gina 0.5.8 → 0.5.9

package/framework/v0.5.9/lib/json-config-header/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "gina-lib-json-config-header",
+  "version": "1.0.0",
+  "description": "Comment-aware header/body splitter for JSON-with-comments config files. Finds the first STRUCTURAL `{` (skipping `//` and `/* */` comments) so a leading comment header can be preserved verbatim across a rewrite. Shared by the connector:add / connector:rm / connector:migrate CLI handlers.",
+  "authors": [
+    {
+      "name": "Martin-Luther ETOUMAN",
+      "email": "contact@gina.io"
+    }
+  ],
+  "copyright": "Copyright (c) 2009-2026 Rhinostone <contact@gina.io>",
+  "engines": {
+    "node": ">=0.10.22"
+  },
+  "main": "src/main",
+  "license": "MIT"
+}

package/framework/v0.5.9/lib/json-config-header/src/main.js

@@ -0,0 +1,113 @@
+/*
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * @module gina/lib/json-config-header
+ *
+ * Comment-aware header/body splitter for JSON-with-comments config files
+ * (`connectors.json`, and any config a CLI handler rewrites from the parsed
+ * object graph while preserving a leading comment header).
+ *
+ * The framework's config loader (`requireJSON`) tolerates `//` and
+ * `/* ... *\/` comments, so a `connectors.json` legitimately carries a
+ * comment header — and the scaffolded template's example block literally
+ * contains `// "couchbase": {`, i.e. a `{` INSIDE a comment. A naive
+ * `raw.indexOf('{')` to find where the JSON body starts therefore lands
+ * inside that comment, so a rewrite (`header + JSON.stringify(...)`) comments
+ * out the body's real opening brace and truncates the header — corrupting the
+ * file. {@link firstStructuralBraceIndex} finds the first `{` that is NOT
+ * inside a `//` or `/* *\/` comment, so {@link splitHeader} keeps the whole
+ * comment header verbatim and the rewritten body stays valid JSON.
+ *
+ * This module is pure — it requires no node builtins, no `lib.*`, and reads
+ * no framework globals, so it is unit-testable by a direct `require`. Same
+ * contract as {@link module:gina/lib/cmd-status-format} and
+ * {@link module:gina/lib/routing-introspect}. Consumed via the `lib` registry
+ * (`lib.jsonConfigHeader`) by the connector:add / connector:rm /
+ * connector:migrate handlers.
+ *
+ * @example
+ * var jch   = lib.jsonConfigHeader;
+ * var raw   = fs.readFileSync(target, 'utf8');
+ * var split = jch.splitHeader(raw);   // { header: '// ...\n', braceIndex: 536 }
+ * var text  = split.header + JSON.stringify(data, null, 4) + '\n';
+ */
+
+/**
+ * Returns the index of the first STRUCTURAL `{` in `raw` — the first `{` that
+ * is not inside a `//` line comment or a `/* ... *\/` block comment — or `-1`
+ * when there is no such brace. A `{` sitting inside a comment (as in the
+ * scaffolded `// "couchbase": {` example block) is skipped.
+ *
+ * Comment detection mirrors `requireJSON`'s intent (`//` and `/* *\/`). It
+ * does NOT track string literals, and does not need to: for a well-formed
+ * JSON-with-comments config nothing but comments and whitespace can precede
+ * the first structural `{`, so no string can appear before it. A genuinely
+ * malformed file fails `requireJSON` before any rewrite, so the split never
+ * runs on it.
+ *
+ * @memberof module:gina/lib/json-config-header
+ * @param   {string} raw - Full file text.
+ * @returns {number} Index of the first non-comment `{`, or `-1` if none.
+ *
+ * @example
+ * firstStructuralBraceIndex('{ "a": 1 }');                 // 0
+ * firstStructuralBraceIndex('// { in a comment\n{ "a":1 }'); // 17  (the real brace)
+ * firstStructuralBraceIndex('/* { *\/ { "a": 1 }');          // 8
+ * firstStructuralBraceIndex('// only comments\n');          // -1
+ */
+var firstStructuralBraceIndex = function (raw) {
+    var s = String(raw == null ? '' : raw);
+    var inLine = false, inBlock = false;
+    for (var i = 0, len = s.length; i < len; i++) {
+        var c = s.charAt(i), n = s.charAt(i + 1);
+        if (inLine)  { if (c === '\n') { inLine = false; } continue; }
+        if (inBlock) { if (c === '*' && n === '/') { inBlock = false; i++; } continue; }
+        if (c === '/' && n === '/') { inLine  = true; i++; continue; }
+        if (c === '/' && n === '*') { inBlock = true; i++; continue; }
+        if (c === '{') { return i; }
+    }
+    return -1;
+};
+
+/**
+ * Splits `raw` into its leading comment header (everything before the first
+ * STRUCTURAL `{`) and reports that brace's index. When the structural brace is
+ * at index 0 (a comment-free file starting with `{`) or absent (`-1`), the
+ * header is the empty string — matching the original `(firstBrace > 0) ? ... :
+ * ''` semantics, so a comment-free config rewrites byte-for-byte as before.
+ *
+ * The returned `header` is verbatim (comments + whitespace, trailing newline
+ * included), so a caller can reassemble a valid file as
+ * `header + JSON.stringify(data, null, 4) + '\n'`.
+ *
+ * @memberof module:gina/lib/json-config-header
+ * @param   {string} raw - Full file text.
+ * @returns {{header: string, braceIndex: number}}
+ *
+ * @example
+ * // scaffolded connectors.json (comment header ending with a bare `{` line)
+ * var s = splitHeader(raw);
+ * // s.braceIndex -> index of the real `{`
+ * // s.header     -> the ENTIRE comment header, verbatim
+ *
+ * @example
+ * splitHeader('{ "$schema": "..." }'); // { header: '', braceIndex: 0 }
+ * splitHeader('// note\n');            // { header: '', braceIndex: -1 }
+ */
+var splitHeader = function (raw) {
+    var s          = String(raw == null ? '' : raw);
+    var braceIndex = firstStructuralBraceIndex(s);
+    var header     = (braceIndex > 0) ? s.slice(0, braceIndex) : '';
+    return { header: header, braceIndex: braceIndex };
+};
+
+module.exports = {
+    firstStructuralBraceIndex : firstStructuralBraceIndex,
+    splitHeader               : splitHeader
+};

