gina 0.5.22 → 0.5.23

package/CHANGELOG.md

@@ -6,6 +6,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.23 - 2026-07-21
+### Fixed
+* Fixed `req.files[].size` under-counting on multipart uploads — the value was snapshotted while the write pipeline could still hold uncounted chunks, so it came up short by a varying whole-chunk amount (file bytes on disk were always intact; only the reported number was wrong). The count is now finalized once the last chunk has been counted — strictly before the request resumes — so `req.files[].size`, and anything persisting it (e.g. via `self.store()`), reflects the exact stored byte size.
+* Fixed a multipart upload hang: a request with two or more file parts never resumed when an early small file finished writing while a later large part was still streaming — the request produced no response and no log line until a client or front-proxy timeout (#B143). The per-stream completion listeners were attached only after the whole body was parsed, and an already-finished stream's event is never replayed; they now arm at stream creation and the request resumes once the parse AND every write stream have completed, whichever lands last. A write error during streaming (missing directory, disk full) now gets a guarded 500 instead of crashing the bundle. Single-file uploads were unaffected.
+* Fixed the stale-release banner (`server.releaseWatch`) not being injected by the async template-loader render delegates — a bundle using `settings.template.<engine>.loader` during a local production rehearsal got the `/_gina/release/*` endpoints and SSE but no in-page banner. Both async delegates (swig + nunjucks) now splice the banner onto the finalized HTML exactly like the sync delegates, including the CSP nonce when `useNonce` is active.
+
 ## 0.5.22 - 2026-07-21
 ### Added
 * The `settings.i18n.cultures` allowlist is now honoured: a non-empty array constrains which cultures the user-signal negotiation steps (URL prefix, cookie, Accept-Language) may match — e.g. a staged rollout keeps a shipped-but-unlaunched catalog out of negotiation. `null` or `[]` keep the historical derive-from-loaded-catalogs behavior, and the bundle-default step (`settings.region.culture`) is never constrained. The whole `i18n` block (cookieName, devMissingKey, fallbackChain, cultures) is now declared in the published settings.json schema. Restart to apply.

