gina 0.5.20 → 0.5.21

package/framework/{v0.5.20 → v0.5.21}/lib/render-cache/src/main.js

@@ -52,8 +52,9 @@
  * renderCache.get('static:demo:/page');  // reconstructs the entry from disk + .meta
  */
 
-var fs    = require('fs');
-var Cache = require('../../cache/src/main');
+var fs     = require('fs');
+var crypto = require('crypto');
+var Cache  = require('../../cache/src/main');
 
 /**
  * Build the on-disk paths for an `fs`-strategy entry. Single source of truth
@@ -989,4 +990,114 @@ RenderCache.validateConfig = function(serverCache, routing, bundle) {
     return out;
 };
 
+/**
+ * #B130 — CSP-nonce re-stamp for served cache hits (pure, static).
+ *
+ * A render/output-cache hit replays the STORED response headers and the STORED
+ * body — both minted by the request that WROTE the entry. When the stored
+ * Content-Security-Policy header carries `'nonce-…'` sources, replaying the
+ * pair verbatim reuses one nonce for every client of that URL until the entry
+ * expires (and, pre-#B130, could even replay a header/body PAIR minted by two
+ * different requests). The serve sites (server.js `serveRenderCacheHit` + the
+ * isaac pre-routing read — keep both in sync) call this to mint a FRESH nonce
+ * per response and rewrite the header copy; the body is rewritten with
+ * {@link RenderCache.swapNonces}. The Csp middleware never runs on a hit (the
+ * hit short-circuits dispatch), so this is the only mint on that path.
+ *
+ * Inputs are never mutated — the cache entry keeps its original values.
+ *
+ * @function renonceCspHeaders
+ * @memberof RenderCache
+ * @static
+ *
+ * @param {object|null} responseHeaders - The stored headers snapshot (`res.getHeaders()` shape, lowercase keys)
+ *
+ * @returns {object|null} `null` when no CSP header carries a nonce (serve the stored pair verbatim);
+ *   else `{ headers, oldNonces, nonce }` — a fresh headers object with every
+ *   `'nonce-…'` value replaced, the distinct old nonce values found, and the new nonce
+ *
+ * @example
+ * var rn = RenderCache.renonceCspHeaders(hit.responseHeaders);
+ * if (rn) {
+ *     body = RenderCache.swapNonces(hit.content, rn.oldNonces, rn.nonce);
+ *     // replay rn.headers instead of hit.responseHeaders
+ * }
+ */
+RenderCache.renonceCspHeaders = function (responseHeaders) {
+    if ( !responseHeaders || typeof(responseHeaders) !== 'object' ) {
+        return null;
+    }
+    var cspKeys = [], oldNonces = [], h = null, i = 0;
+    for (h in responseHeaders) {
+        if (
+            /^content-security-policy(-report-only)?$/i.test(h)
+            && typeof(responseHeaders[h]) === 'string'
+        ) {
+            cspKeys.push(h);
+            var found = responseHeaders[h].match(/'nonce-[^']+'/g) || [];
+            for (i = 0; i < found.length; i++) {
+                // `'nonce-` prefix (7 chars) + trailing `'`
+                var val = found[i].substring(7, found[i].length - 1);
+                if (val && oldNonces.indexOf(val) === -1) {
+                    oldNonces.push(val);
+                }
+            }
+        }
+    }
+    if (oldNonces.length === 0) {
+        return null;
+    }
+    // 16 bytes = 128 bits — parity with the Csp plugin's NONCE_BYTES (the W3C
+    // CSP3 nonce-entropy floor). base64 like the middleware mint.
+    var nonce   = crypto.randomBytes(16).toString('base64');
+    var headers = {};
+    for (h in responseHeaders) {
+        headers[h] = responseHeaders[h];
+    }
+    for (i = 0; i < cspKeys.length; i++) {
+        headers[ cspKeys[i] ] = RenderCache.swapNonces(headers[ cspKeys[i] ], oldNonces, nonce);
+    }
+    return { headers: headers, oldNonces: oldNonces, nonce: nonce };
+};
+
+/**
+ * #B130 — replace every occurrence of each old nonce value with the fresh one.
+ * Exact-string swap (split/join — nonce values are base64 and may carry `+/=`,
+ * so no regex). Covers the framework bootstrap `nonce="…"` attribute AND any
+ * app-template `{{ page.cspNonce }}` occurrence baked into the stored body.
+ * Null-safe: a non-string `content` (or empty swap set) is returned unchanged.
+ *
+ * @function swapNonces
+ * @memberof RenderCache
+ * @static
+ *
+ * @param {string} content - The stored response body
+ * @param {array} oldNonces - Distinct old nonce values (from {@link RenderCache.renonceCspHeaders})
+ * @param {string} nonce - The fresh nonce
+ *
+ * @returns {string} The body with old nonce values swapped for the fresh one
+ *
+ * @example
+ * RenderCache.swapNonces('<script nonce="abc+/=">', ['abc+/='], 'Zm9v');
+ * // -> '<script nonce="Zm9v">'
+ */
+RenderCache.swapNonces = function (content, oldNonces, nonce) {
+    if (
+        typeof(content) !== 'string'
+        || !Array.isArray(oldNonces)
+        || oldNonces.length === 0
+        || typeof(nonce) !== 'string'
+        || !nonce
+    ) {
+        return content;
+    }
+    for (var i = 0; i < oldNonces.length; i++) {
+        if (oldNonces[i] === nonce) {
+            continue;
+        }
+        content = content.split(oldNonces[i]).join(nonce);
+    }
+    return content;
+};
+
 module.exports = RenderCache;

package/framework/{v0.5.20 → v0.5.21}/lib/routing/src/main.js

@@ -1090,7 +1090,10 @@ function Routing() {
 
 
         if ( typeof(routing[rule]) == 'undefined' ) {
-            throw new Error('[ RoutingHelper::getRouting(rule, params) ] : `' +rule + '` not found !')
+            // #B132 — name the bundle + its table size so a degraded/near-empty
+            // table (e.g. a bundle whose routing config never loaded) is
+            // tellable from a plain mistyped rule at the call site.
+            throw new Error('[ RoutingHelper::getRouting(rule, params) ] : `' +rule + '` not found ! (bundle `'+ bundle +'` holds '+ Object.keys(routing).length +' rules)')
         }
 
