gina 0.5.6 → 0.5.7

package/framework/{v0.5.6 → v0.5.7}/core/server.js

@@ -1282,6 +1282,40 @@ function Server(options) {
     }
 
 
+    /**
+     * Confines a resolved static-asset filename to its intended base directory,
+     * rejecting path-traversal escapes (`../`, and their `%2e%2e` / `%2F` encoded
+     * variants once decoded) that would otherwise canonicalise to a sibling under
+     * the shared root. Both paths are normalised with `path.resolve`, then a
+     * separator-aware containment check is applied so a base of `/srv/app/lib`
+     * cannot be bypassed by a sibling such as `/srv/app/lib-secrets`. Callers must
+     * settle percent-decoding on `filename` BEFORE calling — both static resolvers
+     * `safeDecodeURIComponent()` first, so `%2e%2e` / `%2F` are already `..` / `/`
+     * here. Purely lexical (no symlink following) — matches the existing
+     * CVE-2023-25345 boundary-check idiom in `controller.render-swig.js`.
+     *
+     * @inner
+     * @private
+     * @param {string} filename - The concatenated candidate filesystem path (decoded)
+     * @param {string} base     - The intended base directory (mapping target or publicPath)
+     * @returns {string|null} The canonical in-base path, or `null` when it escapes `base`
+     * @example
+     * confineToBase('/srv/app/js/lib/../../../config/secret.json', '/srv/app/js/lib'); // → null
+     * confineToBase('/srv/app/js/lib/app.js', '/srv/app/js/lib');                      // → '/srv/app/js/lib/app.js'
+     */
+    var confineToBase = function(filename, base) {
+        if ( typeof(filename) != 'string' || typeof(base) != 'string' || base.length === 0 ) {
+            return null;
+        }
+        var _resolvedBase = path.resolve(base);
+        var _resolvedFile = path.resolve(filename);
+        // separator-aware containment: identical to base, or a proper child of it
+        if ( _resolvedFile === _resolvedBase || _resolvedFile.indexOf(_resolvedBase + path.sep) === 0 ) {
+            return _resolvedFile;
+        }
+        return null;
+    }
+
     /**
      * Resolves a request URL to an absolute asset filename by consulting
      * `publicResources`, `staticResources`, reverse-routing aliases, and
@@ -1311,6 +1345,7 @@ function Server(options) {
             , path          = null
             , altConf       = ( typeof(staticProps.firstLevel) != 'undefined' && typeof(self.conf.reverseRouting) != 'undefined' ) ? self.conf.reverseRouting[staticProps.firstLevel] : false
             , backedupPath  = null
+            , _base         = null // #B64 — intended base dir to confine `filename` against
         ;
         if (
             staticProps.isFile && staticsArr.indexOf(url) > -1
@@ -1334,11 +1369,26 @@ function Server(options) {
                 } else {
                     filename = (bundleConf.staticResources.indexOf(path) > -1) ? bundleConf.content.statics[path] + url.replace(path, '/') : bundleConf.content.statics[staticProps.firstLevel] + url.replace(staticProps.firstLevel, '/');
                 }
+                // #B64 path-traversal guard — the mapped filename above is
+                // `<mapping target> + <url remainder>` by raw concatenation, so a
+                // decoded `../` in the remainder escapes the target dir. Capture the
+                // matched mapping target as the base to confine against (below).
+                _base = (bundleConf.staticResources.indexOf(path) > -1) ? bundleConf.content.statics[path] : bundleConf.content.statics[staticProps.firstLevel];
             } else {
                 filename = ( bundleConf.staticResources.indexOf(url) > -1 ) ? bundleConf.content.statics[url] : bundleConf.publicPath + url;
+                // #B64 path-traversal guard — exact-match mapping target, else the
+                // bundle `publicPath` (for the `publicPath + url` fallback).
+                _base    = ( bundleConf.staticResources.indexOf(url) > -1 ) ? bundleConf.content.statics[url] : bundleConf.publicPath;
             }
 
 
+            // #B64 — reject any path that canonicalises outside its base dir
+            // (traversal). Returns notFound (`404.html`) — identical to a missing
+            // file, no distinct signal. Guards every caller (HTTP/2 push, asset
+            // catalog) at this single resolver chokepoint.
+            if ( confineToBase(filename, _base) === null )
+                return notFound;
+
             if ( !fs.existsSync(filename) )
                 return notFound;
 