package/README.md

@@ -59,16 +59,11 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.5.22
-
-- **Fixed — multipart binary uploads arrive byte-identical.** Binary file payloads uploaded via native multipart (`FormData`, `curl -F`, hand-built bodies) were string-decoded on their way to disk, so any content that is not valid UTF-8 — images, PDFs, archives — arrived mangled and mis-sized. Pure-ASCII payloads were unaffected, which is what hid the corruption. The request stream now stays raw for multipart bodies and the per-file write pipeline passes chunks through verbatim, so files reach `req.files[].path` byte-identical and `req.files[].size` reports the real on-disk byte count instead of a decoded character count. If you base64-encode binaries over JSON to work around this, you can retire that workaround. Server-side — restart your bundles. (#B103)
-- **Fixed — link HTML callbacks (`data-gina-link-event-on-*`) work, and no longer break the link.** Carrying `data-gina-link-event-on-success` or `data-gina-link-event-on-error` on a `data-gina-link` anchor made every click throw before the XHR was even opened: no request left the page, no callback ran, and the link was effectively dead. Three defects were fixed together — the registration helper was trapped inside another function's scope, the call site passed no type, and the internal success/error events were named and targeted inconsistently between registration and dispatch. Name a `window`-level function (bare identifier, no parentheses) and it now receives `(event, result)`. The programmatic `gina.link.on('success'/'error')` channel is unchanged. Browser-bundled — rebuild your bundles. (#B141)
-- **Fixed — reopening a popin no longer renders the previous open's content.** The AJAX popin content cache outlived the open it warmed, so every open after the first paid for a network fetch yet rendered the body fetched around the *previous* open — a one-generation lag that showed a stale snapshot whenever the content changed between opens. The cache entry now dies with the open it warmed, and a trigger annotated `data-gina-dialog-preload="false"` additionally skips the cache read at open, making `"false"` a hard always-refetch guarantee. Costs at most one extra idempotent GET per close on default triggers. Browser-bundled — rebuild your bundles. (#B139)
-- **Fixed — FormValidator: numbered `is<N>` rules, a hung submit, and the checkbox migration warnings.** Numbered `is` aliases no longer collapse onto the bare `is` error key when validation re-applies rules against the same form (a `_case_` re-evaluation, nested field groups) — each keeps its own distinct key and each message renders once, instead of the last-declared rule's message rendering twice (#B138). A `query` rule's async result path is now blanket-guarded, so a throw while handling a backend result — an unbound form, a malformed body, a boolean checkbox value — warns and releases the pass instead of hanging the submit forever (#B87). And the #49 checkbox migration warnings now name the payload-only remedy (remove the `value` attribute — a boolean-classified checkbox posts its live checked state either way) and can be silenced per form with an explicit `data-gina-form-checkbox-value-as-state` declaration (#B125). Browser-bundled — rebuild your bundles.
-- **Fixed — `page.view.locale` carries the real country record.** The per-request country-locale lookup filtered the region data on a key it has never carried, so the object had always been empty when the culture carried a country code — and an arbitrary first record when it did not. Templates now receive the real record (`countryName`, `currency`, `capital`, …) resolved from the request culture's country code, with lowercase country segments normalized and a country-less culture yielding an explicit empty object. Nothing read the broken object before, so no existing template changes behavior. (#B101)
-- **Fixed — install no longer dies on a redactor-matched npm prefix.** `npm install -g gina` failed whenever the effective npm prefix contained a path segment npm's redactor masks — a UUID-shaped directory is enough (CI sandboxes, generated workspaces): `npm config get prefix` refuses such a read as protected on every current npm generation (10/11/12), and both install scripts ran that probe unguarded. The probe is now guarded, falling back to the prefix npm itself exports to the install lifecycle. The fix ships inside the tarball, so it applies from this version's install onward. (#B126)
-- **Added — the `settings.i18n.cultures` allowlist is honoured.** A non-empty array under `settings.json > i18n` now constrains which cultures the user-signal negotiation steps (URL prefix, cookie, `Accept-Language`) may match, so a staged rollout can ship a `locales/de.json` catalog without `de` becoming reachable until it is listed. `null` or `[]` keep the historical derive-from-loaded-catalogs behavior, and the bundle default (`settings.region.culture`) is never constrained. The whole `i18n` block is now declared in the published settings.json schema. Restart to apply.
-- **Changed — runtime pins moved to the standard `engines` manifest key.** The floors (Node `>= 22 <27`, Bun `>= 1.2`) were declared under a non-standard singular `engine` key that npm and Bun tooling ignore entirely, so unsupported runtimes got no install-time warning at all. They now activate npm's standard `EBADENGINE` warning — a hard failure only where `engine-strict` is set. Scaffolded project manifests — the `project:add` template and the install-time fallback `package.json` — carry the standard object-form key too.
+## What's in 0.5.23
+
+- **Fixed — `req.files[].size` reports the exact stored byte count on multipart uploads.** The size was snapshotted while the write pipeline could still hold chunks it had not yet counted, so it came back short by a varying whole-chunk amount — the file bytes on disk were always intact and complete, only the reported number was wrong. The count is now finalized once the last chunk has been counted, strictly before the request resumes, so `req.files[].size` — and anything that persists it, e.g. the `self.store()` result's `size` — reflects the real on-disk byte size. Server-side — restart your bundles. (#B142)
+- **Fixed — a multi-file multipart upload no longer hangs.** A request carrying two or more file parts never resumed when an early small file finished writing while a later, larger part was still streaming: the request produced no response and no log line until a client or front-proxy timeout. The per-stream completion listeners were attached only after the whole body was parsed, and a stream that had already finished never re-emits its completion event — so the early finisher's completion was lost and the request stalled forever (slow client connections hit this deterministically, fast ones intermittently). They now arm the moment each file stream is created, and the request resumes once the parse and every file write have both completed, in any order. A write error during streaming — a missing upload directory, a full disk — now answers a guarded 500 instead of crashing the bundle. Single-file uploads were never affected. Server-side — restart your bundles. (#B143)
+- **Fixed — the stale-release banner is injected on bundles using a custom async template loader.** A bundle configured with an async template loader (`settings.template.<engine>.loader`) doing a local production rehearsal with `server.releaseWatch` enabled got the `/_gina/release/*` endpoints and the SSE event stream but no in-page banner — the client banner was spliced in only on the synchronous render paths. Both async render delegates (swig and nunjucks) now inject the banner onto the finalized HTML exactly like the synchronous delegates, carrying the per-request CSP nonce when `useNonce` is active. The injector is unchanged and stays byte-inert on any request outside the release-watch gate. Server-side — restart your bundles. (#RWATCH)
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -47,6 +47,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.20` ✅ | **Fixed**: region locale data — the generator now emits one standalone file per language with localized country names (a `fr` culture renders `Allemagne` / `États-Unis` / `Royaume-Uni` through the same `getLocales().getCountries()` path, no app changes; rows without an ISO 3166 alpha-2 code are dropped; read once at boot, so restart to pick up), and `getCountries(code)` honors its projection argument — adding the requested field while the four historical fields stay untouched, an empty locale set degrading to an empty list instead of throwing (#50) · **Fixed**: FormValidator — numbered `is` rules (`is1`, `is2`, …) now install and enforce on client and server (previously silently skipped; **sweep rule JSONs before upgrading — forms may begin 422ing**), each alias keying its error distinctly and server-side `$`-cross-field rules no longer crashing; injected/popin forms resolve `data-gina-form-rule` so live checking activates; boolean `_case_` conditions match live (#B127/#B128/#B129) · **Changed**: multipart parsing uses `@rhinostone/busboy` installed from npm instead of a patched vendored copy — a strict superset of upstream busboy 1.6.0, upload behaviour and the wire format unchanged, pickup is the version plus a bundle restart |
 | **Q3 2026** | `0.5.21` ✅ | **Security**: server-side error responses no longer serialize stack traces to HTTP clients outside local scope — the responder logs the full stack server-side and ships the message line only (JSON bodies, the inline HTML fallback, custom-error-page data; local scope keeps the development-toolbar stack) · **Changed**: a bundle whose `config/routing.json` is missing at boot now refuses to start with an error naming the bundle and environment (previously a silent half-boot with only the framework-synthetic routes; an external supervisor's restart retries until the release tree settles — the daemon itself is fail-stop), and the route-lookup not-found error names the bundle and its rule count · **Fixed**: FormValidator — modifier chords (Cmd/Ctrl+A/C/V/X/Z) run their native defaults again on `autocomplete="off"` live-check fields, the Safari-autocomplete interception gates on real Safari only (Chromium UAs no longer intercepted), and a whole-form live-check pass that turns valid clears every previously-errored field's message (#B134/#B135/#B136) · **Fixed**: merged-process (same-port multi-bundle) projects — the first cross-bundle getUrl no longer permanently replaces the target bundle's routing table with the starting app's, which rendered every cross-bundle link as a literal `404:[…]` marker; distinct-port projects were never affected (#B137) · **Fixed**: CSP `useNonce` on cache-enabled routes — the header and inline-bootstrap nonces now match and rotate per response, on cache hits and misses alike · **Fixed**: the env template's hardcoded `accept-language` response header is gone (a request header, wrongly emitted on every response) · **Added**: popin eager preload — `data-gina-dialog-preload="eager"` warms a popin's AJAX content at browser idle after window load, same safety gates as the hover/focus warm, skipped under Save-Data |
 | **Q3 2026** | `0.5.22` ✅ | **Fixed**: multipart binary uploads arrive byte-identical — file payloads are no longer string-decoded on their way to disk, so images, PDFs and archives stop arriving mangled and mis-sized (pure-ASCII payloads were unaffected, which is what hid it), and `req.files[].size` reports the real on-disk byte count (#B103) · link HTML callbacks work and no longer break the link — `data-gina-link-event-on-success` / `-on-error` used to make every click throw before the request was opened, leaving a dead link; both attributes now fire a `window`-level function with `(event, result)`, the programmatic `gina.link.on()` channel unchanged (#B141) · reopening an AJAX popin renders current content instead of the previous open's — the content cache now dies with the open it warmed, and `data-gina-dialog-preload="false"` becomes a hard always-refetch guarantee (#B139) · FormValidator — numbered `is<N>` rules keep their distinct error keys on re-validation instead of collapsing onto a doubled bare `is` (#B138), a `query` rule failure can no longer hang the submit pass (#B87), and the #49 checkbox migration warnings name the payload-only remedy and can be silenced per form (#B125) · `page.view.locale` carries the real country record instead of an empty object (#B101) · `npm install -g gina` no longer dies when the effective npm prefix contains a path segment npm's redactor masks (#B126) · **Added**: the `settings.i18n.cultures` allowlist is honoured — a non-empty array constrains which cultures the user-signal negotiation steps may match, so a shipped-but-unlaunched catalog stays unreachable until listed; the whole `i18n` block is now in the published schema · **Changed**: runtime pins moved to the standard `engines` manifest key, so unsupported runtimes finally get npm's `EBADENGINE` warning |
+| **Q3 2026** | `0.5.23` ✅ | **Fixed**: multipart `req.files[].size` now reports the exact stored byte count — the value was snapshotted before the write pipeline finished counting, coming up a varying whole-chunk short (file bytes on disk were always intact); it is finalized before the request resumes, so `self.store()` and any persister see the real size (#B142) · a multi-file multipart upload no longer hangs when an early small file finishes while a later large part is still streaming — the per-stream completion listeners now arm at creation (an already-finished stream's event never replays), and a mid-stream write error answers a guarded 500 instead of crashing the bundle; single-file uploads were unaffected (#B143) · the stale-release banner (`server.releaseWatch`) is now injected by the async template-loader render delegates too — a bundle on a custom async loader got the `/_gina/release/*` endpoints and SSE but no in-page banner; both async delegates (swig / nunjucks) now splice it onto the finalized HTML like the sync paths, CSP-nonce-aware, byte-inert outside the gate (#RWATCH) |
 | **Q4 2026** | `0.6.0` | Security & compliance controls (technical safeguards mapping to PCI-DSS / SOC2 / HIPAA) |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |

package/framework/v0.5.23/VERSION

@@ -0,0 +1 @@
+0.5.23

package/framework/{v0.5.22 → v0.5.23}/core/controller/controller.render-nunjucks-async.js

