gina 0.5.5-alpha.1 → 0.5.6-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,32 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.5 - 2026-06-22
+### Added
+* Added gina project:move to relocate a project source tree to a new filesystem path. The project name, its home directory, the port matrix, and its bundles are preserved (only the registry path is updated). It refuses while any bundle in the project is running, refuses a cross-filesystem target (pointing you to project:import), and reverses the move on failure.
+* Added gina project:backup to archive a project source tree into a timestamped .zip. node_modules is excluded and symlinks are skipped (so the framework link is not followed); the archive is written to --out (default: the current directory). The command is read-only — it never changes the source tree or the registry. --with-password is recognised but refused for now, because archive encryption is not yet implemented.
+* Added gina project:restore to rebuild a project from a project:backup .zip. It extracts the source tree to --to and re-registers the project (registry entry, ports, and the gina symlink) so it is immediately startable; node_modules is not in the backup, so run npm install afterwards. It refuses to overwrite an already-registered name or a non-empty target unless --force is given. This also implements lib/archiver decompress() (the inverse of compress(), via JSZip) with a guard against archive entries escaping the target.
+* Added gina framework:update to reconcile the local ~/.gina state files (main.json def_framework and the frameworks list, plus the per-version settings.json) to the installed framework version. It runs as a dry run by default; pass --fix to apply, --to-version=<v> to target a specific version, or --format=json for machine-readable output. A strict-semver guard never regresses the recorded version, and the per-version metadata maps stay owned by framework:init. This automates the post-merge state check that previously had to be performed by hand.
+* Added gina framework:man, project:man, bundle:man and service:man to show inline CLI manual pages in the terminal. Each renders the group ronn .1.md page (substituting the version and copyright year) when one exists (framework today), otherwise it falls back to that group help.txt. Runtime-rendered with no build step and no markdown or man dependency.
+* gina now runs on the Bun runtime. Install with `bun add -g gina`; `engine.bun` declares the supported range (`>= 1.2`), and a CI Bun smoke validates a clean install, bundle boot, and HTTP 200 response under Bun on every push to develop and master.
+* Added `gina framework:reset` (shorthand `gina reset`) — a runtime, package-manager-agnostic factory reset that clears `~/.gina` (settings, project registry, env config, port allocations) so it rebuilds to defaults on the next command. Complements `npm install -g gina@latest --reset` (which only runs inside the npm install lifecycle) and gives Bun users a factory reset, since Bun blocks install scripts. Refuses while the daemon or bundles are running, unless `--force`.
+* Added `gina framework:add <version>` to install a published framework version side-by-side, so a bundle can pin it via `--gina-version` or manifest `gina_version`. Downloads the version from npm, installs its dependencies, archives it under `~/.gina/archives/framework`, symlinks it into the active install, and registers it — without ever changing the default version. Supports `--force`, `--dry-run`, and `--format=json`.
+* Added `gina framework:list` to show the framework versions known to an install — the active version, side-by-side symlinked versions, and archived copies — with `--all` for the full registry and `--format=json` for machine-readable output.
+* Added `gina framework:remove` to remove a side-by-side installed framework version: it unlinks the symlink from the active install, deletes the archived copy, and deregisters it from main.json. Refuses to remove the active default or the real shipped version; `--force` overrides only a bundle pin, `--dry-run` previews, `--format=json` for machine output.
+* `project:status` and `bundle:status` `--format=json` now include a `framework` field (the framework version each project/bundle resolves to — the per-project `projects.json` pin, falling back to the global default) and a `gina_version` field (the per-bundle `manifest.json` override, `null` when unset).
+* Declare WebSocket-over-HTTP/2 routes in routing.json: a route with method "ws" and param.wsHandler "<name>" auto-registers the connection handler at bundle/channels/<name>.js at bundle start, with no programmatic app.onWebSocket() call needed. Matches an exact path or a :param pattern (e.g. url "/live/:room" matches /live/foo and exposes the captured value to the handler as request.params.room; exact paths always take precedence). Optional per-route session options (maxPayload, protocol, closeTimeout) are declared via param.wsOptions and applied when the connection is accepted. The handler receives (session, request) and can use the framework lib registry and the ORM (getModel) directly. Requires the isaac engine with http2Options.enableConnectProtocol set to true.
+* WebSocket channel handlers can now make cross-bundle HTTP calls: session.query(options[, data]) returns a Promise (with an optional trailing callback), mirroring a controller's self.query(). A handler resolves another bundle by hostname (e.g. "api@project/dev") and gets back the parsed response, reusing the running server's warm HTTP/2 session cache. Works for both routing.json-declared (method "ws") and programmatic (app.onWebSocket) channels. Same-bundle data access via getModel already worked; this adds the inter-bundle HTTP leg getModel cannot do. Requires the isaac engine with http2Options.enableConnectProtocol set to true.
+### Fixed
+* Inter-bundle requests made with `self.query()` no longer silently re-execute a non-idempotent request (POST/PUT/PATCH/DELETE) when a transient failure — a stream timeout, connection reset, GOAWAY/premature stream close, or an upstream 502 — occurs after the request was already sent. Auto-retries on both the HTTP/2 and HTTP/1 client paths are now gated on HTTP-method idempotency: only safe methods (GET, HEAD, OPTIONS, TRACE) are retried by default, so a request the upstream already processed is never re-run behind a lost response. A caller whose endpoint is genuinely safe to replay can opt a non-safe method back in per request with `retryUnsafe: true`.
+* Fixed `gina bundle:start` failing to reinstall a project's node_modules under the Bun runtime: the arch/platform reinstall now runs `bun install` (instead of a hardcoded `npm install`) and performs the framework relink through the active runtime, so a bundle starts on a Bun-only image that ships no node or npm binary.
+* Popin/dialog triggers no longer fire two identical GET requests on a single click. The hover/focus preload warmed for a `data-gina-popin-url` (legacy) or `data-gina-dialog-src` trigger is now reused by the click — even while the preload is still in flight — instead of racing a second identical request; `preOpen` popins keep their instant loading skeleton.
+* `framework:init` now determines run-dir pidfile liveness with `process.kill` instead of shelling out to `ps`, so running bundles are no longer misreported as stopped — and their pidfiles wrongly pruned — on minimal images that do not ship the `ps` utility. The pid is also parsed and trimmed so a trailing newline cannot break the check.
+* Fixed a stable release shipping the prior alpha version in `framework/v<version>/package.json` (the published tarball sub-manifest): the version-prepare step now rewrites that `version` field to the cut version when it renames the framework directory, matching the alpha-cut path.
+* Completed the boot-path diagnostic flush so a bundle that aborts during boot — a config read/parse failure, a server core-configuration or port/protocol inconsistency, a bad routing requirement, or any uncaught exception — now writes its reason synchronously to stderr before exiting; the cause survives piped or containerised stdio instead of being truncated to an empty log under load. Also added a clear, actionable error when the listening port cannot be resolved from ports.reverse.json, replacing a cryptic TypeError at boot.
+### Security
+* Bumped the ws dependency floor to ^8.21.0 to resolve a WebSocket memory-exhaustion denial-of-service advisory (GHSA-96hv-2xvq-fx4p) affecting ws versions below 8.21.0.
+* Hardened the framework log-tail auto-restart path (`gina tail --follow`): bundle/project identifiers parsed from log output are now rejected when they contain path separators or `..` traversal (confining the saved-argv lookup to the tmp directory), and the saved start command is re-executed with execFileSync (no shell) instead of execSync, as defense-in-depth against command injection via crafted log content.
+
 ## 0.5.4 - 2026-06-19
 ### Added
 * Added a `--ignore-ports` flag to `gina bundle:add`: pass a comma-separated list of port numbers (e.g. `--ignore-ports=3000,3001`) to exclude them from the availability scan when creating or importing a bundle, on top of the already-assigned ports and the reserved 4100-4199 range that are skipped automatically. Composable with `--start-port-from`.

