gina 0.5.3-alpha.1 → 0.5.4-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,22 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.3 - 2026-06-14
+
+_Patch release — no breaking changes. Finishes the released-response crash-family hardening (a late two-/three-argument `throwError()` and the swig / nunjucks render delegates, including their async variants, no longer crash or emit unhandled rejections when invoked on an already-released response) and adds bundle-boot / startup robustness — atomic `~/.gina` state-file writes, framework command-socket hardening, protection of the framework socket port from a bundle's `--port`, and synchronous boot-failure diagnostics under piped output — plus storage `_id` collision hardening, clearer unresolved-`${secret:KEY}` diagnostics, and the new `gina port:set --force`._
+
+### Added
+* `gina port:set --force` reassigns a port already held by another bundle (the prior holder is evicted from both port maps); without `--force`, an in-use port is still rejected as before. Enables deterministic per-bundle port pinning for one-bundle-per-container deployments.
+### Fixed
+* Hardened the storage plugin's record `_id` generation against same-millisecond collisions by widening the random suffix to 16 base-62 characters, matching the collection ID convention.
+* Containerised and daemonless bundle boot failures no longer exit without a message: the gina-container launcher and the framework boot path now flush the failure reason synchronously before calling process.exit, so a crash on a piped stdout/stderr (the norm under container log collectors) surfaces its cause instead of being truncated.
+* Fixed sub-topic CLI commands (e.g. `gina port:set`, `gina bundle:start`) that were passed `--port` overwriting the framework socket port in `~/.gina/<short>/settings.json` with the bundle port. The corrupted framework port made later online commands fail with "[ gina ] not started" and prevented the bundle from binding its port. The framework-connection flags (`--port`, `--mq-port`, `--host-v4`, `--hostname`, `--debug-port`) are now applied as framework settings only for framework-scoped commands (`gina start`/`stop`/`restart`, `framework:*`); for any other command they are left for that command to interpret.
+* Hardened the framework command socket against a malformed or fragmented payload. The socket handler parsed each incoming TCP chunk as JSON directly, so a partial, empty, or non-JSON payload threw an uncaught exception that dropped the command (and could trigger a framework shutdown). Incoming command data is now accumulated per connection and parsed only once the payload is complete; a payload that is valid JSON but not the expected argument array is ignored instead of crashing.
+* When a ${secret:KEY} placeholder cannot be resolved during config load, the framework now logs the failing key name and the bundle/environment config path at debug level, so operators can pinpoint which secret is unset. Previously the load failed with a generic "Secret resolution failed" message that named neither the key nor the bundle. The propagated error message still intentionally omits the key.
+* Hardened the HTML render delegates (swig and nunjucks, including their async variants) against being invoked after the response was already released. A controller that renders again after a terminal exit — for example an action that fires several parallel self.query() calls and renders a degraded response from the first failure callback, then renders again from a later callback — no longer emits a framework-level unhandled promise rejection; the render delegates now no-op on a released response, matching renderJSON and the streaming delegate.
+* The five ~/.gina state files (main.json, projects.json, settings.json, env.json, locals.json) are now written atomically via a temp file plus rename, so a concurrent boot of many bundles or containers against the same home directory can no longer read a partially-written file and crash on startup.
+* A late `self.throwError(statusCode, error)` call — fired after the response was already sent or released (for example from an async callback that resumes after a redirect) — no longer crashes the bundle. Only the single-argument `throwError(err)` form was previously guarded; the two- and three-argument forms resolved the response reference earlier and could dereference it (on HTTP/2 bundles, or while building the error payload on any bundle) before reaching that guard. These late calls are now logged and ignored, like the single-argument form.
+
 ## 0.5.2 - 2026-06-13
 ### Fixed
 * Fixed an inter-bundle self.query() over HTTP/2 reporting an upstream 502 as success once its retries were exhausted: the 502 response body was handed to the query callback as if it were valid data (and a JSON-shaped body was even relabelled with status 200), so a caller could silently consume a Bad Gateway error page as a real response. Exhausted 502s now surface a typed error to the caller (status 502, code BAD_GATEWAY), matching how timeout, stream-error, and premature-close exhaustion are already reported; non-critical queries still swallow it. (#B34)

package/README.md

@@ -39,10 +39,15 @@ gina bundle:start api @myproject
 open https://localhost:3100
 ```
 
-## What's in 0.5.2
-
-- **Released-response crash family completed across the synchronous controller surface (bundle-killing).** Building on the `throwError()` and HTTP/2 query-path guards in 0.5.1, thirteen more synchronous controller APIs — `renderJSON()`, `redirect()`, `store()`, `push()`, `renderStream()`, `pauseRequest()` / `resumeRequest()`, `downloadFromLocal()`, and the request-method / popin / form-rule helpers — no longer crash the bundle when a controller action keeps running after a terminal exit (typically a `redirect()` that lets the middleware chain continue) and then dereferences the already-released request or response. Each now no-ops or notifies through its existing callback/event channel instead of escalating to an `uncaughtException` and a SIGTERM shutdown; live requests are byte-for-byte unaffected.