@@ -64,7 +64,9 @@
  * adapter + gina filter registration + render + HTTP/1.1 & HTTP/2 send + post-
  * render asset injection (the gina client bundle / CSS / JS via injectAssets()
  * plus the gina-bootstrap whisper pass) + error-interception, so an off-disk
- * full page ships the client runtime and is production-usable. Deferred to a
+ * full page ships the client runtime and is production-usable. The #RWATCH
+ * stale-release banner is spliced onto the finalized HTML too (sync-delegate
+ * parity; self-gated, see release-banner.js). Deferred to a
  * follow-up slice (mirroring the swig-async deferral, all present in the sync
  * render-nunjucks.js to port later): Inspector dev-payload, the bundle
  * `controllers/setup.js` `this.engine` filter hook (registerUserFilters — the
@@ -85,6 +87,11 @@ const merge      = libRef.merge;
 // layout (isWithoutLayout XHR/popin responses), mirroring render-nunjucks.js /
 // render-swig.js.
 const Collection = libRef.Collection;
+// #RWATCH S3 — stale-release banner injector (shared standalone module; the
+// call self-gates on local scope + !dev + server.releaseWatch.enabled).
+// Sibling-file require, cache-hit-deduped across dev evictions — the same
+// shape the sync delegates use (render-swig.js:14 / render-nunjucks.js:129).
+const releaseBanner = require('./release-banner');
 
 /**
  * Lazily construct the process-wide render-context AsyncLocalStorage, parked on
@@ -789,6 +796,14 @@ module.exports = async function renderNunjucksAsync(userData, displayInspector,
         try { console.warn('[render-nunjucks-async] ginaLoader whisper substitution skipped: ' + (whisperErr.message || whisperErr)); } catch (e) {}
     }
 
+    // #RWATCH S3 — stale-release banner on the finalized HTML (parity with the
+    // sync delegates): after the whisper pass, before send. Self-gated in
+    // release-banner.js — byte-inert unless local scope + !dev +
+    // server.releaseWatch.enabled; skipped for partials (no </body> anchor)
+    // and already-bannered HTML (MARKER double-injection guard).
+    var _cspNonceAttr = _cspNonce ? (' nonce="' + _cspNonce + '"') : '';
+    html = releaseBanner.maybeInject(html, localOptions.conf, _cspNonceAttr);
+
     // A concurrent throwError may have sent headers while we awaited — re-check.
     if (headersSent && headersSent()) { return; }
 

package/framework/{v0.5.22 → v0.5.23}/core/controller/controller.render-swig-async.js

@@ -27,7 +27,9 @@
  * filter registration + render + HTTP/1.1 & HTTP/2 send + post-render asset
  * injection — the gina client bundle / CSS / JS are injected via injectAssets()
  * plus the gina-bootstrap whisper pass, mirroring render-nunjucks.js, so an
- * off-disk full page ships the client runtime and is production-usable.
+ * off-disk full page ships the client runtime and is production-usable. The
+ * #RWATCH stale-release banner is spliced onto the finalized HTML too
+ * (sync-delegate parity; self-gated, see release-banner.js).
  * Deferred to follow-up slices (mirroring the render-nunjucks N2 -> #NJ
  * build-out): Inspector dev-payload, static HTML cache writes, error-template
  * routing, and Early Hints.
@@ -48,6 +50,11 @@ const merge  = libRef.merge;
 // render-swig.js. Fetched via the lib registry so dev-mode hot-reload evictions
 // of lib/index.js don't poison the reference across requests.
 const Collection = libRef.Collection;
+// #RWATCH S3 — stale-release banner injector (shared standalone module; the
+// call self-gates on local scope + !dev + server.releaseWatch.enabled).
+// Sibling-file require, cache-hit-deduped across dev evictions — the same
+// shape the sync delegates use (render-swig.js:14 / render-nunjucks.js:129).
+const releaseBanner = require('./release-banner');
 
 /**
  * Lazily construct the process-wide render-context AsyncLocalStorage, parked on
@@ -665,6 +672,14 @@ module.exports = async function renderSwigAsync(userData, displayInspector, errO
         try { console.warn('[render-swig-async] ginaLoader whisper substitution skipped: ' + (whisperErr.message || whisperErr)); } catch (e) {}
     }
 
+    // #RWATCH S3 — stale-release banner on the finalized HTML (parity with the
+    // sync delegates): after the whisper pass, before send. Self-gated in
+    // release-banner.js — byte-inert unless local scope + !dev +
+    // server.releaseWatch.enabled; skipped for partials (no </body> anchor)
+    // and already-bannered HTML (MARKER double-injection guard).
+    var _cspNonceAttr = _cspNonce ? (' nonce="' + _cspNonce + '"') : '';
+    html = releaseBanner.maybeInject(html, localOptions.conf, _cspNonceAttr);
+
     // A concurrent throwError may have sent headers while we awaited — re-check.
     if (headersSent && headersSent()) { return; }
 

package/framework/{v0.5.22 → v0.5.23}/core/server.js

@@ -4370,7 +4370,14 @@ function Server(options) {
                         , fileCount     = 0
                         , tmpFilename   = null
                         , writeStreams  = []
-                        , index         = 0;
+                        , index         = 0
+                        // #B143 — write streams created but not yet closed. Incremented at
+                        // stream creation in the 'file' handler, decremented by each
+                        // stream's close callback (armed at creation, see below).
+                        , pending       = 0
+                        // #B143 — set once busboy has parsed the whole body. Resume fires
+                        // only when busboyDone && pending === 0, whichever event lands last.
+                        , busboyDone    = false;
 
                     request.files = [];
                     request.routing = {
@@ -4476,6 +4483,11 @@ function Server(options) {
                         var group    = ( info.dispositionParams ) ? info.dispositionParams.group : undefined;
 
                         file._dataLen = 0;
+                        // #B142 — this part's request.files record, captured at the
+                        // source's 'end' and size-finalized in liner._flush (below the
+                        // pipe): at 'end' time the liner can still hold queued chunks
+                        // the byte counter has not seen.
+                        var fileRecord;
                         ++fileCount;
 