package/framework/{v0.5.8 → v0.5.9}/lib/routing/src/main.js

@@ -115,7 +115,6 @@ function Routing() {
             urlProps.hostname   = config.envConf[bundle][env].hostname;
             urlProps.host       = config.envConf[bundle][env].host;
             urlProps.webroot    = config.envConf[bundle][env].server.webroot;
-            console.debug("[self.getUrlProps][isProxyHost = "+ getContext('isProxyHost') +"] hostname ", config.envConf[bundle][env].hostname, vs, process.gina.PROXY_HOSTNAME);
         }
 
         return urlProps;

package/framework/{v0.5.8 → v0.5.9}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "dependencies": {
     "@rhinostone/swig": "^2.7.2",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.5.8/core/gna');
+var _gna = require('./framework/v0.5.9/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.5.8/core/controller');
-var EntitySuper     = require('./framework/v0.5.8/core/model/entity');
+var SuperController = require('./framework/v0.5.9/core/controller');
+var EntitySuper     = require('./framework/v0.5.9/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.5.8/lib/uuid');
+var uuid = require('./framework/v0.5.9/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -795,7 +795,7 @@ Dev-mode query instrumentation captures every database query tied to the current
 
 80. **CSRF — three-phase protection (`#CSRF1` Session plugin / `#CSRF2` signed double-submit token / `#CSRF3` Origin pre-filter)** — Session plugin hardens `express-session` cookie defaults from `settings.json > session.cookie.{sameSite, httpOnly, secure}` (opt-in, one-line bundle bootstrap swap, never transparent because bundles legitimately set `httpOnly: false`); signed token middleware uses `crypto.timingSafeEqual` HMAC-SHA256 bound to `req.session.id` with per-route `routing.json > "csrfExempt": true` opt-out (see `routing-and-http2.md § "Per-route flags"` for `req.routing.csrfExempt` two-step propagation: `lib/routing` extracts → `core/server.js` hoists, top-level on `req.routing` not under `param.*`); Origin pre-filter folded INSIDE `gina.plugins.Csrf()` BEFORE token verify on mutating methods, allowlist via `settings.json > csrf.allowedOrigins` (empty defaults to `[bundleHostname]` auto-derived). Negative-invariant lock: matching token + mismatching Origin still 403s — token layer ≠ Origin layer. Implementation traps from the trilogy: plan-vs-shipped attribute drift (downstream commits must `grep -n '<attribute>' <upstream-source-file>` before referencing — source on develop wins, not the plan); CI flake-vs-regression triage (same-message-different-SHA pairs need `git diff --stat A..B` first); source-inspection `indexOf` matches the function DEFINITION before the call site (use unique assignment LHS like `requestOrigin = parseRequestOrigin(req)`); `Origin: "null"` is a real browser value (sandboxed iframes / `file://`) and needs an explicit `s === 'null'` guard so the parser falls through to Referer instead of 403'ing for "origin not allowed".
 
