gina 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -6,6 +6,22 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.1 - 2026-07-31
+### Added
+* SQLite support under the Bun runtime — the sqlite ORM connector, session store, async-job store and the framework state store now resolve the Bun built-in `bun:sqlite` behind a `node:sqlite`-shaped adapter when `node:sqlite` is absent (Bun does not implement it; previously the connector and both stores failed at boot under Bun, and the state store silently fell back to JSON). Node resolution is unchanged (`node:sqlite` is still tried first), and transient/permanent connector-error classification reads both drivers identically.
+* New DuckDB connector — embedded analytical (columnar / OLAP) SQL over the standard entity wiring. A `"connector": "duckdb"` entry opens a file-backed or `":memory:"` database (`file` is optional and defaults to `~/.gina/{version}/{database}.duckdb`); entity methods load from `models/<database>/sql/` with `@param` casting and `@return` shaping, and row-returning detection covers the analytical dialect (`WITH` CTEs, `FROM`-first, `SUMMARIZE`, `PIVOT`/`UNPIVOT`, `DESCRIBE`, `SHOW`) so CTE-heavy queries return rows instead of being routed to the write path. Large numeric types (BIGINT / HUGEINT / DECIMAL) and dates arrive as JSON-safe strings; writes report `{ changes }`. `readOnly: true` opens the database read-only so any number of processes can share one file. The `@duckdb/node-api` driver installs in your project, and the `connector:*` CLI group plus the connectors.json schema recognise the new type.
+### Fixed
+* Fixed two Bun-only crashes that stopped a bundle declaring ANY connector from booting. `new require(mod)(args)` parses as `(new require(mod))(args)`, and Bun's `require` has no constructor slot, so model loading aborted with `function is not a constructor`; and the entity loader reassigned `arguments`, which Bun's parser rejects outright with `Invalid assignment target`. Both repairs are no-ops on Node by construction — the plain call is exactly what Node was already doing — so only Bun behaviour changes. The release smoke now boots a SQLite-backed bundle and round-trips a real query on every Node leg and on the Bun CI leg, so connector support is gated rather than assumed.
+* Query files whose names collide with an inherited prototype member — for example `count.sql`, shadowed by the framework's global `count()` helper — were silently skipped by the mysql, postgresql, sqlite, duckdb, scylladb, and mongodb connectors, with calls falling through to the inherited member. The skip is now reported at startup with the file path and a rename hint (e.g. `countRows.sql`); a file matching a method the entity class itself defines still skips silently, by design (user code wins).
+* The Couchbase connector attaches every N1QL query file unconditionally, so a file named after an existing member — a stamped entity property like `getCluster`, a previously attached query method, or an inherited member such as EventEmitter's `on` — silently overwrote or shadowed that member for the entity. The clobber is now reported at startup with the file path and a rename hint (e.g. `onRows.sql`); shadowing the framework's global `count()`/`functionCount()` helpers stays silent, by design (there the query file winning is the point). Attachment behavior is unchanged — the warning never skips the file.
+* FormValidator reused one shared `XMLHttpRequest` for every form submit, and re-opening it replayed the previous submit's completion handler — visibly, submitting form B after form A had completed re-disabled A's submit button and re-stamped its `data-gina-form-loading`, with nothing ever releasing them (the lock was armed in four places and released in one). Every send now builds its own XHR, and a `loadend` listener releases the submit trigger and loading flag on success, error, timeout and abort alike. Along the way, `$form.isSending` now genuinely spans the request (it used to be cleared almost immediately, at the first readyState transition), and a timed-out form has its `data-gina-form-loading` removed instead of being left holding the truthy string `"false"`.
+* A form declaring `data-gina-form-live-check-enabled="false"` with resolvable rules was only partly opted out: two validation gates evaluated the rules-count boolean inside the regex test, so the truthy string `"false"` short-circuited to that boolean and matched — leaving bind-time silent validation and select-change validation running. Text as-you-type was never affected (the listener-registration gates already tested the attribute alone), so the pre-fix behaviour was an inconsistent middle rather than the attribute being ignored outright. The two gates now test the attribute alone and check the rules count separately, so an explicit `"false"` is honored consistently — which is what the framework's own warnings have been advising all along. Also declares a previously implicit global in the submit-trigger state updater.
