gina 0.5.8 → 0.5.9

package/CHANGELOG.md

@@ -6,6 +6,14 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.9 - 2026-07-04
+### Fixed
+* Fixed `connector:add`, `connector:rm`, and `connector:migrate --fix` corrupting a `connectors.json` that carries a comment header. The scaffolded bundle template's example block contains a `{` inside a `//` comment, and the write-back split the file at the first raw `{` — which landed inside that comment, commenting out the JSON body's opening brace and dropping the rest of the header, so the file no longer parsed (`connector:list`, `connector:test`, and the bundle's own connector load then failed). The header/body split is now comment-aware and preserves the full comment header verbatim; a comment-free `connectors.json` rewrites byte-for-byte as before.
+* Fixed a reverse-proxy host-context leak on workers that serve a mix of proxied and direct traffic (or several public hostnames): the server-side URL, redirect, and config resolvers (`self.getConfig()`, `self.redirect()`, server-rendered asset host resolution, and the per-request routing clone) now resolve the host of the request in hand rather than the host of the last proxied request the worker happened to serve. A direct or internal request — and concurrent requests to different public hosts on the same worker — no longer inherit a stale proxied host. Requests without a per-request proxy classification (the Express engine, released responses, and WebSocket-query callers) fall back to the previous worker-global behaviour, so nothing changes for single-public-host-per-worker deployments.
+* Fixed a latent `ReferenceError` in server-side URL-property resolution for routes flagged with a redirect control: a leftover debug statement referenced an undefined variable and would throw whenever the redirect route `toUrl()` was resolved server-side. The stray debug statement has been removed.
+### Security
+* Fixed a browser-side internal-host information disclosure on reverse-proxied deployments. The client gina.config.hostname and the fetched /_gina/assets/routing.json no longer serialize each bundle's internal scheme://host:port to the browser — a proxied client now receives a public host-only origin and a host-stripped routing map, while direct host:port access stays byte-identical. This also fixes cross-bundle client getRoute(...).toUrl(), which previously resolved to the unreachable internal host on such deployments and now resolves same-origin.
+
 ## 0.5.8 - 2026-07-04
 ### Added
 * `gina help <group>` now prints help for that command group (e.g. `gina help bundle` shows the bundle command reference), falling back to the top-level help for an unknown group.

package/README.md

@@ -42,11 +42,12 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.5.8
+## What's in 0.5.9
 
-- **New — `gina connector:models`.** List the model catalogue a configured AI connector's provider can serve: `gina connector:models <connector> @<project> [<bundle>]`. It is the read sibling of `connector:test --connect` — the same credentialed `models.list()` call, but it returns the model list instead of only a count. Text mode prints one model id per line; `--format=json` emits `{ project, connector, provider, count, models }` with each entry passed through verbatim from the provider (only `id` is guaranteed across providers). Resolves config only and never prints credentials; offline providers such as `ollama://` work with no internet.
-- **New — per-group `gina help [<group>]`.** `gina help <group>` (e.g. `gina help framework`) prints just that group's commands, and an unknown action now prints a clean message instead of a raw stack trace.
-- **Fixed — reverse-proxy host context no longer freezes (#B65).** For a bundle behind a reverse proxy, the host context derived from a port-less `Host` header or `X-Forwarded-Host` was captured once at the first proxied request and reused for the life of the worker, so later requests — and internal cross-bundle calls — could build URLs against a stale host. It is now re-derived per request: single-hop and multi-hop (`X-Forwarded-Host`) deployments resolve the correct host, and a bundle accessed directly on `host:port` (no proxy) is unaffected. No configuration change required.
+- **Security — reverse-proxied deployments no longer disclose a bundle's internal host to the browser (#B66).** The client `gina.config.hostname` and the fetched `/_gina/assets/routing.json` no longer serialize each bundle's internal `scheme://host:port` — a proxied client now receives a public host-only origin and a host-stripped routing map, while direct `host:port` access stays byte-identical. This also fixes cross-bundle client `getRoute(...).toUrl()`, which previously resolved to the unreachable internal host on such deployments and now resolves same-origin.
+- **Fixed — server-side proxy host context is request-scoped (#B66).** The server-side URL, redirect, and config resolvers (`self.getConfig()`, `self.redirect()`, server-rendered asset host resolution, and the per-request routing clone) now resolve the host of the request in hand rather than the last proxied host the worker served. A worker that serves a mix of proxied and direct traffic — or several public hostnames — no longer inherits a stale proxied host. Single-public-host-per-worker deployments are unchanged.
+- **Fixed — `connector:add` / `connector:rm` / `connector:migrate --fix` no longer corrupt a comment-headed `connectors.json`.** The header/body split is now comment-aware, so a `connectors.json` that carries a leading comment header (including the scaffolded example block) is preserved verbatim instead of being truncated into an unparseable file. A comment-free `connectors.json` still rewrites byte-for-byte as before.
+- **Fixed — latent `ReferenceError` in server-side URL resolution for redirect routes.** A leftover debug statement referenced an undefined variable and would throw whenever a redirect-flagged route's `toUrl()` was resolved server-side; it has been removed.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -33,6 +33,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.6` ✅ | AI-connector CLI suite — `connector:infer` (one-off inference · `--stream` NDJSON · `--raw`) + `connector:test` (CI readiness probe · `--connect` zero-token live check) · AI connector `stream()` + Inspector "AI stream" tab · application events in the Inspector — `self.emitEvent()` + a new "Events" tab, opt-in entity-event & connector-lifecycle bridges · `getModel()` exposes the AI `infer`/`stream` API · fixes: model-init fail-fast · corrupt `projects.json` registration skipped cleanly · DELETE-route regex flags + off-by-one crash · UTF-8 multipart upload filenames · native `<dialog>` popin close cleanup · Couchbase dynamic field-path placeholder · `project:import` additive across release targets · `gina stop` bundles-still-running notice |
 | **Q3 2026** | `0.5.7` ✅ | Durable async-job stores — `jobs.store` (app.json) → `connectors.json` entry: SQLite (`node:sqlite`, zero new dependencies) · MongoDB (shared mongod, multi-pod) · Redis (`ioredis`, atomic per-state + expiry indexes, Redis Cluster via hash-tagged prefix); restart-durable, cross-process, fail-fast on an unbuildable store · opt-in failed-job retry (`maxAttempts` + exponential backoff; completion webhook fires exactly once) · npm 12 readiness (install + release tooling, `--allow-scripts=gina` guidance) · render-delegate concurrency fixes (production cross-request data bleed / wrong-controller error routing / cached-route 500) · `"connector": "redis"` entry no longer aborts boot · **Security**: static-asset path-traversal fix — resolver paths canonicalised and confined to their `statics.json` mapping target (404 on any escape, `%2F` / `%2e%2e` forms included) |
 | **Q3 2026** | `0.5.8` ✅ | `connector:models` — list a configured AI connector's provider models (the read sibling of `connector:test --connect`) · per-group `gina help [<group>]` · **Fixed**: reverse-proxy host context request-scoped — `PROXY_HOST` / `PROXY_HOSTNAME` no longer freeze at the first proxied request (single-hop and multi-hop `X-Forwarded-Host` both handled; raw `host:port` unchanged) · CLI help polish (per-group help output, clean message for an unknown action, em-dash flag typos) |
+| **Q3 2026** | `0.5.9` ✅ | **Security**: reverse-proxied deployments no longer disclose a bundle's internal `scheme://host:port` to the browser — the client `gina.config.hostname` and the fetched `/_gina/assets/routing.json` serve a public host-only origin and a host-stripped routing map to proxied clients (direct `host:port` access byte-identical), also fixing cross-bundle client `getRoute(...).toUrl()` which previously resolved to the unreachable internal host (#B66) · **Fixed**: the server-side URL / redirect / config resolvers request-scope the proxy host, so a worker serving mixed proxied + direct traffic (or several public hosts) no longer inherits a stale proxied host (#B66 S2b) · **Fixed**: `connector:add` / `connector:rm` / `connector:migrate --fix` no longer corrupt a comment-headed `connectors.json` · **Fixed**: a latent `ReferenceError` in server-side URL resolution for redirect-flagged routes |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 

package/framework/v0.5.9/VERSION

@@ -0,0 +1 @@
+0.5.9

package/framework/{v0.5.8 → v0.5.9}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -5138,7 +5138,6 @@ function Routing() {
             urlProps.hostname   = config.envConf[bundle][env].hostname;
             urlProps.host       = config.envConf[bundle][env].host;
             urlProps.webroot    = config.envConf[bundle][env].server.webroot;
-            console.debug("[self.getUrlProps][isProxyHost = "+ getContext('isProxyHost') +"] hostname ", config.envConf[bundle][env].hostname, vs, process.gina.PROXY_HOSTNAME);
         }
 
         return urlProps;

package/framework/{v0.5.8 → v0.5.9}/core/asset/plugin/dist/vendor/gina/js/gina.min.js