-- **Exhausted HTTP/2 502 retries now surface a typed error instead of success.** An inter-bundle `self.query()` over HTTP/2 that exhausted its retries against an upstream returning 502 used to hand the Bad Gateway response body to the caller as if it were valid data (a JSON-shaped body was even relabelled `status: 200`). Exhausted 502s now surface `status: 502`, `code: BAD_GATEWAY` to the caller, matching how timeout, stream-error, and premature-close exhaustion are already reported; non-critical queries still swallow it.
+## What's in 0.5.3
+
+- **Released-response crash family finished (bundle-killing).** The two remaining members are now guarded: a late `self.throwError(statusCode, error)` in its two- and three-argument forms (only the single-argument form was guarded before), and the HTML render delegates (swig and nunjucks, including their async variants) invoked after the response was already released. Both now log-and-ignore or no-op instead of dereferencing the released response — no `uncaughtException`, no SIGTERM, no unhandled promise rejection — matching `renderJSON()` and the streaming delegate.
+- **Atomic `~/.gina` state-file writes.** The five state files (`main.json`, `projects.json`, `settings.json`, `env.json`, `locals.json`) are now written via a temp file plus rename, so a concurrent boot of many bundles or containers against the same home directory can no longer read a partially-written file and crash on startup.
+- **Framework command-socket hardening.** The command socket now accumulates each connection's payload and parses it only once complete; a malformed, partial, or non-JSON payload is ignored instead of throwing an uncaught exception that could drop the command or shut the framework down.
+- **Framework socket port no longer corrupted by bundle flags.** A sub-topic command passed `--port` (e.g. `gina port:set`, `gina bundle:start`) no longer overwrites the framework socket port in `~/.gina/<short>/settings.json` — which previously made later online commands fail with `[ gina ] not started`. The framework-connection flags (`--port`, `--mq-port`, `--host-v4`, `--hostname`, `--debug-port`) now apply as framework settings only for framework-scoped commands.
+- **Boot failures surface their cause.** The `gina-container` launcher and the framework boot path now flush the failure reason synchronously before `process.exit`, so a crash on a piped stdout/stderr (the norm under container log collectors) reports its cause instead of exiting with no message.
+- **`gina port:set --force`.** Reassigns a port already held by another bundle (evicting the prior holder from both port maps); without `--force`, an in-use port is still rejected as before. Enables deterministic per-bundle port pinning for one-bundle-per-container deployments.
+- **Storage `_id` collision hardening** (16 base-62 random suffix, matching the collection ID convention) and **clearer unresolved-`${secret:KEY}` diagnostics** (the failing key name and config path are logged at debug level; the propagated error still omits the key).
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -27,6 +27,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q2 2026** | `0.5.0` ✅ | ESM entry points (dual CJS/ESM `exports` map) · Mixed template engines per bundle (extension-keyed `.njk` / `.swig` dispatch) · Nunjucks Inspector parity — the other items originally targeted here shipped earlier: structured logging (`0.4.5`), Alt-Svc (`0.4.2`), WebSocket over HTTP/2 (`0.4.7`), Inspector production auth (`0.4.0`) |
 | **Q2 2026** | `0.5.1` ✅ | Patch: released-response crash family — late `throwError()` and the HTTP/2 inter-bundle query retry / late-response / redirect-intercept paths no longer kill the bundle · dev-mode hot-reload `module.children` heap leak fixed (OOM under sustained load) · inter-bundle proxy JSON bodies keep their `application/json` label · ROADMAP consistency release gate |
 | **Q2 2026** | `0.5.2` ✅ | Patch: released-response crash family completed across the remaining synchronous controller surface — `renderJSON()` / `redirect()` / `store()` / `push()` / `renderStream()` / request-method + form-rule helpers no longer kill the bundle when called on an already-released response · exhausted HTTP/2 502 retries surface a typed `BAD_GATEWAY` error instead of being consumed as success |
+| **Q2 2026** | `0.5.3` ✅ | Patch: released-response crash family finished — late `throwError(status, error)` (2- and 3-argument forms) and the HTML render delegates (swig / nunjucks + async variants) no longer crash or emit unhandled rejections when invoked on an already-released response · atomic `~/.gina` state-file writes (concurrent multi-bundle / multi-container boot can't read a torn file) · framework command-socket hardened against malformed / fragmented payloads · framework socket port no longer corrupted by a bundle's `--port` · synchronous boot-failure diagnostics under piped stdout/stderr · storage `_id` collision hardening · `gina port:set --force` |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · CLI Tier 3 (project:move, framework:update, backup/restore, man pages) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 

package/bin/cli

@@ -83,38 +83,53 @@ async function onExec() {
         // catching debug|inspect arg
         //process.stdout.write('params '+ params.join(', ') + '\n');
 
+        // #B40 — Framework-connection params (--port, --mq-port, --host-v4,
+        // --hostname, --debug-port) are FRAMEWORK settings. Only hoist them into
+        // GINA_* (and persist them to ~/.gina/<short>/settings.json via
+        // isUpdateRequired) for framework-scoped commands: bare commands
+        // (`start`/`stop`/`restart`/`status`/... — prefixed to `framework:*` below)
+        // and explicit `framework:*` commands. For a sub-topic command
+        // (`port:set <bundle> --port=N`, `bundle:start <bundle> --port=N`, ...)