+* The `status` key in a `renderJSON()` payload now reaches the wire over HTTP/2: the body path built its header frame with a hardcoded `:status: 200`, so every JSON error rendered on a genuine HTTP/2 stream was served as HTTP 200 with the error payload in the body (HTTP/1.1 was unaffected; the HEAD branch and the HTML delegates already honoured the resolved code). The `errno` half of the status branch is also guarded like its swig/v1 siblings: an `errno`-only payload with no usable `status` used to poison the status code — the response was silently never sent on HTTP/1.1 and turned into a 500 on HTTP/2 — and is now served as a normal 200 with the payload in the body.
+* Validator error labels: translating the key an app can observe in a field's `errors` object now works for the four rule families that consult a different label key internally — the float coercion's NaN branch (`toFloat` fills `toFloatNAN`) and the number/integer/string length families (the generic `is<X>Length` fills the `Min`/`Max` variants); an app-supplied specific key still wins. Numbered `is` aliases (`is1`, `is2`, …) with no rule-supplied text now fall back to the shared `is` label instead of rendering an empty message. And catalog or `setErrorLabels()` translations for user-defined validator keys are no longer clobbered by the English default at setup. Apps that translated only observable keys will see those messages switch from English to their language at pickup.
+* Validator error rendering: screen-reader announcements now join multiple rule messages with a sentence separator instead of running them together as one string (the visible stacked layout is unchanged), and two rules carrying byte-identical resolved message text render once instead of twice — a coercion paired with its validator no longer shows the same sentence duplicated. The dev inspector still records every error key.
+### Security
+* Fixed a path traversal in the dev-mode Inspector handler (`/_gina/inspector/*`): a request target containing a literal `../` escaped the Inspector asset root and read any file the bundle process could reach, including application config and credentials. Both engines were affected (isaac and Express), and the endpoint carries no IP allowlist. The resolved path is now confined to the Inspector asset root — anything resolving outside it falls through to the same 404 as a missing file, matching the existing static-resolver guard. Only bundles running in dev mode were affected; production bundles never expose this handler, and the URL-encoded `%2e%2e` form was never affected because the handler does not decode.
+
 ## 0.6.0 - 2026-07-28
 ### Added
 * The audit trail can now carry a tamper-evidence hash chain. Opt in with `audit.chain.enabled: true` and a signing key (`audit.chain.secret`, a literal or a `${secret:VAR}` placeholder, or the `GINA_AUDIT_SECRET` environment variable) and every record gains a `hash` that chains from its predecessor — `HMAC-SHA256(secret, previousHash + canonical(record))`. The new offline command `gina audit:verify <bundle> @<project>` walks the trail and reports either the intact totals or the first break with its line and reason, exiting non-zero when the chain is broken. This detects any post-hoc edit, deletion, insertion or reordering of the trail by someone who does not hold the signing key. It is deliberately NOT a defence against the process that writes the records: that process holds the key and could forge a whole chain, so for that stronger adversary stream the trail to write-once (WORM / Object-Lock) storage, as the compliance guide already describes. Two boundaries are stated rather than implied: truncation at the exact tail is invisible to the chain (read the record count), and an empty trail verifies trivially. A crash mid-write leaves a torn tail that the next boot acknowledges with a chained break record and a loud warning rather than a crash loop. The boot refuses the deployment shapes a single linear chain cannot hold — no signing key, a connector `store` backend (whose seam carries no ordering guarantee), or two bundles chaining into the same `audit.file` — so a chain that cannot be trusted never starts silently. Server-side only; enabling the chain needs a bundle restart.