@@ -106,41 +106,41 @@ return u};e.toData=function(){if(k.excluded.length>0)for(var g=0,u=k.excluded.le
 typeof module!=='undefined'&&module.exports?module.exports=FormValidatorUtil:typeof define==='function'&&define.amd&&define('lib/form-validator',[],function(){return FormValidatorUtil});
 function Routing(){var n=typeof module!=='undefined'&&module.exports?!1:!0,F={allowedMethods:['get','post','put','delete'],reservedParams:['controle','file','title','namespace','path'],notFound:{},getInstance:function(p){return Routing.instance}};if(typeof Routing.initialized=='undefined')Routing.initialized=!0,Routing.instance=F,Routing._cached=[],Routing._cachedRoutes={},Routing._tries={};else return F=F.getInstance();F.allowedMethodsString=F.allowedMethods.join(',');var I=null,O=null,G=null;n?
 (O&&typeof O=='function'||(O=require('lib/merge')),G&&typeof G=='function'||(G=require('lib/form-validator'))):(require('fs'),require('util'),require('../../inherits'),O=require('../../merge'),I=require(__dirname+'/../../../core/plugins')||getContext('gina').plugins,G=I.Validator);F.getUrlProps=function(p,k){var e={};if(n){var U=window.gina.config;e.hostname=U.hostname;typeof p!='undefined'&&(p=this.getRoute('webroot@'+p),e.hostname=p.hostname,e.host=p.host,e.webroot=p.webroot)}else U=getContext('gina').config,
-typeof getContext('argvFilename')!='undefined'&&(U.getRouting=getContext('gina').Config.instance.getRouting),typeof p=='undefined'&&(p=U.bundle),typeof k=='undefined'&&(k=U.env),e.hostname=U.envConf[p][k].hostname,e.host=U.envConf[p][k].host,e.webroot=U.envConf[p][k].server.webroot,console.debug('[self.getUrlProps][isProxyHost = '+getContext('isProxyHost')+'] hostname ',U.envConf[p][k].hostname,vs,process.gina.PROXY_HOSTNAME);return e};F.cache=function(p,k,e,U,la){Routing._cached.indexOf(p)==-1&&
-(Routing._cached.length>=5E3&&F.invalidateCached(Routing._cached[0]),Routing._cached.push(p),Routing._cachedRoutes[p]={name:k,routing:e,params:U,methodParams:la})};F.getCached=function(p,k){if(Routing._cached.indexOf(p)>-1){var e=Routing._cachedRoutes[p],U=k.method.toLowerCase();p=JSON.clone(e.routing);e={method:U,requirements:p.requirements,namespace:p.namespace||void 0,url:safeDecodeURI(k.url),rule:p.originalRule||e.name,param:p.param,middleware:p.middleware,bundle:p.bundle,isXMLRequest:k.isXMLRequest,
-isWithCredentials:k.isWithCredentials};typeof p.rule=='undefined'&&typeof e.rule!='undefined'&&(p.rule=e.rule);typeof p.cache!='undefined'&&(e.cache=p.cache);typeof p.csrfExempt!='undefined'&&(e.csrfExempt=p.csrfExempt);typeof p.culturePrefix!='undefined'&&(e.culturePrefix=p.culturePrefix);typeof p.queryTimeout!='undefined'&&(e.queryTimeout=parseTimeout(p.queryTimeout));return F.compareUrls(e,p.url,k)}return null};F.invalidateCached=function(p){Routing._cached.indexOf(p)>-1&&(Routing._cached.splice(Routing._cached.indexOf(p),
-1),delete Routing._cachedRoutes[p])};F.compareUrls=async function(p,k,e,U,la){typeof e=='undefined'&&(e={routing:{}});if(/,/.test(k)){var fa=0;k=k.split(/,/g);for(var x=k.length,v={past:!1,request:e};fa<x&&!v.past;)v=await C(p,k[fa],e,U,la),++fa;return v}return await C(p,k,e,U,la)};var C=async function(p,k,e,U,la){var fa=null;try{fa=p.url.split(/\//)}catch(P){console.warn(P),fa=['']}k=k.split(/\//);var x=0,v=0,Y=k.length,l=0,g={},u=0,J=e.method.toLowerCase(),N='get';try{N=p.method.toLowerCase()}catch(P){}var q=
-!1;if(typeof p.requirements!='undefined'&&/get|delete/i.test(J)&&typeof e[J]!='undefined'||typeof p.requirements!='undefined'&&/get/i.test(J)&&/delete/i.test(N)){/get/i.test(J)&&/delete/i.test(N)&&(J=N);if(/^(delete)$/i.test(J)&&fa.length===k.length){typeof e[J]=='undefined'&&(e[J]={});for(let P=0,ha=k.length;P<ha;P++){if(fa[P]===k[P]){++l;continue}N=k[P].substring(1);if(typeof p.requirements[N]=='undefined')continue;N=p.requirements[N];q='';if(/^\//.test(N))q=N.substring(N.lastIndexOf('/')+1),N=
-N.substring(1,N.lastIndexOf('/'));else if(/^validator::/.test(N)&&await X(k[P],fa[P],p,e,U,la)){++l;continue}/^:/.test(k[P])&&typeof N!='undefined'&&(new RegExp(N,q)).test(fa[P])&&(++l,e[J][k[P].substring(1)]=fa[P])}q=!0}for(var z in e[J])typeof p.requirements[z]!='undefined'&&k.indexOf(':'+z)<0&&(k[v]=':'+z,++v,fa[x]=e[J][z],++x,q||fa.length!==k.length||++Y)}if(!q&&fa.length===k.length)for(;u<Y;++u)fa[u]===k[u]?++l:l==u&&/:/.test(k[u])&&await X(k[u],fa[u],p,e,U,la)&&++l;if(typeof p.requirements!=
-'undefined'&&J==p.method.toLowerCase()&&!q&&l>=Y)for(z=Object.getOwnPropertyNames(p.requirements),x=0,k.join(',').match(/:[-_a-z0-9]+/g);x<z.length;){v=z[x];if(typeof p.param[v]=='undefined'&&/^validator::/i.test(p.requirements[v])){if(k.length!=fa.length)break;var M=k.join(',').match(/:[-_a-z0-9]+/g);let P=p.requirements[v];u={};N={};q={};try{N=JSON.parse(P.split(/::/).splice(1)[0].replace(/([^:"\s+](\w+)):/g,'"$1":').replace(/([^:"\s+](\w+))\s+:/g,'"$1":'))}catch(ha){throw ha;}if(typeof N.query!=
-'undefined'&&typeof N.query.data!='undefined'){u=N.query.data;for(let ha in u)M.indexOf(u[ha])<0&&delete u[ha];for(let ha=0,ma=k.length;ha<ma;ha++){if(!/^:/.test(k[ha]))continue;M=k[ha].replace(/^:/,'');M!=''&&typeof fa[ha]!='undefined'&&(u[M]=fa[ha],typeof e.params[M]=='undefined'&&(e.params[M]=fa[ha]))}}u=O(u,JSON.clone(e[J])||{});typeof u[v]=='undefined'&&(u[v]=null);q[v]=N;_validator=n?new G(u):new G('routing',u,null,q);if(N.count()==0){console.error('Route validation failed '+p.rule);--l;x++;
-continue}for(let ha in N)if(typeof N[ha].data!='undefined'&&(N[ha].data=u),q=Array.isArray(N[ha])?await _validator[v][ha].apply(_validator[v],N[ha]):await _validator[v][ha](N[ha],e,U,la),!q.isValid&&(--l,typeof q.error!='undefined'))throw q.error;}x++}g.past=l===Y?!0:!1;g.past&&(e.routing=Z(p,e[J]),g.request=e);return g},X=async function(p,k,e,U,la,fa){var x=-1,v=p.match(/:\w+/g);x=new RegExp(p,'g');var Y=null,l=null,g=null;Y=!1;var u=Y=l=l=null,J=null,N=U.method.toLowerCase();if(!v.length)return!1;
-e.param.path&&x.test(e.param.path)&&(e.param.path=e.param.path.replace(x,k));e.param.namespace&&x.test(e.param.namespace)&&(e.param.namespace=e.param.namespace.replace(x,k));typeof e.param.file!='undefined'&&/:/.test(e.param.file)&&(Y=new RegExp('(:'+p+'/|:'+p+'$)','g'),E.variable=k,e.param.file=e.param.file.replace(Y,E),Y=null);e.param.title&&x.test(e.param.title)&&(e.param.title=e.param.title.replace(x,k));if(v.length==1){Y=new RegExp(v[0]);x=v.indexOf(p)>-1?v.indexOf(p):!1;x===!1&&p.match(Y)&&
-(x=0);if(x===!1)return x;if(e.method.toLowerCase()!==N)return!1;typeof U[N]=='undefined'&&(U[N]={});g=v[x].substring(1);if(typeof e.requirements=='undefined'||typeof e.requirements[g]=='undefined')return typeof e.param[g]!='undefined'&&typeof U.params!='undefined'&&k?(U.params[g]=k,typeof U[N][g]=='undefined'&&(U[N][g]=k),!0):!1;x=e.requirements[g];if(/^\//.test(x))Y=x.match(/\/(.*)\//).pop(),l=x.replace('/'+Y+'/',''),Y=(new RegExp(Y,l)).test(k);else if(/^validator::/.test(x)&&k){l={};Y={};u={};J=
-'';p.replace(new RegExp('[^'+g+']','g'),function(){J+=arguments[0]});l[g]=k.replace(new RegExp(J,'g'),'');try{Y=JSON.parse(x.split(/::/).splice(1)[0].replace(/([^:"\s+](\w+)):/g,'"$1":').replace(/([^:"\s+](\w+))\s+:/g,'"$1":'))}catch(ha){throw ha;}typeof Y.query!='undefined'&&typeof Y.query.data!='undefined'&&p==Y.query.data[Object.keys(Y.query.data)[0]]&&(Y.query.data[Object.keys(Y.query.data)[0]]=l[g],U.params[g]=l[g]);u[g]=Y;l=new G('routing',l,null,u);if(Y.count()==0)return console.error('Route validation failed '+