                         // #B51 (2026-06-16) — enforce the global maxFields file-count cap. It was
@@ -4567,10 +4579,12 @@ function Server(options) {
                         // #B49 (2026-06-16) — per-group `path` overrides the global uploadDir;
                         // fall back to the global dir when the group declares no path. The
                         // configured defaults resolve to dirs that exist (os.tmpdir() always;
-                        // <project>/tmp is created at boot), but a CUSTOM dir may not exist yet —
-                        // and the writeStream 'error' handler is only attached later, in the
-                        // busboy 'finish' loop, so a missing dir would emit an unhandled ENOENT
-                        // here (during streaming) and crash the bundle. mkdir-if-missing guards it.
+                        // <project>/tmp is created at boot), but a CUSTOM dir may not exist yet.
+                        // mkdir-if-missing prevents the write error entirely; since #B143 the
+                        // writeStream 'error' handler is also armed at stream creation (below),
+                        // so a missing dir would now get a guarded 500 instead of the historical
+                        // unhandled-ENOENT crash (the handler used to attach only in the busboy
+                        // 'finish' loop, after the whole body was parsed).
                         var fileUploadDir = ( opt.groups[fileGroup] && opt.groups[fileGroup].path )
                             ? opt.groups[fileGroup].path
                             : uploadDir;
@@ -4580,6 +4594,38 @@ function Server(options) {
 
                         // creating file
                         writeStreams[index] = fs.createWriteStream( _(fileUploadDir + '/' + filename) );
+                        // #B143 (2026-07-21) — arm the write stream's terminal listeners AT
+                        // CREATION, not in a busboy 'finish' loop. The historical late attach
+                        // lost a race: an early small part's write stream emits 'finish' in
+                        // ~ms while a later large part is still streaming, and Node never
+                        // replays 'finish' for a late listener — that stream's decrement
+                        // never ran, the count never reached 0, and the request hung forever
+                        // (no log line; only a client/front-proxy timeout severed it).
+                        // Attaching here closes the race for every ordering, and gives a
+                        // write error DURING streaming (ENOENT/EIO/disk-full) a handler —
+                        // previously an unhandled 'error' → uncaughtException → SIGTERM.
+                        // An errored stream never emits 'finish', so it never decrements:
+                        // the request stays terminal at the 500 (the pre-#B143 semantics).
+                        ++pending;
+                        writeStreams[index].on('error', function(err) {
+                            console.error('[ busboy ] [ onWriteError ]', err);
+                            throwError(response, 500, 'Internal server error\n' + err, next);
+                            this.close();
+                            return;
+                        });
+                        writeStreams[index].on('finish', function() {
+                            this.close( function onUploaded(){
+                                --pending;
+                                console.debug('closing writestreams : ' + pending);
+
+                                // #B143 — exactly-once by arithmetic: busboy emits no
+                                // 'file' after 'finish', so once busboyDone is set the
+                                // counter can only drain; the LAST close callback resumes.
+                                if (busboyDone && pending === 0) {
+                                    resumeAfterMultipart();
+                                }
+                            })
+                        });
                         var liner = new require('stream').Transform({objectMode: true});
 
                         liner._transform = function (chunk, encoding, done) {
@@ -4602,13 +4648,30 @@ function Server(options) {
                             done()
                         }
 
-                    //     liner._flush = function (done) {
-                    //         done()
-                    //     }
-
                         file.pipe(liner).pipe(writeStreams[index]);
                         ++index;
 
+                        // #B142 (2026-07-21) — finalize req.files[].size once the LAST
+                        // _transform has counted its chunk. Ordering guarantees (probe-
+                        // measured): _flush completes strictly BEFORE the write stream can
+                        // emit 'finish', and the request only resumes (resumeAfterMultipart)
+                        // after every write stream finished — so the patched size is final
+                        // before any consumer (incl. the controller's store()) reads
+                        // request.files. On a settled pipeline _flush can run BEFORE the
+                        // source's 'end' listener; fileRecord is then still undefined here,
+                        // and the push at 'end' reads the already-complete count — both
+                        // interleavings yield the exact byte size. Assigned AFTER the pipe
+                        // on purpose: the Transform only consults _flush at end-of-input,
+                        // and the sibling suite slices the _transform block up to the pipe
+                        // call. (Supersedes the long-commented _flush stub that sat above
+                        // the pipe since the original implementation.)
+                        liner._flush = function (done) {
+                            if ( fileRecord ) {
+                                fileRecord.size = file._dataLen;
+                            }
+                            done()
+                        };
+
 
                         file.on('end', function() {
 
@@ -4619,7 +4682,16 @@ function Server(options) {
                             // above (file.on('end') closes over the same per-file fileUploadDir).
                             tmpFilename = _(fileUploadDir + '/' + filename);
 
-                            request.files.push({
+                            // #B142 (2026-07-21) — size here is PROVISIONAL: 'end' fires on
+                            // the SOURCE stream while the liner Transform downstream can
+                            // still hold queued chunks the byte counter has not seen
+                            // (measured live: a 1.5MB upload reported ~25% short).
+                            // liner._flush finalizes it. The push itself stays HERE: busboy
+                            // emits parts sequentially, so pushing at the source's 'end'
+                            // preserves part order in request.files — flush completion
+                            // order can invert across parts when an earlier part's sink
+                            // drains slower.
+                            fileRecord = {
                                 name: fieldname,
                                 group: group,
                                 originalFilename: filename,
@@ -4627,7 +4699,8 @@ function Server(options) {
                                 type: mimetype,
                                 size: this._dataLen,
                                 path: tmpFilename
-                            });
+                            };
+                            request.files.push(fileRecord);
 
                             // /tmp autoTmpCleanupTimeout
                             if (autoTmpCleanupTimeout) {
@@ -4690,38 +4763,22 @@ function Server(options) {
                                 request[_fieldsMethod] = multipartFields;
                             }
                         }
-                        var total = writeStreams.length;
-
-                        // #B93 — a fields-only multipart body (zero file parts) creates no
-                        // write streams, so the loop below runs zero times and the lifecycle
-                        // continuation never fired: the request hung until a front-proxy
-                        // timeout severed it. Resume directly. (Text fields, dropped when
-                        // #B93 shipped, are captured since #B92-adjacent — see the 'field'
-                        // handler and the assignment above.)
-                        if (total === 0) {
+                        // #B143 — the whole body is parsed; from here the per-stream close
+                        // callbacks (armed at stream creation in the 'file' handler, where
+                        // the historical attach loop that lost the early-finisher race used
+                        // to live) are allowed to resume the request.
+                        busboyDone = true;
+
+                        // #B93 + #B143 — zero streams still pending covers BOTH terminals:
+                        // a fields-only body created no write stream at all (#B93 — this
+                        // branch is what un-hung it), and a multi-file body whose every
+                        // write stream already finished and closed while later parts were
+                        // still being parsed (#B143). Resume directly; otherwise the LAST
+                        // close callback resumes (busboyDone && pending === 0). (Text
+                        // fields, dropped when #B93 shipped, are captured since
+                        // #B92-adjacent — see the 'field' handler and the assignment above.)
+                        if (pending === 0) {
                             resumeAfterMultipart();
-                            return;
-                        }
-
-                        for (var ws = 0, wsLen = writeStreams.length; ws < wsLen; ++ws ) {
-
-                            writeStreams[ws].on('error', function(err) {
-                                console.error('[ busboy ] [ onWriteError ]', err);
-                                throwError(response, 500, 'Internal server error\n' + err, next);
-                                this.close();
-                                return;
-                            });
-
-                            writeStreams[ws].on('finish', function() {
-                                this.close( function onUploaded(){
-                                    --total;
-                                    console.debug('closing writestreams : ' + total);
-
-                                    if (total == 0) {
-                                        resumeAfterMultipart();
-                                    }
-                                })
-                            });
                         }
                     });
 

package/framework/{v0.5.22 → v0.5.23}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.5.22",
+  "version": "0.5.23",
   "dependencies": {
     "@rhinostone/busboy": "^1.6.1",
     "@rhinostone/swig": "^2.7.2",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.5.22/core/gna');
+var _gna = require('./framework/v0.5.23/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.5.22/core/controller');
-var EntitySuper     = require('./framework/v0.5.22/core/model/entity');
+var SuperController = require('./framework/v0.5.23/core/controller');
+var EntitySuper     = require('./framework/v0.5.23/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.5.22/lib/uuid');
+var uuid = require('./framework/v0.5.23/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -984,7 +984,7 @@ Dev-mode query instrumentation captures every database query tied to the current
 