package/README.md

@@ -60,39 +60,32 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.0
-
-> **Two behaviour changes to check before upgrading.** Neither refuses a boot,
-> but both change how an untouched bundle behaves. Session records in the redis,
-> sqlite, mongodb and scylladb stores now follow the session cookie's `maxAge`
-> when no `ttl` is configured, instead of an implicit one-day cap — lifetimes
-> move in **both** directions, so set an explicit `ttl` if you relied on the old
-> 24-hour behaviour. And `req.logout()` now destroys the whole session record
-> rather than only clearing `req.session.user`, so review any flow that expected
-> other session keys to survive logout. See the
+## What's in 0.6.1
+
+> **Three behaviour changes to check before upgrading.** None refuses a boot,
+> but each changes how an untouched bundle behaves. A JSON error payload rendered
+> on a genuine HTTP/2 stream now carries its real status code instead of always
+> being served as HTTP 200 — review any client that keyed off the old 200. A form
+> declaring `data-gina-form-live-check-enabled="false"` now genuinely loses
+> live-check everywhere, where two gates previously kept running. And an app that
+> translated only the error keys it can observe will see those messages switch
+> from English to its own language. See the
 > [migration guide](https://gina.io/docs/migration) for each.
 
-> **Action required — settings reset.** `0.6.0` is a shortVersion bump (`0.5` →
-> `0.6`), so on install the framework creates a fresh `~/.gina/0.6/settings.json`
-> from defaults — your `~/.gina/0.5/settings.json` customizations (log level,
-> port, culture, timezone, etc.) are **not** carried forward. Re-apply them with
-> `gina framework:set`, or copy the values across. Root-level state
-> (`~/.gina/main.json`, `projects.json`, `ports.json`, `gina.db`) is shared
-> across short versions and is unaffected.
-
-- **Added — a tamper-evidence hash chain for the audit trail.** Opt in with `audit.chain.enabled: true` and a signing key (`audit.chain.secret`, a literal or a `${secret:VAR}` placeholder, or `GINA_AUDIT_SECRET`) and every record gains a `hash` chaining from its predecessor — `HMAC-SHA256(secret, previousHash + canonical(record))`. The new offline `gina audit:verify <bundle> @<project>` walks the trail and reports either the intact totals or the first break with its line and reason, exiting non-zero when the chain is broken. This detects any post-hoc edit, deletion, insertion or reordering by someone who does not hold the signing key; it is deliberately *not* a defence against the process that writes the records, which holds the key — for that adversary, stream the trail to WORM / Object-Lock storage as the compliance guide describes. Two boundaries are stated rather than implied: truncation at the exact tail is invisible to the chain (read the record count), and an empty trail verifies trivially. The boot refuses the deployment shapes a single linear chain cannot hold — no signing key, a connector `store` backend, or two bundles chaining into the same `audit.file` — so a chain that cannot be trusted never starts silently. Server-side — restart your bundles. (#COMPLY2)
-- **Added — `lib.authn`, the authentication primitives that are dangerous to hand-roll.** `hashPassword` mints scrypt hashes as self-describing PHC strings (`$scrypt$ln=17,r=8,p=1$<salt>$<key>`), so the cost travels with the hash and can be raised later without a flag day. `verifyPassword` compares in constant time and *also* verifies existing `$argon2*$` and `$2a/2b/2y$` (bcrypt) hashes through your own project's package, so a bundle arriving with credentials already hashed keeps working; paired with `needsRehash`, a successful login upgrades them transparently and the store migrates itself with no password resets. `dummyVerify` spends matching work on the account-not-found branch to close the user-enumeration oracle — always pass `{like: <a stored hash>}` so the cost is read from real data. `validatePasswordPolicy` checks length first per NIST SP 800-63B (12 characters, no mandatory character classes by default). `createLockout()` adds the credential-stuffing brake, defaulting to PCI-DSS v4.0.1 §8.3.4 — 10 consecutive failures, 30 minutes — serialized per key so concurrent failures cannot lose the count, with one `auth.lockout` audit record on the transition. And `generateTotpSecret` / `otpauthURL` / `generateTotp` / `verifyTotp` implement RFC 6238 for a second factor; replay defence is yours, and the returned `counter` is what it needs. Gina still owns no user record, credential store or login route — these are helpers, not an identity provider. Server-side — restart your bundles. (#COMPLY3)