-e.rule),!1;for(var q in Y)Array.isArray(Y[q])?await l[g][q].apply(l[g],Y[q]):await l[g][q](Y[q],U,la,fa);Y=l.isValid()}else Y=(new RegExp(e.requirements[g])).test(k);if(typeof e.param[g]!='undefined'&&typeof e.requirements!='undefined'&&typeof e.requirements[g]!='undefined'&&typeof U.params!='undefined'&&Y){U.params[g]=k;if(typeof U[N][g]=='undefined'){switch(k){case 'null':k=null;break;case 'false':k=!1;break;case 'true':k=!0}U[N][g]=k}return!0}}else{if(typeof e.requirements=='undefined')return!1;
-la=e.url;fa=U.url;N={};u='';var z=!1,M=0;q=0;for(var P=fa.length;q<P;++q)if(fa.charAt(q)!=la.charAt(M)||z){if(u=='')z=!0,u+=fa.charAt(q);else if(q>la.indexOf(v[0])+v[0].length){x=e.requirements[v[0]];k=u.substring(0,u.length);if(/^\//.test(x))Y=x.match(/\/(.*)\//).pop(),l=x.replace('/'+Y+'/',''),Y=(new RegExp(Y,l)).test(k);else if(/^validator::/.test(x)){l={};Y={};u={};J='';p.replace(new RegExp('[^'+g[0]+']','g'),function(){J+=arguments[0]});l[g[0]]=k.replace(new RegExp(J,'g'),'');Y=JSON.parse(x.split(/::/).splice(1)[0].replace(/([^\W+ true false])+(\w+)/g,
-'"$&"'));u[g[0]]=Y;l=new G('routing',l,null,u);for(let ha in Y)if(Array.isArray(Y[ha]))l[g[0]][ha].apply(l[g[0]],Y[ha]);else l[g[0]][ha](Y[ha]);Y=l.isValid()}else Y=(new RegExp(e.requirements[g[0]])).test(k);if(Y)N[v[0].substring(1)]=k;else return!1;u='';z=!1;M=la.indexOf(v[0])+v[0].length;--q;v.splice(0,1)}else u+=fa.charAt(q),++M;if(q==P-1)if(x=e.requirements[v[0]],k=u.substring(0,u.length),/^\//.test(x)?(Y=x.match(/\/(.*)\//).pop(),l=x.replace('/'+Y+'/',''),Y=(new RegExp(Y,l)).test(k)):Y=(new RegExp(e.requirements[g])).test(k),
-Y)N[v[0].substring(1)]=k;else return!1}else++M;if(N.count()==v.length){g=null;for(g in N){switch(N[g]){case 'null':N[g]=null;break;case 'false':N[g]=!1;break;case 'true':N[g]=!0}U.params[g]=N[g]}return!0}}return!1},E=function(p){return/\/$/.test(p)?E.variable+'/':E.variable},Z=function(p,k){var e=null,U,la=p.url,fa=null;for(fa in p.param)if((typeof k=='undefined'||typeof k[fa]!='undefined')&&/^:/.test(p.param[fa])){var x=p.param[fa].substring(1);if(typeof k!='undefined'&&typeof k[x]!='undefined'){var v=
-new RegExp('(:'+x+'/|:'+x+'$)','g');typeof p.param.path!='undefined'&&/:/.test(p.param.path)&&(p.param.path=p.param.path.replace(v,k[x]));typeof p.param.title!='undefined'&&/:/.test(p.param.title)&&(p.param.title=p.param.title.replace(v,k[x]));typeof p.param.namespace!='undefined'&&/:/.test(p.param.namespace)&&(p.param.namespace=p.param.namespace.replace(v,k[x]));typeof p.param.file!='undefined'&&/:/.test(p.param.file)&&(E.variable=k[x],p.param.file=p.param.file.replace(v,E));if(/,/.test(p.url)){e=
-p.url.split(/,/g);var Y=0;for(U=e.length;Y<U;++Y)E.variable=k[x],e[Y]=e[Y].replace(v,E);p.url=e.join(',')}else E.variable=k[x],p.url=p.url.replace(v,E)}}if(e){Y=0;U=e.length;la=la.split(/,/g);var l=0;for(p.urlIndex=0;Y<U;++Y)if(e=0,v=la[0].match(/:[-_a-z0-9]+/ig)){fa=0;for(x=v.length;fa<x;fa++){var g=v[fa].substring(1);typeof k[g]!='undefined'&&k[g]&&e++}e>l&&(l=e,p.urlIndex=Y)}}return p};F.getRoute=function(p,k,e){var U=null,la=!1;n?(window.location.port||window.location.hostname!=window.gina.config.hostname.replace(/^(https|http|wss|ws):\/\//,
-'').replace(/:\d+$/,'')||(la=!0,window.gina.config.hostname=window.gina.config.hostname.replace(/^(https|http|wss|ws):\/\//,'').replace(/:\d+$/,'')),U=window.gina.config):(U=getContext('gina').config,typeof getContext('argvFilename')!='undefined'&&(U.getRouting=getContext('gina').Config.instance.getRouting),la=getContext('isProxyHost'));var fa=U.env||GINA_ENV,x=null,v=U.bundle;/@/.test(p)||typeof v=='undefined'||v==null||(p=p.toLowerCase(),p+='@'+v);if(/@/.test(p)){var Y=p.replace(/(.*):\/\//,'').split(/@/);
-v=Y[1];/\/(.*)$/.test(p)&&(x=p.replace(/(.*):\/\//,'').split(/\/(.*)$/)[1],v=v.replace(/\/(.*)$/,''),fa=x||fa);p=Y[0].toLowerCase()+'@'+v}v=U.getRouting(v,fa);if(typeof v[p]=='undefined')throw Error('[ RoutingHelper::getRouting(rule, params) ] : `'+p+'` not found !');x=JSON.clone(v[p]);Y=null;x=Z(x,k);(x.isProxyHost=la)?(x.proxy_hostname=n?window.location.protocol+'//'+document.location.hostname:process.gina.PROXY_HOSTNAME||U.envConf._proxyHostname,x.proxy_host=x.proxy_hostname.replace(/^(https|http):\/\//,
-'')):n||typeof process.gina.PROXY_HOSTNAME=='undefined'||(x.proxy_hostname=process.gina.PROXY_HOSTNAME,x.proxy_host=x.proxy_hostname.replace(/^(https|http):\/\//,''),console.debug('[getRoute#2]['+la+'] process.gina.PROXY_HOSTNAME ('+process.gina.PROXY_HOSTNAME+') VS config.envConf._proxyHostname ('+U.envConf._proxyHostname+')'));/,/.test(x.url)&&(typeof x.urlIndex!='undefined'&&(e=x.urlIndex,delete x.urlIndex),e=typeof e!='undefined'?e:0,x.url=x.url.split(/,/g)[e]);/\/$/.test(x.url)&&x.url!='/'&&
-(x.url=x.url.substring(0,x.url.length-1));if(/GET/i.test(x.method)&&typeof k!='undefined'){e='?';U=v[p].url;la=[];v=0;for(let l in x.param)F.reservedParams.indexOf(l)>-1||(new RegExp(x.param[l])).test(U)||typeof k[l]=='undefined'||(e+=l+'='+encodeRFC5987ValueChars(k[l])+'&',la[v]=k[l],++v);for(let l in k)F.reservedParams.indexOf(l)>-1||typeof x.requirements[l]!='undefined'||la.indexOf(l)>-1||(e=typeof k[l]=='object'?e+(l+'='+encodeRFC5987ValueChars(JSON.stringify(k[l]))+'&'):e+(l+'='+k[l]+'&'));v=
-la=U=null;e.length>1&&(e=e.substring(0,e.length-1),x.url+=e);e=null}x.toUrl=function(l){var g=null;/^redirect$/i.test(this.param.control)&&(g=F.getUrlProps(this.bundle,fa||GINA_ENV));var u=this.webroot||g.webroot;g=''+this.hostname||''+g.hostname;var J=''+this.url;this.isProxyHost&&(g=''+this.proxy_hostname);this.url=typeof l!='undefined'&&/^true$/i.test(l)?J.replace(new RegExp('^'+u),'/'):J.replace(new RegExp('^('+u+'|/$)'),u);return g+this.url};x.request=function(l,g){var u=null,J=null;typeof arguments[arguments.length-
-1]=='function'&&(u=arguments[arguments.length-1]);typeof arguments[2]=='object'&&(J=arguments[2]);var N=this.webroot||J.webroot,q=this.hostname||J.hostname;J=typeof l!='undefined'&&l==1?path.replace(N,'/'):this.url||J.url;/^\//.test(J)&&(J=q+J);q=/^https/.test(q)?'https':'http';n?window.open(J,typeof g!='undefined'&&typeof g.target!='undefined'?g.target:'_self'):(typeof g.agent=='undefined'&&(g.agent=!1),q=require(''+q),N=function(z){var M='',P=!1;z.on('data',function(ha){M+=ha});z.on('error',function(ha){P=
-'Failed to get mail content';ha&&typeof ha.stack!='undefined'?P+=ha.stack:typeof ha=='string'&&(P+='\n'+ha)});z.on('end',function(){if(/^\{/.test(M))try{M=JSON.parse(M),typeof M.error!='undefined'&&(P=JSON.clone(M),M=null)}catch(ha){P=ha}P?u(P):u(!1,M)})},u?q.get(J,g,N):q.get(J,g))};!/:/.test(x.url)||/:d+\//.test(x.url)||/:\/\//.test(x.url)||(k=x.url.match(/(:(.*)\/|:(.*)$)/g).map(function(l){return l.replace(/\//g,'')}).join(', '),Y='[ RoutingHelper::getRoute(rule[, bundle, method]) ] : route [ %r ] param placeholder not defined: `'+
-x.url+'` !\n Check your route description to compare requirements against param variables [ '+k+']',Y=Y.replace(/%r/,p),p=Error(Y),console.warn(p),Y=p=k=null);return x};F.getRouteByUrl=function(p,k,e,U,la){arguments.length==2&&typeof arguments[1]!='undefined'&&arguments[1]&&F.allowedMethods.indexOf(arguments[1].toLowerCase())>-1&&(e=arguments[1],k=void 0);var fa=null,x=null,v=null,Y=null,l=null,g=null;if(/#/.test(p)&&p.length>1){var u=p.split(/#/);p=u[0];l='#'+u[1];u=null}arguments.length==1&&typeof arguments[0]!=
-'undefined'&&(/^(https|http)/i.test(p)||/^\//.test(p)||(p='/'+p),fa='/'+p.split(/\//g)[1],n&&(Y=gina.config.reverseRouting,v=gina.config.routing),typeof Y[fa]!='undefined'&&(u=v[Y[fa]],k=u.bundle,fa=u.webroot,g=u.hostname,u=null));la=typeof arguments[arguments.length-1]!='boolean'?!1:arguments[arguments.length-1];var J=!1,N=null,q=Y=N=Y=null;u=typeof e!='undefined'?!0:!1;n?(N=window.gina.config,k=typeof k!='undefined'?k:N.bundle,Y=N.env,v=N.routing||N.getRouting(k),Y=N.reverseRouting,isXMLRequest=