         var route   = JSON.clone(routing[rule]);

package/framework/{v0.5.20 → v0.5.21}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.5.20",
+  "version": "0.5.21",
   "dependencies": {
     "@rhinostone/busboy": "^1.6.1",
     "@rhinostone/swig": "^2.7.2",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.5.20/core/gna');
+var _gna = require('./framework/v0.5.21/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.5.20/core/controller');
-var EntitySuper     = require('./framework/v0.5.20/core/model/entity');
+var SuperController = require('./framework/v0.5.21/core/controller');
+var EntitySuper     = require('./framework/v0.5.21/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.5.20/lib/uuid');
+var uuid = require('./framework/v0.5.21/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -870,7 +870,7 @@ Dev-mode query instrumentation captures every database query tied to the current
 - **`server.isaac.js:1954` initializes `req.params`** — `request.params = {}` and `request.params[0] = url` are set before `handle()` runs. Any code that deletes `req.params` breaks `fitsWithRequirements` which checks `typeof(request.params) != 'undefined'` before setting param values.
 - **internal-bundle `setting-get-one-design` was a latent crash** — an internal bundle's routing had `"url": "/settings/get/design/:designId"` with no `requirements` block. Before the `fitsWithRequirements` fix, every GET to that URL threw a 500 TypeError. The fix makes it work correctly. Worth testing that route after the next ff-only merge.
 
-129. **`env.json > response.header` config defaults are asymmetric across engines and can collide with framework `setHeader` calls — always trace the full emit chain before claiming a config default reaches the wire.** `core/server.js` (Express engine) reads `conf.server.response.header` into `resHeaders` at `server.js:1944` and loops `response.setHeader(h, headerValue)` over each key at `server.js:2034` — so any entry in the env.json `response.header` block IS applied on Express. But `core/server.isaac.js` does NOT read `server.response.header` anywhere (grep `serverResponseHeaders` / `server\.response\.header` against `server.isaac.js` returns zero matches) — Isaac builds its headers from the framework's own primitives (`_setPoweredByHeader()` for X-Powered-By, fixed setHeader calls for cache/CORS at the `/_gina/*` handlers), so any env.json `response.header` default is silently ignored on Isaac bundles. Layered on top: framework code that emits its own canonical value via a later `setHeader` call in the Express request lifecycle OVERWRITES whatever env.json set earlier. The combination means an env.json `response.header` config default can look load-bearing in the template while being functionally dead at runtime — applied-then-overwritten on Express, ignored on Isaac. Operator rule: before claiming a `response.header` config key reaches the wire, (a) grep both engines for reads of `server.response.header` (the Isaac silence is the dead-giveaway), and (b) grep for framework `setHeader('<that-key>', ...)` calls that would overwrite. Precedent: 2026-05-17 — the `X-Powered-By: "Gina I/O - v${version}"` env.json default at `core/template/conf/env.json:91` was structurally dead (overwritten by `server.js:3038` on Express, never read on Isaac); dropped in favour of the canonical `Gina/<version>` shape emitted by `server.js:3038` + `_setPoweredByHeader()` and suppressed by `gina.plugins.HidePoweredBy()` middleware + `settings.json > server.hidePoweredBy: true` gate respectively. The handoff that prompted the cleanup had framed the env.json default as a "third emit path that neither plugin nor gate reaches" — wrong in both directions (Express middleware DID remove the overwritten value cleanly; Isaac never read the env.json key at all). Established 2026-05-17. **Amended 2026-07-11 (static-404 suppression uniformity):** the per-request emission in `server.js`'s request-entry catch-all fires for BOTH engines (the Express-only framing above was stale — Isaac requests traverse it too) and is now GATED on `settings.json > server.hidePoweredBy`, so the flag suppresses X-Powered-By framework-wide: routed responses, static-asset serves, static/traversal 404s, framework error pages, and the Isaac `/_gina/*` sites it already covered. Previously the flag gated ONLY the `/_gina/*` sites, and a static-asset 404 leaked `Gina/<version>` past ALL THREE documented mechanisms: the middleware drain is bypassed for non-`text/html` static requests, and `throwError`'s HTTP/1.1 branches called `writeHead` BEFORE `completeHeaders`, whose `!headersSent`-gated loop then skipped the env `response.header` override — while the HTTP/2 branch merged it via `getHeaders()`. That engine asymmetry read as "override works on routed, raw literal on static-404" behind an HTTP/1.1 reverse proxy. `throwError` now applies `completeHeaders` before the HTTP/1.1 flush (a deferred content-type carrier + a late `writeHead`), so an env `response.header` X-Powered-By entry OVERRIDES the framework value on error responses too — i.e. the env.json entry is no longer dead: it is the value-REPLACEMENT mechanism, while `server.hidePoweredBy` is the removal mechanism. Wire-verified 3-config matrix on an isolated daemonless boot: default → `Gina/<version>` everywhere (unchanged); flag → absent everywhere; override `''` → empty value on static-404 + traversal + routed alike.
+129. **`env.json > response.header` config defaults are asymmetric across engines and can collide with framework `setHeader` calls — always trace the full emit chain before claiming a config default reaches the wire.** `core/server.js` (Express engine) reads `conf.server.response.header` into `resHeaders` at `server.js:1944` and loops `response.setHeader(h, headerValue)` over each key at `server.js:2034` — so any entry in the env.json `response.header` block IS applied on Express. But `core/server.isaac.js` does NOT read `server.response.header` anywhere (grep `serverResponseHeaders` / `server\.response\.header` against `server.isaac.js` returns zero matches) — Isaac builds its headers from the framework's own primitives (`_setPoweredByHeader()` for X-Powered-By, fixed setHeader calls for cache/CORS at the `/_gina/*` handlers), so any env.json `response.header` default is silently ignored on Isaac bundles. Layered on top: framework code that emits its own canonical value via a later `setHeader` call in the Express request lifecycle OVERWRITES whatever env.json set earlier. The combination means an env.json `response.header` config default can look load-bearing in the template while being functionally dead at runtime — applied-then-overwritten on Express, ignored on Isaac. Operator rule: before claiming a `response.header` config key reaches the wire, (a) grep both engines for reads of `server.response.header` (the Isaac silence is the dead-giveaway), and (b) grep for framework `setHeader('<that-key>', ...)` calls that would overwrite. Precedent: 2026-05-17 — the `X-Powered-By: "Gina I/O - v${version}"` env.json default at `core/template/conf/env.json:91` was structurally dead (overwritten by `server.js:3038` on Express, never read on Isaac); dropped in favour of the canonical `Gina/<version>` shape emitted by `server.js:3038` + `_setPoweredByHeader()` and suppressed by `gina.plugins.HidePoweredBy()` middleware + `settings.json > server.hidePoweredBy: true` gate respectively. The handoff that prompted the cleanup had framed the env.json default as a "third emit path that neither plugin nor gate reaches" — wrong in both directions (Express middleware DID remove the overwritten value cleanly; Isaac never read the env.json key at all). Established 2026-05-17. **Amended 2026-07-11 (static-404 suppression uniformity):** the per-request emission in `server.js`'s request-entry catch-all fires for BOTH engines (the Express-only framing above was stale — Isaac requests traverse it too) and is now GATED on `settings.json > server.hidePoweredBy`, so the flag suppresses X-Powered-By framework-wide: routed responses, static-asset serves, static/traversal 404s, framework error pages, and the Isaac `/_gina/*` sites it already covered. Previously the flag gated ONLY the `/_gina/*` sites, and a static-asset 404 leaked `Gina/<version>` past ALL THREE documented mechanisms: the middleware drain is bypassed for non-`text/html` static requests, and `throwError`'s HTTP/1.1 branches called `writeHead` BEFORE `completeHeaders`, whose `!headersSent`-gated loop then skipped the env `response.header` override — while the HTTP/2 branch merged it via `getHeaders()`. That engine asymmetry read as "override works on routed, raw literal on static-404" behind an HTTP/1.1 reverse proxy. `throwError` now applies `completeHeaders` before the HTTP/1.1 flush (a deferred content-type carrier + a late `writeHead`), so an env `response.header` X-Powered-By entry OVERRIDES the framework value on error responses too — i.e. the env.json entry is no longer dead: it is the value-REPLACEMENT mechanism, while `server.hidePoweredBy` is the removal mechanism. Wire-verified 3-config matrix on an isolated daemonless boot: default → `Gina/<version>` everywhere (unchanged); flag → absent everywhere; override `''` → empty value on static-404 + traversal + routed alike. **Second amendment (2026-07-20, accept-language removal):** the template's OTHER hardcoded response-header default — `accept-language` (a REQUEST header, meaningless on responses; the runtime-merged template default made every response emit it, errors included) — is removed the same way the X-Powered-By default was: the framework emits nothing by default, a project/bundle env.json that declares its own value keeps being emitted verbatim (the override path is intact), and the controller's locale fallback still honors a declared value. The response.header block itself stays present-but-empty in the template — the controller fallback dereferences `server.response.header`, so the block's existence is load-bearing.
 
