gina 0.5.19 → 0.5.20

package/CHANGELOG.md

@@ -6,6 +6,16 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.20 - 2026-07-19
+### Changed
+* Multipart parsing now uses `@rhinostone/busboy` installed from npm instead of a patched copy vendored inside the framework. The fork is a strict superset of upstream busboy 1.6.0 whose only addition exposes each part's parsed Content-Disposition parameters, which is what lets the upload layer read the `group="..."` tag — previously a local patch that had to be re-applied by hand on every upstream upgrade. Upload behaviour and the multipart wire format are unchanged: files still arrive with their group, an unconfigured group is still rejected, and a file with no group still falls back to `untagged`. Pickup is the version plus a bundle restart; no client rebuild is needed.
+### Fixed
+* Fixed the region locale generator so each requested language emits a standalone file — a `--region=en,fr` build used to append the second language's rows to the first's output, so every `isoShort` was duplicated and `isoShort` lookups always matched the English copy. Non-en builds now localize `countryName` from a per-language short-names resource (`region.names.<lang>.json`, French ships with the framework), rows without an ISO 3166 alpha-2 code are dropped, and `dist/region/en.json` / `fr.json` are regenerated clean — a bundle resolving a `fr` culture now gets `Allemagne` / `États-Unis` / `Royaume-Uni` through the existing `getLocales().getCountries()` path with zero consumer changes.
+* Fixed `getLocales().getCountries(code)` — the documented projection argument was computed and never applied. A valid `code` (e.g. `capital`, `continent`, `tld`) now adds that field to every returned row while the 4 historical fields stay untouched, and an empty or missing locale set degrades to an empty list instead of throwing.
+* FormValidator: numbered `is` aliases (`is0`, `is1`, ...) now install and enforce. The lazy alias installer sat below a typecheck that skipped exactly the state the installer required, so any `is<N>` rule key was silently ignored on both the client and the server; the installer regex is now anchored (`is0abc` no longer matches), numbered aliases keep distinct per-alias error keys on both sides (server-side they previously collapsed to a shared `is` key, letting a later passing alias erase an earlier failing one), and server-side validation of rules carrying `$` cross-field references no longer crashes. Behavior change to plan for: previously-skipped `is<N>` rules START ENFORCING at pickup — forms that submitted clean may begin erroring or returning 422; sweep your rule JSONs for `is<N>` keys before upgrading.
+* FormValidator: a form injected after init (e.g. loaded inside a popin) carrying `data-gina-form-rule` now binds its declared rule — live-check and submit-trigger gating work instead of being silently disabled. `validateFormById` resolved the rule name from the form id only and consulted the attribute in an unreachable branch, so the lookup missed, the form bound zero rules, and the form was stamped `data-gina-form-live-check-enabled="false"` while the submit pass resolved the same attribute fine. Attribute-less forms whose id names the rule resolve as before.
+* Fixed FormValidator `_case_` condition matching in live-check / single-element mode: the cross-field case scan coerced the wrong variable — the field being validated instead of the case value — so a boolean `case` declaration (e.g. `case: false`) never matched the case field's raw "false"/"true" DOM string, and a validated field whose own value was "true"/"false" silently broke string case matching for its pass. The case value itself is now coerced, aligning the scan with the direct-case site's semantics; note that `case` values declared as the strings "true"/"false" now coerce to booleans at this site too, consistent with full-form validation.
+
 ## 0.5.19 - 2026-07-17
 ### Added
 * The checkbox migration warning now also covers the un-tick direction: markup carrying the `checked` attribute plus a `value` (or `data-value`) reading false or empty — which used to render unticked and now stays ticked — is flagged once per field, with the same legacy opt-in pointer as the existing warning

package/CONTRIBUTING.md

@@ -27,7 +27,7 @@ Gina follows a BDFL governance model — see [GOVERNANCE.md](./GOVERNANCE.md) fo
 | Requirement | Version |
 | --- | --- |
 | OS | macOS or Linux (Windows: Docker only) |
-| Node.js | >= 18 |
+| Node.js | >= 22 < 27 |
 | npm | >= 8 |
 | Changie | >= 1.24 |
 
@@ -35,22 +35,31 @@ Gina follows a BDFL governance model — see [GOVERNANCE.md](./GOVERNANCE.md) fo
 