-typeof isXMLRequest!='undefined'?isXMLRequest:!1,g=g||N.hostname,fa=fa||N.webroot,U={routing:{},method:e,params:{},url:p},k&&(U.bundle=k)):(N=getContext('gina').config,k=typeof k!='undefined'?k:N.bundle,Y=N.env,v=N.getRouting(k),g=N.envConf[k][Y].hostname,fa=N.envConf[k][Y].server.webroot,U||={routing:{},isXMLRequest:!1,method:typeof e!='undefined'?e.toLowerCase():'get',params:{},url:p},la&&(U.method=e),isXMLRequest=U.isXMLRequest||!1);N=p.replace(new RegExp('^('+g+'|'+g.replace(/:\d+/,'')+')'),'');
-typeof U.routing.path=='undefined'&&(U.routing.path=safeDecodeURI(N));e=typeof e!='undefined'?e.toLowerCase():'get';u&&(U.originalMethod=U.method,U.method=e,U.routing.path=safeDecodeURI(N));U.method||(U.method=e);Y={};fa=new RegExp(e,'i');g=null;for(z in v){if(typeof v[z].param=='undefined')break;if(v[z].bundle==k&&(g=v[z].method,/,/.test(g)&&fa.test(g)&&(g=U.method),typeof v[z].method=='undefined'||fa.test(g))){Y={method:g,requirements:v[z].requirements,namespace:v[z].namespace||void 0,url:safeDecodeURI(N),
-rule:v[z].originalRule||z,param:JSON.clone(v[z].param),middleware:JSON.clone(v[z].middleware),bundle:v[z].bundle,isXMLRequest};try{if(q=F.compareUrls(Y,v[z].url,U),q.past){x=JSON.clone(v[z]);x.name=z;x.param=Y.param;J=!0;q={};break}}catch(M){throw Error('Route [ '+z+' ] needs your attention.\n'+M.stack);}}}if(J)return/\/$/.test(p)&&p!='/'&&(p=p.substring(0,p.length-1)),l&&(p+=l),x.url=p,x.toUrl=function(M){var P=this.webroot,ha=this.hostname,ma=this.url;this.url=typeof M!='undefined'&&M==1?ma.replace(P,
-'/'):ma;return ha+this.url},x;if(n){var z=!1;if(p=='#'&&/GET/i.test(e)&&u||/^404:/.test(p))p=location.pathname,z=!0;typeof F.notFound=='undefined'&&(F.notFound={});l=null;x='[ RoutingHelper::getRouteByUrl(rule[, bundle, method]) ] : route [ %r ] is called but not found inside your view: `'+p+'` !';if((l=(l=gina.hasPopinHandler&&gina.popinIsBinded?gina.popin.getActivePopin().target.innerHTML.match(/404:\[\w+\][a-z 0-9-_@]+/):document.body.innerHTML.match(/404:\[\w+\][a-z 0-9-_@]+/))&&l.length>0?l[0]:
-null)&&u&&z)return z=l.match(/\[\w+\]/)[0],l=l.replace('404:'+z,z.replace(/\[|\]/g,'')+'::'),x=x.replace(/%r/,l.replace(/404:\s+/,'')),typeof F.notFound[l]=='undefined'?F.notFound[l]={count:1,message:x}:u&&typeof F.notFound[l]!='undefined'&&++F.notFound[l].count,!1;if((z=gina.config.reverseRouting[p]||null)&&typeof z!='undefined'&&z.split(/@(.+)$/)[1]==k)return l=z,typeof F.notFound[l]=='undefined'?(x=x.replace(/%r/,e.toUpperCase()+'::'+z),F.notFound[l]={count:1,message:x}):u&&typeof F.notFound[l]!=
-'undefined'&&++F.notFound[l].count,!1;l=F.compareUrls(Y,p,U)||null;l.past&&u&&(l=e.toUpperCase()+'::'+l.request.routing.rule,typeof F.notFound[l]=='undefined'?x=x.replace(/%r/,l):++F.notFound[l].count);return!1}console.warn(Error('[ RoutingHelper::getRouteByUrl(rule[, bundle, method, request]) ] : route not found for url: `'+p+'` !').stack);return!1};F.buildTrie=function(p,k){if(!n){var e=require('./radix'),U=e.createNode(),la;for(la in p){var fa=p[la];if(fa&&typeof fa==='object'&&fa.bundle===k){fa=
-Array.isArray(fa.url)?fa.url:String(fa.url).split(',');for(var x=0;x<fa.length;x++){var v=fa[x].trim();v&&e.insert(U,v,la)}}}Routing._tries[k]=U}};F.lookupTrie=function(p,k){return Routing._tries&&Routing._tries[k]?require('./radix').lookup(Routing._tries[k],p):null};return F}
-typeof module!=='undefined'&&module.exports?(typeof console.err=='undefined'&&(console=require('../../logger')),module.exports=Routing()):typeof define==='function'&&define.amd&&define('lib/routing',['require','lib/form-validator','lib/merge'],function(){return Routing()});function registerEvents(n,F){typeof gina=='undefined'&&typeof window.gina!='undefined'&&(gina=window.gina);gina.registeredEvents[n]=F}function mergeEventProps(n,F){for(let I in F)typeof n[I]=='undefined'&&(n[I]=F[I]);return n}
+typeof getContext('argvFilename')!='undefined'&&(U.getRouting=getContext('gina').Config.instance.getRouting),typeof p=='undefined'&&(p=U.bundle),typeof k=='undefined'&&(k=U.env),e.hostname=U.envConf[p][k].hostname,e.host=U.envConf[p][k].host,e.webroot=U.envConf[p][k].server.webroot;return e};F.cache=function(p,k,e,U,la){Routing._cached.indexOf(p)==-1&&(Routing._cached.length>=5E3&&F.invalidateCached(Routing._cached[0]),Routing._cached.push(p),Routing._cachedRoutes[p]={name:k,routing:e,params:U,methodParams:la})};
+F.getCached=function(p,k){if(Routing._cached.indexOf(p)>-1){var e=Routing._cachedRoutes[p],U=k.method.toLowerCase();p=JSON.clone(e.routing);e={method:U,requirements:p.requirements,namespace:p.namespace||void 0,url:safeDecodeURI(k.url),rule:p.originalRule||e.name,param:p.param,middleware:p.middleware,bundle:p.bundle,isXMLRequest:k.isXMLRequest,isWithCredentials:k.isWithCredentials};typeof p.rule=='undefined'&&typeof e.rule!='undefined'&&(p.rule=e.rule);typeof p.cache!='undefined'&&(e.cache=p.cache);
+typeof p.csrfExempt!='undefined'&&(e.csrfExempt=p.csrfExempt);typeof p.culturePrefix!='undefined'&&(e.culturePrefix=p.culturePrefix);typeof p.queryTimeout!='undefined'&&(e.queryTimeout=parseTimeout(p.queryTimeout));return F.compareUrls(e,p.url,k)}return null};F.invalidateCached=function(p){Routing._cached.indexOf(p)>-1&&(Routing._cached.splice(Routing._cached.indexOf(p),1),delete Routing._cachedRoutes[p])};F.compareUrls=async function(p,k,e,U,la){typeof e=='undefined'&&(e={routing:{}});if(/,/.test(k)){var fa=
+0;k=k.split(/,/g);for(var x=k.length,v={past:!1,request:e};fa<x&&!v.past;)v=await C(p,k[fa],e,U,la),++fa;return v}return await C(p,k,e,U,la)};var C=async function(p,k,e,U,la){var fa=null;try{fa=p.url.split(/\//)}catch(P){console.warn(P),fa=['']}k=k.split(/\//);var x=0,v=0,Y=k.length,l=0,g={},u=0,J=e.method.toLowerCase(),N='get';try{N=p.method.toLowerCase()}catch(P){}var q=!1;if(typeof p.requirements!='undefined'&&/get|delete/i.test(J)&&typeof e[J]!='undefined'||typeof p.requirements!='undefined'&&
+/get/i.test(J)&&/delete/i.test(N)){/get/i.test(J)&&/delete/i.test(N)&&(J=N);if(/^(delete)$/i.test(J)&&fa.length===k.length){typeof e[J]=='undefined'&&(e[J]={});for(let P=0,ha=k.length;P<ha;P++){if(fa[P]===k[P]){++l;continue}N=k[P].substring(1);if(typeof p.requirements[N]=='undefined')continue;N=p.requirements[N];q='';if(/^\//.test(N))q=N.substring(N.lastIndexOf('/')+1),N=N.substring(1,N.lastIndexOf('/'));else if(/^validator::/.test(N)&&await X(k[P],fa[P],p,e,U,la)){++l;continue}/^:/.test(k[P])&&typeof N!=
+'undefined'&&(new RegExp(N,q)).test(fa[P])&&(++l,e[J][k[P].substring(1)]=fa[P])}q=!0}for(var z in e[J])typeof p.requirements[z]!='undefined'&&k.indexOf(':'+z)<0&&(k[v]=':'+z,++v,fa[x]=e[J][z],++x,q||fa.length!==k.length||++Y)}if(!q&&fa.length===k.length)for(;u<Y;++u)fa[u]===k[u]?++l:l==u&&/:/.test(k[u])&&await X(k[u],fa[u],p,e,U,la)&&++l;if(typeof p.requirements!='undefined'&&J==p.method.toLowerCase()&&!q&&l>=Y)for(z=Object.getOwnPropertyNames(p.requirements),x=0,k.join(',').match(/:[-_a-z0-9]+/g);x<
+z.length;){v=z[x];if(typeof p.param[v]=='undefined'&&/^validator::/i.test(p.requirements[v])){if(k.length!=fa.length)break;var M=k.join(',').match(/:[-_a-z0-9]+/g);let P=p.requirements[v];u={};N={};q={};try{N=JSON.parse(P.split(/::/).splice(1)[0].replace(/([^:"\s+](\w+)):/g,'"$1":').replace(/([^:"\s+](\w+))\s+:/g,'"$1":'))}catch(ha){throw ha;}if(typeof N.query!='undefined'&&typeof N.query.data!='undefined'){u=N.query.data;for(let ha in u)M.indexOf(u[ha])<0&&delete u[ha];for(let ha=0,ma=k.length;ha<