-- **Added — `req.login()` works for gina-native bundles and rotates the session id.** Previously the login shim only served Passport bundles; without Passport it threw, so native bundles bound the user by hand with no rotation at all. The native branch now regenerates the session — destroying the pre-login record, the session-fixation defence — binds the principal at `req.session.user`, stamps the absolute-timeout anchor, persists, and reports through the required callback; where the session provider exposes no `regenerate()` it binds without rotation and warns. Anything stored in the pre-login session is destroyed by the rotation: read it before the call and re-set it in the callback if it must survive. Outstanding CSRF tokens re-derive from the current session id on the next response, and Passport bundles are untouched. Server-side — restart your bundles. (#COMPLY4)
-- **Added — an opt-in absolute session timeout.** `session({ absoluteTimeout: <ms> })` on the Session plugin, or `settings.json > session.absoluteTimeout` as the deployment default with bundle code winning (`absoluteTimeout: false` disables it). An authenticated session older than the cap — measured from login, not from last activity — is destroyed on its next request and the request proceeds with a fresh anonymous session, exactly as a naturally-expired record behaves. Fail-closed: when the record cannot be destroyed the authentication is still dropped. This is the fixed-cap half of session-lifetime control; idle expiry already existed (the cookie `maxAge` and the store-record TTL both roll with activity) and composes with it. Anonymous sessions are never touched, preserving `saveUninitialized: false` semantics. Declared in the published settings.json schema. Server-side — restart your bundles. (#COMPLY4)
-- **Security — `req.logout()` destroys the persisted session record.** It previously only cleared `req.session.user`: the store record, the session id and every other session key survived to TTL, so a leaked or intercepted session id stayed valid server-side long after the user logged out. It now calls the session's own `destroy()` when one is exposed, degrades gracefully when it is not, and accepts an optional callback — `req.logout(function (err) { … })`. **Review flows that relied on other session keys surviving logout: the whole record is gone afterwards.** The session cookie stays yours to expire (its name is not discoverable by the framework), and Passport bundles are unaffected — the shim never installs when Passport is initialized.
-- **Fixed — co-located CLIs reach the control plane again.** 0.5.26's loopback bind default carried a dial-side regression: CLI-side clients (the command socket, the MQ speaker and file log containers, and `gina tail`) dialled `host_v4` while the daemon binds `bind_host`, so any deployment whose `host_v4` is a non-loopback address of the same machine — the common containerized shape — could not reach its own daemon, and `bundle:start` aborted before the HTTP server ever bound. Clients now resolve the dial host through a locality check: a `host_v4` naming one of the machine's own interfaces dials the bind address, while a genuinely remote `host_v4` is dialled unchanged. The bind side is untouched, so nothing is newly exposed, and the connection-refused error now names both the dial target and the `bind_host` knob. If you applied the `GINA_BIND_HOST=0.0.0.0` workaround purely to un-break co-located CLIs, you can drop it after upgrading. (#B160)
-- **Fixed — `gina framework:set --bind-host=` now persists.** The value was silently reverted to the loopback default by the very next CLI invocation — the settings regeneration had a disk-to-env read-back for every connection key except `bind_host` — and again by every container bootstrap, which rewrote settings.json with a hardcoded value. The persisted value now survives both paths; `GINA_BIND_HOST` still takes precedence when set. (#B161)