package/README.md

@@ -28,28 +28,28 @@ Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope
 | Hot reload | WatcherService evicts `require.cache` only on file change — zero per-request overhead in dev |
 | K8s ready | `gina-container`, `gina-init`, SIGTERM drain, JSON stdout logging |
 | Dependency injection | Mockable connectors and config for unit testing |
+| Runtime | Node.js 22–26, or **Bun** (`bun add -g gina`) — install + boot validated end-to-end by a CI Bun smoke |
 
 ## Quick start
 
 ```bash
-npm install -g gina@latest --prefix=~/.npm-global
+npm install -g gina@latest --prefix=~/.npm-global   # or, on the Bun runtime: bun add -g gina
 gina project:add @myproject --path=$(pwd)/myproject
 gina bundle:add api @myproject
 gina bundle:start api @myproject
 open https://localhost:3100
 ```
 
-## What's in 0.5.4
-
-- **Node.js 26 support.** The supported range now includes Node 26 — `engine.node` is `>= 22 <27`, the full test suite passes on 26.3.0, and Node 26 is part of the CI matrix.
-- **Form-validation rule fixes (server + client).** `isFloat` now accepts string float values such as `"1.5"`, so server-side validation of form and urlencoded input (always strings) no longer rejects valid floats — whole numbers still fail. `isDate` validates non-ISO masks like `dd/mm/yyyy` (a slash mask with a day past 12 is no longer mis-read as US `MM/DD`) and now returns the field object, so it chains: `field.isDate(mask).isRequired()`.
-- **Quieter live form validation.** While a field is being edited only the soft warning border shows; the error message is revealed once the field is committed (on blur or submit).
-- **File uploads honour their configured directory and limits.** Multipart uploads now write to the configured `upload.tmpPath` (or a per-group `path`), creating the directory if missing, instead of always using the OS temp dir. `upload.maxFields` (a global per-request file-count cap) is now enforced, and `upload.maxFieldsSize` honours its unit suffix (`B`/`KB`/`MB`/`GB`; a bare number is read as MB). **Security:** a file uploaded to an unconfigured group is now rejected with HTTP 400 instead of streaming through unchecked, closing a bypass of a group's `allowedExtensions` / `isMultipleAllowed` limits. **Back-compat:** the `untagged` default now sets `isMultipleAllowed: true`, and a non-MB `maxFieldsSize` suffix now means what it says — see the [migration guide](https://gina.io/docs/migration) if your bundle configures uploads.
-- **Dev-mode heap fixes.** Two retention paths that could push a long-running dev bundle toward an out-of-memory crash under sustained traffic are closed: the hot-reload path no longer accumulates dead module references for five core libraries (now loaded once, like the logger / job / state singletons), and the HTTP/2 `self.query()` client releases a settled stream at every non-retry outcome instead of retaining the per-request controller and its config clone. Production was never affected by either.
-- **Tighter per-request config isolation.** The router now deep-clones only the routing table a matched request mutates, sharing the large immutable remainder by reference — removing a concurrency heap high-water-mark proportional to config size. Relatedly, `getRouteByUrl` no longer mutates the shared route config in place, so a `:placeholder` route can't leak one request's resolved values (path / namespace / file / title) into later requests for the same route.
-- **Dev Inspector reliability.** The data tabs now reliably track the page that opened the Inspector — a per-tab channel survives `Cross-Origin-Opener-Policy: same-origin` severing `window.opener`. The Swig render path isolates per-request query/flow capture (concurrent requests no longer cross data); `/_gina/logs` and `/_gina/indexes` resolve the right bundle in reverse-proxy multi-bundle setups; and the SPA is hardened against a corrupted localStorage fold-state and an unescaped form-data label. Dev tooling only.
-- **Express-engine admin-endpoint parity.** The default (Express) engine now serves `/_gina/info` and `/_gina/cache/stats` with the same always-on, loopback-only, IP-allowlisted behaviour as the Isaac engine (they previously 404'd there).
-- **`gina bundle:add --ignore-ports`.** Exclude specific ports from the availability scan when creating or importing a bundle (e.g. `--ignore-ports=3000,3001`); composable with `--start-port-from`.
+## What's in 0.5.5
+
+- **WebSocket routes in `routing.json`.** Declare a WebSocket-over-HTTP/2 endpoint with `"method": "ws"` and a `param.wsHandler` pointing at a `channels/<name>.js` handler — auto-registered at bundle start, no `app.onWebSocket()` call needed. Routes support `:param` path segments and per-route `param.wsOptions` (`maxPayload` / `protocol` / `closeTimeout`).