-93. **Reverse-proxy path-prefix awareness via `X-Forwarded-Prefix` — the bundle's internal `server.webroot` stays `/`, but the value templated into `gina.config.webroot` carries the proxy's mount path so client-side root-relative URLs (`/_gina/assets/routing.json`, the `gina.min.css` link injection, etc.) target the correct upstream through the proxy instead of routing to whichever bundle answered bare `/`.** Standard header used by Spring Boot, Traefik, FastAPI, ASP.NET Core, NestJS, Quarkus. Capture site: `core/server.isaac.js` proxy-detection block (sibling to the `X-Forwarded-Host` / `X-Forwarded-Proto` reads); normalisation rules — leading slash added if missing, trailing slashes stripped, empty / `"/"` dropped; stored on `process.gina.PROXY_PREFIX`. Composition site: `core/controller/controller.js` at the `set('page.environment.webroot', ...)` call (~line 513) — when `PROXY_PREFIX` is set, public webroot becomes `prefix + bundle.server.webroot` (slash-normalised), then templated into `gina.onload.min.js`. Internal disk-path resolution and asset-rewrite call sites (e.g. `controller.js:927,956`) still use the bundle's native `server.webroot` — only the browser-facing `gina.config.webroot` carries the prefix; the proxy strips the prefix when forwarding upstream so the bundle's static handlers receive native paths. Symptom shape that surfaces this gap: browser fetches `/_gina/*` URLs that nginx routes to the wrong upstream (the bundle that owns bare `/`, not the bundle that rendered the page); inspector indicator names one bundle but `routing.json` contents come from another. Server-side asset URL rewriting at `controller.js:927,956` and the `linkTo` family also write URLs intended for browser consumption — same prefix-awareness gap, deferred follow-up. The bare `/_gina/assets/routing.json` handler exists only in `server.isaac.js` with no engine-agnostic equivalent in `server.js`; bundles using the Express engine don't have this endpoint at all — independent of this slice but worth noting on the next `/_gina/*` parity sweep. Established 2026-05-06 after the symptom surfaced from a multi-bundle nginx deployment where a sub-path bundle's pages were fetching the root bundle's `routing.json`. **Sibling fix — reverse-proxy HOST context request-scoped (`#B65`, 2026-07-04):** the same one-shot `!isProxyHost` gate froze the `PROXY_HOST` / `PROXY_HOSTNAME` worker-globals (derived from a port-less `Host` or `X-Forwarded-Host`) at the FIRST proxied request's value, and internal `Controller::query()` forwards read that frozen global. `core/server.isaac.js` now request-scopes them — per-request `request._ginaIsProxyHost` / `_ginaProxyHost` / `_ginaProxyHostname` slots (mirroring `_ginaProxyPrefix`), and the worker-global is refreshed on EVERY proxied request so it can never freeze (and, being written ONLY from proxied requests, can never freeze to a raw `host:port`); `core/controller/controller.js` forwards THIS request's proxied host from the slot (worker-global fallback for req-less callers: released-response / ws-query). Classification: a request is proxied when its inbound `Host` is port-less OR it carries `X-Forwarded-Host` — which separates all three topologies safely: RAW `host:port` (never classified proxied → URL builders keep the static config host, unchanged), single-hop (port-less Host → host = Host), multi-hop (`X-Forwarded-Host` wins). `setContext('isProxyHost', true)` stays monotonic (cert-skip readers unaffected). Server-side only, NO dist rebuild; the `lib/routing` `toUrl` full request-scope (browser-bundled → dist rebuild) is deferred as `#B65` S2b pending a live multi-hop measurement (the un-gate already fixes `toUrl`/`getConfig`/`redirect` transparently via the never-frozen global for single-public-host-per-worker topologies — S2b only closes mixed-worker/multi-tenant concurrency). Tests: `server.isaac.test.js §15/§15b` (three-topology + freeze-fix + gate-removal subtract), `controller.test.js §30/§30b` (slot-wins-over-stale-global forward, raw-no-forward, req-less→global fallback).