+        // `--port` is the BUNDLE's port, NOT the framework socket port; hoisting it
+        // overwrote settings.json `port` (8124 -> bundle port), so every later
+        // online command connected to the wrong framework port and reported
+        // "[ gina ] not started". The `--inspect`/`--debug` splice below stays
+        // unconditional — `bundle:start ... --inspect=<port>` relies on it.
+        var _topic = process.argv[2] || '';
+        var isFrameworkScopedCmd = ( _topic.indexOf(':') < 0 || /^framework:/.test(_topic) );
+
         if ( params.length > 0 ) {
             for (let p = 0, len = params.length; p < len; ++p) {
 
-                if ( /^\-\-port/.test(params[p]) ) {
+                if ( isFrameworkScopedCmd && /^\-\-port/.test(params[p]) ) {
                     let port = params[p].split(/\=/)[1];
                     setEnvVar('GINA_PORT', ~~port);// jshint ignore:line
                     isUpdateRequired = true;
                     continue;
                 }
 
-                if ( /^\-\-mq\-port/.test(params[p]) ) {
+                if ( isFrameworkScopedCmd && /^\-\-mq\-port/.test(params[p]) ) {
                     let mqPort = params[p].split(/\=/)[1];
                     setEnvVar('GINA_MQ_PORT', ~~mqPort);// jshint ignore:line
                     isUpdateRequired = true;
                     continue;
                 }
 
-                if ( /^\-\-host\-v4/.test(params[p]) ) {
+                if ( isFrameworkScopedCmd && /^\-\-host\-v4/.test(params[p]) ) {
                     let host = params[p].split(/\=/)[1];
                     setEnvVar('GINA_HOST_V4', host);// jshint ignore:line
                     isUpdateRequired = true;
                     continue;
                 }
 
-                if ( /^\-\-hostname/.test(params[p]) ) {
+                if ( isFrameworkScopedCmd && /^\-\-hostname/.test(params[p]) ) {
                     hostname = params[p].split(/\=/)[1];
                     setEnvVar('GINA_HOSTNAME', hostname);// jshint ignore:line
                     isUpdateRequired = true;
                     continue;
                 }
 
-                if ( /^\-\-debug(\_|\-)port/.test(params[p]) ) {
+                if ( isFrameworkScopedCmd && /^\-\-debug(\_|\-)port/.test(params[p]) ) {
                     let port = params[p].split(/\=/)[1];
                     setEnvVar('GINA_DEBUG_PORT', ~~port);// jshint ignore:line
                     isUpdateRequired = true;

package/bin/cmd

@@ -41,6 +41,18 @@ function Cmd(opt, runOffine) {
     var launchFramework = function(){
 
         var framework = net.createServer( function(conn) {//'connection' listener
+
+            // #B41 — per-connection accumulation buffer for the command JSON
+            // payload. The client sends `JSON.stringify(process.argv)` in a
+            // single write (bin/cli), but TCP may split or coalesce it across
+            // 'data' chunks, so we accumulate and only parse once the payload
+            // is complete. A partial chunk fails to parse and we keep waiting;
+            // a malformed / empty payload never completes and is ignored here
+            // — an unguarded JSON.parse would otherwise throw, surfacing as a
+            // [ FRAMEWORK ][ uncaughtException ] that drops the command (and
+            // risks a SIGTERM via proc.js).
+            var _payload = '';
+
             //feedback.
             conn.once('end', function() {
                 console.debug('[ CLI ] task completed');
@@ -57,7 +69,28 @@ function Cmd(opt, runOffine) {
             //Receiving.
             conn.on('data', function(data) {
 
-                var argv = JSON.parse( data.toString() );
+                _payload += data.toString();
+
+                var argv;
+                try {
+                    argv = JSON.parse( _payload );
+                } catch (parseErr) {
+                    // Payload not yet complete (TCP split) — keep accumulating.
+                    // A non-JSON / empty payload never parses and is ignored,
+                    // so the framework does not crash on a malformed command.
+                    return;
+                }
+                // Complete payload consumed — reset for any further command on
+                // this connection.
+                _payload = '';
+
+                if ( !Array.isArray(argv) ) {
+                    // Valid JSON but not the expected argv array — drop without
+                    // crashing (argv.join below would otherwise throw). The
+                    // real client always sends process.argv (an array).