@@ -2359,6 +2409,10 @@ function Server(options) {
         var isCacheless       = bundleConf.isCacheless;
         // by default
         var filename        = bundleConf.publicPath + pathname;
+        // #B64 path-traversal guard — the intended base dir for `filename`. Starts
+        // at publicPath (the default build above) and is re-pointed to the matched
+        // statics mapping target in each branch below, then confined post-decode.
+        var _staticBase     = bundleConf.publicPath;
         var isFilenameDir   = null
             , stat          = null
             , dirname       = null
@@ -2374,6 +2428,7 @@ function Server(options) {
         var staticIndex     = bundleConf.staticResources.indexOf(pathname);
         if ( staticProps.isStaticFilename && staticIndex > -1 ) {
             filename =  bundleConf.content.statics[ bundleConf.staticResources[staticIndex] ]
+            _staticBase = filename; // #B64 — exact single-file mapping; base = the file itself
         } else {
             var s = 0, sLen = bundleConf.staticResources.length;
             for ( ; s < sLen; ++s ) {
@@ -2383,6 +2438,8 @@ function Server(options) {
                 //                       `staticResources` path.
                 // if ( eval('/^' + bundleConf.staticResources[s].replace(/\//g,'\\/') +'/').test(pathname) ) {
                 if ( new RegExp('^' + bundleConf.staticResources[s].replace(/\//g,'\\/')).test(pathname) ) {
+                    // #B64 — capture the matched mapping target as the confinement base
+                    _staticBase = bundleConf.content.statics[ bundleConf.staticResources[s] ];
                     filename = bundleConf.content.statics[ bundleConf.staticResources[s] ] +'/'+ pathname.replace(bundleConf.staticResources[s], '');
                     break;
                 }
@@ -2393,6 +2450,8 @@ function Server(options) {
                 var key = pathname.replace(pathname.split('/').splice(-1), '');
                 for ( ; s < sLen; ++s ) {
                     if ( bundleConf.staticResources[s] == key ) {
+                        // #B64 — capture the matched mapping target as the confinement base
+                        _staticBase = bundleConf.content.statics[ bundleConf.staticResources[s] ];
                         filename = bundleConf.content.statics[ bundleConf.staticResources[s] ] +'/'+ pathname.replace(bundleConf.staticResources[s], '');
                         break;
                     }
@@ -2410,6 +2469,15 @@ function Server(options) {
         // and crash the bundle. Fall back to the raw filename on a bad escape.
         // was: filename = decodeURIComponent(filename);
         filename = safeDecodeURIComponent(filename);
+        // #B64 path-traversal guard — `filename` above is `<base> + '/' + <url
+        // remainder>` (or `publicPath + pathname`) by raw concatenation, so a
+        // decoded `../` (incl. %2F / %2e%2e, now settled by the line above)
+        // escapes the base dir. Reject anything resolving outside `_staticBase`
+        // with a plain 404 — identical to a missing file, no distinct signal.
+        // Guards BOTH the fs.readFile and fs.createReadStream sinks below.
+        if ( confineToBase(filename, _staticBase) === null ) {
+            return throwError(response, 404, 'Page not found: \n' + pathname, next);
+        }
         let filenameObj = new _(filename, true);
         filenameObj.exists(function onStaticExists(exists) {
         // fs.exists(filename, function onStaticExists(exists) {

package/framework/{v0.5.6 → v0.5.7}/lib/index.js

@@ -84,6 +84,10 @@ function Lib() {
         archiver        : require('./archiver'),
         cmd             : _require('./cmd'),
         SessionStore    : _require('./session-store'),
+        // #AI6 — connector-backed job-store factory (lib/job `start({store})`).
+        // Stateless dispatcher invoked ONCE at boot from gna.js; _require like
+        // SessionStore (no instance/singleton state to protect from eviction).
+        JobStore        : _require('./job-store'),
         SwigFilters     : _require('./swig-filters'),
         Cache           : require('./cache'),    // #B32-residual — plain require (leaf class held at gen-0 via server.isaac.js:35; Cache._events is a Collection). See Collection note above.
         uuid            : require('./uuid'),      // #B32-residual — plain require (pushed as a child of the gen-0 collection module per `new Collection()`). See Collection note above.

