runs cacheless).
+- **Changed — the `Cache-Status` miss form follows RFC 9211.** It is now `gina-cache; fwd=uri-miss` (previously the bare `gina-cache; uri-miss`, which read as an unregistered parameter to RFC-aware tooling), and the engine-agnostic read path emits it on a genuine both-tier miss — giving Express bundles their first cache-miss signal on the wire.
+- **Fixed — event-driven cache invalidation now works, and a cache fault no longer discards a good page.** A route's `cache.invalidateOnEvents` was registered but nothing ever fired it — the documented `self.cache.invalidateByEvent()` did not exist, so configured routes served stale content until their TTL expired. `self.cache` now exists on the controller and reports the number of entries evicted. Three further defects in the same path are fixed: re-registering a key carrying a querystring **threw** (the registry ran cache keys through a condition evaluator, where `?`/`=` parse as operator tokens) and under the swig engine that throw unwound to the top-level error handler, which answered 500 and discarded a page that had already rendered; registrations were never reclaimed, so the registry grew a row per cache-miss re-render; and an `fs` entry read back after a restart carried no registration at all. Separately, a failed cache **write** now degrades exactly as the nunjucks and JSON renderers already did — the response is served, the failure logged, and the next miss retries.
+- **Fixed — the `fs` render cache survives a restart.** An `fs`-cached response written to disk was previously orphaned on the next boot (the in-process index starts empty), so it was never served again and its file was never cleaned up — `fs` behaved no better than `memory` across a restart. The read path now falls back to disk on an index miss, replaying the entry from a `.meta` sidecar and preserving the **original absolute expiry**, so a restart never extends a TTL. Entries expiring on their timer now run the same cleanup as a manual eviction, instead of stranding their body and sidecar on disk.
+- **Fixed — a checkbox's `value` attribute no longer decides its `checked` state.** The HTML `checked` attribute alone drives the initial rendering, and the posted boolean is derived from the live checked state rather than the value string — so a consent-style checkbox rendered with `value="true"` is no longer silently pre-ticked, `value="false"` no longer un-ticks a server-checked box, a checkbox unticked from your own script no longer posts `true` off its stale value, and a neutral-valued checkbox with an `isBoolean` rule posts real booleans instead of going dead. The forced rule injection now appends `isRequired` before `isBoolean`, so an unchecked box whose rule declared neither no longer fails with "Cannot be left empty". A transitional per-form opt-in — `data-gina-form-checkbox-value-as-state="true"` (deprecated) — preserves the old value-driven ticking while markup migrates to `checked`, and a once-per-field console warning flags the affected checkboxes. (#49)
+- **Fixed — the published TypeScript declarations now describe the runtime.** `import gina from "gina"; gina.lib` previously failed to typecheck for every consumer, because the main entry declared no value at all. The module surface now carries all 78 runtime members including `gina.dto`; `SuperController` gains its i18n / jobs / trailers / events / template-override methods plus `GinaRequest<TDto>` and `req.dto` typing for route DTOs; fictional declarations were removed; and a two-part gate (a consumer fixture compiled by `tsc` through the package exports map, plus a runtime-parity test) keeps the declarations and the runtime in sync.
+- **Fixed — errors surface instead of crashing, masking, or coming back as `0`.** A framework error raised from a detached context — a scheduled cron/timer, a worker, or a bootstrap-time `getLib()` — no longer crashes the process with `TypeError: next is not a function` while masking the original error. `getLib()` / `getConfig()` no longer crash with an opaque `Cannot read properties of undefined (reading 'conf')` when configuration is read while the config build is still partway (for example a fail-closed `${secret:KEY}` resolution), so the real boot error surfaces. A bitwise `|` at nine sites across the HTTP server, the browser client bundle, and three CLI commands coerced the Error to the number `0` — a rendered 500 page body and the `protocol:set` / `port:reset` / `project:add` output all reported `0` instead of the cause. And log messages containing a `$` are no longer mangled by the text formatter's `%`-token splice, across every level and sink. (#B108 / #B112)
+- **Fixed — two smaller corrections.** A server-side form-validator `query` rule no longer re-points the framework's process-wide cache onto a second Map, so concurrent renders keep reading their cached entries and pooled HTTP/2 sessions land in the real server's cache. And `bundle:openapi` / `bundle:mcp` no longer advertise `.exclude()`d DTO fields in response schemas — the 200 content schema and the MCP tool `outputSchema` now emit the response projection, while request-side schemas keep the declared shape. (#B110 / #B115)
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 
@@ -71,6 +81,17 @@ Full installation guide, tutorials, configuration reference, and API docs at **[
 