+- **Cross-bundle calls from a channel handler.** A WebSocket handler can now call another bundle over HTTP with `session.query()` — the same warm-HTTP/2-session call a controller makes with `self.query()`.
+- **Framework versions side-by-side.** `gina framework:add <version>` installs a published framework version alongside the active one so a bundle can pin it via `--gina-version`; `framework:list` / `framework:remove` / `framework:update` / `framework:reset` round out the set.
+- **Project lifecycle CLI.** `gina project:move --to=<path>` relocates a project's source tree (and its registry entry); `project:backup` / `project:restore` archive a project to a `.zip` and rebuild it.
+- **Inline CLI man pages.** `gina framework:man` (and `project:man` / `bundle:man` / `service:man`) renders a command group's manual page in the terminal.
+- **Bun is now a supported runtime.** Install with `bun add -g gina`; the install + boot path is validated end-to-end by a CI Bun smoke.
+- **Idempotent HTTP/2 client retries.** Inter-bundle `self.query()` now auto-retries only HTTP safe methods on a transient transport failure, so a `POST` / `PUT` / `PATCH` / `DELETE` the upstream already executed is no longer silently replayed; opt a non-safe call back in with `retryUnsafe: true`.
+- **Security.** A WebSocket denial-of-service fix via an `ws` dependency override (reached through `engine.io`), plus log-tail restart hardening.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -29,7 +29,8 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q2 2026** | `0.5.2` ✅ | Patch: released-response crash family completed across the remaining synchronous controller surface — `renderJSON()` / `redirect()` / `store()` / `push()` / `renderStream()` / request-method + form-rule helpers no longer kill the bundle when called on an already-released response · exhausted HTTP/2 502 retries surface a typed `BAD_GATEWAY` error instead of being consumed as success |
 | **Q2 2026** | `0.5.3` ✅ | Patch: released-response crash family finished — late `throwError(status, error)` (2- and 3-argument forms) and the HTML render delegates (swig / nunjucks + async variants) no longer crash or emit unhandled rejections when invoked on an already-released response · atomic `~/.gina` state-file writes (concurrent multi-bundle / multi-container boot can't read a torn file) · framework command-socket hardened against malformed / fragmented payloads · framework socket port no longer corrupted by a bundle's `--port` · synchronous boot-failure diagnostics under piped stdout/stderr · storage `_id` collision hardening · `gina port:set --force` |
 | **Q2 2026** | `0.5.4` ✅ | Node.js 26 support (engine `>= 22 <27`, CI matrix) · FormValidator fixes (`isFloat` accepts string floats · `isDate` non-ISO masks + rule chaining) · quieter live form validation (error message revealed on blur) · file-upload fixes (honour `tmpPath` / per-group `path` · enforce `maxFields` + `maxFieldsSize` unit suffix · **Security**: reject uploads to an unconfigured group, closing an `allowedExtensions` / `isMultipleAllowed` bypass) · two dev-mode heap fixes (hot-reload lib-eviction leak · HTTP/2 `self.query()` settled-stream retention) · tighter per-request config isolation (narrowed router clone · `getRouteByUrl` shared-config mutation) · dev Inspector reliability (per-tab channel under COOP · Swig render-race isolation · multi-bundle proxy log/index routing · SPA hardening) · Express-engine `/_gina/info` + `/_gina/cache/stats` parity · `bundle:add --ignore-ports` |
-| **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · CLI Tier 3 (project:move, framework:update, backup/restore, man pages) · Beemaster admin + visual translation editor |
+| **Q2 2026** | `0.5.5` ✅ | WebSocket routes in `routing.json` (`method: "ws"` + `param.wsHandler` → `channels/<name>.js`, `:param` paths, per-route `param.wsOptions`) · cross-bundle `session.query()` from WebSocket channel handlers · framework version side-by-side CLI (`framework:add` / `framework:list` / `framework:remove` / `framework:update` / `framework:reset`) · `project:move` / `project:backup` / `project:restore` · inline CLI man pages (`framework:man` / `project:man` / `bundle:man` / `service:man`) · Bun promoted to a supported, CI-gated runtime · idempotent HTTP/2 client retries (safe-method gating + per-call `retryUnsafe` opt-in) · **Security**: WebSocket-DoS dependency hardening (`ws` override) · `tail` restart hardening |
+| **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 
 ---
@@ -78,10 +79,14 @@ Stub commands confirmed in source — handler files exist but are empty or comme
 