+93. **Reverse-proxy path-prefix awareness via `X-Forwarded-Prefix` — the bundle's internal `server.webroot` stays `/`, but the value templated into `gina.config.webroot` carries the proxy's mount path so client-side root-relative URLs (`/_gina/assets/routing.json`, the `gina.min.css` link injection, etc.) target the correct upstream through the proxy instead of routing to whichever bundle answered bare `/`.** Standard header used by Spring Boot, Traefik, FastAPI, ASP.NET Core, NestJS, Quarkus. Capture site: `core/server.isaac.js` proxy-detection block (sibling to the `X-Forwarded-Host` / `X-Forwarded-Proto` reads); normalisation rules — leading slash added if missing, trailing slashes stripped, empty / `"/"` dropped; stored on `process.gina.PROXY_PREFIX`. Composition site: `core/controller/controller.js` at the `set('page.environment.webroot', ...)` call (~line 513) — when `PROXY_PREFIX` is set, public webroot becomes `prefix + bundle.server.webroot` (slash-normalised), then templated into `gina.onload.min.js`. Internal disk-path resolution and asset-rewrite call sites (e.g. `controller.js:927,956`) still use the bundle's native `server.webroot` — only the browser-facing `gina.config.webroot` carries the prefix; the proxy strips the prefix when forwarding upstream so the bundle's static handlers receive native paths. Symptom shape that surfaces this gap: browser fetches `/_gina/*` URLs that nginx routes to the wrong upstream (the bundle that owns bare `/`, not the bundle that rendered the page); inspector indicator names one bundle but `routing.json` contents come from another. Server-side asset URL rewriting at `controller.js:927,956` and the `linkTo` family also write URLs intended for browser consumption — same prefix-awareness gap, deferred follow-up. The bare `/_gina/assets/routing.json` handler exists only in `server.isaac.js` with no engine-agnostic equivalent in `server.js`; bundles using the Express engine don't have this endpoint at all — independent of this slice but worth noting on the next `/_gina/*` parity sweep. Established 2026-05-06 after the symptom surfaced from a multi-bundle nginx deployment where a sub-path bundle's pages were fetching the root bundle's `routing.json`. **Sibling fix — reverse-proxy HOST context request-scoped (`#B65`, 2026-07-04):** the same one-shot `!isProxyHost` gate froze the `PROXY_HOST` / `PROXY_HOSTNAME` worker-globals (derived from a port-less `Host` or `X-Forwarded-Host`) at the FIRST proxied request's value, and internal `Controller::query()` forwards read that frozen global. `core/server.isaac.js` now request-scopes them — per-request `request._ginaIsProxyHost` / `_ginaProxyHost` / `_ginaProxyHostname` slots (mirroring `_ginaProxyPrefix`), and the worker-global is refreshed on EVERY proxied request so it can never freeze (and, being written ONLY from proxied requests, can never freeze to a raw `host:port`); `core/controller/controller.js` forwards THIS request's proxied host from the slot (worker-global fallback for req-less callers: released-response / ws-query). Classification: a request is proxied when its inbound `Host` is port-less OR it carries `X-Forwarded-Host` — which separates all three topologies safely: RAW `host:port` (never classified proxied → URL builders keep the static config host, unchanged), single-hop (port-less Host → host = Host), multi-hop (`X-Forwarded-Host` wins). `setContext('isProxyHost', true)` stays monotonic (cert-skip readers unaffected). Server-side only, NO dist rebuild; the SERVER-side serve-time rewrites are S2b (shipped 2026-07-04 — see the end of this entry), and the browser-bundled `lib/routing` `toUrl` worker-global proxy read (#B66 S2c) was MEASURED INERT and CLOSED (2026-07-04, no code — inert in single-public-host all-proxied topologies; only mixed-worker / multi-host contaminate; a server-side caller-override fix needs NO dist rebuild — see the end of this entry). Tests: `server.isaac.test.js §15/§15b` (three-topology + freeze-fix + gate-removal subtract), `controller.test.js §30/§30b` (slot-wins-over-stale-global forward, raw-no-forward, req-less→global fallback). **Follow-up — browser-side residual fixed (`#B66`, 2026-07-04):** #B65 fixed the SERVER-side host context; the BROWSER still received every bundle's INTERNAL `scheme://host:port` via two surfaces — the inline `gina.config.hostname` whisper (`controller.js` ~556) AND the boot-static `/_gina/assets/routing.json` blob (`server.isaac.js`). #B66 closes both, SERVER-SIDE, gated on the SAME per-request `request._ginaIsProxyHost` slot (RAW byte-identical, NO dist rebuild): **S1** whispers `page.environment.hostname = local.req._ginaProxyHostname` (host-only, port-less, forwarded scheme) when proxied — the internal `hostname` var + `_proxyHostname` stay byte-identical (grep-confirmed no server-side reader of `page.environment.hostname` besides the whisper template); **S2** boot-builds a SECOND host-stripped `routing.json` (drops each route's `host`+`hostname`, KEEPS `webroot`, still `.br`/`.gz`), served instead of the full blob when proxied with `Cache-Control: private` (a shared cache must not cross-serve variants). The host-only whisper is what flips the browser routing self-check (`lib/routing/src/main.js:1034` — it can't strip a port/webroot the whispered value carries, so an internal `host:port(+webroot)` leaves it false), after which cross-bundle `toUrl` (`:1189/1193`) resolves same-origin instead of the unreachable internal host. Measured (daemonless 2-bundle + reverse-proxy-header repro, real `getRoute().toUrl()` 4-state matrix): S1 ALONE fixes the function (route.hostname intact → public origin); stripping `route.hostname` is SAFE (the design's "degrades to a same-origin URL, no throw" holds) and matters ONLY in states where S1 hasn't flipped the self-check, which are UNREACHABLE in production because S1+S2 are COUPLED by the same per-request gate (both fire when proxied, neither when raw). Precision correction to the design's raw-form claim: in that unreachable strip-without-S1 state the RAW `toUrl` return carries an `"undefined"` segment — `''+this.hostname` with the host/hostname key absent → `"undefined/webroot/path"`, which the browser resolves RELATIVE to the current origin (same-origin, wrong path — i.e. the design's "relative same-origin" is functionally right; its "no undefined" summary just missed the raw segment); `"no throw"` holds because `webroot` is kept. The one out-of-scope edge is a mode-2 proxied deploy whose PUBLIC url carries an explicit port (self-check needs `!location.port`), already broken today. Tests: `controller.test.js §31/§31b`, `server.isaac.test.js §16/§16b` (+ the §09 fixed-window X-Powered-By pin converted to a structural ordering pin — the handler insert displaced it, sanctioned test change). **S2b shipped (2026-07-04, server-side, NO dist rebuild):** the 4 serve-time host rewrites in `controller.js` — the setOptions routing-clone gate + the `page.environment.proxyHost/Hostname` whisper, `getNodeRes`'s proxied-host build, `redirect`'s target host, and `getConfig`'s hostname/host override — now read THIS request's per-request slot (`local.req._ginaIsProxyHost` / `_ginaProxyHost` / `_ginaProxyHostname`) with the worker-global as a MANDATORY fallback (the Express engine — the default when `engine` is unset — never sets the slots, and `getConfig` is reachable req-less: ws-query / released-response / async health probe). Closes the mixed-worker/multi-tenant/concurrent-request residual — a direct or interleaved request on a worker that just served a proxied one no longer resolves the stale last-proxied host. Measured non-leaks left out of scope: the isSpecialCase `:host != PROXY_HOST` comparisons (a cross-bundle-link heuristic a stale global can't flip) and `query()`'s `PROXY_SCHEME` (boot-static, never per-request-refreshed). §12 reconcile — the getConfig re-point is neutral-or-better for the Origin-header false-positive: `_ginaIsProxyHost` is classified in `server.isaac.js` (`:1704`) BEFORE the Origin→Host rewrite (`:2089`), so a same-origin direct POST classifies `false` and getConfig no longer overwrites the config hostname. Live before/after on the REAL getConfig (mixed proxied-A → raw → proxied-B interleave: 2 fails → 5/5). Tests: `controller.test.js §32/§32b` (source pins on all 4 sites + pure-logic replicas + subtract). The browser-bundled `lib/routing` `toUrl`/`getRoute` worker-global proxy read (#B66 S2c) was MEASURED INERT and CLOSED (2026-07-04, no code) — inert in the single-public-host all-proxied topology (only mixed-worker / multi-host contaminate); a server-side caller-override fix (NO dist rebuild) is the ready recipe if a future topology needs it.
 