 ## Getting started locally
 
-Gina must be installed globally — the CLI and framework bootstrapper expect to run from the npm global prefix. Contributors clone directly into that location instead of using `npm install -g .`.
+Gina must be reachable from the npm global prefix — the CLI and framework bootstrapper expect to run from `${prefix}/lib/node_modules/gina`. **Do not clone directly into that path**: npm owns it, and any `npm install -g gina` run on the machine replaces whatever sits there — a direct clone would be destroyed, git history, uncommitted work and all — with the published tarball. Clone to a normal workspace directory and **symlink** it into the prefix instead: npm can then only ever replace the symlink, never your repository.
 
-#### 1. Find your global prefix
+#### 1. Clone to your workspace
+
+```bash
+git clone https://github.com/gina-io/gina.git
+cd gina && git checkout develop
+```
+
+#### 2. Link the clone into the npm global prefix
 
 ```bash
 npm config get prefix --quiet
 ```
 
-The default is `/usr/local` (system) or `~/.npm-global` (user). The target directory is `${prefix}/lib/node_modules/gina`.
+The default is `/usr/local` (system) or `~/.npm-global` (user).
 
-#### 2. Clone into the prefix
+```bash
+ln -s "$PWD" "$(npm config get prefix)/lib/node_modules/gina"
+```
+
+Optional hardening (macOS): make the link immutable, so even a global install fails loudly instead of silently replacing it. Undo with `chflags -h nouchg` before an intentional change.
 
 ```bash
-cd $(npm config get prefix)/lib/node_modules
-git clone https://github.com/gina-io/gina.git gina
-cd gina && git checkout develop
+chflags -h uchg "$(npm config get prefix)/lib/node_modules/gina"
 ```
 
 #### 3. Run the install scripts
@@ -66,6 +75,14 @@ node ./script/post_install.js
 gina version
 ```
 
+If the `gina` command is not found, link the CLIs into the prefix bin once:
+
+```bash
+cd "$(npm config get prefix)/bin" && ln -s ../lib/node_modules/gina/bin/gina* .
+```
+
+> ⚠️ On a machine set up this way, never run `npm install -g gina` — it replaces the symlink with the published tarball and your clone stops being served (with a direct clone at that path, it would have been deleted outright). Update with `git pull` instead; to switch to the published package deliberately, remove the symlink first.
+
 ---
 
 ## Running the tests
@@ -80,6 +97,17 @@ node --test test/**/*.test.js framework/v*/test/unit/*.test.js
 node --test test/core/controller.test.js
 ```
 
+Some tests resolve the framework the way a consuming project does — via
+`require('gina')`. For that to resolve from inside the clone, the repository
+must be reachable as its own `gina` module. Create a one-time self-symlink (it
+lives inside the gitignored `node_modules/`, so it never shows in `git status`):
+
+```bash
+mkdir -p node_modules && ln -sfn "$PWD" node_modules/gina
+```
+
+Without it, a handful of suite members fail with `Cannot find module 'gina'`.
+
 ---
 