 133. **SQL Query-Instrumentation index reporting does per-query column-level coverage (#QI Phase C) — heuristic, declared-index-vs-WHERE, NOT a planner verdict.** `sql-parser.js` gained two exports beyond Phase A's `parseCreateIndexes`/`extractTargetTable`: `extractWhereColumns(queryString)` (heuristic — bare lowercase identifiers immediately left of a comparison operator inside the WHERE clause; strips table/alias qualifiers; ignores ORDER BY/GROUP BY/HAVING; functional predicates like `LOWER(email)=?` yield no column, conservatively) and `annotateCoverage(tableIndexes, queryString)` (clones each descriptor, adds a `covers` boolean via the **leftmost-prefix rule** — an index covers the filter only if its FIRST column is among the WHERE columns, mirroring real B-tree usability; never mutates the shared `_knownIndexes`). `parseCreateIndexes` now captures each index's `columns` array (regex extended to consume the `(col, ...)` body plus an optional `USING <method>`; ASC/DESC/opclass/prefix-length reduced to the bare leading identifier). Each SQL connector's QI block (mysql/postgresql/sqlite) calls `annotateCoverage` and stores `_queryEntry.whereColumns` + per-index `covers`. The Inspector Query tab adds a 4th badge state `.bm-idx-uncovered` (amber-gold, dark `#e6b800` / light `#8a6d00`, label "no index for filter") that fires only when the table HAS indexes AND a WHERE filter parsed AND none cover it (so there is no false "uncovered" when the filter is unparseable or absent); the existing green/amber/red/N-A states are unchanged. **SQL-connector-only** — Couchbase reads the actually-used index from the query execution profile (accurate), so column inference is moot there and its path is untouched. Heuristic limits (documented deliberately): regex WHERE-parsing with no AST, no selectivity / range-vs-equality / functional-index awareness, and `indexes.sql` is a declaration that can drift from the live DB — the badge says "no index for filter", NOT "index unused". Phase B live-introspection (#QI Phase C.2, 2026-05-20) now ALSO captures each index's columns — MySQL adds `SEQ_IN_INDEX`/`COLUMN_NAME` to the STATISTICS query, PostgreSQL parses `indexdef` via the new `sql-parser.parseIndexDefColumns()` export, SQLite adds a per-index `PRAGMA index_info` — so live descriptors carry the same `{ name, primary, columns }` shape as Phase A and column-level coverage survives the opt-in `/_gina/indexes` refresh (subsequent queries annotate correctly instead of a false `uncovered` badge; server-side only, no SPA/dist change since coverage is computed server-side per query). Tests: `test/core/inspector.test.js` §61 (21, Phase C) + §62 (12, Phase C.2). Established 2026-05-20.
 