-- **Fixed — session records honour the cookie `maxAge`.** In the redis, sqlite, mongodb and scylladb stores an implicit one-day default made the cookie-`maxAge` fallback in `set()` / `touch()` unreachable, so a record's lifetime ignored the session cookie unless a `ttl` was configured explicitly — a 1-hour cookie left its record alive server-side for 24 hours, and a 7-day cookie was silently cut to 24 hours. When neither the store options nor the connectors.json entry sets a `ttl`, the record TTL now follows the cookie's `maxAge` (one day only when the cookie has none), matching the Couchbase stores. An explicitly configured `ttl` still wins. **Note this moves record lifetimes in both directions** relative to the old accidental 24-hour cap. (#B163)
-- **Fixed — the SQLite session store no longer expires the session it was asked to refresh.** `touch()` stamped `now + ttl` without first checking the resolved ttl — and express-session's `cookie.maxAge` is a decaying remainder, which truncates to zero in the final second and turns negative once expired — so a session near its expiry had an already-past expiry written to it and ended early. It now performs no write and returns cleanly on a non-positive ttl, matching the redis, mongodb and scylladb stores which already guarded this. (#B166)
-- **Fixed — the Couchbase session store's `lastModified` is refreshed and UTC.** An internal idle check compared an elapsed value in milliseconds against a TTL in seconds, so it fired roughly 1000× sooner than intended and left `lastModified` un-refreshed on most calls — even though every `touch()` extends the document's expiry regardless. The stamp now tracks each extension, keeping the client-side session countdown measuring from the right origin. The SDK 4 store additionally writes it as an ISO 8601 UTC string, matching the redis, sqlite, mongodb and scylladb stores; it previously wrote a zone-less local-time value that the browser re-parsed in its own timezone. (#B165)
-- **Fixed — the Couchbase session store requires its open bucket explicitly.** It now takes `options.db` — the already-open bucket the model layer creates from the `session` connector entry (`getModel('session').getConnection()`) — and fails fast with an actionable error when it is missing or is not a bucket, instead of crashing at bundle init inside a dead self-connect path that called the SDK v2 `openBucket()` API, absent from the supported v3 and v4 SDKs. The connection options that only fed that dead path (`host`, `hosts`, `username`, `password`, `bucket`, `cachefile`) were removed with it. No working deployment is affected — the path they fed could not succeed on a supported SDK. (#B167)
-- **Fixed — server-side `getRoute()` no longer crashes when no proxy hostname is resolvable.** With the worker-wide proxied latch set but both proxy-hostname sources unset — the boot-time global and the per-render `envConf` fallback, each of which the framework itself can legitimately leave empty — every `getRoute()` call threw a `TypeError`, taking down any render or readiness probe that resolved a route. The route now degrades to its direct hostname and `route.isProxyHost` flips false, so `toUrl()` cannot stringify an unset value into the emitted URL; a once-per-process warning names the degraded state. The `url` template filters hold `getRoute()`'s own resolution so their per-request override can never replace a usable value with an unset one. Server-side — restart your bundles. (#B168)
-- **Fixed — the JSON schemas now describe the `audit` and `session` blocks.** All five audit keys (`enabled`, `file`, `store`, `actorKey`, `events.authz`) and the three consumed session-cookie keys (`sameSite`, `httpOnly`, `secure`) were undeclared, so an editor offered no completion, no type checking and no description on hover, and a mistyped key surfaced only as a boot refusal at the next restart. Each declaration mirrors the corresponding boot lint or factory-time validation rather than merely permitting the keys, and rejects unread keys — putting `maxAge` or a store `ttl` under `settings.json > session` has never had any effect, and an editor now says so. Separately, the `connectors.json` schema no longer labels the session-store `ttl` and `prefix` keys "Redis only" — `ttl` is read by the redis, sqlite, mongodb and scylladb stores and `prefix` by redis and sqlite — and its stale `86400` default is gone. Runtime behaviour is unchanged; the schemas are editor tooling, never enforced at boot.