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
-| 📋 | **`project:move`** — Relocate a project's source directory and update all `~/.gina/` registry entries to the new path. Handler is 0 lines. | `0.5.x` | Q1 2027 |
-| 📋 | **`framework:update`** — Self-update the installed Gina framework to the latest (or a specified) version without reinstalling via npm. Handler is 0 lines. | `0.5.x` | Q1 2027 |
-| 📋 | **`project:backup` / `project:restore`** — Archive a project's source, config, and data to a tarball (`backup`), and restore from it (`restore`). Documented in `project/help.txt` as support-only. No handler files exist. | `0.5.x` | Q1 2027 |
-| 📋 | **`framework:man` / `project:man` / `bundle:man`** — Inline CLI manual pages. Mentioned in `framework/help.txt` but no handler files exist for any group. | `0.5.x` | Q1 2027 |
+| ✅ | **`project:move`** — Relocate a project's source directory (atomic `renameSync`) and rewrite the `~/.gina/` registry `path`. Refuses while a bundle is running or across filesystems; `--to=/new/path`. | `0.5.5-alpha.2` | 2026-06-19 |
+| ✅ | **`framework:update`** — Reconcile the `~/.gina/` state files (`main.json` `def_framework` + `frameworks` list, `<short>/settings.json`) to the installed framework version. Dry-run by default; `--fix` to apply, `--to-version` to target a specific version, `--format=json`. Automates the post-merge state check with a strict-semver never-regress guard. npm self-update is a planned follow-up — use `npm i -g gina@latest` meanwhile. | `0.5.5-alpha.2` | 2026-06-20 |
+| ✅ | **`framework:add`** — Install a published framework version side-by-side so a bundle can pin it via `--gina-version` / manifest `gina_version`. Downloads from npm, installs the tree's own deps, archives it under `~/.gina/archives/framework`, symlinks it into the active install, and registers it in `main.json` `frameworks[<short>]` — never changing the default version. `--dry-run` / `--force` / `--format=json`. | `0.5.5-alpha.2` | 2026-06-21 |
+| ✅ | **`framework:list`** — List the framework versions known to this install — the active version, side-by-side symlinked versions, and archived copies — by reconciling the install dirs, the `~/.gina/archives/framework` copies, and the `main.json` `frameworks` registry into one view. `--all` also includes versions registered but not on disk; `--format=json`. Read-only. | `0.5.5-alpha.2` | 2026-06-21 |
+| ✅ | **`framework:remove`** — Remove a side-by-side version: deregister it from `main.json` `frameworks[<short>]`, unlink its symlink, and delete its archived copy — the inverse of `framework:add`. Refuses to remove the active default (`def_framework`) or the real shipped dir (neither `--force`-overridable); `--force` overrides only a bundle pin. `--dry-run` / `--format=json`. | `0.5.5-alpha.2` | 2026-06-21 |
+| ✅ | **`framework:reset`** — Factory reset: clears `~/.gina` (settings, project registry, env config, port allocations) so the framework rebuilds to clean defaults on the next command — the runtime, package-manager-agnostic equivalent of a fresh install (works identically on Node and Bun, unlike the npm install-flag form). Project source files are never touched. Refuses while the daemon or any bundle is running (`framework:init`'s `process.kill`-based pidfile prune keeps the guard reliable even on `ps`-less images); `--force` overrides. Shorthand: `gina reset`. | `0.5.5-alpha.2` | 2026-06-21 |
+| ✅ | **`project:backup` / `project:restore`** — Archive a project's source tree to a `.zip` (`backup`, symlinks skipped), and rebuild + re-register a project from a backup `.zip` so it is immediately startable (`restore`). | `0.5.5-alpha.2` | 2026-06-19 |
+| ✅ | **`framework:man` / `project:man` / `bundle:man` / `service:man`** — Inline CLI manual pages. Runtime-renders the group's ronn `.1.md` (substituting `{version}`/`{year}`) when it exists (`framework` today), else falls back to that group's `help.txt`. No build step or markdown/man dependency. | `0.5.5-alpha.2` | 2026-06-20 |
 