@@ -916,7 +916,7 @@ Dev-mode query instrumentation captures every database query tied to the current
 
 212. **Structured (JSON) logging — `GINA_LOG_FORMAT=json` + per-request `requestId`/`durationMs` (consolidates former #152/#155; #M12a/#M12b).** The logger resolves its render format ONCE at init into `opt.format` (precedence `GINA_LOG_FORMAT=json|text` > `GINA_LOG_STDOUT` truthy ⇒ json > `text` default) BEFORE containers are cloned; a JSON line is `{ts, level, bundle, message, group, msg}` — `bundle`/`message` canonical, `group`/`msg` retained as additive back-compat aliases — and the raw `console.log` path honours the format too (otherwise JSON mode would interleave plain lines and break a collector); the `text` default keeps container logs byte-identical. Per-request `requestId` + `durationMs` ride JSON logs via a NARROW `AsyncLocalStorage` (`process.gina._reqALS`, parked on `process.gina` so it survives dev require-cache busting), gated on JSON logging ONLY (text renders no id field, so the ALS would be pure overhead — the text path stays byte-identical/zero-cost): the id resolver honours a SANITISED inbound `X-Request-Id` (`/^[\w.\-]{1,128}$/`, regenerate-on-violation kills log forging) else `crypto.randomUUID()`; the `.run({requestId, startMs})` wrap sits at `handle()` — NOT the request-entry handler — because the `request.on('end')` boundary between them loses async context while `handle()`'s awaits preserve it (the original body became `_handleDispatch`; `handle` is a thin wrapper); HTTP/2 gets per-stream scoping free via Node's per-stream compat `'request'` event, NOT `session.on('stream')`; the JSON-assembly sites read `getStore()` and add `requestId` + per-line `durationMs`, gracefully absent for CLI/boot/off-request logs. `.run()`, never `enterWith()` (enterWith bleeds sideways across siblings).
 