 ## Development environment

package/README.md

@@ -42,16 +42,12 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.5.19
-
-- **Added — route authorization.** A `routing.json` rule can now gate access declaratively, enforced before the controller action runs. `param.requireAuth: true` requires an authenticated session (`req.session.user` set — populating it at login stays the app's job): an unauthenticated XHR gets a 401, a browser navigation gets a non-cacheable redirect to `settings.json > auth.loginRoute` with the original request snapshotted for `self.resumeRequest()` to replay. `param.roles: ["admin", "editor"]` requires any one of a set of roles (implies `requireAuth`); `param.policy: "ownsInvoice"` delegates the decision to a per-bundle `policies/ownsInvoice.js` function for the ownership/record checks roles can't express (AND-composed after roles, allowed only on a literal `true`, a throwing policy denies). Denials stay generic — the required roles and policy name never reach the wire, and the client-served routing maps no longer ship the authorization keys. Author mistakes refuse to boot rather than leaving a route silently open (a non-boolean flag, an undeclared `loginRoute`, an invalid `roles` shape, a missing / broken / `async` policy). Also adds the imperative `self.hasRole(role)` controller helper. Routes that declare nothing behave exactly as before.
-- **Added — an audit trail.** A user-attributed, append-only record of "who did what to which record when", with its own store, never riding the logger sinks. Opt in with `settings.json > audit.enabled: true` and call `self.audit("invoice.delete", { resource: id })` from an action; the default backend is an append-only JSONL file at `<project>/logs/audit-<bundle>-<env>.jsonl` (override with `audit.file`, or point `audit.store` at a connectors.json entry). The actor is a snapshot of `session.user[audit.actorKey]` plus a copy of `user.roles` — never the whole user object — and `X-Forwarded-For` is never trusted. Route-authorization denials are recorded automatically (`authz.denied`, opt out with `audit.events.authz: false`), and an audit failure can never change an authorization outcome. Every request now carries an always-on request id, so audit records and JSON log lines correlate by construction. Malformed `audit` settings refuse to boot rather than leaving a compliance control silently off.
-- **Added — an OCI image and container CLI.** Building on `image:build` (0.5.11), five verbs now inspect and run images on the same container host: `gina image:list` (aligned table or `--format=json` with a machine-sortable `sizeBytes` and an RFC3339 `createdAt`), `image:rm <ref>` (untags a multi-tagged image; no bulk delete; the reference is charset-gated), and `image:run <image>` (runs with podman — detached by default, publishing the EXPOSEd port same:same, with `--publish` / `--rm` / `--stream` / `--env-var` / `--env-file`, so a `${secret:KEY}` baked into an image gets its value at start without ever entering argv or a shell). A new `container:` group lists and stops running containers — `container:ps [--all]` and `container:stop <name|id>`, which reports the rung the container came down on (137 = SIGKILL after the grace period, otherwise its own terms). Every verb resolves the host with `image:build`'s precedence and reports a build-only host (buildah without podman) honestly instead of failing opaquely.
-- **Changed — `redirect()` carries request data through the session by default.** When a redirect carried the request's params they used to travel in the URL as `?inheritedData=<encoded JSON>` — in clear, in the address bar, browser history, and access logs, capped at 2000 characters. On a bundle with a session they now ride the session instead (a one-shot flash, consumed by the next routed GET, gone on refresh); the URL form and its cap now apply only to session-less bundles. For a bundle that halts a credential-bearing POST mid-flight (a registration or login), this removes a plaintext-secret-in-URL disclosure. The target action still reads the data from `req.get` unchanged, and `resumeRequest()`'s plain-XHR and full-page replays no longer drop it.
-- **Fixed — metrics no longer double-count under the isaac engine.** With `app.json metrics.enabled` on, the request-lifecycle hook ran at both dispatch layers for any request reaching the router, so Prometheus counters were double-incremented and the duration histogram double-observed. The hook now records exactly once on either engine, durations are measured from engine entry, and the dev Inspector Flow timeline keeps its accurate request-start time. Metrics-enabled deployments will see counter rates roughly halve at pickup — that is the double-count disappearing, not traffic dropping. (#OBS1)
-- **Fixed — redirect resolution.** The relative-path `self.redirect('/path')` form resolves its target server-side again (the route matcher is async and the historical un-awaited call could never match; `redirect()` is now async — prefer `return self.redirect(...)` from actions), a redirect to an unresolvable target gets a clean 404 instead of crashing the process, and `getRoute()` no longer throws a 500 when composing a URL for a GET route that declares no `requirements` block and receives extra params (they now land as query parameters). (#B120 / #B121)