package/framework/{v0.5.6 → v0.5.7}/lib/job/src/main.js

@@ -25,14 +25,22 @@
  *     deferred functions run at once; the rest queue. This is the whole point
  *     of moving the work out-of-band — a burst of requests must not fan out
  *     into N unbounded concurrent (and expensive) LLM calls.
- *   - **Pluggable store, memory in v1.** Records persist behind a small
+ *   - **Failed-job retry (opt-in).** `create(fn, { maxAttempts: N })` retries
+ *     a failed attempt with exponential backoff (`retryBackoffMs`, default
+ *     1s, doubling); the record returns to `pending` (last error and
+ *     `nextRetryAt` stay visible) until the final attempt — `failed` is
+ *     strictly terminal. The deferred fn lives only in the creating process,
+ *     so only the origin pod retries; other pods just read records.
+ *   - **Pluggable store, memory by default.** Records persist behind a small
  *     callback-shaped store interface (`set / get / remove / list / sweep`).
- *     v1 ships the in-memory store; a connector-backed store (for multi-pod,
- *     where a job created on one pod is polled on another) is a drop-in
- *     follow-up — no API change, because the interface is callback-shaped
- *     from day one. The deferred *function* always lives in the creating
- *     process's memory (a closure cannot be serialised); only the *record*
- *     (state / result / error) goes in the store.
+ *     The in-memory store is the default; a connector-backed store is a
+ *     drop-in via `start({ store })` — SQLite ships first
+ *     (`core/connectors/sqlite/lib/job-store.js`, wired from `app.json`'s
+ *     `jobs.store` through `lib/job-store`), making records survive a bundle
+ *     restart and readable cross-process. The deferred *function* always
+ *     lives in the creating process's memory (a closure cannot be
+ *     serialised); only the *record* (state / result / error) goes in the
+ *     store.
  *   - **Self-contained TTL sweep.** Terminal (completed / failed) records past
  *     their TTL are purged by an unref'd `setInterval` (the SQLite
  *     session-store cleanup pattern) — NOT `lib/cron`, which is dormant (not
@@ -48,12 +56,18 @@
  *         "maxConcurrency": 4,
  *         "ttl":           3600,
  *         "sweepInterval":  300,
- *         "idSize":          21
+ *         "idSize":          21,
+ *         "retryBackoffMs": 1000,
+ *         "store":         "jobsDb"
  *       }
  *     }
  *
  * `core/gna.js`'s `server.on('started')` callback calls `lib.job.start(...)`
- * once per bundle with this block.
+ * once per bundle with this block. `store` (optional) names a
+ * `config/connectors.json` entry; gna.js resolves it through `lib/job-store`
+ * into a connector-backed store (records survive restarts / are visible
+ * cross-process) and fails the boot if it cannot be built. Absent `store`
+ * means the in-memory store, as before.
  *
  * @package    gina.framework
  * @namespace  lib.job
@@ -74,8 +88,9 @@ var uuid = require('../../uuid/src/main');
 
 /**
  * Job lifecycle states. A job moves `PENDING -> RUNNING -> COMPLETED | FAILED`.
- * A terminal `FAILED` job may be returned to `PENDING` only by an explicit
- * retry (sweeper-driven; not implemented in v1).
+ * With retries (`maxAttempts > 1`) a failed attempt moves `RUNNING -> PENDING`
+ * (rescheduled with backoff on the creating process) — `FAILED` and
+ * `COMPLETED` are strictly terminal.
  *
  * @memberof module:gina/lib/job
  * @constant
@@ -141,6 +156,17 @@ var DEFAULT_WEBHOOK_BACKOFF_MS = 500;
 /** Per-attempt request timeout (ms). @memberof module:gina/lib/job @constant @type {number} */
 var DEFAULT_WEBHOOK_TIMEOUT_MS = 5000;
 
+/**
+ * Default base delay (ms) between attempts of a failed job with retries
+ * remaining (`maxAttempts > 1`) — doubles on each attempt (the webhook-retry
+ * backoff shape).
+ *
+ * @memberof module:gina/lib/job
+ * @constant
+ * @type {number}
+ */
+var DEFAULT_RETRY_BACKOFF_MS = 1000;
+
 /**
  * The active record store (memory store by default). `null` until the first
  * {@link create} or {@link start}.
@@ -191,6 +217,15 @@ var _webhookTimeoutMs = DEFAULT_WEBHOOK_TIMEOUT_MS;
  * @type {?string}
  */
 var _webhookSecret = null;
+/** @inner @type {number} */
+var _retryBackoffMs = DEFAULT_RETRY_BACKOFF_MS;
+/**
+ * Pending retry timers (unref'd). Tracked so {@link reset} can cancel them —
+ * a timer firing after a reset would re-enqueue into a torn-down store.
+ * @inner
+ * @type {Set<*>}
+ */
+var _retryTimers = new Set();
 