 ---
 
@@ -292,7 +297,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **Trailer support** — `stream.sendTrailers()` + `waitForTrailers: true` | `0.4.0` | 2026-05-22 | Opt-in HTTP/2 response trailers via `self.sendTrailers(fields)`. The render pipeline sets `waitForTrailers` and emits the trailing headers after the body (in the `wantTrailers` event), across all render delegates. Activated only when a controller calls `self.sendTrailers(fields)`; HTTP/1.1 and the no-trailers path are unchanged. For gRPC-style streaming (`grpc-status`) and content-integrity (`Digest`) use cases. |
 | ✅ | **Alt-Svc header** — advertise HTTP/3 availability | `0.4.2` | 2026-06-02 | Set `Alt-Svc: h3=":443"; ma=86400` response header to advertise HTTP/3 (QUIC) availability via a QUIC-capable reverse proxy (nginx, Caddy, Cloudflare). Gina does not need to implement QUIC — just announce it. Opt-in via `settings.server.json`. Native HTTP/3 is out of scope: Node.js has no stable QUIC API, and the standard deployment topology (Gina → proxy → client) already delivers HTTP/3 at the edge. |
 | 📋 | **RFC 9218 Extensible Priorities** — read `Priority: u=N, i` request header | `0.5.x` | Q1 2027 | Use the RFC 9218 priority header to order response writes for multiplexed API clients. Low value for typical HTML page loads; high value for parallel API requests with declared urgency. |
-| ✅ | **WebSocket over HTTP/2** (RFC 8441 extended CONNECT) — opt-in via `http2Options.enableConnectProtocol` (default off; https and cleartext h2c HTTP/2 bundles). From `onInitialize`, `app.onWebSocket(path, handler)` registers per-path WebSocket handlers; accepted streams arrive as full sessions backed by a built-in dependency-free RFC 6455 codec (auto-pong, timed close handshake, UTF-8 + close-code validation, payload/fragment DoS caps, backpressure passthrough, graceful shutdown drain). Unknown paths are refused with 404, plain CONNECT keeps its 405, and default-off deployments are byte-identical. | `0.4.7` | 2026-06-11 |
+| ✅ | **WebSocket over HTTP/2** (RFC 8441 extended CONNECT) — opt-in via `http2Options.enableConnectProtocol` (default off; https and cleartext h2c HTTP/2 bundles). From `onInitialize`, `app.onWebSocket(path, handler)` registers per-path WebSocket handlers; accepted streams arrive as full sessions backed by a built-in dependency-free RFC 6455 codec (auto-pong, timed close handshake, UTF-8 + close-code validation, payload/fragment DoS caps, backpressure passthrough, graceful shutdown drain). Unknown paths are refused with 404, plain CONNECT keeps its 405, and default-off deployments are byte-identical. **Extended in `0.5.5`:** endpoints are declarable in `routing.json` (`method: "ws"` + `param.wsHandler` → `channels/<name>.js`, `:param` paths, per-route `param.wsOptions`), and handlers can call other bundles over HTTP with `session.query()`. | `0.4.7` | 2026-06-11 |
 