-- **Fixed — `image:build` for projects that depend on gina.** Images built for a project that lists gina among its own dependencies no longer fail at `gina-init` with `EACCES`, and the pinned framework now actually wins `require('gina')` inside the image — the `node_modules/gina` link supersedes the project-extracted copy. Dependency-free projects were unaffected. (#B118 / #B119)
-- **Fixed — two smaller corrections.** `gina.emit('error', ...)` on the module object no longer throws (`emit` is an inert stub; application events go through the controller's `self.emitEvent()`), and the checkbox migration warning added in 0.5.18 now also covers the un-tick direction — markup carrying `checked` plus a false / empty `value` that used to render unticked and now stays ticked is flagged once per field. (#B109 / #49)
+## What's in 0.5.20
+
+- **Fixed — region locale data: one file per language, with localized country names.** The region-locale generator used to append each requested language's rows to the previous language's output, so `dist/region/fr.json` carried every country twice (the English copy first) and `getLocales().getCountries()` always resolved the English row. Each language now ships as a standalone file, and non-English builds localize `countryName` — a bundle resolving a `fr` culture now renders `Allemagne`, `États-Unis`, `Royaume-Uni` where it previously showed `Germany`, `US`, `UK`, through the same `getLocales().getCountries()` path with no application changes. Rows with no ISO 3166 alpha-2 code are dropped (they could only ever render blank). The region files are read once at boot, so restart your bundles after upgrading to pick up the regenerated data. (#50)
+- **Fixed — `getCountries(code)` honors its projection argument.** The optional `code` argument (e.g. `capital`, `continent`, `tld`) was computed and never applied; it now adds that field to every returned row while the four historical fields (`isoShort`, `isoLong`, `countryName`, `officialStateName`) stay untouched, so calls without an argument return exactly what they did before. An unknown or non-string field logs a warning and is ignored, and a bundle with no locale set gets an empty list instead of throwing. (#50)
+- **Fixed — FormValidator: numbered `is` rules now enforce, injected forms activate live checking, and boolean `_case_` conditions match live.** Numbered `is` aliases (`is1`, `is2`, …) were silently skipped and now install and run on both the client and the server — **a form that submitted clean because its `is2` condition was ignored may begin failing validation (or returning 422), so sweep your rule files for numbered `is` keys before upgrading.** Each alias now records its error under its own key on both sides, and server-side validation of rules carrying `$` cross-field references no longer crashes. Separately, dynamically injected (popin) forms now resolve `data-gina-form-rule` so live checking activates, and `_case_` conditions written as the strings `"true"` / `"false"` now match during live checking. These are browser-bundled changes — rebuild your bundles after upgrading. (#B127/#B128/#B129)
+- **Changed — busboy is now an npm dependency, not a vendored copy.** Multipart form parsing uses [`@rhinostone/busboy`](https://github.com/gina-io/busboy) — a strict superset of upstream busboy 1.6.0 whose only addition exposes each part's parsed Content-Disposition parameters, which is what lets the upload layer read the `group="…"` tag — installed from npm instead of a patched copy carried inside the framework tree. Upload behaviour and the multipart wire format are unchanged: files still arrive with their group, an unconfigured group is still rejected, and a file with no group still falls back to `untagged`. No application changes and no client rebuild — pickup is the version plus a bundle restart.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -44,6 +44,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.17` ✅ | **Fixed**: `npm install -g gina` no longer fails with `EALLOWSCRIPTS` under the npm 12 `--allow-scripts=gina` remedy — the nested framework-dependency install drops the inherited allowance, making `0.5.17` the first version installable on npm 12 (#B106) · stale project cleanup is reliable — `project:rm @<project> --force` (the alias) removes the entry, and `project:remove` / `:rm --force` no longer `ENOENT`-crashes on an uncreatable stale path, going straight to registry-only removal (#B104/#B105) · `bundle:start` honours a bundle's configured default scope (a typo had returned an undefined property) |
 | **Q3 2026** | `0.5.18` ✅ | **Added**: a redis-backed L2 render cache — rendered output is cached in a shared store, so several replicas serve the same rendered page and a freshly-started replica serves what a peer already rendered (cross-replica cold-start), degrading to per-replica caching if redis is down · pluggable cache backends (`server.cache.type`: `memory` / `fs` / `redis`) with bundle-wide `sliding` / `maxAge` fallbacks a route inherits · type-safe DTOs and a default-on validation pipe (`gina.dto` — one shape projected to runtime validation, response shaping, JSON Schema and TypeScript; `param.dto` validates the payload before the action with a localised 422, `param.responseDto` shapes the wire, `gina bundle:types` emits declarations, and `bundle:openapi` / `bundle:mcp` emit real request/response schemas) · `releaseWatch` — an