-213. **Client-plugin discipline — CSP-safe listeners, native-dialog parity, preload coalescing (consolidates former #149/#159/#200).** (1) Client-bundle plugins must NOT inject inline event-handler attributes (`setAttribute('onclick', …)`, `el.onX = …`) — they trip CSP `script-src-attr` under nonce-based policies; suppress defaults with `addEventListener('click', e => e.preventDefault())`, and keep it `preventDefault`-ONLY (no stopPropagation) when the element participates in event delegation other handlers depend on — a `preventDefault`-only listener still sets `event.defaultPrevented` exactly as the inline handler did. (2) Dialog popins open as native modals (`$el.showModal()`) in EVERY env — the dev-only non-modal downgrade + manual overlay are gone for dialog mode (native `::backdrop`); a consumer that PRE-OPENS the dialog (skeleton loading) must also use `showModal()` or it is born non-modal with nothing positioning it; the opt-in `preOpen`/`loadingShell` skeleton is idempotent via `hasAttribute('open')` — NOT getAttribute truthiness, because `showModal()` sets `open` to the EMPTY string; a native UA close (Escape, `<form method="dialog">`) fires the element's `close` event WITHOUT the plugin's own close path, so a once-per-element `close` listener (the event is `close`, not `cancel` — `cancel` is Escape-only) routes it through the plugin close, keeping open-state/listeners/toolbar consistent — a UA-closed shared popin otherwise re-opens "one render behind" (#B58). (3) A popin/dialog click fired TWO identical GETs because the hover/`focusin` preload — `focusin` is part of the click gesture — was never reused: an in-flight preload registry lets the click-time consume ADOPT the in-flight fetch (waiter woken with the body, caller's own load on failure) instead of fetching again, and the legacy click path consumes preloads at all now (#B54); only the initial GET is ever preloaded. The consume path bypassing the full load tail (redirect/JSON handling) was ASSUMED acceptable — but a hover/focus-WARMED trigger whose GET returns a redirect/JSON response (`application/json` `{isXhrRedirect,location}`) had that raw JSON blind-injected as the popin body via `applyContent` (`$el.innerHTML`), the `_self` tunnel never firing — IDENTICAL symptom to the #B77 `_self` timer race but a DIFFERENT mechanism (the consume path, regression `2c61c494` v0.5.5), so #B77 fixed only the UNWARMED click-time path and the WARMED path persisted until #B80 (2026-07-06, `37e6829c`): `preloadFetch`'s `onreadystatechange` now caches a 2xx response ONLY when its Content-Type is NOT `application/json` (mirrors `popinLoad`'s own `isJsonContent` detection), firing the in-flight waiters with `null` (→ `consumePreload`'s `onMiss` = the click-time `doLoad`) and leaving the cache empty (→ a ready consume returns false → `doLoad`), so a JSON-returning trigger falls through to the click-time `popinLoad`'s full redirect/JSON tail exactly as a non-preloaded click (one extra GET on click — the hover-warm GET is not reused; measured 2 GETs). Only a genuine HTML fragment is preloaded+injected. Browser-bundled → prod dist rebuilt; VERIFIED in a real browser (a warmed legacy `data-gina-popin-url` redirect trigger now shows the tunnel target, not the raw JSON; the decline path positively exercised via resource-timing) — jsdom is falsely green. That residual — the GET itself still fired on hover for side-effecting triggers, authenticated (same-origin cookies) and CSRF-token-less (GET) — is CLOSED by the #B91 per-trigger opt-out (2026-07-10): `data-gina-dialog-preload="false"` on the trigger (honored on legacy `data-gina-popin-url` triggers too — the gate reads the attribute off the closest-matched intent target; case-INSENSITIVE `/^false$/i` on purpose, so a templated "False" cannot fail open and fire the GET anyway — deliberately safer than data-gina-dialog-modal's case-sensitive parse) suppresses BOTH the hover warm and the focusin-on-click warm at the shared intent handler; the opted-out click loads normally at click time (undefined cache slot → consume returns false → the caller's click-time load; exactly one GET per click). Default stays preload-ON: GET is presumed safe to fire early per HTTP semantics — a side-effecting trigger declares itself (the hover-prefetch ecosystem's convention, live-verified). (4) A proxied/tunnelled redirect JSON response (`isXhrRedirect`+`location`, default `_self`) used to `$popin.load()` then arm a blind `setTimeout(50, () => !$popin.isOpen && $popin.open())`; a follow-up load slower than 50 ms opened the popin against a not-yet-injected (skeleton/empty) target → intermittent unhandled-deref crash. Removed as vestigial (v0.1.0, 2021) — the already-armed `loaded.<id>` listener opens CONTENT-FIRST (injects the body via popinBind/handleLoadedBody, THEN popinOpen), so the load alone suffices; the `_self` branch's `return;` still guards the `window.open` fall-through (non-`_self` targets only) (#B77). Event contract: `open.<id>` = a fresh open, `loaded.<id>` = reload/redirect content injected — a consumer needing "content ready on every load" must listen to BOTH. A structurally identical blind timer lived in the SIBLING validator `Validator::Popin now redirecting` path (`core/plugins/lib/validator/src/main.js`), removed by #B79 (2026-07-10): the validator DISCARDED popinLoad's return, and that return IS the `{open}` handle whose `open()` arms the content-first `loaded.<id>` listener — so the timer was papering over a race the discarded handle created (an XHR faster than 50 ms fired `loaded` into the void and the body was lost, a slower one opened an empty popin first). It now captures the handle and calls `open()` inside the same not-open gate, guarding the `undefined` popinLoad returns when the request cannot start (CORS unsupported) so a failed load never blind-opens an empty popin; and the cross-popin branch resets `isRedirecting` before closing the ORIGINAL popin, because `popinClose` early-bails on a redirecting popin — that close was a silent no-op, leaving the original open behind the new one (browser-verified: pre-fix stays open, post-fix closes). MEASURED CORRECTION: the timer was NOT load-bearing for the different-popin branch as long assumed — that branch threw first, because the published `gina.popin` WAS re-assembled with a target-wins merge on every `new Popin()`, so its `getPopinByName`/`getPopinById` stayed bound to the FIRST instance's registry and resolved ONLY the boot popin, while `$popins` + `getActivePopin` saw every popin and `gina.popin.activePopinId` never updated (so `getActivePopin()` returned null once nothing was open) — and popins registered AFTER an instance's publish (click-time in-page dialog registrations) never reached the published registry at all, with destroyed popins lingering in it. FIXED as #B90 (2026-07-10): ONE module-scoped registry (`_sharedPopins`) aliased by every instance's `$popins`; a publish-ONCE `gina.popin = instance` (the published object IS the first instance, LIVE — re-publishing was both the freeze defect and, with a shared registry, a self-merge recursion hazard: gina's merge deep-recurses plain objects and `$popin.eventData` can hold the $popin itself); and a `setActivePopinId` write-through helper at all 7 write sites keeping the published `activePopinId` truthful no matter which instance opens or closes a popin. Browser-verified both ways on the built bundle (pre-fix: accessors blind + the validator cross-popin redirect 422-throws `not found`; fixed: accessors resolve every instance's popins and a form submit redirecting into a DIFFERENT popin works end-to-end — the original closes, the target loads content-first, `activePopinId` follows). Generalises: an accessor published through a target-wins `merge()` silently keeps the first instance's closure — publish a live instance once and share module-scoped state instead of re-merging per construction; and never infer a code path is reachable from the fact that it exists. All four are browser-bundled — prod dist rebuild required; verify (2), (3) and (4) with a REAL preemptive-open / preload / redirect-tunnel consumer — a minimal smoke page is falsely green.
+213. **Client-plugin discipline — CSP-safe listeners, native-dialog parity, preload coalescing (consolidates former #149/#159/#200).** (1) Client-bundle plugins must NOT inject inline event-handler attributes (`setAttribute('onclick', …)`, `el.onX = …`) — they trip CSP `script-src-attr` under nonce-based policies; suppress defaults with `addEventListener('click', e => e.preventDefault())`, and keep it `preventDefault`-ONLY (no stopPropagation) when the element participates in event delegation other handlers depend on — a `preventDefault`-only listener still sets `event.defaultPrevented` exactly as the inline handler did. (2) Dialog popins open as native modals (`$el.showModal()`) in EVERY env — the dev-only non-modal downgrade + manual overlay are gone for dialog mode (native `::backdrop`); a consumer that PRE-OPENS the dialog (skeleton loading) must also use `showModal()` or it is born non-modal with nothing positioning it; the opt-in `preOpen`/`loadingShell` skeleton is idempotent via `hasAttribute('open')` — NOT getAttribute truthiness, because `showModal()` sets `open` to the EMPTY string; a native UA close (Escape, `<form method="dialog">`) fires the element's `close` event WITHOUT the plugin's own close path, so a once-per-element `close` listener (the event is `close`, not `cancel` — `cancel` is Escape-only) routes it through the plugin close, keeping open-state/listeners/toolbar consistent — a UA-closed shared popin otherwise re-opens "one render behind" (#B58). (3) A popin/dialog click fired TWO identical GETs because the hover/`focusin` preload — `focusin` is part of the click gesture — was never reused: an in-flight preload registry lets the click-time consume ADOPT the in-flight fetch (waiter woken with the body, caller's own load on failure) instead of fetching again, and the legacy click path consumes preloads at all now (#B54); only the initial GET is ever preloaded. The consume path bypassing the full load tail (redirect/JSON handling) was ASSUMED acceptable — but a hover/focus-WARMED trigger whose GET returns a redirect/JSON response (`application/json` `{isXhrRedirect,location}`) had that raw JSON blind-injected as the popin body via `applyContent` (`$el.innerHTML`), the `_self` tunnel never firing — IDENTICAL symptom to the #B77 `_self` timer race but a DIFFERENT mechanism (the consume path, regression `2c61c494` v0.5.5), so #B77 fixed only the UNWARMED click-time path and the WARMED path persisted until #B80 (2026-07-06, `37e6829c`): `preloadFetch`'s `onreadystatechange` now caches a 2xx response ONLY when its Content-Type is NOT `application/json` (mirrors `popinLoad`'s own `isJsonContent` detection), firing the in-flight waiters with `null` (→ `consumePreload`'s `onMiss` = the click-time `doLoad`) and leaving the cache empty (→ a ready consume returns false → `doLoad`), so a JSON-returning trigger falls through to the click-time `popinLoad`'s full redirect/JSON tail exactly as a non-preloaded click (one extra GET on click — the hover-warm GET is not reused; measured 2 GETs). Only a genuine HTML fragment is preloaded+injected. Browser-bundled → prod dist rebuilt; VERIFIED in a real browser (a warmed legacy `data-gina-popin-url` redirect trigger now shows the tunnel target, not the raw JSON; the decline path positively exercised via resource-timing) — jsdom is falsely green. That residual — the GET itself still fired on hover for side-effecting triggers, authenticated (same-origin cookies) and CSRF-token-less (GET) — is CLOSED by the #B91 per-trigger opt-out (2026-07-10): `data-gina-dialog-preload="false"` on the trigger (honored on legacy `data-gina-popin-url` triggers too — the gate reads the attribute off the closest-matched intent target; case-INSENSITIVE `/^false$/i` on purpose, so a templated "False" cannot fail open and fire the GET anyway — deliberately safer than data-gina-dialog-modal's case-sensitive parse) suppresses BOTH the hover warm and the focusin-on-click warm at the shared intent handler; the opted-out click loads normally at click time (undefined cache slot → consume returns false → the caller's click-time load; exactly one GET per click). Default stays preload-ON: GET is presumed safe to fire early per HTTP semantics — a side-effecting trigger declares itself (the hover-prefetch ecosystem's convention, live-verified). (4) A proxied/tunnelled redirect JSON response (`isXhrRedirect`+`location`, default `_self`) used to `$popin.load()` then arm a blind `setTimeout(50, () => !$popin.isOpen && $popin.open())`; a follow-up load slower than 50 ms opened the popin against a not-yet-injected (skeleton/empty) target → intermittent unhandled-deref crash. Removed as vestigial (v0.1.0, 2021) — the already-armed `loaded.<id>` listener opens CONTENT-FIRST (injects the body via popinBind/handleLoadedBody, THEN popinOpen), so the load alone suffices; the `_self` branch's `return;` still guards the `window.open` fall-through (non-`_self` targets only) (#B77). Event contract: `open.<id>` = a fresh open, `loaded.<id>` = reload/redirect content injected — a consumer needing "content ready on every load" must listen to BOTH. A structurally identical blind timer lived in the SIBLING validator `Validator::Popin now redirecting` path (`core/plugins/lib/validator/src/main.js`), removed by #B79 (2026-07-10): the validator DISCARDED popinLoad's return, and that return IS the `{open}` handle whose `open()` arms the content-first `loaded.<id>` listener — so the timer was papering over a race the discarded handle created (an XHR faster than 50 ms fired `loaded` into the void and the body was lost, a slower one opened an empty popin first). It now captures the handle and calls `open()` inside the same not-open gate, guarding the `undefined` popinLoad returns when the request cannot start (CORS unsupported) so a failed load never blind-opens an empty popin; and the cross-popin branch resets `isRedirecting` before closing the ORIGINAL popin, because `popinClose` early-bails on a redirecting popin — that close was a silent no-op, leaving the original open behind the new one (browser-verified: pre-fix stays open, post-fix closes). MEASURED CORRECTION: the timer was NOT load-bearing for the different-popin branch as long assumed — that branch threw first, because the published `gina.popin` WAS re-assembled with a target-wins merge on every `new Popin()`, so its `getPopinByName`/`getPopinById` stayed bound to the FIRST instance's registry and resolved ONLY the boot popin, while `$popins` + `getActivePopin` saw every popin and `gina.popin.activePopinId` never updated (so `getActivePopin()` returned null once nothing was open) — and popins registered AFTER an instance's publish (click-time in-page dialog registrations) never reached the published registry at all, with destroyed popins lingering in it. FIXED as #B90 (2026-07-10): ONE module-scoped registry (`_sharedPopins`) aliased by every instance's `$popins`; a publish-ONCE `gina.popin = instance` (the published object IS the first instance, LIVE — re-publishing was both the freeze defect and, with a shared registry, a self-merge recursion hazard: gina's merge deep-recurses plain objects and `$popin.eventData` can hold the $popin itself); and a `setActivePopinId` write-through helper at all 7 write sites keeping the published `activePopinId` truthful no matter which instance opens or closes a popin. Browser-verified both ways on the built bundle (pre-fix: accessors blind + the validator cross-popin redirect 422-throws `not found`; fixed: accessors resolve every instance's popins and a form submit redirecting into a DIFFERENT popin works end-to-end — the original closes, the target loads content-first, `activePopinId` follows). Generalises: an accessor published through a target-wins `merge()` silently keeps the first instance's closure — publish a live instance once and share module-scoped state instead of re-merging per construction; and never infer a code path is reachable from the fact that it exists. (5) EAGER content warm — `data-gina-dialog-preload="eager"` (case-insensitive) opts a trigger into a one-shot idle warm-all pass: after `window` load, on requestIdleCallback (setTimeout fallback), serialized one GET at a time, routed through the SAME shared per-trigger gate as the hover warm (`warmTrigger`: disabled skip → the `"false"` opt-out → URL-cache dedup → in-flight reserve + fetch) so the two warm paths cannot drift and whichever fires second is a no-op; skipped entirely under Save-Data; triggers injected after the pass keep the delegated hover warm; staleness matches the shipped no-TTL hover semantics — the opt-in accepts the wider warm→open window. Content preload deliberately does NOT ride 103 Early Hints: popin responses vary on `X-Requested-With` (a non-XHR GET of a fragment layout gets the iframe-wrap variant and misses the scripts append), and a browser `Link rel=preload` fetch never carries that header — wrong-variant bytes or a double GET, with no success branch; `self.setEarlyHints()` remains the right tool for a popin's STATIC subassets (the CSS/JS it injects via getScript/getStyle). All five are browser-bundled — prod dist rebuild required; verify (2), (3), (4) and (5) with a REAL preemptive-open / preload / redirect-tunnel consumer — a minimal smoke page is falsely green.
 