+                    console.warn( '[ FRAMEWORK ] ignoring non-argv command payload' );
+                    return;
+                }
 
                 console.debug( '[ FRAMEWORK ] CMD received "'+ argv.join(' ') +'"' );
 

package/bin/gina-container

@@ -34,6 +34,28 @@ var spawn = require('child_process').spawn;
 var binPath  = __dirname;
 var ginaPath = binPath.replace(/\/bin$/, '');
 
+// ── 0. Synchronous stdout writer ──────────────────────────────────────────────
+/**
+ * Writes a message synchronously to stdout (fd 1).
+ *
+ * `process.stdout.write` is ASYNCHRONOUS when stdout is a pipe — the norm under
+ * a container log collector (kubectl/Fluentd/Datadog) or a test harness that
+ * pipes the launcher's stdio. A `process.stdout.write` immediately followed by
+ * `process.exit(1)` therefore loses its message: the process tears down before
+ * libuv drains the pipe. Every diagnostic this launcher prints precedes either
+ * the bundle spawn or a `process.exit`, so on the failure paths the message
+ * vanishes — exactly the empty-log signature seen in the container-boot CI
+ * flake. `fs.writeSync(1, …)` blocks until the bytes are handed to the pipe, so
+ * the diagnostic always survives. (It does not reproduce on a local TTY, where
+ * stdout is synchronous.)
+ *
+ * @param {string} msg - Message to write to stdout.
+ * @returns {void}
+ */
+function out(msg) {
+    try { fs.writeSync(1, msg); } catch (e) { /* stdout gone — nothing better to do */ }
+}
+
 // ── 1. Bootstrap utils/helper ─────────────────────────────────────────────────
 // Injects globals: _, setEnvVar, getEnvVar, getUserHome, getTmpDir, etc.
 require(ginaPath + '/utils/helper'); // jshint ignore:line
@@ -117,7 +139,7 @@ if (fs.existsSync(_mainJsonPath)) {
     try {
         var _mainData = JSON.parse(fs.readFileSync(_mainJsonPath, 'utf8'));
         if (_mainData.def_framework !== version) {
-            process.stdout.write('[gina-container] def_framework: ' + (_mainData.def_framework || 'unset') + ' → ' + version + '\n');
+            out('[gina-container] def_framework: ' + (_mainData.def_framework || 'unset') + ' → ' + version + '\n');
             _mainData.def_framework = version;
             if (!_mainData.frameworks) { _mainData.frameworks = {}; }
             if (!_mainData.frameworks[shortVersion]) { _mainData.frameworks[shortVersion] = []; }
@@ -127,7 +149,7 @@ if (fs.existsSync(_mainJsonPath)) {
             fs.writeFileSync(_mainJsonPath, JSON.stringify(_mainData, null, 4));
         }
     } catch(e) {
-        process.stdout.write('[gina-container] warn: could not sync def_framework — ' + (e.message || e) + '\n');
+        out('[gina-container] warn: could not sync def_framework — ' + (e.message || e) + '\n');
     }
 }
 
@@ -146,7 +168,7 @@ for (var a = 0; a < rawArgs.length; a++) {
 }
 
 if (!bundleName || !projectName) {
-    process.stdout.write('Usage: gina-container <bundle> @<project>\n');
+    out('Usage: gina-container <bundle> @<project>\n');
     process.exit(1);
 }
 
@@ -155,7 +177,7 @@ var projectsPath     = home + '/projects.json';
 var portsReversePath = home + '/ports.reverse.json';
 
 if (!fs.existsSync(projectsPath)) {
-    process.stdout.write(
+    out(
         '[ gina-container ] ' + projectsPath + ' not found.\n' +
         '  Run: gina project:import @' + projectName + '\n'
     );
@@ -169,7 +191,7 @@ var portsReverse = fs.existsSync(portsReversePath)
 
 var projectEntry = projects[projectName];
 if (!projectEntry) {
-    process.stdout.write(
+    out(
         '[ gina-container ] project @' + projectName + ' not registered in projects.json\n' +
         '  Run: gina project:import @' + projectName + '\n'
     );
@@ -199,12 +221,12 @@ try {
     }
 } catch (err) {
     // fallback: bundles/<bundle>/index.js (mirrors start.js catch block)
-    process.stdout.write('[ gina-container ] manifest.json warning: ' + (err.message || err) + '\n');
+    out('[ gina-container ] manifest.json warning: ' + (err.message || err) + '\n');
     appPath = projectRoot + '/bundles/' + bundleName + '/index.js';
 }
 
 if (!fs.existsSync(appPath)) {
-    process.stdout.write('[ gina-container ] bundle entry point not found: ' + appPath + '\n');
+    out('[ gina-container ] bundle entry point not found: ' + appPath + '\n');
     process.exit(1);
 }
 
@@ -239,9 +261,9 @@ var ctxJSON = JSON.stringify({
 // stdio: 'inherit' — bundle stdout/stderr go directly to the container's
 // stdout/stderr, which is what K8s log collectors (kubectl logs, Fluentd,
 // Datadog, etc.) expect.  No MQ logger intermediary is needed here.