 Gina is co-authored by **Martin Luther ETOUMAN NDAMBWE** ([Rhinostone](https://rhinostone.com)) and **Fabrice DELANEAU** ([fdelaneau.com](https://fdelaneau.com)). Final decisions on direction, API design, and releases rest with Martin Luther. Community contributions and RFCs are welcome and taken seriously. See [GOVERNANCE.md](./GOVERNANCE.md) for details.
 
+## Supply-chain scanners
+
+Gina is an MVC framework with a process-management CLI, so it uses Node's
+`child_process` by design — to start and supervise application bundle processes
+and the framework daemon, run local/SSH commands (`lib/shell`), launch the
+inspector, and perform setup in the npm install scripts. Supply-chain scanners
+therefore report a **Shell access** capability for `child_process`. This is
+expected and intrinsic to a CLI framework, not a vulnerability: the install-time
+commands are built only from local values (npm prefix, install path) and take no
+network input.
+
 ## License (MIT)
 
 Copyright © 2009-2026 [Rhinostone](https://rhinostone.com)

package/ROADMAP.md

@@ -42,6 +42,8 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.15` ✅ | Client-side components (Web Components) — standards-based, zero-dependency conventions for stateful client widgets: `gina view:add` scaffolds a reference custom element (server-rendered light-DOM partial + behavior-only class), components upgrade automatically in popin/XHR-injected content with no rebinding, form-associated custom elements participate in `FormValidator`, live-data components ride the connect/disconnect lifecycle over `method:"ws"` routes or SSE, and the dev Inspector gains a component census + client component-event capture · a popin/dialog trigger can opt out of the hover/focus preload (`data-gina-dialog-preload="false"`) · **Fixed**: `gina.popin` sees every popin so a form can redirect into a different one (#B90), a redirect into a popin opens content-first (#B79), server-side validation of a data object against a rules object works (#B85), `$form.send(FormData)` nests bracket-notation field names (#B92), a fields-only multipart POST no longer hangs (#B93) and a malformed multipart body no longer crashes the bundle (#B97), `X-Powered-By` suppression reaches static and error responses (#B96), and upload reset/delete removes the preview, restores class-hidden inputs, and gains removal callbacks (#B94/#B95) |
 | **Q3 2026** | `0.5.16` ✅ | **Added**: a `multipart/form-data` request's non-file text fields are now captured into `request.body` (bracket-notation nested, values verbatim, capped by `upload.maxTextFields` / `upload.maxTextFieldSize` with a 400 on breach) — previously silently dropped · **Fixed**: `$form.send(FormData)` keeps its non-file fields when the payload also carries files (#B92), and a routing rule's `param.title` now reaches the browser-tab title (`page.view.title`) instead of always showing the route name, with the route name as the fallback (#B98) |
 | **Q3 2026** | `0.5.17` ✅ | **Fixed**: `npm install -g gina` no longer fails with `EALLOWSCRIPTS` under the npm 12 `--allow-scripts=gina` remedy — the nested framework-dependency install drops the inherited allowance, making `0.5.17` the first version installable on npm 12 (#B106) · stale project cleanup is reliable — `project:rm @<project> --force` (the alias) removes the entry, and `project:remove` / `:rm --force` no longer `ENOENT`-crashes on an uncreatable stale path, going straight to registry-only removal (#B104/#B105) · `bundle:start` honours a bundle's configured default scope (a typo had returned an undefined property) |