+ma;ha++){if(!/^:/.test(k[ha]))continue;M=k[ha].replace(/^:/,'');M!=''&&typeof fa[ha]!='undefined'&&(u[M]=fa[ha],typeof e.params[M]=='undefined'&&(e.params[M]=fa[ha]))}}u=O(u,JSON.clone(e[J])||{});typeof u[v]=='undefined'&&(u[v]=null);q[v]=N;_validator=n?new G(u):new G('routing',u,null,q);if(N.count()==0){console.error('Route validation failed '+p.rule);--l;x++;continue}for(let ha in N)if(typeof N[ha].data!='undefined'&&(N[ha].data=u),q=Array.isArray(N[ha])?await _validator[v][ha].apply(_validator[v],
+N[ha]):await _validator[v][ha](N[ha],e,U,la),!q.isValid&&(--l,typeof q.error!='undefined'))throw q.error;}x++}g.past=l===Y?!0:!1;g.past&&(e.routing=Z(p,e[J]),g.request=e);return g},X=async function(p,k,e,U,la,fa){var x=-1,v=p.match(/:\w+/g);x=new RegExp(p,'g');var Y=null,l=null,g=null;Y=!1;var u=Y=l=l=null,J=null,N=U.method.toLowerCase();if(!v.length)return!1;e.param.path&&x.test(e.param.path)&&(e.param.path=e.param.path.replace(x,k));e.param.namespace&&x.test(e.param.namespace)&&(e.param.namespace=
+e.param.namespace.replace(x,k));typeof e.param.file!='undefined'&&/:/.test(e.param.file)&&(Y=new RegExp('(:'+p+'/|:'+p+'$)','g'),E.variable=k,e.param.file=e.param.file.replace(Y,E),Y=null);e.param.title&&x.test(e.param.title)&&(e.param.title=e.param.title.replace(x,k));if(v.length==1){Y=new RegExp(v[0]);x=v.indexOf(p)>-1?v.indexOf(p):!1;x===!1&&p.match(Y)&&(x=0);if(x===!1)return x;if(e.method.toLowerCase()!==N)return!1;typeof U[N]=='undefined'&&(U[N]={});g=v[x].substring(1);if(typeof e.requirements==
+'undefined'||typeof e.requirements[g]=='undefined')return typeof e.param[g]!='undefined'&&typeof U.params!='undefined'&&k?(U.params[g]=k,typeof U[N][g]=='undefined'&&(U[N][g]=k),!0):!1;x=e.requirements[g];if(/^\//.test(x))Y=x.match(/\/(.*)\//).pop(),l=x.replace('/'+Y+'/',''),Y=(new RegExp(Y,l)).test(k);else if(/^validator::/.test(x)&&k){l={};Y={};u={};J='';p.replace(new RegExp('[^'+g+']','g'),function(){J+=arguments[0]});l[g]=k.replace(new RegExp(J,'g'),'');try{Y=JSON.parse(x.split(/::/).splice(1)[0].replace(/([^:"\s+](\w+)):/g,
+'"$1":').replace(/([^:"\s+](\w+))\s+:/g,'"$1":'))}catch(ha){throw ha;}typeof Y.query!='undefined'&&typeof Y.query.data!='undefined'&&p==Y.query.data[Object.keys(Y.query.data)[0]]&&(Y.query.data[Object.keys(Y.query.data)[0]]=l[g],U.params[g]=l[g]);u[g]=Y;l=new G('routing',l,null,u);if(Y.count()==0)return console.error('Route validation failed '+e.rule),!1;for(var q in Y)Array.isArray(Y[q])?await l[g][q].apply(l[g],Y[q]):await l[g][q](Y[q],U,la,fa);Y=l.isValid()}else Y=(new RegExp(e.requirements[g])).test(k);
+if(typeof e.param[g]!='undefined'&&typeof e.requirements!='undefined'&&typeof e.requirements[g]!='undefined'&&typeof U.params!='undefined'&&Y){U.params[g]=k;if(typeof U[N][g]=='undefined'){switch(k){case 'null':k=null;break;case 'false':k=!1;break;case 'true':k=!0}U[N][g]=k}return!0}}else{if(typeof e.requirements=='undefined')return!1;la=e.url;fa=U.url;N={};u='';var z=!1,M=0;q=0;for(var P=fa.length;q<P;++q)if(fa.charAt(q)!=la.charAt(M)||z){if(u=='')z=!0,u+=fa.charAt(q);else if(q>la.indexOf(v[0])+
+v[0].length){x=e.requirements[v[0]];k=u.substring(0,u.length);if(/^\//.test(x))Y=x.match(/\/(.*)\//).pop(),l=x.replace('/'+Y+'/',''),Y=(new RegExp(Y,l)).test(k);else if(/^validator::/.test(x)){l={};Y={};u={};J='';p.replace(new RegExp('[^'+g[0]+']','g'),function(){J+=arguments[0]});l[g[0]]=k.replace(new RegExp(J,'g'),'');Y=JSON.parse(x.split(/::/).splice(1)[0].replace(/([^\W+ true false])+(\w+)/g,'"$&"'));u[g[0]]=Y;l=new G('routing',l,null,u);for(let ha in Y)if(Array.isArray(Y[ha]))l[g[0]][ha].apply(l[g[0]],
+Y[ha]);else l[g[0]][ha](Y[ha]);Y=l.isValid()}else Y=(new RegExp(e.requirements[g[0]])).test(k);if(Y)N[v[0].substring(1)]=k;else return!1;u='';z=!1;M=la.indexOf(v[0])+v[0].length;--q;v.splice(0,1)}else u+=fa.charAt(q),++M;if(q==P-1)if(x=e.requirements[v[0]],k=u.substring(0,u.length),/^\//.test(x)?(Y=x.match(/\/(.*)\//).pop(),l=x.replace('/'+Y+'/',''),Y=(new RegExp(Y,l)).test(k)):Y=(new RegExp(e.requirements[g])).test(k),Y)N[v[0].substring(1)]=k;else return!1}else++M;if(N.count()==v.length){g=null;
+for(g in N){switch(N[g]){case 'null':N[g]=null;break;case 'false':N[g]=!1;break;case 'true':N[g]=!0}U.params[g]=N[g]}return!0}}return!1},E=function(p){return/\/$/.test(p)?E.variable+'/':E.variable},Z=function(p,k){var e=null,U,la=p.url,fa=null;for(fa in p.param)if((typeof k=='undefined'||typeof k[fa]!='undefined')&&/^:/.test(p.param[fa])){var x=p.param[fa].substring(1);if(typeof k!='undefined'&&typeof k[x]!='undefined'){var v=new RegExp('(:'+x+'/|:'+x+'$)','g');typeof p.param.path!='undefined'&&/:/.test(p.param.path)&&
+(p.param.path=p.param.path.replace(v,k[x]));typeof p.param.title!='undefined'&&/:/.test(p.param.title)&&(p.param.title=p.param.title.replace(v,k[x]));typeof p.param.namespace!='undefined'&&/:/.test(p.param.namespace)&&(p.param.namespace=p.param.namespace.replace(v,k[x]));typeof p.param.file!='undefined'&&/:/.test(p.param.file)&&(E.variable=k[x],p.param.file=p.param.file.replace(v,E));if(/,/.test(p.url)){e=p.url.split(/,/g);var Y=0;for(U=e.length;Y<U;++Y)E.variable=k[x],e[Y]=e[Y].replace(v,E);p.url=
+e.join(',')}else E.variable=k[x],p.url=p.url.replace(v,E)}}if(e){Y=0;U=e.length;la=la.split(/,/g);var l=0;for(p.urlIndex=0;Y<U;++Y)if(e=0,v=la[0].match(/:[-_a-z0-9]+/ig)){fa=0;for(x=v.length;fa<x;fa++){var g=v[fa].substring(1);typeof k[g]!='undefined'&&k[g]&&e++}e>l&&(l=e,p.urlIndex=Y)}}return p};F.getRoute=function(p,k,e){var U=null,la=!1;n?(window.location.port||window.location.hostname!=window.gina.config.hostname.replace(/^(https|http|wss|ws):\/\//,'').replace(/:\d+$/,'')||(la=!0,window.gina.config.hostname=
+window.gina.config.hostname.replace(/^(https|http|wss|ws):\/\//,'').replace(/:\d+$/,'')),U=window.gina.config):(U=getContext('gina').config,typeof getContext('argvFilename')!='undefined'&&(U.getRouting=getContext('gina').Config.instance.getRouting),la=getContext('isProxyHost'));var fa=U.env||GINA_ENV,x=null,v=U.bundle;/@/.test(p)||typeof v=='undefined'||v==null||(p=p.toLowerCase(),p+='@'+v);if(/@/.test(p)){var Y=p.replace(/(.*):\/\//,'').split(/@/);v=Y[1];/\/(.*)$/.test(p)&&(x=p.replace(/(.*):\/\//,
+'').split(/\/(.*)$/)[1],v=v.replace(/\/(.*)$/,''),fa=x||fa);p=Y[0].toLowerCase()+'@'+v}v=U.getRouting(v,fa);if(typeof v[p]=='undefined')throw Error('[ RoutingHelper::getRouting(rule, params) ] : `'+p+'` not found !');x=JSON.clone(v[p]);Y=null;x=Z(x,k);(x.isProxyHost=la)?(x.proxy_hostname=n?window.location.protocol+'//'+document.location.hostname:process.gina.PROXY_HOSTNAME||U.envConf._proxyHostname,x.proxy_host=x.proxy_hostname.replace(/^(https|http):\/\//,'')):n||typeof process.gina.PROXY_HOSTNAME==
+'undefined'||(x.proxy_hostname=process.gina.PROXY_HOSTNAME,x.proxy_host=x.proxy_hostname.replace(/^(https|http):\/\//,''),console.debug('[getRoute#2]['+la+'] process.gina.PROXY_HOSTNAME ('+process.gina.PROXY_HOSTNAME+') VS config.envConf._proxyHostname ('+U.envConf._proxyHostname+')'));/,/.test(x.url)&&(typeof x.urlIndex!='undefined'&&(e=x.urlIndex,delete x.urlIndex),e=typeof e!='undefined'?e:0,x.url=x.url.split(/,/g)[e]);/\/$/.test(x.url)&&x.url!='/'&&(x.url=x.url.substring(0,x.url.length-1));if(/GET/i.test(x.method)&&
+typeof k!='undefined'){e='?';U=v[p].url;la=[];v=0;for(let l in x.param)F.reservedParams.indexOf(l)>-1||(new RegExp(x.param[l])).test(U)||typeof k[l]=='undefined'||(e+=l+'='+encodeRFC5987ValueChars(k[l])+'&',la[v]=k[l],++v);for(let l in k)F.reservedParams.indexOf(l)>-1||typeof x.requirements[l]!='undefined'||la.indexOf(l)>-1||(e=typeof k[l]=='object'?e+(l+'='+encodeRFC5987ValueChars(JSON.stringify(k[l]))+'&'):e+(l+'='+k[l]+'&'));v=la=U=null;e.length>1&&(e=e.substring(0,e.length-1),x.url+=e);e=null}x.toUrl=