-process.stdout.write('[ gina-container ] Starting ' + bundleName + '@' + projectName + '\n');
-process.stdout.write('[ gina-container ] App:   ' + appPath + '\n');
-process.stdout.write('[ gina-container ] Env:   ' + env + '  Scope: ' + scope + '\n');
+out('[ gina-container ] Starting ' + bundleName + '@' + projectName + '\n');
+out('[ gina-container ] App:   ' + appPath + '\n');
+out('[ gina-container ] Env:   ' + env + '  Scope: ' + scope + '\n');
 
 var child = spawn(process.argv[0], [appPath, ctxJSON, projectName, bundleName], {
     detached: false,
@@ -264,7 +286,7 @@ process.on('SIGINT',  function() { forwardSignal('SIGINT');  });
 
 // ── 10. Exit when child exits ─────────────────────────────────────────────────
 child.on('error', function(err) {
-    process.stdout.write('[ gina-container ] failed to spawn bundle: ' + (err.message || err) + '\n');
+    out('[ gina-container ] failed to spawn bundle: ' + (err.message || err) + '\n');
     process.exit(1);
 });
 

package/framework/v0.5.4-alpha.1/VERSION

@@ -0,0 +1 @@
+0.5.4-alpha.1

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -20261,8 +20261,11 @@ function StoragePlugin(options) {
      * */
     function collectionInsert(content) {
 
-        // TODO - add uuid
-        content['_id']         = Date.now().toString(36) + '-' + uuid();
+        // uuid(16): a 16-char base-62 suffix (62^16) avoids the birthday-paradox
+        // _id collision the 4-char default risks when several records are inserted
+        // within the same millisecond (the Date.now() prefix is shared at ms
+        // granularity). Mirrors the lib/collection #COLL1 size=16 opt-in.
+        content['_id']         = Date.now().toString(36) + '-' + uuid(16);
         content['_createdAt']  = new Date().format("isoDateTime");
         content['_updatedAt']  = new Date().format("isoDateTime");
 

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/asset/plugin/dist/vendor/gina/js/gina.min.js

@@ -514,7 +514,7 @@ ra(x.name,a,R)}),na=U.childNodes,fa=0,lLen=na.length,lLen>0)))for(;fa<lLen;++fa)
 va.target,'init.'+va.id,function(G){G=null;typeof va.$popins['gina-popin-'+va.id+'-'+x.name]=='undefined'&&(G=B({},xa),ya(G,x));va.isReady=!0;gina.hasPopinHandler=!0;gina.popin=B(gina.popin,va);triggerEvent(gina,va.target,'ready.'+va.id,G)});va.initialized=!0;return va}(e)}});
 function StoragePlugin(n){function D(v){k=JSON.parse(Z.getItem(this.bucket));typeof k[v]=='undefined'&&(k[v]=[],Z.setItem(this.bucket,JSON.stringify(k)),k=JSON.parse(Z.getItem(this.bucket)));p[v]={_collection:v,_bucket:this.bucket};p[v]=O(p[v],ka);return p[v]}function H(v){if(typeof v!=='object')throw Error('filter must be an object');var u=k[this._collection],Y=v.count(),l=0,g=null;if(Y==0)return null;for(var r in u)for(var I in v){var N=typeof v[I]!='boolean'?v[I].toLocaleLowerCase():v[I];v[I]&&
 e.indexOf(N)>-1&&N=='not null'&&typeof u[r][I]!='undefined'&&typeof u[r][I]!=='object'&&u[r][I]===v[I]&&u[r][I]!='null'&&u[r][I]!='undefined'?g.indexOf(u[r][I])<0&&(++l,l===Y&&(g=u[r],g._index=r,g._collection=this._collection,g._bucket=this._bucket)):typeof u[r][I]!='undefined'&&typeof u[r][I]!=='object'&&u[r][I]===v[I]&&(++l,l===Y&&(g=u[r],g._index=r,g._collection=this._collection,g._bucket=this._bucket,g._filter=v))}g&&(g.save=ca);return g}var O=O||require('lib/merge');D=D||require('lib/collection');
-var E=E||require('lib/uuid'),B=B||require('helpers/dateFormat'),X={bucket:'default'},C={},Z=null,p={},k={},e=['not null'],V={bucket:void 0,drop:function(){Z.removeItem(X.bucket);C=null;for(var v in this)delete this[v];return C},Collection:D},ka={insert:function(v){v._id=Date.now().toString(36)+'-'+E();v._createdAt=(new Date).format('isoDateTime');v._updatedAt=(new Date).format('isoDateTime');k[this._collection][k[this._collection].length]=v;Z.setItem(this._bucket,JSON.stringify(k))},find:function(v,
+var E=E||require('lib/uuid'),B=B||require('helpers/dateFormat'),X={bucket:'default'},C={},Z=null,p={},k={},e=['not null'],V={bucket:void 0,drop:function(){Z.removeItem(X.bucket);C=null;for(var v in this)delete this[v];return C},Collection:D},ka={insert:function(v){v._id=Date.now().toString(36)+'-'+E(16);v._createdAt=(new Date).format('isoDateTime');v._updatedAt=(new Date).format('isoDateTime');k[this._collection][k[this._collection].length]=v;Z.setItem(this._bucket,JSON.stringify(k))},find:function(v,