 /**
  * No-op callback used when a caller omits one.
@@ -206,14 +241,15 @@ function noop() {}
  * @property {*}           result      - The resolved value once `completed`; `null` otherwise.
  * @property {?{name:string, message:string, stack:?string}} error - Serialised error once `failed`; `null` otherwise.
  * @property {number}      attempts    - How many times the worker has run the function.
- * @property {number}      maxAttempts - Retry ceiling (1 in v1 — retry is a follow-up).
+ * @property {number}      maxAttempts - Retry ceiling (default 1 — run once). Above 1, a failed attempt is retried with backoff on the creating process.
  * @property {?string}     callbackUrl - Webhook URL POSTed `{ id, state, result, error }` on completion when set.
  * @property {?Object}     meta        - Caller-supplied opaque metadata.
  * @property {number}      createdAt   - Epoch ms at creation.
  * @property {number}      updatedAt   - Epoch ms of the last transition.
  * @property {?number}     startedAt   - Epoch ms the worker began; `null` while pending.
  * @property {?number}     finishedAt  - Epoch ms of the terminal transition; `null` until then.
- * @property {?number}     expiresAt   - Epoch ms after which a terminal record is sweepable; `null` until terminal.
+ * @property {?number}     expiresAt   - Epoch ms after which a terminal record is sweepable; `null` until terminal — deliberately including while a retry is pending, so the sweep can never purge a retryable job.
+ * @property {?number}     nextRetryAt - Epoch ms of the next scheduled attempt while a failed attempt awaits its retry; `null` once terminal (absent if the job never settled).
  * @property {?number}     webhookDeliveredAt - Epoch ms a completion webhook succeeded; absent until delivered.
  * @property {?boolean}    webhookFailed      - `true` once webhook delivery exhausts its retries; absent otherwise.
  * @property {?string}     webhookError       - Last webhook failure reason; absent on success.
@@ -377,33 +413,61 @@ function runOne(entry) {
         rec.startedAt = Date.now();
         rec.updatedAt = rec.startedAt;
         rec.attempts  = (rec.attempts || 0) + 1;
+        // Carried to settle() so the retry decision needs no extra store read
+        // (the fn itself rides on the entry — it exists only in this process).
+        entry.attempts    = rec.attempts;
+        entry.maxAttempts = rec.maxAttempts || 1;
         _store.set(id, rec, function() {
             Promise.resolve().then(function() {
                 return entry.fn();
             }).then(function(result) {
-                settle(id, result, null);
+                settle(id, result, null, entry);
             }, function(rejErr) {
-                settle(id, null, rejErr);
+                settle(id, null, rejErr, entry);
             });
         });
     });
 }
 
 /**
- * Write the terminal state for a job, free the worker slot, and pump the
- * queue again.
+ * Route a finished attempt. A failed attempt with retries remaining
+ * (`attempts < maxAttempts`) is rescheduled: the record returns to `pending`
+ * with the serialised failure kept visible and an informational
+ * `nextRetryAt`, while `expiresAt` stays `null` so the sweep can never purge
+ * a retryable job. Otherwise the terminal state is written, the worker slot
+ * freed, and the queue pumped again. `failed` / `completed` are strictly
+ * terminal, and the completion webhook fires only on that final transition.
  *
  * @inner
  * @param   {string} id
  * @param   {*}      result - Resolved value on success.
  * @param   {*}      err    - Thrown / rejected value on failure (mutually exclusive with `result`).
+ * @param   {{id:string, fn:function, attempts:number, maxAttempts:number}} entry - In-process queue entry (carries the deferred fn for a reschedule).
  * @returns {void}
  */
-function settle(id, result, err) {
-    var now   = Date.now();
+function settle(id, result, err, entry) {
+    var now = Date.now();
+
+    // Retry path — only the process that created the job holds the fn, so a
+    // reschedule can only ever originate here: a pod that merely reads the
+    // record through a shared store never reaches this code for that id.
+    if (err && entry && entry.attempts < entry.maxAttempts) {
+        var delay = _retryBackoffMs * Math.pow(2, entry.attempts - 1);
+        update(id, {
+            state:       STATES.PENDING,
+            error:       serializeError(err),
+            nextRetryAt: now + delay
+        }, function() {
+            _running--;
+            drain();
+            scheduleRetry(entry, delay);
+        });
+        return;
+    }
+
     var patch = err
-        ? { state: STATES.FAILED,    error: serializeError(err), finishedAt: now, expiresAt: now + _ttl * 1000 }
-        : { state: STATES.COMPLETED, result: result,             finishedAt: now, expiresAt: now + _ttl * 1000 };
+        ? { state: STATES.FAILED,    error: serializeError(err), nextRetryAt: null, finishedAt: now, expiresAt: now + _ttl * 1000 }
+        : { state: STATES.COMPLETED, result: result, error: null, nextRetryAt: null, finishedAt: now, expiresAt: now + _ttl * 1000 };
 