+| **Q3 2026** | `0.5.18` ✅ | **Added**: a redis-backed L2 render cache — rendered output is cached in a shared store, so several replicas serve the same rendered page and a freshly-started replica serves what a peer already rendered (cross-replica cold-start), degrading to per-replica caching if redis is down · pluggable cache backends (`server.cache.type`: `memory` / `fs` / `redis`) with bundle-wide `sliding` / `maxAge` fallbacks a route inherits · type-safe DTOs and a default-on validation pipe (`gina.dto` — one shape projected to runtime validation, response shaping, JSON Schema and TypeScript; `param.dto` validates the payload before the action with a localised 422, `param.responseDto` shapes the wire, `gina bundle:types` emits declarations, and `bundle:openapi` / `bundle:mcp` emit real request/response schemas) · `releaseWatch` — an opt-in stale built-release watch for local production rehearsals (source-tree fingerprint against the manifest release stamp, `GET /_gina/release/status` + an SSE stream, idle-gated rebuild-and-restart honouring in-flight requests and busy probes, a live shadow-DOM banner, and `restartMode: supervisor` for daemonless container launches) · `POST /_gina/cache/clear` + a `gina cache:clear` CLI (flush the rendered-output cache, or evict by event across bundles) · two-tier cache observability (an RFC 9211 `Cache-Status` `detail` naming the serving tier, plus an `l2` redis-health block on `/_gina/cache/stats`) · **Changed**: render-cache keys are release-namespaced, so an upgrade auto-invalidates (`GINA_CACHE_NAMESPACE`, else the framework version) · the `Cache-Status` miss form is now the RFC 9211 `gina-cache; fwd=uri-miss`, and Express bundles get their first cache-miss signal · **Fixed**: event-driven cache invalidation works — `self.cache.invalidateByEvent()` now exists, and a key carrying a querystring no longer throws a 500 that discarded an already-rendered page · the `fs` cache survives a restart (disk read-back via a `.meta` sidecar, original absolute expiry preserved, no TTL extension) · a checkbox's `value` attribute no longer decides its `checked` state (#49) · the published TypeScript declarations describe the runtime · errors surface instead of crashing, masking, or coming back as `0` (detached-context `throwError`, partial-boot `getLib()` / `getConfig()`, a bitwise-or at nine sites, and `$` in log messages) |
+| **Q4 2026** | `0.6.0` | Security & compliance controls (technical safeguards mapping to PCI-DSS / SOC2 / HIPAA) |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 
@@ -60,6 +62,20 @@ This roadmap covers planned features, architectural improvements, new connectors
 | ✅ | **PATCH method** — `req.patch` populated with the parsed request body (JSON or form-encoded). `req.body` aliases `req.patch`. URI params merged. `"method": "PATCH"` valid in `routing.json`. Use PATCH for partial updates (only sent fields change) vs PUT which replaces the full resource. | `0.3.0` | 2026-03-31 |
 | ✅ | **HEAD method** — `req.head` populated with query-string and URI params. Full controller action runs so all response headers are set correctly; body is suppressed before writing to the wire. Both `render()` and `renderJSON()` honour HEAD. Routes declared as `GET` automatically accept HEAD — no extra routing rule needed. | `0.3.0` | 2026-03-31 |
 | ✅ | **Client-side components (Web Components)** — Standards-based conventions for stateful client widgets: custom elements v1, zero dependency, no build tooling. Server-rendered light-DOM authoring keeps HTML (designer) and JS (developer) separated — the behavior-only class binds its own server-rendered subtree and holds no markup strings (repeatable markup clones from a server-rendered `<template>`). Components upgrade automatically in popin/XHR-injected content with no rebinding; SEO/GEO-first (meaningful content ships in the initial server-rendered HTML). `gina view:add` scaffolds a reference component (engine partial + behavior-only class); e2e coverage locks popin auto-upgrade, strict-CSP compatibility (real nonce'd header, no `unsafe-inline`), SSR hydration from attributes + a JSON `data-*` payload, and no-JS crawler equivalence. The `gina-*` tag prefix is reserved for framework components. Form-associated custom elements participate in FormValidator — a named component exposing a `.value` getter is collected, validated, serialized into the AJAX payload, and error-rendered like a native control (client-side live-check on its composed bubbling `change`, dirty-tracking, and auto-id), so long as it declares `static formAssociated = true`, carries a `name`, and fires a composed `change` on commit. Live-data components ride the same lifecycle — open the connection in `connectedCallback`, close it in `disconnectedCallback` (popin close then tears it down automatically) — paired with `method:"ws"` routes or SSE via `renderStream()`, with per-animation-frame batching guidance for high-frequency streams; the lifecycle contract is executed against a live HTTP/2 extended-CONNECT loopback in the test suite. Dev-mode Inspector observability: the View tab carries a component census with a red undefined-components indicator (a typo'd tag or a missing definition script is no longer a silent failure), and the Events tab surfaces client-side `<tag>:<verb>` component events — metadata always, `detail` values only behind the existing `inspector.events.captureArgs` opt-in. | `0.5.15` | 2026-07-11 |
+| ✅ | **Stale built-release watch** — For LOCAL production rehearsals. A bundle serving a built release under `local` scope + a non-dev env has no hot-reload, so after you edit source it silently keeps serving the stale build. Opt in via `server.releaseWatch` in `settings.json`: the bundle watches its SOURCE tree, compares fingerprints against the manifest release stamp, and surfaces staleness on `GET /_gina/release/status` and a live `GET /_gina/release/events` SSE stream (notify mode, the default) — or auto-rebuilds on change (opt-in `auto` mode). `POST /_gina/release/rebuild` rebuilds with an **idle-gated restart** that waits on in-flight HTTP requests and `gina.registerBusyProbe` application probes, so a restart never interrupts in-flight work. Hard-gated on `local` scope + a non-dev env — never active on a real cluster. | `0.5.18-alpha` | 2026-07-16 |
+
+---
+
+## Type-Safe DTOs & Validation
+
+A unified data-shape layer — define a DTO/schema once and reuse it for request validation, response serialization, static types, and OpenAPI, then layer a default-on validation pipe and DTO-derived typing on top.
+
+| Status | Feature | Version | Target |
+| --- | --- | --- | --- |
+| ✅ | **Unified DTO / schema primitive** — Define a data shape once and reuse it for runtime validation, static types, JSON-Schema/OpenAPI, and response serialization. Foundation for the validation pipe and DTO-derived types. | `0.5.18-alpha.2` | shipped |
+| ✅ | **Global validation pipe** — Framework-level, default-on validation + coercion of the request payload against the route's DTO before the controller action runs, handing a typed, validated object to the handler. Declaring `param.dto` on a route also answers a clean 422 on failure; `param.responseDto` shapes the outgoing JSON. | `0.5.18-alpha.2` | shipped |
+| ✅ | **Type safety from the DTO** — Types derived from DTO definitions (`gina bundle:types` emits `.d.ts` from a bundle's DTOs) plus a two-part gate that verifies the shipped declarations against the runtime: a consumer fixture compiled by `tsc` through the package exports map, and a runtime-parity test diffing the declarations against the live framework surface. `GinaRequest<TDto>` and `req.dto` type route-DTO payloads end to end. Keeps the existing JS runtime, no rewrite. | `0.5.18-alpha.2` | shipped |
+| ✅ | **Documentation & guides** — DTO authoring, the validation pipe, and typed controllers on the docs site: the Route DTOs guide, `bundle:types` in the CLI reference, the routing `param.dto` / `param.responseDto` schema rows, and migration notes. | `0.5.18-alpha.2` | shipped |
 