opt-in stale built-release watch for local production rehearsals (source-tree fingerprint against the manifest release stamp, `GET /_gina/release/status` + an SSE stream, idle-gated rebuild-and-restart honouring in-flight requests and busy probes, a live shadow-DOM banner, and `restartMode: supervisor` for daemonless container launches) · `POST /_gina/cache/clear` + a `gina cache:clear` CLI (flush the rendered-output cache, or evict by event across bundles) · two-tier cache observability (an RFC 9211 `Cache-Status` `detail` naming the serving tier, plus an `l2` redis-health block on `/_gina/cache/stats`) · **Changed**: render-cache keys are release-namespaced, so an upgrade auto-invalidates (`GINA_CACHE_NAMESPACE`, else the framework version) · the `Cache-Status` miss form is now the RFC 9211 `gina-cache; fwd=uri-miss`, and Express bundles get their first cache-miss signal · **Fixed**: event-driven cache invalidation works — `self.cache.invalidateByEvent()` now exists, and a key carrying a querystring no longer throws a 500 that discarded an already-rendered page · the `fs` cache survives a restart (disk read-back via a `.meta` sidecar, original absolute expiry preserved, no TTL extension) · a checkbox's `value` attribute no longer decides its `checked` state (#49) · the published TypeScript declarations describe the runtime · errors surface instead of crashing, masking, or coming back as `0` (detached-context `throwError`, partial-boot `getLib()` / `getConfig()`, a bitwise-or at nine sites, and `$` in log messages) |
 | **Q3 2026** | `0.5.19` ✅ | **Added**: route authorization — a `routing.json` rule gates access before the action runs via `param.requireAuth` (a 401 for XHR, a non-cacheable login redirect for a browser navigation, the original request snapshotted for `resumeRequest()`), `param.roles` (ANY-of, implies `requireAuth`), and `param.policy` (a per-bundle function for the ownership/record checks roles can't express, AND-composed after roles); denials stay generic — required roles and the policy name never reach the wire — author mistakes refuse to boot, and `self.hasRole()` authorizes mid-logic · an audit trail — opt-in `self.audit(action, data)` writes a user-attributed append-only JSONL record (its own store, never the logger sinks; an actor snapshot, `X-Forwarded-For` never trusted), route-authorization denials recorded automatically, and an always-on request id correlating audit records to JSON logs · an OCI image/container CLI on the `image:build` host — `image:list` / `image:rm` / `image:run` (podman; publishes the EXPOSEd port, `--env-var` / `--env-file` keep secrets out of argv) and a `container:` group (`container:ps` / `container:stop`, reporting the rung a container came down on) · **Changed**: `redirect()` carries request data through the session by default (a one-shot flash, gone on refresh), the clear-text `?inheritedData=` URL form and its 2000-char cap now session-less-only — removing a plaintext-secret-in-URL disclosure when a session-ful bundle halts a credential-bearing POST · **Fixed**: Prometheus metrics no longer double-count under the isaac engine (#OBS1) · the relative `self.redirect('/path')` form resolves again and an unresolvable target 404s instead of crashing (`redirect()` is now async), and `getRoute()` no longer 500s on a requirements-less GET route with extra params (#B120/#B121) · `image:build` for gina-dependent projects no longer fails at gina-init and the pinned framework wins `require('gina')` (#B118/#B119) · `gina.emit` is an inert stub (#B109) and the checkbox migration warning now covers the un-tick direction (#49) |
+| **Q3 2026** | `0.5.20` ✅ | **Fixed**: region locale data — the generator now emits one standalone file per language with localized country names (a `fr` culture renders `Allemagne` / `États-Unis` / `Royaume-Uni` through the same `getLocales().getCountries()` path, no app changes; rows without an ISO 3166 alpha-2 code are dropped; read once at boot, so restart to pick up), and `getCountries(code)` honors its projection argument — adding the requested field while the four historical fields stay untouched, an empty locale set degrading to an empty list instead of throwing (#50) · **Fixed**: FormValidator — numbered `is` rules (`is1`, `is2`, …) now install and enforce on client and server (previously silently skipped; **sweep rule JSONs before upgrading — forms may begin 422ing**), each alias keying its error distinctly and server-side `$`-cross-field rules no longer crashing; injected/popin forms resolve `data-gina-form-rule` so live checking activates; boolean `_case_` conditions match live (#B127/#B128/#B129) · **Changed**: multipart parsing uses `@rhinostone/busboy` installed from npm instead of a patched vendored copy — a strict superset of upstream busboy 1.6.0, upload behaviour and the wire format unchanged, pickup is the version plus a bundle restart |
 | **Q4 2026** | `0.6.0` | Security & compliance controls (technical safeguards mapping to PCI-DSS / SOC2 / HIPAA) |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
@@ -281,6 +282,7 @@ New database connectors follow the same interface as the existing Couchbase conn