 214. **Per-request routing-clone correctness — narrow the defensive clone, and propagate mutations onto returned clones (consolidates former #194/#195; #B52-residual, 2026-06-18).** The router's per-request `options.conf = JSON.clone(conf)` — a multi-MB deep clone of the ENTIRE bundle config per matched request, held for the request's whole query+render window — was narrowed to: shallow-copy the top level + `conf.content`, deep-clone ONLY `conf.content.routing`, the one subtree actually MUTATED per request (audited: every other per-request write is a whole-subtree REASSIGNMENT a shallow copy isolates, and plugins/connectors/models read config via their own clones, never through the request's) — removing a dev/high-load heap high-water-mark proportional to config size (measured 163→62 MB peak under 150 concurrent slow requests, drains on idle). Rule: clone only the subtrees mutated per request and share the immutable remainder by reference — but audit EVERY per-request writer first, or a missed mutate-into-a-shared-subtree reintroduces cross-request contamination. Sibling: `getRouteByUrl` (server-side redirect/relative-route resolution AND browser-bundled) aliased the shared route config's `param` by REFERENCE while the matcher rewrites `param.{path,namespace,file,title}` in place for `:placeholder` routes — request A's substitution contaminated request B (server) and repeat navigations (client). The fix is TWO coordinated edits, not just "clone the alias": clone `param` per request AND propagate the substituted param onto the returned route object — the function returns a fresh clone of the SINGLETON, so cloning alone returns the un-substituted `:placeholder` and regresses even the first request. Rule: when a matcher both aliases a shared config object and returns a re-clone of that object, isolating the alias is insufficient — propagate the per-request mutations onto the returned clone. The sibling is browser-bundled → prod dist rebuild.
 