     update(id, patch, function(uErr, rec) {
         _running--;
@@ -417,6 +481,31 @@ function settle(id, result, err) {
     });
 }
 
+/**
+ * Arm the unref'd backoff timer that re-enqueues a failed attempt's entry.
+ * The timer closure is what keeps the deferred function alive between
+ * attempts (no separate registry). {@link reset} cancels pending timers so
+ * none can fire into a torn-down store, and the timer re-checks the store
+ * before re-queueing (a reset may race an already-elapsed timer). Re-entry
+ * goes through the normal queue, so retries respect `maxConcurrency` like
+ * any other job.
+ *
+ * @inner
+ * @param   {{id:string, fn:function}} entry
+ * @param   {number} delay - Backoff delay (ms).
+ * @returns {void}
+ */
+function scheduleRetry(entry, delay) {
+    var t = setTimeout(function() {
+        _retryTimers.delete(t);
+        if (!_store) return; // reset() raced the timer
+        _queue.push(entry);
+        drain();
+    }, delay);
+    if (t && typeof t.unref === 'function') t.unref();
+    _retryTimers.add(t);
+}
+
 /**
  * Best-effort completion webhook. POSTs `{ id, state, result, error }` to the
  * record's `callbackUrl` with retry/backoff and an optional HMAC signature.
@@ -515,7 +604,13 @@ function retryWebhook(record, payload, attempt, reason) {
 
 /**
  * Get-merge-set a partial patch onto a record. Store-agnostic (works for the
- * sync memory store and a future async connector store).
+ * sync memory store and an async connector store).
+ *
+ * NOT atomic across the get/set pair. Safe because every writer for a given id
+ * runs sequentially by construction — create, then the worker, then settle,
+ * then the webhook outcome, all on the origin pod (other pods only read). Do
+ * not add a concurrent same-id update() caller without adding per-id
+ * serialisation first.
  *
  * @inner
  * @param   {string}   id
@@ -550,7 +645,7 @@ function update(id, patch, cb) {
  * @param   {Object}   [opts]
  * @param   {string}   [opts.callbackUrl]     - Webhook URL notified on completion (consumed by the webhook slice).
  * @param   {Object}   [opts.meta]            - Opaque metadata stored on the record.
- * @param   {number}   [opts.maxAttempts=1]   - Retry ceiling (retry is a follow-up; v1 runs once).
+ * @param   {number}   [opts.maxAttempts=1]   - Retry ceiling. Above 1, a failed attempt is retried on the creating process with exponential backoff (`retryBackoffMs`); `failed` is only ever the state after the last attempt.
  * @returns {string}                          - The job id.
  * @throws  {TypeError}                        - When `fn` is not a function.
  *
@@ -587,10 +682,18 @@ function create(fn, opts) {
         expiresAt:   null
     };
 
-    _store.set(id, record, noop);
     _queue.push({ id: id, fn: fn });
-    // Defer so create() returns the id before the function starts.
-    setImmediate(drain);
+    // Defer so create() returns the id before the function starts — and pump
+    // only once the store has landed the record: with an async connector store
+    // an immediate drain could reach runOne's get() before the set() has
+    // persisted, and the vanished-record guard would silently drop the job.
+    // (The memory store fires this callback synchronously — identical timing.)
+    _store.set(id, record, function(setErr) {
+        if (setErr) {
+            console.warn('[lib.job] create: store.set failed for job `' + id + '` — the job will be dropped: ' + (setErr.message || setErr));
+        }
+        setImmediate(drain);
+    });
     return id;
 }
 