 u){if(!v)return k[this._collection];if(typeof v!=='object')throw Error('filter must be an object');u=k[this._collection];v.count();var Y=0,l=[],g;for(g in u)for(var r in v){var I=typeof v[r]!='boolean'?v[r].toLocaleLowerCase():v[r];v[r]&&e.indexOf(I)>-1&&I=='not null'&&typeof u[g][r]!='undefined'&&typeof u[g][r]!=='object'&&u[g][r]!='null'&&u[g][r]!='undefined'?l.indexOf(u[g][r])<0&&(l[Y]=u[g][r],++Y):typeof u[g][r]!='undefined'&&typeof u[g][r]!=='object'&&u[g][r]===v[r]&&(l[Y]=u[g],++Y)}return l},
 findOne:H,update:null,'delete':function(v){if(typeof v!=='object')throw Error('filter must be an object');var u=JSON.clone(k[this._collection]),Y=0,l=[],g;for(g in u)for(var r in v)v[r]&&e.indexOf(v[r].toLocaleLowerCase())>-1&&v[r].toLowerCase()=='not null'&&typeof u[g][r]!='undefined'&&typeof u[g][r]!=='object'&&u[g][r]!='null'&&u[g][r]!='undefined'?l.indexOf(u[g][r])<0&&(l[Y]=u[g][r],delete k[this._collection][g][r],++Y):typeof u[g][r]!='undefined'&&typeof u[g][r]!=='object'&&u[g][r]===v[r]&&(l[Y]=
 u[g],k[this._collection].splice(g,1),++Y);return l.length>0?(Z.setItem(this._bucket,JSON.stringify(k)),!0):!1},drop:function(v){if(typeof k[this._collection]=='undefined')throw Error('Collection `'+v+'` not found');delete p[this._collection];delete k[this._collection];Z.setItem(this._bucket,JSON.stringify(k))}},ca=function(v){v=v||!1;try{var u=JSON.clone(k),Y=this._index,l=this._collection,g=this._bucket,r=this._filter;this._updatedAt=(new Date).format('isoDateTime');u[l][Y]=O(u[l][Y],this,!0);delete u[l][Y]._index;

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/config.js

@@ -2795,6 +2795,15 @@ function Config(opt, contextResetNeeded) {
         try {
             secrets.resolve(self.envConf[bundle][env]);
         } catch (secretErr) {
+            // #B42 — name the failing secret + config path at debug level so
+            // operators can locate it. The user-facing message intentionally
+            // omits the key (lib/secrets/backends/env.js); the key rides on the
+            // non-enumerable `_ginaSecretKey` and is surfaced here only.
+            console.debug(
+                '[CONFIG][loadBundleConfig] Secret resolution failed for `'
+                + (secretErr._ginaSecretKey || '<unknown>')
+                + '` in `'+ bundle +'/'+ env +':'+ scope +'` configuration'
+            );
             return callback(secretErr);
         }
 

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/controller/controller.js

@@ -5409,7 +5409,12 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      * Late calls: when throwError fires after a response terminal exit has
      * already released the per-request refs (`local.res` is null — e.g. an
      * entity/query callback resuming after a redirect() sent its 301), the
-     * call is logged and ignored instead of crashing the bundle (#B31).
+     * call is logged and ignored instead of crashing the bundle. This holds
+     * for every call shape: the 1-arg `throwError(err)` form is caught by the
+     * guard after the errorObject build (#B31), and the 2-arg/3-arg forms —
+     * whose `res` is already the released `local.res` before that build — are
+     * caught by an up-front guard so the HTTP/2 `res.stream` and the
+     * errorObject-build `res.error` reads can't deref null first (#B44).
      *
      * @param {object} [ res ]
      * @param {number} code
@@ -5436,6 +5441,32 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             res  = local.res;
         }
 
+        // #B44 — for the 2-arg `throwError(code, Error|string)` and 3-arg
+        // `throwError(local.res, code, msg)` shapes, `res` is already `local.res`
+        // here (set by the shift above, or passed by the caller) — which is null
+        // when a terminal exit has released the response. The reads below all
+        // deref `res` BEFORE the #B31 guard further down: `res.stream` in the
+        // protocol branch (HTTP/2 bundles crash there) and `res.error` /
+        // `res.stack` / `res.message` / `res.fallback` in the errorObject build
+        // (every bundle crashes there). So a released response would crash
+        // (uncaughtException → SIGTERM) instead of being ignored. Bail up-front
+        // with the same no-op contract as the #B31 guard. The 1-arg shapes keep
+        // a truthy `res` (the Error/errorObj) here, so they are unaffected and
+        // still reach the #B31 guard after `res` is reassigned to `local.res` at
+        // the end of the errorObject build.