@@ -1001,3 +1001,13 @@ Dev-mode query instrumentation captures every database query tied to the current
 256. **Region locale data (`core/locales`) — standalone per-language files, localized `countryName`, additive `getCountries(code)` projection (#50, 2026-07-18, unreleased).** The region generator (`node src/make --target=region --region=en,fr`; CSV `resources/region.csv` = datahub country-codes, `;`-separated) emits ONE STANDALONE `dist/region/<lang>.json` per requested language: the row accumulator is reset per pass (it used to APPEND each language's rows to the previous output, so every `isoShort` was duplicated with the English copy FIRST and `findOne({isoShort})` always matched English), the requireJSON-cached column mapping is cloned per pass (a mutating pass used to leak into the next language's build — a `fr,en` order lost `officialStateName` for en), and rows without an ISO 3166 alpha-2 code are dropped (2 M49 aggregates with empty `isoShort` AND empty `countryName`; `en.json` 251→249). Non-en passes overlay `countryName` from `resources/region.names.<lang>.json` beside the CSV (French ships with the framework) and FAIL FAST when that file is missing for a requested language — never silently shipping English names under a non-en filename. The names files use PLAIN CLDR territory names: the fr `-alt-short` variants are abbreviations (`É.-U.`, `R.-U.`), not display names, so plain deliberately wins — a knowing style asymmetry with the CSV's own English column, which prefers `-alt-short` (`US`, `UK`). `--outdir=<path>` overrides the target dir; `require.main === module` gates the CLI so the module is require-safe/testable. Controller side: `getCountries(code)` honors its documented projection arg ADDITIVELY — a valid string field (`capital`, `continent`, `tld`) is added to each returned row, the 4 historical fields stay untouched, no-arg output is byte-identical, unknown/dotted codes warn and are ignored — and `getLocales()` on a bundle with no locale set degrades to an empty list instead of throwing. Composition: the per-request negotiated `req.culture` selects which language's region set a request sees through the setOptions locale bridge (#B100 guarded fallback to the bundle default then `en` when the resolved language has no region file), so an `Accept-Language` flip changes `countryName` per request — warm cached routes included (#B84: the cached fast-path re-negotiates). Region files are read ONCE at boot (`core/locales/index.js` loads ALL `dist/region/*.json` onto the gina context) — regenerated data needs a bundle restart; dev hot-reload does not deliver it.
 