 ---
 

package/bin/cli-debug

@@ -11,6 +11,7 @@ const {exec} = require('child_process');
 const {execSync}   = require('child_process');
 const {spawn}   = require('child_process');
 const os    = require('os');
+var runtime = require(__dirname + '/../utils/runtime.js');
 
 var isWin32 = function() {
     return (os.platform() == 'win32') ? true : false;
@@ -61,7 +62,12 @@ debugPort = (debugPort != null) ? '--inspect-brk=0.0.0.0:'+debugPort : '--inspec
 // console.debug('\r\nDebugger attached.');
 console.log('\nYou should now start debug on port #'+ settings.debug_port +' before doing anything else ...');
 
-var nodeBin         = execSync('which node').toString().trim();
+// Under Bun, `which node` resolves nothing (a Bun image ships no node) — spawn
+// the running Bun binary instead. Under Node this is the byte-identical
+// `which node` result (runtimeBinary() returns its fallback verbatim).
+var nodeBin         = runtime.isBun()
+                        ? runtime.runtimeBinary()
+                        : runtime.runtimeBinary(execSync('which node').toString().trim());
 var cliBin          = __dirname + '/cli';
 
 argv.splice(0, 0, debugPort);

package/bin/gina

@@ -29,13 +29,20 @@
 var fs              = require('fs');
 const {spawn}       = require('child_process');
 const {execSync}    = require('child_process');
+var runtime         = require(__dirname + '/../utils/runtime.js');
 
 var restartPid      = null;
 
 function runAsSubProcess() {
 
     var argv            =  Array.from(process.argv);
-    var nodeBin         = execSync('which node').toString().trim();
+    // Under Bun, `which node` resolves nothing (a Bun image ships no node) — spawn
+    // the running Bun binary instead so the daemon child inherits the runtime.
+    // Under Node this is the byte-identical `which node` result: isBun() is false,
+    // so runtimeBinary() returns its fallback verbatim (zero Node delta).
+    var nodeBin         = runtime.isBun()
+                            ? runtime.runtimeBinary()
+                            : runtime.runtimeBinary(execSync('which node').toString().trim());
     var cliBin          = __dirname + '/cli';
     var fakeDaemonPid   = '--fake-daemon-pid='+ process.pid;
 
@@ -189,7 +196,13 @@ function runCMD() {
 
     process.env.NODE_BUNDLE     = process.argv[3];
     process.env.NODE_PROJECT    = process.argv[4];
-    process.env.NODE_PROJECT    = process.env.NODE_PROJECT.replace(/\@/, '');
+    // Bun-safety: under Node, assigning an absent argv to an env var coerces to
+    // the string 'undefined' (so .replace works); under Bun it stays real
+    // undefined and .replace throws. Guard the call so Node behaviour is
+    // unchanged (on Node the value is always a string here).
+    if ( typeof process.env.NODE_PROJECT === 'string' ) {
+        process.env.NODE_PROJECT    = process.env.NODE_PROJECT.replace(/\@/, '');
+    }
 
     if (
         /(bundle\:start|bundle\:restart)/.test(process.argv[2])
@@ -200,7 +213,12 @@ function runCMD() {
         var tmpPath     = getTmpDir();
         var argFilename = tmpPath +'/'+ process.env.NODE_BUNDLE +'@'+ process.env.NODE_PROJECT +'.argv';
 