 247. **Published TypeScript declarations repaired + the two-part types gate (#DTO3b, 0.5.18-alpha.2): a `tsc` pass proves declarations are well-FORMED, never that they are TRUE.** The shipped `types/*.d.ts` compiled clean at strict while wrong 15 ways — the headline: `types/index.d.ts` declared NO value, so `import gina from 'gina'; gina.lib` was a type error for every consumer; plus silent lies that typecheck then crash at runtime (`Gna extends EventEmitter` on a plain object literal; `String.prototype.ltrim/rtrim/gtrim` pure fiction; `export class SuperController` for a constructor the main entry never exports — the constructors live on `require('gina/gna')`). The repair shape is namespace-as-module — `declare namespace gina { ... } export = gina` — the only shape describing BOTH `import gina = require('gina')` (the primary CJS form) and the ESM default import: `export default` alone half-fixes, `export =` cannot coexist with sibling `export type/class` statements nor merge with a `declare const`, so every public type moves INSIDE the namespace and the constructors demote to `SuperControllerConstructor`/`EntitySuperConstructor` interfaces. Ambient-namespace `const` members cannot be optional — conditionally-assigned members (`gina.getConfig`, which only exists once models have loaded; the proxy host quartet) are typed `| undefined` to force narrowing. The route-DTO payoff rides along: `GinaRequest<TDto>` types `req.dto` (strict projection) and the method payloads as `TDto & Record<string, any>` (the intersection PRESERVES declared field types while URL params stay reachable), and `RouteParam` gains `dto`/`responseDto`. The gate is two-part because a compile catches neither lie class: (a) `script/check_types_consumer.js` compiles a consumer fixture BY PACKAGE NAME through the exports map (`moduleResolution: node16`; a by-path probe is structurally blind to a missing `export =`) with `skipLibCheck: false` (with `true`, a deliberately-garbage `.d.ts` reports clean), `@ts-expect-error` tripwires that fail the build if a removed lie returns, and a MUST-FAIL control program whose TS2339+TS2304 prove the instrument can fire; (b) `test/lib/types-runtime-parity.test.js` reflects the real runtime — the framework lib registry keys, a real `createTestInstance()` instance, the UNANCHORED `gna.<name> =` source enumeration (a line-anchored variant missed 22 indented members, `onInitialize` included), and the injected-globals diff — and diffs it two-way against the declarations, every deliberate exception carrying its reason inline (e.g. the injected `paths` global is an accidental sloppy-mode leak and stays deliberately UNdeclared). Wired as `npm run types:check` + a `Check published types` CI step; devDeps `typescript@^7.0.2` + `@types/node@^26.1.1`.
 