 257. **FormValidator #B127/#B128/#B129 (2026-07-19, ride the next cut) — numbered `is` aliases enforce, injected forms resolve their declared rule, `_case_` boolean coercion reads the case value.** (1) Numbered `is` aliases (`is0`, `is1`, … — multiple `is` conditions per field) were NEVER installed: the per-rule function typecheck `continue`d on exactly the undefined state the lazy installer required, silently skipping any `is<N>` key on client AND server. They now install (anchored `/^is\d+$/`) with a DISTINCT error key per alias on BOTH sides (client via the `window._currentValidatorAlias` handshake, server via a Node-`global` alias-root — key parity, both-fail → both keys present; previously the shared server key let a later PASSING alias erase an earlier FAILING alias's error — a silent bypass). ⚠️ Enforcement-tightening: `is<N>` rules that silently skipped START ENFORCING at pickup — sweep rule JSONs for `is<N>` keys before upgrading. Also fixed alongside: the server auto path no longer crashes on a `$`-bearing rule set (`$fields` null-guard), so server-side cross-field `$` conditions work; the `is` grammar remains ONE binary comparison (`=== !== == != < > <= >=`), no `&&` compounds, failing loudly with a warn. (2) `validateFormById(id)` (the popin/injected-form bind path) resolved the rule by FORM ID only — the `data-gina-form-rule` attribute read was unreachable — so a form injected after boot bound `{}` rules and live-check was stamped `"false"` while submit resolved the same attribute fine; the branch is attribute-first now (the id-derived name stays the fallback for attribute-less forms whose id names the rule). Live-check gate precedence: an AUTHOR-set `data-gina-form-live-check-enabled` always wins; the gate decides only when the attribute is absent (rules bound → true, none → false). (3) The cross-field `_case_` scan coerced the WRONG variable (the field being validated instead of the case value): a boolean `case: false` never matched a case field's raw "false" DOM string in single-element/live-check passes, and an outer field valued "true"/"false" clobbered string case matching for its pass. The case value itself now coerces (unconditional, matching the direct-case site's semantics) — declare boolean cases as JSON booleans; `case` values written as the strings "true"/"false" coerce to booleans consistently across sites. Worth knowing: a MATCHING case application replaces that field's rule set in the bound form's rules store persistently for the page, and there are NO standalone `maxLength`/`minLength` engine rules — length constraints are `isString`/`isNumber`/`isInteger` parameters; unknown rule keys are silently skipped.
+
+258. **CSP useNonce × server cache (#B130, 2026-07-19, rides the next cut) — the bootstrap-script nonce is render-time, and cache hits re-mint.** With `Csp({useNonce:true})` + `server.cache.enable:true`, the framework-injected onGinaLoaded bootstrap `<script>` used to carry a nonce frozen at first compile (baked into the per-view compiled-template cache AND the persisted layout-cache file, which is only re-primed when missing), while the middleware minted a fresh header nonce per request — so header != markup on every later response of a cached route (misses included), breaking enforce-mode CSP. Now: (1) the loader injection is a swig conditional evaluated per execute against `page.cspNonce` (assigned pre-execute on both the compiled-cache-hit and compile branches), so cached compiled templates are nonce-agnostic; (2) stale layout-cache files written by pre-fix builds are normalized in place on the next compile (anchored on the loader's own comment-wrapper idiom + the dev Inspector script openers; idempotent; app-authored tags untouched); (3) output-cache HITS mint fresh per response — both engines' serve paths rewrite the stored CSP header (enforce and report-only) and swap the old nonce values in the stored body (exact-string split/join, base64-safe) without ever mutating the stored entry; the isaac fs read-back buffers instead of streaming only when a re-nonce applies. Verify on a live route: header nonce == every markup nonce AND rotating across responses on miss + hit. Dev/cacheless was never affected (layout re-primed every request).
+
+259. **Server-side error responses strip stack traces outside local scope — the engine-level throwError sanitizes centrally; the full stack goes to the server log (2026-07-20, rides the next cut).** Two throwError implementations exist: the controller-side one (scope-gated since 0.5.x — it strips the `stack` FIELD outside local scope) and the SERVER-side engine-attached one, whose feeders (router action/middleware catches, server internals) flatten `err.stack` INTO the message string — so non-local 500 bodies used to carry absolute framework paths + stack frames in the JSON `error` field, the inline HTML error fallback, and custom-error page data. The server-side throwError now detects a stack-bearing message (`/\n\s+at\s/`, the V8 frame format) outside local scope, logs the FULL text server-side, and ships only the message line; an object msg has `.stack` logged then stripped off a clone (the caller's object is untouched). Local scope is byte-identical — the dev toolbar reads the stack off the wire. The gate reads the same NODE_SCOPE_IS_LOCAL env var as the controller-side gate (set once at bootstrap), deliberately NOT the config-derived per-bundle scope flag: that flag derives from the project's DEFAULT scope and can lag a boot started with an explicit NODE_SCOPE/--scope. Siblings fixed with it: the JSON render delegate's HTTP/1.1 reason-phrase catch ships `err.message` (a multi-line reason phrase is invalid on the HTTP/1.1 status line — Node rejects the write), and the cached-file stream error path ships message-only. Consumers who relied on wire stacks for service-to-service debugging keep them on LOCAL scope only; everywhere else the server log carries the diagnostic.
+
+260. **A bundle with a missing or unreadable config/routing.json REFUSES to boot (matching the malformed-JSON path), and the route-lookup not-found error names the bundle + its rule count (2026-07-20, rides the next cut).** Bundle config hydration is readdir-driven: a routing.json absent at boot readdir time was never iterated, so the bundle silently booted with only the framework-synthetic routes (bundle-status, custom-error-page, webroot + the upload endpoints) — every app route 404'd and a sibling bundle's cross-bundle route lookup threw hours later with a message indistinguishable from a mistyped rule; there is no prod re-hydration. The config loader now tracks whether the config-file loop resolved a REAL routing config (bundle dir or shared-config complement; env-versioned `routing.<env>.json` variants ride their base file's iteration, so an env-only file still refuses — it never loaded anyway) and otherwise fails the boot with an error naming the bundle + environment; an EXTERNAL supervisor restart (an orchestrator liveness/restart, a container restart policy such as restart=always, an init system) then retries until the release tree settles, so a mid-deploy race self-heals — gina's own daemon does NOT retry a startup crash: it reports `crashed during startup` once and stops, so a bare `gina bundle:start` deployment is fail-stop until a manual restart. BEHAVIOR CHANGE: a deployment that relied on the silent half-boot must fix its release artifact. The `RoutingHelper::getRouting` not-found throw keeps its historical prefix and appends `(bundle <name> holds N rules)`, so a degraded or near-empty table is tellable from a plain mistyped rule — browser bundle included (dist rebuilt).
+
+261. **FormValidator autocomplete interception + live-check stale-error clear (#B134/#B135/#B136).** The Safari-autocomplete keydown interception (fields with autocomplete="off" on a live-check form: preventDefault + programmatic value rebuild behind a transient readonly) now (a) bails on modifier chords — e.metaKey/e.ctrlKey returns BEFORE preventDefault so the native select-all/copy/paste/cut/undo defaults run; pre-fix Cmd+A typed the chord letter into the field and keyboard paste was dead (execCommand("paste") is inert in unprivileged web content; the whole chord-case block is commented out, incl. the undo case that wiped input back to defaultValue) — and (b) gates on REAL Safari only (/safari/i && !/chrom(e|ium)/i): every Chromium UA carries the Safari/537.36 token, so the workaround ran on Chrome/Edge/Brave where it was never intended; WebKit-on-iOS browsers (CriOS/FxiOS) stay matched by design. And (c) the live-check whole-form pass, when it turns VALID, now clears every previously-errored field' rendered error in BOTH copies (the input/checkbox/radio processEvent pass and updateSelect') instead of leaving a stale blocking-error paragraph beside the re-enabled submit trigger — the old clear branch was gated on the stored errors map being ALREADY empty and cleared only the touched field; the pass still never renders NEW errors on untouched fields. All three are browser-bundled (dist rebuilt). Tests: validator-autocomplete-interception.test.js + validator-livecheck-stale-error-clear.test.js — extracted-real-bytes execution (brace-walked handler + branch blocks, a real-UA matrix) with red-first dist pins (Closure De-Morgans the chord bail and folds the clear loop into a brace-less for-in, so minified pins target property-name shapes, never var names).
+
+262. **Merged-process cross-bundle routing clobber (#B137).** In a merged-process project (several bundles sharing ONE port — `isStandalone` stays true and one process serves the project), `Env.getConf`'s merged branch permanently reassigned the TARGET bundle's `content.routing` to the STARTING app's table (a reference assignment surviving for the process lifetime, a 2015 single-table-era fossil). Under per-bundle `rule@bundle` keying the starting app's table cannot hold a sibling's keys, so the FIRST cross-bundle getUrl both inflicted the clobber and failed: every cross-bundle link rendered the literal `404:[<METHOD>]<rule>@<bundle>` marker (the not-found message betrays it — the sibling "holds N rules" where N is the STARTING app's count), and merged-mode inbound statics dispatch (which resolves a statics-prefix-matched sibling's table through the same slot) could match requests against the wrong bundle's table. Fixed by dropping the reassignment: each bundle keeps its own table (the hostname share stays — same host:port in merged mode by definition); the merged view of all bundles' rules lives in the global `envConf.routing`. Distinct-port projects always took the clean branch and were never affected; single-bundle projects saw only a benign self-assign. Server-side only — no browser-bundle rebuild.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.5.20",
+  "version": "0.5.21",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -73,12 +73,12 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.5.20/core/gna",
+  "main": "./framework/v0.5.21/core/gna",
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
       "import": "./index.mjs",
-      "require": "./framework/v0.5.20/core/gna.js"
+      "require": "./framework/v0.5.21/core/gna.js"
     },
     "./gna": {
       "types": "./types/gna.d.ts",

package/framework/v0.5.20/VERSION

@@ -1 +0,0 @@
-0.5.20