 94. **ScyllaDB / Cassandra connector — `cassandra-driver` wrapper + fictitious `@scylladb/scylla-driver` registry placeholder + CQL ergonomics + `USING TTL` session store** — The Node.js ecosystem has no first-party shard-aware ScyllaDB driver (Python / Java / Go / Rust drivers are first-party shard-aware; Node.js is not), so the framework `scylladb` connector wraps `cassandra-driver` (Apache Software Foundation, `>=4.0.0` requires Node >=20, eval-safe per #SCS1 posture). Pre-#CN5 `lib/connector-registry/src/main.js` pinned `@scylladb/scylla-driver@>=1.0.0` as a placeholder — that npm package does not exist (404), which would have failed at install time the moment `connector:add primary --connector=scylladb --driver-version=...` printed its install hint. **Always `npm view <pkg>` to confirm the package exists** when populating registry-style mappings — same shape as the #I18N2 `intl-messageformat@9.13.0` non-existent-version trap. **CQL ORM** mirrors the SQL connector shape: entity files at `models/<keyspace>/cql/<Entity>/*.sql` (distinct dir like Couchbase's `n1ql/`, uniform `.sql` extension), `?` positional placeholders, `client.execute(query, args, { prepare: true })` returning Promise + `.onComplete()` shim, `@param` casting for CQL types (text/int/bigint/uuid/timeuuid/timestamp/boolean/blob/list/set/map/decimal/double/inet), `@return` coercion handling SELECT rows / LWT `[applied]` / write defaults. **CQL session store** has no Redis-EXPIRE equivalent — `set()` issues `INSERT … USING TTL <ttl>` (atomic write + expiry); `touch()` issues `UPDATE … USING TTL <ttl> SET sess = ? WHERE sid = ?` (rewrites data with fresh TTL); `clear()` uses CQL `TRUNCATE` (heavy cluster op — the only full-table delete CQL allows). Required schema: `CREATE TABLE sessions (sid TEXT PRIMARY KEY, sess TEXT) WITH default_time_to_live = 86400`. Promise → callback safety mirrors post-#CB-BUG-4: write methods MUST call `fn(null)` explicitly inside `.then()`, never `.then(fn)` directly. Established 2026-05-09 (#CN5). **MongoDB connector (#CN6)** — wraps the official `mongodb` driver (`>=7.0.0`); JSON op files at `models/<db>/pipelines/<Entity>/*.json` with `{"$arg":N}` / `{"$oid":hex}` / `"$scope"` placeholders + `castParam` BSON coercion (`objectid`/`int`/`long`/`double`/`date`/etc.); self-contained TTL-index session store auto-creates `{expiresAt:1}` (`expireAfterSeconds:0`, one-shot `_ttlReady` guard, `IndexOptionsConflict` warn-and-continue) and filters `{expiresAt:{$gt:now}}` because Mongo's TTL monitor lags up to 60s (vs Scylla's server-side `USING TTL` reap — same intent, different mechanism). Both connectors' registry pins must EXIST and be CURRENT (`npm view <pkg>` — the `@scylladb/scylla-driver` 404 + stale `mongodb>=5` traps). Established 2026-05-09 (#CN6).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -73,12 +73,12 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.5.8/core/gna",
+  "main": "./framework/v0.5.9/core/gna",
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
       "import": "./index.mjs",
-      "require": "./framework/v0.5.8/core/gna.js"
+      "require": "./framework/v0.5.9/core/gna.js"
     },
     "./gna": {
       "types": "./types/gna.d.ts",

package/framework/v0.5.8/VERSION

@@ -1 +0,0 @@
-0.5.8