+function(l){var g=null;/^redirect$/i.test(this.param.control)&&(g=F.getUrlProps(this.bundle,fa||GINA_ENV));var u=this.webroot||g.webroot;g=''+this.hostname||''+g.hostname;var J=''+this.url;this.isProxyHost&&(g=''+this.proxy_hostname);this.url=typeof l!='undefined'&&/^true$/i.test(l)?J.replace(new RegExp('^'+u),'/'):J.replace(new RegExp('^('+u+'|/$)'),u);return g+this.url};x.request=function(l,g){var u=null,J=null;typeof arguments[arguments.length-1]=='function'&&(u=arguments[arguments.length-1]);
+typeof arguments[2]=='object'&&(J=arguments[2]);var N=this.webroot||J.webroot,q=this.hostname||J.hostname;J=typeof l!='undefined'&&l==1?path.replace(N,'/'):this.url||J.url;/^\//.test(J)&&(J=q+J);q=/^https/.test(q)?'https':'http';n?window.open(J,typeof g!='undefined'&&typeof g.target!='undefined'?g.target:'_self'):(typeof g.agent=='undefined'&&(g.agent=!1),q=require(''+q),N=function(z){var M='',P=!1;z.on('data',function(ha){M+=ha});z.on('error',function(ha){P='Failed to get mail content';ha&&typeof ha.stack!=
+'undefined'?P+=ha.stack:typeof ha=='string'&&(P+='\n'+ha)});z.on('end',function(){if(/^\{/.test(M))try{M=JSON.parse(M),typeof M.error!='undefined'&&(P=JSON.clone(M),M=null)}catch(ha){P=ha}P?u(P):u(!1,M)})},u?q.get(J,g,N):q.get(J,g))};!/:/.test(x.url)||/:d+\//.test(x.url)||/:\/\//.test(x.url)||(k=x.url.match(/(:(.*)\/|:(.*)$)/g).map(function(l){return l.replace(/\//g,'')}).join(', '),Y='[ RoutingHelper::getRoute(rule[, bundle, method]) ] : route [ %r ] param placeholder not defined: `'+x.url+'` !\n Check your route description to compare requirements against param variables [ '+
+k+']',Y=Y.replace(/%r/,p),p=Error(Y),console.warn(p),Y=p=k=null);return x};F.getRouteByUrl=function(p,k,e,U,la){arguments.length==2&&typeof arguments[1]!='undefined'&&arguments[1]&&F.allowedMethods.indexOf(arguments[1].toLowerCase())>-1&&(e=arguments[1],k=void 0);var fa=null,x=null,v=null,Y=null,l=null,g=null;if(/#/.test(p)&&p.length>1){var u=p.split(/#/);p=u[0];l='#'+u[1];u=null}arguments.length==1&&typeof arguments[0]!='undefined'&&(/^(https|http)/i.test(p)||/^\//.test(p)||(p='/'+p),fa='/'+p.split(/\//g)[1],
+n&&(Y=gina.config.reverseRouting,v=gina.config.routing),typeof Y[fa]!='undefined'&&(u=v[Y[fa]],k=u.bundle,fa=u.webroot,g=u.hostname,u=null));la=typeof arguments[arguments.length-1]!='boolean'?!1:arguments[arguments.length-1];var J=!1,N=null,q=Y=N=Y=null;u=typeof e!='undefined'?!0:!1;n?(N=window.gina.config,k=typeof k!='undefined'?k:N.bundle,Y=N.env,v=N.routing||N.getRouting(k),Y=N.reverseRouting,isXMLRequest=typeof isXMLRequest!='undefined'?isXMLRequest:!1,g=g||N.hostname,fa=fa||N.webroot,U={routing:{},
+method:e,params:{},url:p},k&&(U.bundle=k)):(N=getContext('gina').config,k=typeof k!='undefined'?k:N.bundle,Y=N.env,v=N.getRouting(k),g=N.envConf[k][Y].hostname,fa=N.envConf[k][Y].server.webroot,U||={routing:{},isXMLRequest:!1,method:typeof e!='undefined'?e.toLowerCase():'get',params:{},url:p},la&&(U.method=e),isXMLRequest=U.isXMLRequest||!1);N=p.replace(new RegExp('^('+g+'|'+g.replace(/:\d+/,'')+')'),'');typeof U.routing.path=='undefined'&&(U.routing.path=safeDecodeURI(N));e=typeof e!='undefined'?
+e.toLowerCase():'get';u&&(U.originalMethod=U.method,U.method=e,U.routing.path=safeDecodeURI(N));U.method||(U.method=e);Y={};fa=new RegExp(e,'i');g=null;for(z in v){if(typeof v[z].param=='undefined')break;if(v[z].bundle==k&&(g=v[z].method,/,/.test(g)&&fa.test(g)&&(g=U.method),typeof v[z].method=='undefined'||fa.test(g))){Y={method:g,requirements:v[z].requirements,namespace:v[z].namespace||void 0,url:safeDecodeURI(N),rule:v[z].originalRule||z,param:JSON.clone(v[z].param),middleware:JSON.clone(v[z].middleware),
+bundle:v[z].bundle,isXMLRequest};try{if(q=F.compareUrls(Y,v[z].url,U),q.past){x=JSON.clone(v[z]);x.name=z;x.param=Y.param;J=!0;q={};break}}catch(M){throw Error('Route [ '+z+' ] needs your attention.\n'+M.stack);}}}if(J)return/\/$/.test(p)&&p!='/'&&(p=p.substring(0,p.length-1)),l&&(p+=l),x.url=p,x.toUrl=function(M){var P=this.webroot,ha=this.hostname,ma=this.url;this.url=typeof M!='undefined'&&M==1?ma.replace(P,'/'):ma;return ha+this.url},x;if(n){var z=!1;if(p=='#'&&/GET/i.test(e)&&u||/^404:/.test(p))p=
+location.pathname,z=!0;typeof F.notFound=='undefined'&&(F.notFound={});l=null;x='[ RoutingHelper::getRouteByUrl(rule[, bundle, method]) ] : route [ %r ] is called but not found inside your view: `'+p+'` !';if((l=(l=gina.hasPopinHandler&&gina.popinIsBinded?gina.popin.getActivePopin().target.innerHTML.match(/404:\[\w+\][a-z 0-9-_@]+/):document.body.innerHTML.match(/404:\[\w+\][a-z 0-9-_@]+/))&&l.length>0?l[0]:null)&&u&&z)return z=l.match(/\[\w+\]/)[0],l=l.replace('404:'+z,z.replace(/\[|\]/g,'')+'::'),
+x=x.replace(/%r/,l.replace(/404:\s+/,'')),typeof F.notFound[l]=='undefined'?F.notFound[l]={count:1,message:x}:u&&typeof F.notFound[l]!='undefined'&&++F.notFound[l].count,!1;if((z=gina.config.reverseRouting[p]||null)&&typeof z!='undefined'&&z.split(/@(.+)$/)[1]==k)return l=z,typeof F.notFound[l]=='undefined'?(x=x.replace(/%r/,e.toUpperCase()+'::'+z),F.notFound[l]={count:1,message:x}):u&&typeof F.notFound[l]!='undefined'&&++F.notFound[l].count,!1;l=F.compareUrls(Y,p,U)||null;l.past&&u&&(l=e.toUpperCase()+
+'::'+l.request.routing.rule,typeof F.notFound[l]=='undefined'?x=x.replace(/%r/,l):++F.notFound[l].count);return!1}console.warn(Error('[ RoutingHelper::getRouteByUrl(rule[, bundle, method, request]) ] : route not found for url: `'+p+'` !').stack);return!1};F.buildTrie=function(p,k){if(!n){var e=require('./radix'),U=e.createNode(),la;for(la in p){var fa=p[la];if(fa&&typeof fa==='object'&&fa.bundle===k){fa=Array.isArray(fa.url)?fa.url:String(fa.url).split(',');for(var x=0;x<fa.length;x++){var v=fa[x].trim();
+v&&e.insert(U,v,la)}}}Routing._tries[k]=U}};F.lookupTrie=function(p,k){return Routing._tries&&Routing._tries[k]?require('./radix').lookup(Routing._tries[k],p):null};return F}typeof module!=='undefined'&&module.exports?(typeof console.err=='undefined'&&(console=require('../../logger')),module.exports=Routing()):typeof define==='function'&&define.amd&&define('lib/routing',['require','lib/form-validator','lib/merge'],function(){return Routing()});
+function registerEvents(n,F){typeof gina=='undefined'&&typeof window.gina!='undefined'&&(gina=window.gina);gina.registeredEvents[n]=F}function mergeEventProps(n,F){for(let I in F)typeof n[I]=='undefined'&&(n[I]=F[I]);return n}
 function addListener(n,F,I,O){var G=function(E,Z,p,k){typeof E.event!='undefined'&&E.event.isTouchSupported&&/^(click|mouseout|mouseover)/.test(p)&&E.event[p].indexOf(Z)==-1&&(E.event[p][E.event[p].length]=Z);typeof Z!='undefined'&&Z!=null?Z.addEventListener?Z.addEventListener(p,k,!1):Z.attachEvent&&Z.attachEvent('on'+p,k):E.customEvent.addListener(p,k);gina.events[p]=typeof Z.id!='undefined'&&typeof Z.id!='object'?Z.id:Z.getAttribute('id')},C=0,X=null;if(Array.isArray(I))for(X=I.length;C<X;C++)G(n,
 F,I[C],O);else if(Array.isArray(F))for(C=0,X=F.length;C<X;C++){let E=/\.$/.test(I)?I+F[C].id:I;G(n,F[C],E,O)}else I=/\.$/.test(I)?I+F.id:I,G(n,F,I,O)}
 function triggerEvent(n,F,I,O,G){if(typeof F!='undefined'&&F!=null){var C=!1;window.CustomEvent||document.createEvent?(window.CustomEvent?n=new CustomEvent(I,{detail:O,bubbles:!0,cancelable:!0,target:F}):(n=document.createEvent('HTMLEvents'),n.detail=O,n.target=F,n.initEvent(I,!0,!0),n.eventName=I),G&&(n=mergeEventProps(n,G)),typeof n.defaultPrevented!='undefined'&&n.defaultPrevented&&(C=n.defaultPrevented),C||F.dispatchEvent(n)):document.createEventObject&&(n=document.createEventObject(),n.srcElement.id=