+        if ( !res ) {
+            self.isProcessingError = true;
+            var _b44LateError = msg || code;
+            var _b44LateErrorStr = '';
+            try {
+                _b44LateErrorStr = ( _b44LateError && typeof(_b44LateError) == 'object' ) ? JSON.stringify(_b44LateError) : String(_b44LateError || '');
+            } catch (_b44JsonErr) {
+                _b44LateErrorStr = String(_b44LateError);
+            }
+            console.warn('[ Controller ] throwError() called after the response was released — ignoring late error: '+ _b44LateErrorStr);
+            return false;
+        }
+
         var protocol        = getResponseProtocol(res);
         var stream          = ( /http\/2/.test(protocol) && res.stream ) ? res.stream : null;
         var header          = ( /http\/2/.test(protocol) && res.stream ) ? {} : null;

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/controller/controller.render-nunjucks-async.js

@@ -512,6 +512,20 @@ module.exports = async function renderNunjucksAsync(userData, displayInspector,
     var res   = local.res;
     var _next = local.next;
 
+    // #B45 — released-response guard. render() can be re-entered on a controller
+    // instance whose terminal exit already nulled the per-request triplet — e.g.
+    // an action that fired several parallel self.query() calls against a downed
+    // upstream: the first failure callback renders a degraded response and
+    // releases the triplet, then a later callback re-enters render() here with
+    // local.res === null. A later res.stream / setResources(local.req.headers)
+    // deref then throws; since render() is async, that escapes as an unhandled
+    // promise rejection. Nothing to render to a response already sent/released —
+    // no-op. Mirrors render-json.js (#B36) / render-stream.js (#B38); distinct
+    // from the #M1 in-flight null-out the captures above isolate.
+    if ( local.res == null ) {
+        return;
+    }
+
     // #HDR5/#HDR16 — per-request CSP nonce (set on req by gina.plugins.Csp({useNonce:true})).
     var _cspNonce = (req && req._ginaCspNonce) ? req._ginaCspNonce : null;
 

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/controller/controller.render-nunjucks.js

@@ -968,6 +968,20 @@ module.exports = async function renderNunjucks(userData, displayInspector, errOp
     var res   = local.res;
     var _next = local.next;
 
+    // #B45 — released-response guard. render() can be re-entered on a controller
+    // instance whose terminal exit already nulled the per-request triplet — e.g.
+    // an action that fired several parallel self.query() calls against a downed
+    // upstream: the first failure callback renders a degraded response and
+    // releases the triplet, then a later callback re-enters render() here with
+    // local.res === null. A later res.stream / setResources(local.req.headers)
+    // deref then throws; since render() is async, that escapes as an unhandled
+    // promise rejection. Nothing to render to a response already sent/released —
+    // no-op. Mirrors render-json.js (#B36) / render-stream.js (#B38); distinct
+    // from the #M1 in-flight null-out the captures above isolate.
+    if ( local.res == null ) {
+        return;
+    }
+
     // #HDR5 — per-request CSP nonce (set on req by gina.plugins.Csp({useNonce:true})).
     // Mirrored onto every framework-injected inline <script> so a bundle can drop
     // 'unsafe-inline' from script-src. Threaded into injectAssets() (which has no

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/controller/controller.render-swig-async.js

@@ -426,6 +426,20 @@ module.exports = async function renderSwigAsync(userData, displayInspector, errO
     var res   = local.res;
     var _next = local.next;
 
+    // #B45 — released-response guard. render() can be re-entered on a controller
+    // instance whose terminal exit already nulled the per-request triplet — e.g.
+    // an action that fired several parallel self.query() calls against a downed
+    // upstream: the first failure callback renders a degraded response and
+    // releases the triplet, then a later callback re-enters render() here with
+    // local.res === null. A later res.stream / setResources(local.req.headers)
+    // deref then throws; since render() is async, that escapes as an unhandled
+    // promise rejection. Nothing to render to a response already sent/released —
+    // no-op. Mirrors render-json.js (#B36) / render-stream.js (#B38); distinct
+    // from the #M1 in-flight null-out the captures above isolate.
+    if ( local.res == null ) {
+        return;
+    }
+
     // No-view short-circuit (e.g. redirect responses reach render() without a
     // configured template).
     if (!hasViews || !hasViews()) {

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/controller/controller.render-swig.js

@@ -186,6 +186,21 @@ module.exports = async function render(userData, displayInspector, errOptions, d
     var req         = local.req;
     var res         = local.res;
     var _next       = local.next;
+
+    // #B45 — released-response guard. render() can be re-entered on a controller
+    // instance whose terminal exit already nulled the per-request triplet — e.g.
+    // an action that fired several parallel self.query() calls against a downed
+    // upstream: the first failure callback renders a degraded response and
+    // releases the triplet, then a later callback re-enters render() here with
+    // local.res === null. A later res.stream / setResources(local.req.headers)
+    // deref then throws; since render() is async, that escapes as an unhandled
+    // promise rejection. Nothing to render to a response already sent/released —
+    // no-op. Mirrors render-json.js (#B36) / render-stream.js (#B38); distinct
+    // from the #M1 in-flight null-out the captures above isolate.