@@ -682,6 +785,7 @@ function sweep(cb) {
  * @param   {number}   [opts.ttl=3600]           - Terminal-record TTL (seconds).
  * @param   {number}   [opts.sweepInterval=300]  - Sweep interval (seconds); `0` disables the internal timer.
  * @param   {number}   [opts.idSize=21]          - jobId length (characters).
+ * @param   {number}   [opts.retryBackoffMs=1000]    - Base delay (ms) between attempts of a failed job with retries remaining; doubles each attempt.
  * @param   {number}   [opts.webhookMaxAttempts=3]   - Completion-webhook retry ceiling.
  * @param   {number}   [opts.webhookBackoffMs=500]   - Webhook backoff base (ms); doubles each retry.
  * @param   {number}   [opts.webhookTimeoutMs=5000]  - Per-attempt webhook request timeout (ms).
@@ -707,6 +811,9 @@ function start(opts) {
     if (typeof opts.idSize === 'number' && opts.idSize > 0) {
         _idSize = Math.floor(opts.idSize);
     }
+    if (typeof opts.retryBackoffMs === 'number' && opts.retryBackoffMs >= 0) {
+        _retryBackoffMs = Math.floor(opts.retryBackoffMs);
+    }
     if (typeof opts.webhookMaxAttempts === 'number' && opts.webhookMaxAttempts > 0) {
         _webhookMaxAttempts = Math.floor(opts.webhookMaxAttempts);
     }
@@ -721,6 +828,12 @@ function start(opts) {
     }
     if (!_store) {
         _store = (opts.store && typeof opts.store === 'object') ? opts.store : createMemoryStore();
+    } else if (opts.store && typeof opts.store === 'object' && opts.store !== _store) {
+        // Store adoption is once-only: a store arriving after one is installed
+        // (e.g. a create() already ran ensureStarted() and defaulted to the
+        // memory store) would strand the earlier records, so it is refused —
+        // loudly, because silently ignoring it loses the configured durability.
+        console.warn('[lib.job] start: a job store is already installed — the `store` option was ignored. Wire `jobs.store` before the first create().');
     }
     ensureSweepTimer();
     return true;
@@ -728,13 +841,14 @@ function start(opts) {
 
 /**
  * Snapshot of worker state. Useful for tests (asserting the concurrency cap)
- * and a future admin view.
+ * and a future admin view. `retryWaiting` counts failed attempts currently
+ * awaiting their backoff timer.
  *
  * @memberof module:gina/lib/job
- * @returns {{running:number, queued:number, maxConcurrency:number}}
+ * @returns {{running:number, queued:number, maxConcurrency:number, retryWaiting:number}}
  */
 function stats() {
-    return { running: _running, queued: _queue.length, maxConcurrency: _maxConcurrency };
+    return { running: _running, queued: _queue.length, maxConcurrency: _maxConcurrency, retryWaiting: _retryTimers.size };
 }
 
 /**
@@ -772,6 +886,8 @@ function reset() {
         clearInterval(_sweepTimer);
         _sweepTimer = null;
     }
+    _retryTimers.forEach(function(t) { clearTimeout(t); });
+    _retryTimers.clear();
     _store          = null;
     _queue          = [];
     _running        = 0;
@@ -783,6 +899,7 @@ function reset() {
     _webhookBackoffMs   = DEFAULT_WEBHOOK_BACKOFF_MS;
     _webhookTimeoutMs   = DEFAULT_WEBHOOK_TIMEOUT_MS;
     _webhookSecret      = null;
+    _retryBackoffMs     = DEFAULT_RETRY_BACKOFF_MS;
 }
 
 module.exports = {
@@ -800,6 +917,7 @@ module.exports = {
     DEFAULT_TTL:            DEFAULT_TTL,
     DEFAULT_SWEEP_INTERVAL: DEFAULT_SWEEP_INTERVAL,
     DEFAULT_ID_SIZE:        DEFAULT_ID_SIZE,
+    DEFAULT_RETRY_BACKOFF_MS: DEFAULT_RETRY_BACKOFF_MS,
     DEFAULT_WEBHOOK_MAX_ATTEMPTS: DEFAULT_WEBHOOK_MAX_ATTEMPTS,
     DEFAULT_WEBHOOK_BACKOFF_MS:   DEFAULT_WEBHOOK_BACKOFF_MS,
     DEFAULT_WEBHOOK_TIMEOUT_MS:   DEFAULT_WEBHOOK_TIMEOUT_MS