-        process.env.NODE_ARGV   = process.argv.slice();
+        // Bun-safety: Node coerces an array assigned to an env var to a comma-
+        // joined string; Bun leaves it a real array (object), so the writeFileSync
+        // below throws "data must be string/Buffer". String(array) reproduces
+        // Node's comma-join exactly (zero Node delta) and matches the comma->space
+        // read in getBundleStartingArgv() (utils/helper.js).
+        process.env.NODE_ARGV   = String(process.argv.slice());
         if (/bundle\:restart/.test(process.argv[2])) {
             process.env.NODE_ARGV = process.env.NODE_ARGV.replace('bundle:restart', 'bundle:start');
         }
@@ -208,7 +226,10 @@ function runCMD() {
         try {
             fs.writeFileSync(argFilename, process.env.NODE_ARGV );
         } catch (err) {
-            console.emerg(err);
+            // bin/gina's `console` is the global console (no lib.logger here), which
+            // has no `.emerg` on either runtime; emerg would itself throw. (This
+            // catch is unreachable on Node, where the write above never throws.)
+            console.error(err);
         }
         help    = null;
         tmpPath = null;

package/framework/v0.5.6-alpha.1/VERSION

@@ -0,0 +1 @@
+0.5.6-alpha.1

package/framework/{v0.5.5-alpha.1 → v0.5.6-alpha.1}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -17517,6 +17517,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
      * @type {object}
      */
     var preloadCache = {};
+    // preloadWaiters[url] = [fn, ...] — callbacks parked by a click that adopted an
+    // in-flight preload; preloadFetch fires them with the body (or null on failure) so a
+    // click reuses the prefetch instead of issuing a second identical GET (#B54).
+    var preloadWaiters = {};
 
     /** @inner @type {object} warn-once registry, keyed by deprecated attribute name */
     var _deprecationWarned = {};
@@ -18032,10 +18036,16 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             xhrPreload.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
             xhrPreload.onreadystatechange = function () {
                 if ( xhrPreload.readyState == 4 ) {
+                    // #B54 — wake any click that adopted this in-flight preload instead of
+                    // firing its own duplicate GET (see consumePreload).
+                    var _waiters = preloadWaiters[url] || [];
+                    delete preloadWaiters[url];
                     if ( /^2/.test(xhrPreload.status) ) {
                         preloadCache[url] = xhrPreload.responseText;
+                        for ( var _w = 0; _w < _waiters.length; ++_w ) { _waiters[_w](xhrPreload.responseText); }
                     } else {
                         delete preloadCache[url];
+                        for ( var _wf = 0; _wf < _waiters.length; ++_wf ) { _waiters[_wf](null); }
                     }
                 }
             };
@@ -18087,17 +18097,47 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
         }
 
         /**
-         * consumePreload — if a warmed preload for `url` is cached, apply it to the popin
-         * (deleting the cache entry) and return `true`; else `false` so the caller falls
-         * back to a click-time XHR. A `null` entry is in-flight (reserved, not ready).
+         * consumePreload — reuse a hover/focus preload for `url` instead of firing a second
+         * identical GET on click (#B54):
+         *   - ready (cached body)      -> apply it now; return true.
+         *   - in-flight (null slot)    -> park a waiter that applies the body when the
+         *                                 preload resolves (or runs `onMiss` if it failed);
+         *                                 return true (handled — caller must NOT also load).
+         *   - never warmed (undefined) -> return false so the caller loads itself.
          *
          * @inner
+         * @param {string} url - the resolved popin URL.
+         * @param {object} $popin - the registered popin.
+         * @param {function} [onMiss] - the caller's click-time load, run only if an adopted
+         *   in-flight preload ends up failing.
+         * @returns {boolean} true if the preload was (or will be) consumed.
          */
-        function consumePreload(url, $popin) {
-            if ( preloadCache[url] == null ) {
+        function consumePreload(url, $popin, onMiss) {
+            var slot = preloadCache[url];
+            if ( typeof(slot) == 'undefined' ) {
                 return false;
             }
-            var body = preloadCache[url];
+            if ( slot === null ) {
+                // In-flight: adopt the running preload rather than fire a second GET.
+                // A preOpen popin still gets its instant born-modal skeleton now; the
+                // adopted preload swaps in the real content on arrival — matching the
+                // popinLoad preOpen flow this consume path bypasses (#B54).
+                if ( $popin && $popin.options && $popin.options.preOpen ) {
+                    showLoadingShell($popin, ensurePopinDialog($popin));
+                }
+                if ( typeof(preloadWaiters[url]) == 'undefined' ) {
+                    preloadWaiters[url] = [];
+                }
+                preloadWaiters[url].push(function (body) {
+                    if ( body == null ) {
+                        if ( typeof(onMiss) == 'function' ) { onMiss(); }
+                    } else {
+                        handleLoadedBody(body, $popin, ensurePopinDialog($popin));
+                    }
+                });
+                return true;
+            }
+            var body = slot;
             delete preloadCache[url];
             var $el = ensurePopinDialog($popin);
             handleLoadedBody(body, $popin, $el);
@@ -18261,12 +18301,13 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                     });
                 }
 