 ---
 
@@ -226,6 +242,23 @@ Secrets handling for bundle JSON configs without baking plaintext values into so
 
 ---
 
+## Security & Compliance Controls
+
+Technical-safeguard primitives that map to the **PCI-DSS**, **SOC2**, and **HIPAA** technical requirements. Gina supplies the controls; certification itself is an organizational, infrastructure, and process matter (a QSA assessment, a SOC2 auditor, HIPAA BAAs + a risk analysis) — a framework cannot be "certified." These are the building blocks an application deployed on Gina uses to satisfy the technical safeguards.
+
+| Status | Feature | Version | Target |
+| --- | --- | --- | --- |
+| 📋 | **Authorization / RBAC** — A role/permission model, per-route authorization gate, and policy helpers (today Gina ships authentication status only, no authorization). Maps to PCI-DSS req 7, HIPAA §164.312(a)(1), SOC2 CC6 (least privilege). | `0.6.x` | Q4 2026 |
+| 📋 | **Tamper-evident audit trail** — A user-attributed, append-only, integrity-protected record of who did what to which record when, distinct from application logging. Maps to PCI-DSS req 10, HIPAA §164.312(b), SOC2 CC7. | `0.6.x` | Q4 2026 |
+| 📋 | **Authentication hardening** — Password hashing/policy helpers, account lockout, and MFA/TOTP hooks. Maps to PCI-DSS req 8, HIPAA §164.312(d). | `0.6.x` | Q4 2026 |
+| 📋 | **Session lifecycle hardening** — Session-id rotation on privilege change and idle/absolute timeouts, on top of the existing Session plugin. Maps to PCI-DSS req 8.2. | `0.6.x` | Q4 2026 |
+| 📋 | **PII/PHI protection** — Production log-field redaction, data classification, and retention helpers (today's redaction is a dev-only inspector tool). Maps to HIPAA and SOC2 Privacy. | `0.6.x` | Q4 2026 |
+| 📋 | **Application-level rate limiting** — Per-endpoint / per-client throttling at the route layer (today only an HTTP/2 rapid-reset limiter exists). Maps to PCI-DSS anti-automation and SOC2 availability. | `0.6.x` | Q4 2026 |
+| 📋 | **Data-at-rest / field-level encryption helpers** — Field-level encryption + key-management utilities. Maps to PCI-DSS req 3 and HIPAA §164.312(a)(2)(iv). | `0.6.x` | Q4 2026 |
+| 📋 | **Compliance control-mapping guide** — A reference mapping each Gina control to the PCI-DSS / SOC2 / HIPAA requirement it supports, plus an explicit "what the framework does not cover" section (to follow). | `0.6.x` | Q4 2026 |
+
+---
+
 ## Connectors
 
 New database connectors follow the same interface as the existing Couchbase connector: declared in `connectors.json`, acquired via `getConnection()`.

package/framework/v0.5.18/VERSION

@@ -0,0 +1 @@
+0.5.18

package/framework/{v0.5.17 → v0.5.18}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3769,7 +3769,17 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         var Controller = require(_(GINA_FRAMEWORK_DIR +'/core/controller/controller.js'), true);
         var controller = new Controller(controllerOptions);
         controller.name = route.param.control;
-        controller.serverInstance = serverInstance;
+        // #B115 — prefer the LIVE engine published by server.js start(): query()
+        // re-points lib/cache's process-wide backing Map to the controller's
+        // `serverInstance._cached`, so handing it the config dict's own minted Map
+        // sends a concurrent render's cache ops (compiled templates, output cache)
+        // to the wrong store and strands the pooled HTTP/2 session + its
+        // `_http2Sessions` tracker where nothing reads them. The config dict above
+        // (+ its minted `_cached`) remains the fallback when no server runs in this
+        // process (offline CLI / test harnesses).
+        controller.serverInstance = ( process.gina && process.gina._serverInstance )
+            ? process.gina._serverInstance
+            : serverInstance;
         controller.setOptions(request, response, next, controllerOptions);
 
         var data = ( typeof(options.data) == 'object' && options.data.count() > 0 )
@@ -11006,10 +11016,6 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
                     defaultValue = $form.fieldsSet[f].defaultValue;
 