package/framework/v0.5.7/lib/job-store.js

@@ -0,0 +1,84 @@
+/*
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+var fs          = require('fs');
+
+var helpers = require('./../helpers');
+var console = require('./logger');
+
+/**
+ * @module lib/job-store
+ * @description Thin factory that loads the connector-specific job-store
+ * implementation from `<connectorsPath>/<connector>/lib/job-store.js` and
+ * returns a ready `JobStore` instance for `lib/job`'s `start({ store })` —
+ * the `lib/session-store` sibling for the async-job primitive (#AI6).
+ *
+ * Do not call this directly — declare the backend in `config/connectors.json`,
+ * point `app.json`'s `jobs.store` at that entry name, and let `gna.js` wire it
+ * at boot (before the first `create()`, since store adoption is once-only).
+ */
+
+/**
+ * Resolve `connName` against the bundle's `connectors.json` and build the
+ * connector-specific job store.
+ *
+ * @class JobStore
+ * @constructor
+ *
+ * @param {string} connName - `connectors.json` entry name (referenced by `app.json`'s
+ *                            `jobs.store`). The entry's `.connector` field selects the
+ *                            implementation (`sqlite` ships first; a connector without a
+ *                            `lib/job-store.js` is rejected).
+ * @returns {object}        - A `JobStore` instance (`set/get/remove/list/sweep`).
+ * @throws {Error}          - When the entry is missing, has no `connector` field, or the
+ *                            connector has no job-store implementation. `gna.js` treats a
+ *                            throw as fatal — an explicitly configured store must build,
+ *                            never degrade silently to the memory store.
+ *
+ * @example
+ *   // app.json:        { "jobs": { "store": "jobsDb" } }
+ *   // connectors.json: { "jobsDb": { "connector": "sqlite", "file": "/data/jobs.db" } }
+ *   var store = new JobStore('jobsDb'); // done by gna.js at boot
+ */
+function JobStore(connName) {
+
+    if (typeof connName !== 'string' || connName.length === 0) {
+        throw new Error('[JobStore] a connectors.json entry name is required (got: ' + JSON.stringify(connName) + ')');
+    }
+
+    var ctx                 = getContext()
+        , bundle            = ctx.bundle
+        , env               = ctx.env
+        , conf              = getConfig()[bundle][env]
+        // Same resolution as lib/session-store (#B10 fix): conf.connectorsPath is
+        // never populated by config.js — use GINA_FRAMEWORK_DIR directly.
+        , connectorsPath    = GINA_FRAMEWORK_DIR + '/core/connectors'
+        , connConf          = null
+        , connector         = null
+    ;
+    try {
+        connConf  = conf.content.connectors[connName];
+        connector = connConf.connector;
+    } catch (err) {
+        throw new Error('[JobStore] could not resolve `' + connName + '`: check your bundle configuration @config/connectors.json\n' + err.stack);
+    }
+    if (!connector) {
+        throw new Error('[JobStore] connectors.json entry `' + connName + '` has no `connector` field');
+    }
+
+    var filename = _(connectorsPath + '/' + connector + '/lib/job-store.js', true);
+
+    if ( !fs.existsSync(filename) ) {
+        throw new Error('[JobStore] connector `' + connector + '` has no job-store implementation (`' + filename + '` is missing)');
+    }
+
+    var store = require(filename)(connConf, bundle);
+    console.debug('[job-store] loaded connector=' + connector + ' bundle=' + bundle + ' (entry: ' + connName + ')');
+    return store;
+};
+
+module.exports = JobStore;

package/framework/{v0.5.6 → v0.5.7}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "dependencies": {
     "@rhinostone/swig": "^2.7.2",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.5.6/core/gna');
+var _gna = require('./framework/v0.5.7/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.5.6/core/controller');
-var EntitySuper     = require('./framework/v0.5.6/core/model/entity');
+var SuperController = require('./framework/v0.5.7/core/controller');
+var EntitySuper     = require('./framework/v0.5.7/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.5.6/lib/uuid');
+var uuid = require('./framework/v0.5.7/lib/uuid');
 
 module.exports = {