 | ✅ | **`connector:infer` — one-off AI inference CLI** | `0.5.6-alpha.3` | Q2 2026 | Runs a single inference against a configured `ai` connector **outside a request** — the runtime sibling of the config-only `connector:list`/`add`/`rm`/`migrate` tooling. Resolves the project's shared (or shared+bundle merged) `connectors.json`, resolves `${secret:KEY}` credentials from the CLI's own environment (the resolved value is never echoed), instantiates the connector directly (no bundle boot, no framework socket), and prints the normalised result. `gina connector:infer <connector> [<bundle>] @<project> --message="..."`, with `--system` / `--model` / `--max-tokens` / `--temperature` per-call overrides; `--message` takes precedence over a messages JSON array piped on stdin. `--format=json` (matched strictly — `jsonl`/`json5` fall back to the text output) emits `{ content, model, usage }`, with `--raw` adding the full provider response as a `raw` field (omitted by default for CLI use); text mode writes the content to stdout and a model/usage footer to stderr. `--stream` streams the inference as newline-delimited JSON (NDJSON) — one frame per line on stdout: a `start` frame, a `delta` frame per token, then a terminal `done` (content, model, usage, latency; plus the provider `raw` object under `--raw` — `null` for OpenAI-family streams) or `error` frame; token counters are passed through verbatim and are `null` (never fabricated) when a provider does not report them. Errors cleanly on a non-`ai` connector, and surfaces missing-SDK / credential / transport failures with a non-zero exit and the reason on stderr. Useful for smoke-testing connectivity + credentials from CI/automation, or scripting a one-off inference from a shell; offline providers such as `ollama://` work with no paid-API key. Implemented 2026-06-30 (`connector:infer` + the `--stream` NDJSON mode; a later output-hardening pass added `--raw`, pipe-safe synchronous writes, and `--message`-over-stdin precedence). |
 | ✅ | **`connector:test` — connector readiness probe CLI** | `0.5.6-alpha.3` | Q2 2026 | Probes a project's configured connectors for readiness **outside a request** — the CI-friendly sibling of `connector:list` (driver-install status only) and `secrets:check` (env presence only), answering "is this connector ready to use?". Default is validate-only and offline: per connector it checks the `connector` type / `ai` protocol is recognised, the npm driver is installed at `<project>/node_modules`, and every `${secret:KEY}` placeholder resolves from the environment — no network, no connector instantiated — exiting non-zero when any connector fails so it can gate a deploy. `gina connector:test [<connector> [<bundle>]] @<project>` tests one connector or every connector in a project (bare → every registered project), mirroring `connector:infer`'s positional grammar and `secrets:check`'s all-mode; `--format=json` emits a machine-readable readiness report. The `--connect` opt-in adds a live connectivity probe: for `ai` connectors it calls the provider's `models.list` (a credentialed request that authenticates with **zero generation tokens**; `ollama://` confirms the local server is up), resolving `${secret:KEY}` the way `connector:infer` does (the value is never printed). For DB/cache connectors the live `--connect` probe is reported as **skipped** for now (config / driver / secrets are still validated) — the live DB/cache probe is a follow-up, since those connector classes load `core/gna` (which exits the process outside a booted bundle) and cannot be instantiated the way the AI connector is. Implemented 2026-06-30. |
 | ✅ | **`connector:models` — list an AI connector's provider models** | `0.5.8` | Q2 2026 | Lists the model catalogue a configured `ai` connector's provider can serve — the read sibling of `connector:test --connect` (which makes the same `models.list()` call but keeps only the count). `gina connector:models <connector> @<project> [<bundle>]` prints one model id per line (a count footer on stderr), or `--format=json` emits `{ project, connector, provider, count, models }` with each entry passed through verbatim from the provider (only `id` is guaranteed across providers — Anthropic and OpenAI-family return different fields). Reuses the direct-`AIConnector` bootstrap of `connector:infer` / `connector:test` (no bundle boot, no framework socket); resolves config only and never prints credentials; offline providers such as `ollama://` work with no internet. `isAIConnector`-gated (a non-AI connector is rejected cleanly), and a provider client without `models.list` reports `supported:false` with a non-zero exit rather than a fabricated empty list. Implemented 2026-07-03. |
+| 📋 | **DuckDB** | `0.5.x` | Q3 2026 | ORM / entity connector for DuckDB — an embedded **analytical** (columnar, OLAP) store: the analytics-side sibling of the SQLite connector's embedded OLTP role. Planned shape follows the MySQL / PostgreSQL architecture: entity wiring, `sql/` layout, positional placeholders (DuckDB accepts `?` and `$name`), `@param`/`@return` annotations, native Promise + `.onComplete()`, driver loaded from the project's `node_modules` as an optional peer dependency. Client: `@duckdb/node-api` (DuckDB's current-generation Node client). Use cases: in-process analytics and reporting bundles over app data, querying Parquet / CSV / JSON files directly without an ETL hop, larger-than-memory local aggregation; both `:memory:` and file-backed databases. Session store is a non-goal — DuckDB is a single-writer analytics engine (Redis / SQLite cover session storage). |
 