-248. **Stale built-release watch — `server.releaseWatch` (#RWATCH, 0.5.18-alpha.2).** A bundle serving a BUILT release under `local` scope + a non-dev env runs full prod mode (no `refreshCore`, no dev watcher, render cache ON), so after you edit source it silently keeps serving the stale build — dev-env hot-reloads, a local production rehearsal had nothing. Opt in via `settings.json` `server.releaseWatch { enabled:false, mode:"notify"|"auto", restartMode:"daemon"|"supervisor", debounceMs:750, reconcileIntervalMs:0 }` — inside the `server` block ⇒ flows to `conf.server.releaseWatch` with ZERO config.js changes (the `server.hidePoweredBy` precedent, not the top-level-fold the cache key needed). **Hard-gated THREE ways, all mandatory + fail-closed:** `NODE_SCOPE_IS_LOCAL==='true'` (never active on a real cluster regardless of config) · `!isDev` (`NODE_ENV_IS_DEV!=='true'`, built-release only) · `enabled===true` (a truthy-but-not-`===true` value — e.g. the string `"true"` — WARNS and stays off). Module `lib/release-watch`, **plain-require** in lib/index.js so its fs.watch handles + busy-probe registry + in-flight gauge survive dev `refreshCore()` (the job/instrument/State precedent). **Fingerprint = `fpSpec:1`** (sha1 over sorted `relpath|size|floor(mtimeMs)` of the bundle SOURCE tree; ignores node_modules/.git/.DS_Store/logs/tmp), stamped at build START into the existing `<project>/manifest.json` `releases[defaultScope][env].{fingerprint,builtAt,fpSpec}` by BOTH build verbs (`bundle:build` + `project:build`; non-fatal try/catch, defaultScope-only, records-that-exist-only) — zero new artifacts; a missing stamp reads `stampUnknown`, never a false alarm. **⚠ Watch events are TRIGGERS ONLY; the fingerprint-vs-stamp compare is the staleness VERDICT** — on macOS the first FSEvents stream in a process can take seconds to go live AND replays writes made just before it started, so flipping stale straight off an event would fabricate staleness from replayed pre-boot writes; the batch handler re-runs `fingerprintTree(srcRoot)` and compares against the stamp (also converges spurious/duplicate events + the reconcile sweep on one truth source). srcRoot = `projectRoot + manifest.bundles[b].src` (gna.js:564 shape — prod `bundlePath` is the RELEASE dir, so the watch root MUST come from the manifest src). **Dual-axis staleness:** `srcStale` = fingerprint(src)≠stamp · `processBehind` = the release moved past the boot identity in a restart-owed way (NOT bare stamp inequality — an assets-only rebuild moves the release fingerprint without owing a restart). **Classification:** `public/**` ⇒ `assets` (build-only — prod statics resolve from the RELEASE tree, so a rebuild refreshes the served bytes with NO restart, measured); everything else + unknown/null-filename ⇒ `restart` (fail-safe over-restart). **Endpoints** (raw-URL pre-router dispatch, `^`-anchored, admin-gated via `lib.admin.isClientAllowed` → canonical 403, contract-IDENTICAL on BOTH engines): `GET /_gina/release/status` (JSON `getStatus()` — dual-axis + `severity`/`changes`/`action`/`restartMode`; bare path, query-string rejected) · `POST /_gina/release/rebuild?restart=auto|skip|force` (default `auto`; `skip` = build+flush no restart; `force` on an already-`waiting` gate opens it NOW via `forceRestartGate` — the stuck-idle escape hatch; **409** on a busy pipeline; an unrecognised `?restart=` value silently falls back to `auto`) · `GET /_gina/release/events` (`text/event-stream` SSE, `:ok` + an initial `status` frame, `{type,data,at}` envelopes over 9 event types status/stale/behind/build/waiting/flushed/restarting/done/error, registers in `process.gina._sseConnections`, `_sseClose`-idiom teardown). **Rebuild pipeline (SSE-observable):** build child (`spawn gina bundle:build`, watcher paused, post-build re-fingerprint RE-CLASSIFIES — a paused-watcher resume swallows during-build edits, so detection-only would strand a poisoned severity → the NEXT rebuild adopts it `assetsOnlyKnown` = silent stale server code; unclassifiable drift ⇒ restart-class) → in-process render-cache flush (`new lib.RenderCache().from(instance._cached).clear(bundle)` — reaches L1 + the redis L2 process-singleton on `process.gina._renderCacheStore`; the `swig:` template cache dies with the process) → assets-done | skip | idle gate → restart. **In-flight gauge** (`trackRequest(url)→idempotent done()` on `finish`+`close`, once-latched) EXCLUDES `/_gina/*` — an open SSE never fires `finish` and would deadlock the idle gate; and is **first-seer-guarded** (`request._rwTracked`) because under isaac the engine's `server.on('request')` listener AND `onInstance` (its `cb`) both carry the hook → double-count without the guard (the same onInstance double-dispatch also double-recorded #OBS1 metrics from 0.3.11 until the same first-seer claim — `request._metricsRecorded`, plus `!request._devTimeline` on the dev timeline init — closed every both-tops hook; any NEW per-request hook wired at both dispatch tops must claim a request flag first or it double-fires under isaac). **Idle gate:** polls until the in-flight gauge==0 && every busy probe idle, held continuously for `graceMs` (2s), live `waiting` SSE + a Force escape. **Busy probes:** `gina.registerBusyProbe(name, fn)` (plain-fn export on gna, no `this` — immune to the #B109 detached-copy trap) where `fn` is a zero-arg Promise-returning `{busy,detail}` or `(cb)` callback-shaped (detected via `fn.length`); timeout(1.5s)/throw/reject ⇒ `busy:true` (fail-safe toward not killing work — Force exists). Framework auto-registers a `jobs` probe from `lib.job.stats()` (`running+queued+retryWaiting>0`), idempotent so an app override wins. **restartMode:** `daemon` (default) drains + spawns detached `gina bundle:restart` (needs the framework daemon) — a detached spawn ALWAYS needs an `'error'` listener (async ENOENT ⇒ uncaughtException→SIGTERM on the just-drained, successor-less process); `supervisor` drains + `exit(0)` for a container/orchestrator to respawn (the daemonless `gina-container` path — REQUIRES a restart-on-clean-exit policy: a k8s Deployment or `docker run --restart=always`, NOT `--restart=on-failure`), its flushed final line to `fs.writeSync(2,…)` (stderr/diagnostic — fd 1 would pollute a driving test's TAP stream; `gina-container` `stdio:'inherit'` still carries fd 2). A shared `drainHttpServer` helper (SSE closers → closeIdleConnections → `server.close` under `GINA_SHUTDOWN_TIMEOUT`, once-latched, mirrors the proc.js drain) backs both executors. **Banner (S3):** a live SSE-driven Shadow-DOM bottom bar (`:host{all:initial}`), injected server-side by render-swig + render-nunjucks via a **function-replacer** `</body>` splice (the `$`-safe defensive form, render-swig §18) BEFORE `writeCache` so it rides cache hit + miss — a STATE-AGNOSTIC scaffold baked once into the cached bytes; the client re-derives staleness at runtime, so it is correct on every cache hit where a render-time `stale`-gate could never fire (the delegate never re-runs on a hit). `cspNonce`-aware (#HDR16), own gate mirroring boot-init (`stale && local && !isDev && enabled`), double-injection guarded; **NO dist rebuild** (server-side inline, statusbar precedent — Bundle Freshness confirms). Non-HTML bundles: the log line + status endpoint are the surface. **Liveness caveat (Node 22 CI-caught):** unref STANDING timers (debounce/sweep/gate/cooldown) but keep BOUNDED in-flight deadlines ref'd — an `unref()`'d timeout that is a caller's ONLY settlement guarantee drains an otherwise-idle loop with the promise still pending; Node 24/26 mask it (the runner holds a ref). Live-confirmed end-to-end (daemon-in-isolated-home on custom framework ports): assets-edit → build-only-no-restart, code-edit → idle-gated composed self-restart (old PID drained+kill-9'd, daemon boots a fresh successor off the rebuilt release). Server/CLI-side throughout — no dist rebuild.