package/framework/{v0.5.8 → v0.5.9}/core/controller/controller.js

@@ -512,11 +512,19 @@ function SuperController(options) {
             //     && /^true$/i.test(req.headers['x-nginx-proxy'])
             // ) ? true : false;
             // setContext('isProxyHost', isProxyHost);
-            var isProxyHost = getContext('isProxyHost') || false;
+            // #B66 S2b — the routing-clone gate (drives the _proxyHostname derivation
+            // + the per-route host rewrite below) AND the browser-whispered proxy host
+            // (page.environment.proxyHost/proxyHostname -> gina.config.* via loader.js)
+            // read THIS request's per-request #B65 classification (local.req slots)
+            // instead of the sticky worker-global latch, so a mixed proxied+direct (or
+            // concurrent multi-host) worker resolves the request in hand, not the last
+            // proxied global. The worker-global stays the fallback for req-less/Express
+            // paths that never set the slots.
+            var isProxyHost = ( local.req && typeof(local.req._ginaIsProxyHost) != 'undefined' ) ? local.req._ginaIsProxyHost : ( getContext('isProxyHost') || false );
             set('page.environment.isProxyHost', isProxyHost);
             if ( /^true$/.test(isProxyHost) ) {
-                set('page.environment.proxyHost', process.gina.PROXY_HOST);
-                set('page.environment.proxyHostname', process.gina.PROXY_HOSTNAME);
+                set('page.environment.proxyHost', ( local.req && local.req._ginaProxyHost ) ? local.req._ginaProxyHost : process.gina.PROXY_HOST);
+                set('page.environment.proxyHostname', ( local.req && local.req._ginaProxyHostname ) ? local.req._ginaProxyHostname : process.gina.PROXY_HOSTNAME);
             }
 
             var _config = ctx.config.envConf[options.conf.bundle][process.env.NODE_ENV];
@@ -553,7 +561,24 @@ function SuperController(options) {
             //     }
             // }
 
-            set('page.environment.hostname', hostname);
+            // #B66 — the hostname whispered to the browser (gina.config.hostname).
+            // On a proxied deployment (per-request #B65 classification) whisper the
+            // PUBLIC host-only origin (scheme://public-host, port-less — the webroot is
+            // whispered separately below) instead of the bundle's INTERNAL
+            // scheme://host:port(+webroot). This closes an information-disclosure AND
+            // lets the browser routing self-check flip isProxyHost=true (it cannot while
+            // the whispered value carries a port/webroot the self-check can't strip), so
+            // cross-bundle toUrl resolves same-origin. The internal `hostname` var above
+            // is left byte-identical — it still feeds _proxyHostname + the routing clone
+            // below. RAW (direct host:port) whispers the internal value, byte-identical.
+            // `_ginaProxyHostname` is the per-request #B65 slot (host-only, forwarded
+            // scheme); per-request (NOT a process-global) so it can't leak across a mix
+            // of proxied + direct requests. See server.isaac.js for the writer.
+            var _publicHostname = hostname;
+            if ( local.req && local.req._ginaIsProxyHost === true && local.req._ginaProxyHostname ) {
+                _publicHostname = local.req._ginaProxyHostname;
+            }
+            set('page.environment.hostname', _publicHostname);
             // Updating _config.rootDomain - 2024/04/15
             // _config.rootDomain = domainLib.getRootDomain(hostname).value;
 
@@ -970,7 +995,10 @@ function SuperController(options) {
             , rLen          = resArr.length
             , obj           = null
             , str           = ''
-            , isProxyHost   = getContext('isProxyHost')
+            // #B66 S2b — read THIS request's per-request #B65 proxy classification
+            // (slot) instead of the sticky worker-global latch; worker-global stays
+            // the fallback for req-less/Express paths that never set the slot.
+            , isProxyHost   = ( local.req && typeof(local.req._ginaIsProxyHost) != 'undefined' ) ? local.req._ginaIsProxyHost : ( getContext('isProxyHost') || false )
             , requestHost   = ( /http\/2/.test(local.options.conf.server.protocol) )
                     ? local.req.headers[':host']
                     : local.req.headers.host
@@ -999,7 +1027,9 @@ function SuperController(options) {
             && !isSpecialCase
         ) {
 
-            hostname    = scheme + '://'+ (local.req.headers.host||local.req.headers[':host']||process.gina.PROXY_HOST);
+            // #B66 S2b — last-resort host fallback prefers THIS request's slot over the
+            // worker-global (local.req is guaranteed here — headers are dereferenced above).
+            hostname    = scheme + '://'+ (local.req.headers.host||local.req.headers[':host']||local.req._ginaProxyHost||process.gina.PROXY_HOST);
 
             // replaced: /^(80|443)$/ + new RegExp(requestPort+'$') — use string methods (#P1, #P12)
             if (
@@ -2203,12 +2233,18 @@ function SuperController(options) {
                 typeof(local.req.headers['x-nginx-proxy']) != 'undefined'
                 && String(local.req.headers['x-nginx-proxy']).toLowerCase() === 'true'
                 ||
-                typeof(process.gina.PROXY_HOSTNAME) != 'undefined'
+                // #B66 S2b — the freeze-prone catch-all term: prefer THIS request's
+                // per-request #B65 classification (slot) over the worker-global "has this
+                // worker ever seen a proxy" latch, so a raw/direct request on a worker
+                // that previously served a proxied one is not misclassified as proxied.
+                // Worker-global stays the fallback for req-less/Express paths (no slot).
+                ( ( local.req && typeof(local.req._ginaIsProxyHost) != 'undefined' ) ? local.req._ginaIsProxyHost === true : typeof(process.gina.PROXY_HOSTNAME) != 'undefined' )
             ) ? true : false;
 
             // var isProxyHost = getContext('isProxyHost');
+            // #B66 S2b — redirect target host prefers THIS request's slot over the worker-global.
             var hostname = (isProxyHost)
-                    ? process.gina.PROXY_HOSTNAME
+                    ? ( ( local.req && local.req._ginaProxyHostname ) ? local.req._ginaProxyHostname : process.gina.PROXY_HOSTNAME )
                     : ctx.config.envConf[bundle][env].hostname;
 
 
@@ -4952,13 +4988,23 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             tmp = JSON.clone(local.options.conf);
         }
 
+        // #B66 S2b — prefer THIS request's per-request proxy classification (the
+        // #B65 slots on local.req) over the sticky worker-global latch, so a mixed
+        // proxied+direct worker (or a concurrent request to a different public host)
+        // resolves the host for the request in hand, not the last-proxied global.
+        // getConfig is reachable req-less (ws-query, released-response, the async
+        // health probe) AND under the Express engine (which never sets the slots),
+        // so the worker-global stays the fallback whenever the slot is absent.
+        var _isProxyHost   = ( local.req && typeof(local.req._ginaIsProxyHost) != 'undefined' ) ? local.req._ginaIsProxyHost : ( getContext('isProxyHost') || false );
+        var _proxyHostname = ( local.req && local.req._ginaProxyHostname ) ? local.req._ginaProxyHostname : process.gina.PROXY_HOSTNAME;
+        var _proxyHost     = ( local.req && local.req._ginaProxyHost )     ? local.req._ginaProxyHost     : process.gina.PROXY_HOST;
         if (
-            getContext('isProxyHost')
+            _isProxyHost
             && typeof(tmp.hostname) != 'undefined'
-            && typeof(process.gina.PROXY_HOSTNAME) != 'undefined'
+            && typeof(_proxyHostname) != 'undefined'
         ) {
-            tmp.hostname    = process.gina.PROXY_HOSTNAME;
-            tmp.host        = process.gina.PROXY_HOST;
+            tmp.hostname    = _proxyHostname;
+            tmp.host        = _proxyHost;
         }
         return tmp;
     }

package/framework/{v0.5.8 → v0.5.9}/core/server.isaac.js

@@ -334,6 +334,20 @@ function ServerEngineClass(options) {
 
         }// EO for routing keys
 
+        // #B66 — a host-stripped variant of the routing map, served to PROXIED clients
+        // so the browser never receives any bundle's INTERNAL scheme://host:port (an
+        // information disclosure) and cross-bundle client toUrl resolves same-origin.
+        // Drop each route's `host` + `hostname`; KEEP `webroot` (the client toUrl path
+        // relies on it). Proxy-host-agnostic + boot-static like the full map above; the
+        // serve-time handler picks stripped-vs-full per request on request._ginaIsProxyHost.
+        // See the #B66 handler branch below.
+        var _routingStripped = JSON.clone(_routing);
+        var _routingStrippedKeys = Object.keys(_routingStripped);
+        for (var si = 0; si < _routingStrippedKeys.length; ++si) {
+            const { host, hostname, ...cleanStripped } = _routingStripped[_routingStrippedKeys[si]];
+            _routingStripped[_routingStrippedKeys[si]] = cleanStripped;
+        }// EO for stripped routing keys
+
         // Checking if brotli is installed
         var brotliBin = null;
         try {
@@ -420,6 +434,53 @@ function ServerEngineClass(options) {
             }
         }
 