 ---
 

package/framework/v0.5.20/VERSION

@@ -0,0 +1 @@
+0.5.20

package/framework/{v0.5.19 → v0.5.20}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3892,9 +3892,17 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
          * */
         self[el]['is'] = function(condition, errorMessage, errorStack) {
             var isValid     = false;
-            var alias       = ( typeof(window) != 'undefined' && typeof(window._currentValidatorAlias) != 'undefined' ) ? window._currentValidatorAlias : 'is';
-            if ( typeof(window) != 'undefined'  && window._currentValidatorAlias)
-                delete window._currentValidatorAlias;
+            // #B127 — alias root: window in the browser, the Node global on the
+            // server, so numbered `is<N>` aliases keep DISTINCT error keys on both
+            // sides. The installer's setAlias IIFE already writes the alias to the
+            // Node global (sloppy-mode `this`); the old window-only read collapsed
+            // every server alias to the shared key `is`, which let a later PASSING
+            // alias delete an earlier FAILING alias's error (see the !isValid /
+            // delete bookkeeping below) — the field then validated clean.
+            var _aliasRoot  = ( typeof(window) != 'undefined' ) ? window : ( ( typeof(global) != 'undefined' ) ? global : null );
+            var alias       = ( _aliasRoot && typeof(_aliasRoot._currentValidatorAlias) != 'undefined' ) ? _aliasRoot._currentValidatorAlias : 'is';
+            if ( _aliasRoot && _aliasRoot._currentValidatorAlias )
+                delete _aliasRoot._currentValidatorAlias;
 
             var errors      = self[this['name']]['errors'] || {};
             local.data[this.name] = self[this.name].value;
@@ -10427,18 +10435,27 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
             var rule    = null;
             if ( typeof(customRule) == 'undefined') {
-                rule = _id.replace(/\-/g, '.');
+                // #B128 — attribute-first: an injected form carrying `data-gina-form-rule`
+                // (the popin bind path calls validateFormById with no customRule) must
+                // resolve by the attribute's dotted name — the id-derived name stays the
+                // fallback for attribute-less forms whose id names the rule. The old shape
+                // read the attribute only when `rules` was undefined — unreachable on a
+                // rules-bearing page (and its inner `rules` recheck was false by
+                // construction, so that branch could only ever throw): the id-derived
+                // lookup missed, bindForm re-resolved by id, `$form.rules` bound `{}`,
+                // and the live-check gate stamped the form
+                // `data-gina-form-live-check-enabled="false"` while the submit handler
+                // independently re-read the attribute and succeeded.
+                // was: rule = _id.replace(/\-/g, '.'); then the attribute behind an
+                // unreachable `else if` ending in a dead throw.
+                if ( typeof($form.target) != 'undefined' && $form.target !== null && $form.target.getAttribute('data-gina-form-rule') ) {
+                    rule = $form.target.getAttribute('data-gina-form-rule').replace(/\-|\//g, '.');
+                } else {
+                    rule = _id.replace(/\-/g, '.');
+                }
 