+248. **Stale built-release watch — `server.releaseWatch` (#RWATCH, 0.5.18-alpha.2).** A bundle serving a BUILT release under `local` scope + a non-dev env runs full prod mode (no `refreshCore`, no dev watcher, render cache ON), so after you edit source it silently keeps serving the stale build — dev-env hot-reloads, a local production rehearsal had nothing. Opt in via `settings.json` `server.releaseWatch { enabled:false, mode:"notify"|"auto", restartMode:"daemon"|"supervisor", debounceMs:750, reconcileIntervalMs:0 }` — inside the `server` block ⇒ flows to `conf.server.releaseWatch` with ZERO config.js changes (the `server.hidePoweredBy` precedent, not the top-level-fold the cache key needed). **Hard-gated THREE ways, all mandatory + fail-closed:** `NODE_SCOPE_IS_LOCAL==='true'` (never active on a real cluster regardless of config) · `!isDev` (`NODE_ENV_IS_DEV!=='true'`, built-release only) · `enabled===true` (a truthy-but-not-`===true` value — e.g. the string `"true"` — WARNS and stays off). Module `lib/release-watch`, **plain-require** in lib/index.js so its fs.watch handles + busy-probe registry + in-flight gauge survive dev `refreshCore()` (the job/instrument/State precedent). **Fingerprint = `fpSpec:1`** (sha1 over sorted `relpath|size|floor(mtimeMs)` of the bundle SOURCE tree; ignores node_modules/.git/.DS_Store/logs/tmp), stamped at build START into the existing `<project>/manifest.json` `releases[defaultScope][env].{fingerprint,builtAt,fpSpec}` by BOTH build verbs (`bundle:build` + `project:build`; non-fatal try/catch, defaultScope-only, records-that-exist-only) — zero new artifacts; a missing stamp reads `stampUnknown`, never a false alarm. **⚠ Watch events are TRIGGERS ONLY; the fingerprint-vs-stamp compare is the staleness VERDICT** — on macOS the first FSEvents stream in a process can take seconds to go live AND replays writes made just before it started, so flipping stale straight off an event would fabricate staleness from replayed pre-boot writes; the batch handler re-runs `fingerprintTree(srcRoot)` and compares against the stamp (also converges spurious/duplicate events + the reconcile sweep on one truth source). srcRoot = `projectRoot + manifest.bundles[b].src` (gna.js:564 shape — prod `bundlePath` is the RELEASE dir, so the watch root MUST come from the manifest src). **Dual-axis staleness:** `srcStale` = fingerprint(src)≠stamp · `processBehind` = the release moved past the boot identity in a restart-owed way (NOT bare stamp inequality — an assets-only rebuild moves the release fingerprint without owing a restart). **Classification:** `public/**` ⇒ `assets` (build-only — prod statics resolve from the RELEASE tree, so a rebuild refreshes the served bytes with NO restart, measured); everything else + unknown/null-filename ⇒ `restart` (fail-safe over-restart). **Endpoints** (raw-URL pre-router dispatch, `^`-anchored, admin-gated via `lib.admin.isClientAllowed` → canonical 403, contract-IDENTICAL on BOTH engines): `GET /_gina/release/status` (JSON `getStatus()` — dual-axis + `severity`/`changes`/`action`/`restartMode`; bare path, query-string rejected) · `POST /_gina/release/rebuild?restart=auto|skip|force` (default `auto`; `skip` = build+flush no restart; `force` on an already-`waiting` gate opens it NOW via `forceRestartGate` — the stuck-idle escape hatch; **409** on a busy pipeline; an unrecognised `?restart=` value silently falls back to `auto`) · `GET /_gina/release/events` (`text/event-stream` SSE, `:ok` + an initial `status` frame, `{type,data,at}` envelopes over 9 event types status/stale/behind/build/waiting/flushed/restarting/done/error, registers in `process.gina._sseConnections`, `_sseClose`-idiom teardown). **Rebuild pipeline (SSE-observable):** build child (`spawn gina bundle:build`, watcher paused, post-build re-fingerprint RE-CLASSIFIES — a paused-watcher resume swallows during-build edits, so detection-only would strand a poisoned severity → the NEXT rebuild adopts it `assetsOnlyKnown` = silent stale server code; unclassifiable drift ⇒ restart-class) → in-process render-cache flush (`new lib.RenderCache().from(instance._cached).clear(bundle)` — reaches L1 + the redis L2 process-singleton on `process.gina._renderCacheStore`; the `swig:` template cache dies with the process) → assets-done | skip | idle gate → restart. **In-flight gauge** (`trackRequest(url)→idempotent done()` on `finish`+`close`, once-latched) EXCLUDES `/_gina/*` — an open SSE never fires `finish` and would deadlock the idle gate; and is **first-seer-guarded** (`request._rwTracked`) because under isaac the engine's `server.on('request')` listener AND `onInstance` (its `cb`) both carry the hook → double-count without the guard (the same onInstance double-dispatch also double-recorded #OBS1 metrics from 0.3.11 until the same first-seer claim — `request._metricsRecorded`, plus `!request._devTimeline` on the dev timeline init — closed every both-tops hook; any NEW per-request hook wired at both dispatch tops must claim a request flag first or it double-fires under isaac). **Idle gate:** polls until the in-flight gauge==0 && every busy probe idle, held continuously for `graceMs` (2s), live `waiting` SSE + a Force escape. **Busy probes:** `gina.registerBusyProbe(name, fn)` (plain-fn export on gna, no `this` — immune to the #B109 detached-copy trap) where `fn` is a zero-arg Promise-returning `{busy,detail}` or `(cb)` callback-shaped (detected via `fn.length`); timeout(1.5s)/throw/reject ⇒ `busy:true` (fail-safe toward not killing work — Force exists). Framework auto-registers a `jobs` probe from `lib.job.stats()` (`running+queued+retryWaiting>0`), idempotent so an app override wins. **restartMode:** `daemon` (default) drains + spawns detached `gina bundle:restart` (needs the framework daemon) — a detached spawn ALWAYS needs an `'error'` listener (async ENOENT ⇒ uncaughtException→SIGTERM on the just-drained, successor-less process); `supervisor` drains + `exit(0)` for a container/orchestrator to respawn (the daemonless `gina-container` path — REQUIRES a restart-on-clean-exit policy: a k8s Deployment or `docker run --restart=always`, NOT `--restart=on-failure`), its flushed final line to `fs.writeSync(2,…)` (stderr/diagnostic — fd 1 would pollute a driving test's TAP stream; `gina-container` `stdio:'inherit'` still carries fd 2). A shared `drainHttpServer` helper (SSE closers → closeIdleConnections → `server.close` under `GINA_SHUTDOWN_TIMEOUT`, once-latched, mirrors the proc.js drain) backs both executors. **Banner (S3):** a live SSE-driven Shadow-DOM bottom bar (`:host{all:initial}`), injected server-side by render-swig + render-nunjucks via a **function-replacer** `</body>` splice (the `$`-safe defensive form, render-swig §18) BEFORE `writeCache` so it rides cache hit + miss — a STATE-AGNOSTIC scaffold baked once into the cached bytes; the client re-derives staleness at runtime, so it is correct on every cache hit where a render-time `stale`-gate could never fire (the delegate never re-runs on a hit). `cspNonce`-aware (#HDR16), own gate mirroring boot-init (`stale && local && !isDev && enabled`), double-injection guarded; **NO dist rebuild** (server-side inline, statusbar precedent — Bundle Freshness confirms). Non-HTML bundles: the log line + status endpoint are the surface. **Liveness caveat (Node 22 CI-caught):** unref STANDING timers (debounce/sweep/gate/cooldown) but keep BOUNDED in-flight deadlines ref'd — an `unref()`'d timeout that is a caller's ONLY settlement guarantee drains an otherwise-idle loop with the promise still pending; Node 24/26 mask it (the runner holds a ref). Live-confirmed end-to-end (daemon-in-isolated-home on custom framework ports): assets-edit → build-only-no-restart, code-edit → idle-gated composed self-restart (old PID drained+kill-9'd, daemon boots a fresh successor off the rebuilt release). Server/CLI-side throughout — no dist rebuild. Since 0.5.23 the banner is also injected by the async template-loader render delegates (`settings.template.<engine>.loader` bundles) — before that, an async-loader bundle got the endpoints + SSE but no in-page banner.
 