-                // Consume a warmed preload if present; else fall through to a click-time XHR.
-                if ( consumePreload(descriptor.src, existing) ) {
+                // Consume a warmed OR in-flight preload; else fall through to a click-time XHR.
+                var loadOptions = merge({ isSynchrone: false, withCredentials: false }, existing.options);
+                var onMiss = function () { popinLoad(name, descriptor.src, loadOptions); };
+                if ( consumePreload(descriptor.src, existing, onMiss) ) {
                     return;
                 }
-                var loadOptions = merge({ isSynchrone: false, withCredentials: false }, existing.options);
-                popinLoad(name, descriptor.src, loadOptions);
+                onMiss();
             } else {
                 openInPageDialog(descriptor, $trigger);
             }
@@ -18374,23 +18415,6 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                             // console.debug("[POPIN CLICK #3]", $popin.openTrigger, " VS ", e.currentTarget.id);
                             $popin.openTrigger = e.currentTarget.id || e.currentTarget.getAttribute('id');
 
-                            var fired = false;
-                            addListener(gina, $popin.target, 'loaded.'+$popin.id, function(e) {
-                                e.preventDefault();
-
-                                // console.debug('Popin loaded: true, fired: '+ fired + ', $popin.isOpen: '+ $popin.isOpen);
-
-                                if (!fired) {
-                                    fired = true;
-                                    console.debug('active popin should be ', $popin.id);
-                                    gina.popin.activePopinId = $popin.id;
-                                    popinBind(e, $popin);
-                                    if (!$popin.isOpen) {
-                                        popinOpen($popin.name);
-                                    }
-                                }
-                            });
-
                             // loading & binding popin
                             // Non-Preflighted requests
                             var options = {
@@ -18402,7 +18426,38 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                             if (!url) {
                                 throw new Error('Popin `url` not defined, please check value for `data-gina-popin-url`');
                             }
-                            popinLoad($popin.name, url, options);
+
+                            // The click-time load: registers the loaded.<id> listener that
+                            // injects + opens, then issues the XHR. Wrapped so a consumed
+                            // preload can skip it (#B54), and an adopted-but-failed preload
+                            // can fall back to it.
+                            var doLoad = function() {
+                                var fired = false;
+                                addListener(gina, $popin.target, 'loaded.'+$popin.id, function(e) {
+                                    e.preventDefault();
+
+                                    // console.debug('Popin loaded: true, fired: '+ fired + ', $popin.isOpen: '+ $popin.isOpen);
+
+                                    if (!fired) {
+                                        fired = true;
+                                        console.debug('active popin should be ', $popin.id);
+                                        gina.popin.activePopinId = $popin.id;
+                                        popinBind(e, $popin);
+                                        if (!$popin.isOpen) {
+                                            popinOpen($popin.name);
+                                        }
+                                    }
+                                });
+                                popinLoad($popin.name, url, options);
+                            };
+
+                            // #B54 — reuse a hover/focus preload (warmed OR in-flight) for the
+                            // same URL instead of firing a second identical GET. Mirrors the
+                            // new data-gina-dialog path (openFromTrigger).
+                            if ( consumePreload(url, $popin, doLoad) ) {
+                                return;
+                            }
+                            doLoad();
                         });
 
 
@@ -19003,9 +19058,9 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
          *
          * @example
          * // gina default skeleton:
-         * new PopinHandler({ name: 'form', preOpen: true });
+         * new Popin({ name: 'form', preOpen: true });
          * // consumer markup (delete your own pre-open observer, keep your look):
-         * new PopinHandler({ name: 'form', preOpen: true, loadingShell: '<div class="my-skel">…</div>' });
+         * new Popin({ name: 'form', preOpen: true, loadingShell: '<div class="my-skel">…</div>' });
          */
         function showLoadingShell($popin, $el) {
             // Opt-in only — off unless the popin was registered with `preOpen: true`.