-                    if (/$(on|true|false)$/i.test(defaultValue)) {
-                        defaultValue = (/$(on|true)$/i.test(defaultValue)) ? true : false;
-                    }
-
                     if ( /^(checkbox|radio)$/i.test($element.type) ) {
                         $element.checked = $form.fieldsSet[f].defaultChecked;
                     } else if ( !/^(checkbox|radio)$/i.test($element.type) ) {
@@ -14574,6 +14580,47 @@ function ValidatorPlugin(rules, data, formId, culture) {
      *
      * @return {object} bindedForm
      * */
+    /**
+     * Tells whether a checkbox posts a boolean derived from its live `.checked`
+     * state (#49). A checkbox is boolean-classified when it carries no `value`
+     * attribute (the DOM then defaults `.value` to `on`), when its value reads
+     * `true` or `false` (the framework's change-time mirror maintains those), or
+     * when a validation rule declares `isBoolean` for the field. A checkbox that
+     * is NOT boolean-classified is value-carrying: its `value` is the submitted
+     * payload and must never be coerced to a boolean.
+     *
+     * @inner
+     * @param {object} $el - Checkbox element
+     * @param {object} [rule] - Validation rule object declared for the field
+     *
+     * @returns {boolean} isBooleanCheckbox
+     */
+    var isBooleanCheckbox = function($el, rule) {
+        return (
+            $el.getAttribute('value') === null
+            || /^(true|false)$/.test($el.value)
+            || typeof(rule) != 'undefined' && rule && typeof(rule.isBoolean) != 'undefined'
+        ) ? true : false;
+    }
+
+    /**
+     * Legacy opt-in (#49 — deprecated, transitional): when the form carries
+     * `data-gina-form-checkbox-value-as-state="true"`, a checkbox's `value`
+     * attribute keeps deciding its initial checked state like it did before
+     * the fix. Default is the HTML-spec behavior: only the `checked`
+     * attribute decides the initial state.
+     *
+     * @inner
+     * @param {object} $form - Form object (`instance.$forms[id]` shape)
+     *
+     * @returns {boolean} isCheckboxValueAsState
+     */
+    var isCheckboxValueAsState = function($form) {
+        return /^true$/i.test($form.target.dataset.ginaFormCheckboxValueAsState) ? true : false;
+    }
+    // one warn per field id per page load (migration aid, #49)
+    var checkboxValueStateWarned = {};
+
     var bindForm = function($target, customRule) {
 
         var $form   = null
@@ -14851,9 +14898,6 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
             if (!$form.fieldsSet[ elId ]) {
                 let defaultValue = $inputs[f].value;
-                if (/$(on|true|false)$/i.test(defaultValue)) {
-                    defaultValue = (/$(on|true)$/i.test(defaultValue)) ? true : false;
-                }
                 // just in case
                 // if (
                 //     typeof($form.fieldsSet[elId]) != 'undefined'
@@ -14878,10 +14922,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     // reads FALSE at bind time despite the attribute being present, so
                     // caching from `.checked` would hold the wrong default and a subsequent
                     // form-reset would clear the originally-checked option.
+                    // #49: the value-derived clause (a checkbox whose `value` reads
+                    // true/on used to be treated as checked-by-default) is legacy
+                    // behavior, now gated on the form's explicit opt-in.
                     $form.fieldsSet[elId].defaultChecked = (
                                                             $inputs[f].defaultChecked
                                                             ||
-                                                            /^(true|on)$/.test(defaultValue)
+                                                            isCheckboxValueAsState($form)
+                                                            && /^(true|on)$/.test(defaultValue)
                                                             && /^(checkbox)$/i.test($inputs[f].type)
                                                         ) ? true : false;
 
@@ -14889,6 +14937,20 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         $form.fieldsSet[elId].value = $inputs[f].value;
                         $form.fieldsSet[elId].defaultValue = $inputs[f].value;
                     }
+
+                    // Migration aid (#49): this markup used to be auto-ticked by its
+                    // `value` — surface it once so the author adds `checked` or the
+                    // legacy form opt-in.
+                    if (
+                        /^(checkbox)$/i.test($inputs[f].type)
+                        && !isCheckboxValueAsState($form)
+                        && !$inputs[f].hasAttribute('checked')
+                        && /^(true|on)$/i.test($inputs[f].getAttribute('value'))
+                        && !checkboxValueStateWarned[elId]
+                    ) {
+                        checkboxValueStateWarned[elId] = true;
+                        console.warn('[ FormValidator ] checkbox `'+ elId +'`: `value` no longer implies the checked state; add the `checked` attribute if it must render ticked, or set `data-gina-form-checkbox-value-as-state="true"` on the form to restore the legacy behavior');
+                    }
                 }
             }
 