+        // #B66 — write + (br/gz)-compress the host-stripped variant to disk, mirroring
+        // the full routing.json above. Served to proxied clients by the #B66 handler
+        // branch; RAW clients keep the full blob (the full write above is untouched).
+        if (_routingStripped) {
+            targetFile  = 'routing.stripped.json';
+            // Storing to disk
+            console.debug(`Writing ${targetFile} to: ${targetDir}/${targetFile}`);
+            fd = fs.openSync(targetDir +'/'+ targetFile, 'w'); // Open file for writing
+            buffer = Buffer.from( JSON.stringify(_routingStripped) );
+            fs.writeSync(fd, buffer, 0, buffer.length, 0); // Write the buffer
+            fs.closeSync(fd); // Close the file descriptor
+
+            // Adding brotli version (see the full routing.json block above)
+            try {
+                if (brotliBin) {
+                    brFileObj = new _(targetDir +'/'+ targetFile +'.br');
+                    if ( brFileObj.existsSync() ) {
+                        brFileObj.rmSync();
+                    }
+                    cmd = brotliBin +' --best '+ _(targetDir +'/'+ targetFile, true);
+                    exec(cmd, function(brCmdErr, stdout) {
+                        if (brCmdErr) { console.error('[ SERVER ] brotli compression error: ' + (brCmdErr.stack || brCmdErr.message)); return; }
+                        if (stdout) console.debug(stdout.toString().trim());
+                    });
+                }
+            } catch (brError) {
+                console.error('[ SERVER ] '+ brError.stack);
+            }
+
+            // Adding GZip version
+            try {
+                if (gZipBin) {
+                    gzFileObj = new _(targetDir +'/'+ targetFile +'.gz');
+                    if ( gzFileObj.existsSync() ) {
+                        gzFileObj.rmSync();
+                    }
+                    cmd = gZipBin +' -9 -k '+ _(targetDir +'/'+ targetFile, true);
+                    exec(cmd, function(gzCmdErr, stdout) {
+                        if (gzCmdErr) { console.error('[ SERVER ] gzip compression error: ' + (gzCmdErr.stack || gzCmdErr.message)); return; }
+                        if (stdout) console.debug(stdout.toString().trim());
+                    });
+                }
+            } catch (gzError) {
+                console.error('[ SERVER ] '+ gzError.stack);
+            }
+        }
+
 
         buffer = null;
         fd = null;
@@ -430,6 +491,12 @@ function ServerEngineClass(options) {
                 file    : 'routing.json',
                 path    : targetDir,
                 mime    : 'application/json; charset=utf8'
+            },
+            // #B66 — host-stripped variant, served to proxied clients (see handler branch)
+            {
+                file    : 'routing.stripped.json',
+                path    : targetDir,
+                mime    : 'application/json; charset=utf8'
             }
         ];
         for (let i=0, len=localAssets.length; i<len; i++) {
@@ -1688,9 +1755,22 @@ function ServerEngineClass(options) {
                 // server.toApi(reques, response)
                 // console.debug('[ SERVER ][200] '+ request.url);
                 localAsset = assetsCollection.findOne({ file: request.url.split(/\//g).slice(-1).toString() });
+                // #B66 — on a proxied deployment serve the host-stripped routing.json so
+                // the browser never receives any bundle's INTERNAL scheme://host:port (an
+                // information disclosure) and cross-bundle client toUrl resolves
+                // same-origin. Gated on the per-request #B65 classification; RAW (direct
+                // host:port) keeps the full blob, byte-identical.
+                if ( request._ginaIsProxyHost === true ) {
+                    var _strippedRoutingAsset = assetsCollection.findOne({ file: 'routing.stripped.json' });
+                    if (_strippedRoutingAsset) {
+                        localAsset = _strippedRoutingAsset;
+                    }
+                }
                 response.setHeader('content-type', localAsset.mime);
                 response.setHeader('vary', 'Origin');
-                response.setHeader('cache-control', 'public, max-age=86400');
+                // #B66 — a shared cache must not cross-serve the stripped (proxied) and
+                // full (raw) variants under the same URL; mark the proxied variant private.
+                response.setHeader('cache-control', ( request._ginaIsProxyHost === true ) ? 'private, max-age=86400' : 'public, max-age=86400');
                 response.setHeader('x-content-type-options', 'nosniff');
                 response.setHeader('x-frame-options', 'DENY');
                 response.setHeader('x-xss-protection', '1; mode=block');

package/framework/{v0.5.8 → v0.5.9}/lib/cmd/connector/add.js

@@ -25,7 +25,7 @@ var CmdHelper = require('./../helper');
  *   2. the framework's built-in driver range table (DRIVER_MAP / AI_DRIVER_MAP)
  *
  * Leading header comments at the top of an existing `connectors.json` are
- * preserved verbatim (everything before the first `{`). Mid-body `//` or
+ * preserved verbatim (everything before the first non-comment `{`). Mid-body `//` or
  * `/* * /` comments are lost — the JSON body is rewritten from the parsed
  * object graph. See help.txt for the caveat.
  *
@@ -349,7 +349,7 @@ function Add(opt, cmd) {
 
     /**
      * Reads the existing `connectors.json` (if any), preserves any leading
-     * comment header (everything before the first `{`), and parses the
+     * comment header (everything before the first non-comment `{`), and parses the
      * JSON body with comment tolerance via `requireJSON`.
      *
      * Returns `{ header: string, data: object }`. On a parse failure, exits
@@ -379,8 +379,10 @@ function Add(opt, cmd) {
             process.exit(1);
             return null;
         }
-        var firstBrace = raw.indexOf('{');
-        var header     = (firstBrace > 0) ? raw.slice(0, firstBrace) : '';
+        // Comment-aware: the scaffolded template's `// "couchbase": {` puts a
+        // brace inside a comment, so a naive first-brace scan lands there and
+        // corrupts the rewrite. splitHeader finds the first STRUCTURAL `{`.
+        var header = lib.jsonConfigHeader.splitHeader(raw).header;
         var data;
         try {
             data = requireJSON(target) || {};
@@ -435,7 +437,7 @@ function Add(opt, cmd) {
      * @inner
      * @private
      * @param {string} target
-     * @param {string} header - Text before the first `{` in the existing file
+     * @param {string} header - Text before the first non-comment `{` in the existing file
      * @param {object} data - Full merged config object
      */
     var writeFile = function (target, header, data) {

package/framework/{v0.5.8 → v0.5.9}/lib/cmd/connector/migrate.js

@@ -36,7 +36,7 @@ var CmdHelper = require('./../helper');
  * when a concrete migration (e.g. #CN8 Couchbase SDK v2 removal at
  * `0.4.0`) lands with a real before/after shape.
  *
- * Leading comment headers (everything before the first `{`) are preserved
+ * Leading comment headers (everything before the first non-comment `{`) are preserved
  * verbatim when `--fix` writes the file — same convention as `add.js` and
  * `remove.js`. Mid-body comments are lost on rewrite.
  *
@@ -285,8 +285,10 @@ function Migrate(opt, cmd) {
             report.parseError = 'read failed: ' + e.message;
             return report;
         }
-        var firstBrace = raw.indexOf('{');
-        report.header = (firstBrace > 0) ? raw.slice(0, firstBrace) : '';
+        // Comment-aware: the scaffolded template's `// "couchbase": {` puts a
+        // brace inside a comment, so a naive first-brace scan lands there and
+        // corrupts a --fix rewrite. splitHeader finds the first STRUCTURAL `{`.
+        report.header = lib.jsonConfigHeader.splitHeader(raw).header;
 
         var data;
         try {

package/framework/{v0.5.8 → v0.5.9}/lib/cmd/connector/remove.js

@@ -24,7 +24,7 @@ var CmdHelper = require('./../helper');
  * user can decide whether to keep the driver installed.
  *
  * Leading header comments at the top of an existing `connectors.json`
- * (everything before the first `{`) are preserved verbatim. Mid-body
+ * (everything before the first non-comment `{`) are preserved verbatim. Mid-body
  * `//` or `/* * /` comments are lost — the body is rewritten from the
  * parsed object graph. Same caveat as `connector:add`.
  *
@@ -269,7 +269,7 @@ function Remove(opt, cmd) {
 
     /**
      * Reads the existing `connectors.json`, preserves the leading comment
-     * header (everything before the first `{`), and parses the body with
+     * header (everything before the first non-comment `{`), and parses the body with
      * comment tolerance. Exits on parse or I/O failure. Returns null when
      * the target file does not exist at all — that's an error for
      * `connector:rm` because there's nothing to remove.
@@ -293,8 +293,10 @@ function Remove(opt, cmd) {
             process.exit(1);
             return null;
         }
-        var firstBrace = raw.indexOf('{');
-        var header     = (firstBrace > 0) ? raw.slice(0, firstBrace) : '';
+        // Comment-aware: the scaffolded template's `// "couchbase": {` puts a
+        // brace inside a comment, so a naive first-brace scan lands there and
+        // corrupts the rewrite. splitHeader finds the first STRUCTURAL `{`.
+        var header = lib.jsonConfigHeader.splitHeader(raw).header;
         var data;
         try {
             data = requireJSON(target) || {};

package/framework/{v0.5.8 → v0.5.9}/lib/index.js

@@ -160,6 +160,14 @@ function Lib() {
         // caller can run lib.secrets.resolve() on it in place. Pure (same
         // contract as connector-registry / cmd-status-format).
         connectorConfig : _require('./connector-config'),
+        // Comment-aware header/body splitter for JSON-with-comments config
+        // files. firstStructuralBraceIndex / splitHeader find the first `{`
+        // that is NOT inside a `//` or block comment, so a rewrite preserves a
+        // leading comment header verbatim (the scaffolded connectors.json
+        // template carries `// "couchbase": {` — a brace inside a comment).
+        // Consumed by the connector:add / connector:rm / connector:migrate
+        // handlers. Pure (same contract as cmd-status-format / routing-introspect).
+        jsonConfigHeader: _require('./json-config-header'),
         // Pure resolver that picks between a project-installed @rhinostone/swig
         // (or swig-twig) and the framework's bundled copy. Opt-in via
         // settings.json > swig.useProject; default-off. Returns a decision