+    if ( local.res == null ) {
+        return;
+    }
+
     // #H10 — opt-in HTTP/2 response trailers (registered via self.sendTrailers()).
     var _trailers   = (local._trailers && typeof(local._trailers) === 'object') ? local._trailers : null;
     // #HDR5 — per-request CSP nonce (set on req by gina.plugins.Csp({useNonce:true})).

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/gna.js

@@ -431,6 +431,10 @@ var abort = function(err, bundle) {
         console.emerg(err.stack||err);
     }
 
+    // Guarantee the abort reason survives process.exit(): process.stdout/stderr
+    // are async on a pipe (e.g. under bin/gina-container), so the console.emerg
+    // above is truncated by the immediate exit. fs.writeSync blocks until flushed.
+    try { fs.writeSync(2, '[ FRAMEWORK ] abort: ' + ((err && err.stack) || err) + '\n'); } catch (_e) { /* best-effort */ }
     process.exit(1);
 };
 
@@ -695,7 +699,10 @@ gna.mount = process.mount = function(bundlesPath, source, target, type, callback
 
                 } catch (err) {
                     if (err) {
-                        console.emerg('[ FRAMEWORK ] '+ (err.stack||err.message));
+                        var _mountMsg = '[ FRAMEWORK ] '+ (err.stack||err.message);
+                        console.emerg(_mountMsg);
+                        // Guarantee the reason survives process.exit() on an async pipe (e.g. bin/gina-container).
+                        try { fs.writeSync(2, _mountMsg + '\n'); } catch (_e) { /* best-effort */ }
                         process.exit(1)
                     }
                     if ( fs.existsSync(target) ) {

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/plugins/lib/storage/src/main.js

@@ -223,8 +223,11 @@ function StoragePlugin(options) {
      * */
     function collectionInsert(content) {
 
-        // TODO - add uuid
-        content['_id']         = Date.now().toString(36) + '-' + uuid();
+        // uuid(16): a 16-char base-62 suffix (62^16) avoids the birthday-paradox
+        // _id collision the 4-char default risks when several records are inserted
+        // within the same millisecond (the Date.now() prefix is shared at ms
+        // granularity). Mirrors the lib/collection #COLL1 size=16 opt-in.
+        content['_id']         = Date.now().toString(36) + '-' + uuid(16);
         content['_createdAt']  = new Date().format("isoDateTime");
         content['_updatedAt']  = new Date().format("isoDateTime");
 

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/server.isaac.js

@@ -488,7 +488,10 @@ function ServerEngineClass(options) {
                 cert: readSync(options.credentials.certificate)
             };
         } catch(err) {
-            console.emerg('You are trying to start a secured server (https) wihtout suficient credentials: check your `server settings`\n'+ err.stack);
+            var _credMsg = 'You are trying to start a secured server (https) wihtout suficient credentials: check your `server settings`\n'+ err.stack;
+            console.emerg(_credMsg);
+            // Guarantee the reason survives process.exit() on an async pipe (e.g. bin/gina-container).
+            try { fs.writeSync(2, _credMsg + '\n'); } catch (_e) { /* best-effort */ }
             process.exit(1)
         }
     }

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/core/server.js

@@ -691,7 +691,10 @@ function Server(options) {
             self.emit('configured', false, engine.instance, engine.middleware, self.conf[self.appName][self.env]);
 
         } catch (err) {
-            console.emerg('[ BUNDLE ] [ '+ self.appName +' ] ServerEngine ' + err.stack)
+            var _engineMsg = '[ BUNDLE ] [ '+ self.appName +' ] ServerEngine ' + err.stack;
+            console.emerg(_engineMsg)
+            // Guarantee the reason survives process.exit() on an async pipe (e.g. bin/gina-container).
+            try { fs.writeSync(2, _engineMsg + '\n'); } catch (_e) { /* best-effort */ }
             process.exit(1)
         }
     }

package/framework/{v0.5.3-alpha.1 → v0.5.4-alpha.1}/lib/cmd/port/help.txt

@@ -56,6 +56,17 @@
 
     Ports 4100-4199 are reserved for Gina infrastructure and will be rejected.
 
+    Reassign a port already held by another bundle (--force)
+    ----------
+
+    By default, setting a port that another bundle/environment already holds is
+    rejected. Pass --force to take the port anyway: the prior holder is evicted
+    (it loses that port for the protocol/scheme and re-pins itself the next time
+    its own context runs port:set). This is the intended shape for one-bundle-per-
+    container deployments that pin each bundle to a fixed port.
+
+    $ gina port:set <bundle_name> @<project_name> --protocol=<protocol> --scheme=<scheme> --port=<port_number> --env=<environment> --force
+
 [ Listing port numbers ]
 
     $ gina port:list <bundle_name> @<project_name>