                 if ( typeof(rules) != 'undefined' ) {
                     $form['rule'] = customRule = getRuleObjByName(rule)
-                } else if ( typeof($form.target) != 'undefined' && $form.target !== null && $form.target.getAttribute('data-gina-form-rule') ) {
-                    rule = $form.target.getAttribute('data-gina-form-rule').replace(/\-|\//g, '.');
-
-                    if ( typeof(rules) != 'undefined' ) {
-                        $form['rule'] = getRuleObjByName(rule)
-                    } else {
-                        throw new Error('[ FormValidator::validateFormById(formId) ] using `data-gina-form-rule` on form `'+$form.target+'`: no matching rule found')
-                    }
                 } // no else to allow form without any rule
             } else {
                 rule = customRule.replace(/\-|\//g, '.');
@@ -17187,8 +17204,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
         var stringifiedRules = JSON.stringify(rules);
         fields = formatFields(stringifiedRules, fields);
         if ( /\$(.*)/.test(stringifiedRules) ) {
+            // #B127 — `$fields` is null on the server paths (backendInit passes
+            // validate($form, fields, null, rules, …)), so the unguarded
+            // `$fields.count()` crashed the server pass for ANY `$`-bearing rule
+            // set (plain `is` included) before the rules ever ran. A server pass
+            // is a full-form pass by definition — never a single-element live-check.
             var isLiveCheckingOnASingleElement = (
-                !/^form$/i.test($formOrElement.tagName)
+                $fields
+                && !/^form$/i.test($formOrElement.tagName)
                 && $fields.count() == 1
                 && /true/i.test($formOrElement.form.dataset.ginaFormLiveCheckEnabled)
             ) ? true : false;
@@ -17256,18 +17279,26 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
             // check each field against rule
             for (var rule in rules[field]) {
-                // skip when not processing rule function
-                if ( typeof(d[field][rule]) != 'function' ) {
-                    continue;
-                }
-
-                if ( /^((is)\d+|is$)/.test(rule) && typeof(d[field][rule]) == 'undefined' ) { // is aliases
+                // #B127 — numbered `is` aliases (`is0`, `is1`, …) must be installed
+                // BEFORE the function typecheck below: the installer requires the
+                // `undefined` state the typecheck `continue`s on, so with the old
+                // order (typecheck first) the installer was unreachable and every
+                // `is<N>` rule key was silently skipped — client AND server. The
+                // regex is anchored: the old unanchored alternative also matched
+                // names like `is0abc`, which would inherit from a nonexistent base.
+                // was (below the typecheck — unreachable):
+                // if ( /^((is)\d+|is$)/.test(rule) && typeof(d[field][rule]) == 'undefined' ) { // is aliases
+                if ( /^is\d+$/.test(rule) && typeof(d[field][rule]) == 'undefined' ) { // is aliases
                     d[field][rule] = function(){};
                     d[field][rule] = inherits(d[field][rule], d[field][ rule.replace(/\d+/, '') ]);
                     d[field][rule].setAlias = (function(alias) {
                         this._currentValidatorAlias = alias
                     }(rule));
                 }
+                // skip when not processing rule function
+                if ( typeof(d[field][rule]) != 'function' ) {
+                    continue;
+                }
                 // check for rule params
                 try {
                     if (Array.isArray(rules[field][rule])) { // has args
@@ -17733,10 +17764,26 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             } // EO caseEvent
                             */
                             caseValue = allFields[caseName];
+                            // #B129 — coerce the CASE value itself (the direct-case
+                            // site's semantics: unconditional string "true"/"false"
+                            // -> boolean, isGFFCtx gate kept). The old shape tested
+                            // `fields[field]` — the OUTER field being validated — so
+                            // a boolean `case` never coerced unless the outer field's
+                            // own value happened to be "true"/"false", which instead
+                            // CLOBBERED the case value for that field's pass. Masked
+                            // in full-form passes by the direct-case site below;
+                            // unmasked in single-element/live-check mode.
+                            // was:
+                            // if (isGFFCtx) {
+                            //     if (fields[field] == "true")
+                            //         caseValue = true;
+                            //     else if (fields[field] == "false")
+                            //         caseValue = false;
+                            // }
                             if (isGFFCtx) {
-                                if (fields[field] == "true")
+                                if (caseValue == "true")
                                     caseValue = true;
-                                else if (fields[field] == "false")
+                                else if (caseValue == "false")
                                     caseValue = false;
                             }