@@ -15635,7 +15697,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 localValue = false
             }
             var isLocalBoleanValue = ( /^(true|on|false)$/i.test(localValue) ) ? true : false;
-            if (isInit && isLocalBoleanValue) { // on checkbox init
+            // #49: value-driven initial ticking is legacy behavior — the HTML `checked`
+            // attribute decides the initial state unless the form explicitly opts in.
+            if (isInit && isLocalBoleanValue && isCheckboxValueAsState($form)) { // on checkbox init (legacy value-as-state mode)
                 // update checkbox initial state
                 // Value defines checked state by default
                 if ( /^true$/i.test(localValue) && !$el.checked) {
@@ -16577,7 +16641,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 if (isDisabled) continue;
 
                 // checkbox or radio
-                if ( typeof($target[i].type) != 'undefined' && $target[i].type == 'radio' || typeof($target[i].type) != 'undefined' && $target[i].type == 'checkbox' ) {
+                if ( typeof($target[i].type) != 'undefined' && $target[i].type == 'checkbox' && isBooleanCheckbox($target[i], (rules) ? rules[name] : null) ) {
+                    // #49: boolean checkbox — the live `.checked` state IS the posted value
+                    fields[name] = $target[i].checked;
+                } else if ( typeof($target[i].type) != 'undefined' && $target[i].type == 'radio' || typeof($target[i].type) != 'undefined' && $target[i].type == 'checkbox' ) {
 
                     if ( $target[i].checked ) {
                         // if is boolean
@@ -16833,7 +16900,23 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 && $form[i].type == 'checkbox' )
              {
 
-                if (
+                if ( $form[i].type == 'checkbox' && isBooleanCheckbox($form[i], (rules) ? rules[name] : null) ) {
+                    // #49: boolean checkbox — the live `.checked` state IS the posted
+                    // value; self-inject the isBoolean rule like the legacy path did
+                    if (rules) {
+                        if ( typeof(rules[name]) == 'undefined' ) {
+                            rules[name] = { isBoolean: true };
+                        } else if ( typeof(rules[name]) != 'undefined' && typeof(rules[name].isBoolean) == 'undefined' ) {
+                            // forces it when field found in validation rules; isRequired is
+                            // appended BEFORE isBoolean — rules run in key insertion order and
+                            // the engine's isBoolean rescue only clears an isRequired error
+                            // recorded before it (a boolean false otherwise reads as empty)
+                            rules[name].isRequired = true;
+                            rules[name].isBoolean = true;
+                        }
+                    }
+                    fields[name] = $form[i].checked;
+                } else if (
                     $form[i].checked
                     || typeof (rules[name]) == 'undefined'
                         && $form[i].value != 'undefined'
@@ -16851,9 +16934,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         if ( typeof(rules[name]) == 'undefined' ) {
                             rules[name] = { isBoolean: true };
                         } else if ( typeof(rules[name]) != 'undefined' && typeof(rules[name].isBoolean) == 'undefined' ) {
-                            rules[name].isBoolean = true;
-                            // forces it when field found in validation rules
+                            // forces it when field found in validation rules; isRequired is
+                            // appended BEFORE isBoolean — rules run in key insertion order and
+                            // the engine's isBoolean rescue only clears an isRequired error
+                            // recorded before it (a boolean false otherwise reads as empty)
                             rules[name].isRequired = true;
+                            rules[name].isBoolean = true;
                         }
 
                         if ($form[i].type == 'radio') {
@@ -23475,7 +23561,7 @@ function getDependencies(gina, cb) {
             arr[i].func.apply(null,arr[i].args);
         }
     } catch (err) {
-        console.error(err.stack|err.message|err);
+        console.error(err.stack||err.message||err);
     }
 }