 249. **gina class model & controller authoring** — gina uses constructor functions + `inherits(Child, Parent)` throughout, NOT ES6 classes: `inherits` builds the prototype chain AND calls BOTH constructors on a fresh `this` (not `Object.create` semantics), so there is no `super()` — chain constructors with `Parent.call(this, ...)`. The router auto-wires controllers: `router.js` itself calls `inherits(Controller, SuperController)` before every dispatch (`router.js:645`; namespace routes chain the namespace controller through a MainController first), so a controller file must NEVER require SuperController or call `inherits` on itself — actions are plain `this.<action> = function(req, res, next) {…}` assignments, never `Controller.prototype.<method>`. Ordinary imports in a controller are fine and expected (`require('lib/uuid')` etc. — the bare-module NODE_PATH feature). For entity unit tests, `EntitySuper(conn, caller, injected)` accepts a third arg: pass `{ connector: mockConn, config: fn }` to override `getConnection()`/`getConfig()` with test doubles.
 
@@ -1021,3 +1021,5 @@ Dev-mode query instrumentation captures every database query tied to the current
 265. **npm refuses `config get prefix` whenever the RESOLVED VALUE trips its redactor — a UUID-shaped path segment is enough — killing any install script that probes it unguarded (#B126, fixed 2026-07-20: both gina install scripts guard the probe).** npm's `config get` gates every read on isPrivate(key, value) = protected-key OR redact(value) !== value, so a prefix like `/tmp/<uuid>/x` (CI sandboxes, generated workspace dirs) makes `npm config get prefix` exit 1 with "The prefix option is protected, and cannot be retrieved in this way" — measured on npm 10.9.8 / 11.6.2 / 11.18.0 / 12.0.1 (every current generation refuses; plain-path controls all pass), and the option's SOURCE (flag, env, npmrc) is irrelevant — only the VALUE matters. A consumer datapoint had framed this as "env-sourced protected reads, npm 11.6.2 only, 11.17 unaffected"; both axes were artifacts of WHICH PATHS each version happened to be tested with. `script/pre_install.js` and `script/post_install.js` both ran the probe unguarded at configure() start, so `npm install -g --prefix=<such-a-path> gina` died in pre_install (reproduced end-to-end in a real -g --prefix lifecycle, exact field error; fixing only one script would move the crash to the other). Fix: try/catch around the probe in BOTH scripts, falling back to the lifecycle-exported `npm_config_prefix` (npm exports the effective prefix to script children — measured present in the lifecycle env) then the node-derived default prefix (`path.resolve(process.execPath, '..', '..')`). Reusable rule: any script probing npm config must treat `npm config get <key>` as fallible — the refusal depends on the runtime VALUE, not the key list or the npm version. Install-side only — the fix ships inside the tarball, so pickup is the next cut; older tarballs cannot be retro-fixed. Tests: test/lib/pre-install-prefix-probe.test.js (probe-inside-try + fallback-chain source pins on BOTH scripts; a deterministic refusing-shim replica; the pre-fix subtract reproducing the crash).
 
 266. **The link plugin's HTML-callback attributes (`data-gina-link-event-on-success` / `data-gina-link-event-on-error`) were dead AND deadly — carrying either killed the link's XHR with an uncaught ReferenceError before xhr.open (#B141, fixed 2026-07-21).** Three stacked layers, all live-verified in a real browser render (real clicks; the attribute-less control link on the same page fetched normally both runs): (1) SCOPE — the only live `listenToXhrEvents` definition sat INSIDE `on()` in utils/events.js (a brace slip; the adjacent "Nothing can be added after on()" comment shows it was meant to follow on() as a top-level shim global like handleXhr), so link/main.js's call resolved nothing and threw; (2) ARITY — the call passed one arg, so a reachable definition would read `data-gina-undefined-event-on-*` and silently register nothing; (3) PLUMBING — handleXhr fired the `.hlink` events named by the link INSTANCE id and dispatched them on document, while registration binds the PER-LINK id on the anchor element — name and target could never match. Fix: the definition is a top-level global in utils/events.js (body byte-preserved incl. the function-call-shape refusal warn), link/main.js passes ($link, 'link') and drops its stale commented-out local copy, and the six .hlink triggers address $link.target + $link.id. Deliberately untouched: the plain programmatic channel (gina.link.on('success'/'error') — instance id + document on BOTH sides, always aligned) and the forms' .hform path (the form validator is self-contained and coherent). Registration is per-link idempotent (gina.events dedup by event name). Browser-bundled — consumers re-bake at pickup. Tests: link-xhr-events.test.js (18 — src+dist pins incl. the column-0 top-level scope invariant, extracted-real-definition behaviour incl. the one-arg pre-fix subtract, registration/trigger alignment replica incl. the instance-id-mismatch subtract; all discriminators red-first-validated against the pre-fix blobs).
+
+267. **`req.files[].size` was a racy under-count — the per-file byte counter is incremented in the liner Transform one pipe hop DOWNSTREAM, but the record was built final at the SOURCE stream's 'end', when the objectMode liner (16-OBJECT high-water marks) can still hold un-counted queued chunks (#B142, fixed 2026-07-21; surfaced by a consumer verifying the #B103 pickup — measured live 16/16 uploads short by a whole-chunk amount, ~25% on a 1.5MB file, while md5 stayed perfect: bytes on disk were always intact, only the number lied).** The fix captures the pushed record in a per-part closure var and finalizes `size` in a live `liner._flush`, with probe-measured ordering guarantees: `_flush` runs after the LAST `_transform` and strictly before the write stream can emit 'finish', and the request only resumes after every write stream finished — so the patched value is final before any consumer (incl. `self.store()`, which copies `files[i].size`) reads `request.files`. On a settled pipeline `_flush` can run BEFORE the source's 'end' listener; the push then reads the already-complete count — both interleavings yield the exact byte size (both measured). The push deliberately stays at source-'end': busboy emits parts sequentially, so that preserves `request.files` part order, while flush COMPLETION order can invert across parts. Server-side only — no dist rebuild; running bundles pick it up at restart. Sibling discovered during the same verification and FIXED as #B143 (2026-07-21): the per-writeStream 'finish'/'error' listeners attached only inside `busboy.on('finish')` — after the WHOLE body was parsed — and Node never replays 'finish' for a late listener, so an early small file whose write stream finished while a later large part was still streaming lost the listener race and the request never resumed (measured live: a throttled two-file upload hung deterministically, no log line; unthrottled ~1 in 13 — fast clients exposed, rarely; unauthenticated, both engines, single-file unaffected). Both listeners now arm AT STREAM CREATION in the 'file' handler, counted by a pending counter plus a busboyDone flag set at parse end; resume fires on busboyDone && pending === 0, whichever event lands last — closing the race for every ordering (the same zero-pending branch still covers the fields-only #B93 terminal), and a mid-stream write error (missing dir, disk full) now gets a guarded 500 instead of the historical unhandled-'error' uncaughtException SIGTERM. Live post-fix: the throttled two-file was-hang 200s with exact sizes and preserved part order; fields-only, single-file, and three-file arms all green. Server-side only — no dist rebuild; restart to apply. Tests: upload-size-accuracy.test.js (11 — red-first-validated source pins, control-gated extraction of the live _transform+_flush bytes, a stalled-sink choreography replica making the race deterministic, and a frozen pre-fix subtract) + multipart-multifile-resume.test.js (15 — red-first pins incl. loop-gone negatives, a real-Writable never-replays proof with a can-fail control, the deterministic early-finisher race replica + frozen pre-fix subtract, and a REAL busboy paced two-part drive where the early sink provably finishes before parse end).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.5.22",
+  "version": "0.5.23",
   "description": "MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -76,12 +76,12 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.5.22/core/gna",
+  "main": "./framework/v0.5.23/core/gna",
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
       "import": "./index.mjs",
-      "require": "./framework/v0.5.22/core/gna.js"
+      "require": "./framework/v0.5.23/core/gna.js"
     },
     "./gna": {
       "types": "./types/gna.d.ts",

package/framework/v0.5.22/VERSION

@@ -1 +0,0 @@
-0.5.22