+> **No settings reset.** `0.6.1` is a patch — the `shortVersion` stays `0.6`, so
+> your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
+
+- **Security — the dev-mode Inspector no longer serves files outside its asset root.** A request to `/_gina/inspector/*` carrying a literal `../` escaped the Inspector's asset directory and read any file the bundle process could reach — application config and credentials included. The path helper the handler used *normalizes* `../` rather than rejecting it, so the traversal resolved rather than failing, and both engines were affected. Only bundles running in **dev mode** were ever exposed: production bundles do not serve this handler, and the URL-encoded `%2e%2e` form was never affected because the handler does not decode. A browser could not trigger it — browsers normalize `../` before the request is sent — but any raw HTTP client could. The resolved path is now confined to the Inspector asset root, and anything resolving outside it falls through to the same 404 as a missing file, matching the existing static-resolver guard. Nothing to do beyond upgrading. Worth reviewing while you are here: this endpoint carries no IP allowlist, unlike `/_gina/info` and `/_gina/cache/*`, and a dev bundle binds all interfaces by default — restricting dev hosts at the network layer is still worthwhile. Server-side — restart your bundles. (#B179)
+- **Added — DuckDB connector.** Embedded **analytical** (columnar / OLAP) SQL over the standard entity wiring — the analytics-side sibling of the SQLite connector's embedded OLTP role. A `"connector": "duckdb"` entry opens a file-backed or `":memory:"` database (`file` is optional and defaults to `~/.gina/{version}/{database}.duckdb`), and entity methods load from `models/<database>/sql/` with the same `@param` casting and `@return` shaping as MySQL and PostgreSQL. Row-returning detection covers the analytical dialect — `WITH` CTEs, `FROM`-first, `SUMMARIZE`, `PIVOT`/`UNPIVOT`, `DESCRIBE`, `SHOW` — so CTE-heavy queries return rows instead of being routed to the write path, and Parquet / CSV / JSON files can be queried directly with no ETL hop. Large numeric types (BIGINT / HUGEINT / DECIMAL) and dates arrive as JSON-safe strings; writes report `{ changes }`. `readOnly: true` opens the database read-only so any number of processes can share one file. The `@duckdb/node-api` driver installs in your project, and the `connector:*` CLI group plus the connectors.json schema recognise the new type. Additive — nothing to change. Server-side — restart your bundles. (#CN11)
+- **Added — SQLite works under the Bun runtime.** The SQLite ORM connector, the SQLite session store, the async-job store and the framework state store now resolve Bun's built-in `bun:sqlite` behind a `node:sqlite`-shaped adapter whenever `node:sqlite` is absent. Bun does not implement `node:sqlite`, so all four previously failed at boot under Bun — and the state store silently fell back to its JSON path. Nothing to install and no configuration change; transient/permanent connector-error classification reads both drivers identically. On Node.js nothing changes, since `node:sqlite` is still tried first. MongoDB remains unavailable under Bun — its `bson` dependency calls a `node:v8` API Bun does not implement, an upstream limitation with no framework-side fix.
+- **Fixed — Bun: a bundle declaring any connector boots again.** Two Bun-only crashes stopped model loading outright. `new require(mod)(args)` parses as `(new require(mod))(args)`, and Bun's `require` has no constructor slot, so loading aborted with `function is not a constructor`; and the entity loader reassigned `arguments`, which Bun's parser rejects with `Invalid assignment target`. Both repairs are no-ops on Node by construction — the plain call is exactly what Node was already doing — so only Bun behaviour changes. The release smoke now boots a SQLite-backed bundle and round-trips a real query on every Node leg and on the Bun CI leg, so connector support is gated rather than assumed.
+- **Fixed — reserved-name query files now warn instead of vanishing silently.** A query file whose name collides with an inherited prototype member — most commonly `count.sql`, shadowed by the framework's global `count()` helper — was silently skipped by the MySQL, PostgreSQL, SQLite, DuckDB, ScyllaDB and MongoDB connectors, and calls fell through to the inherited member, returning a plausible but unrelated value. The skip is now reported at startup with the file path and a rename hint (for example `countRows.sql`). Behaviour is unchanged — the file is still skipped — and a file matching a method your entity class itself defines still skips silently, by design: your code wins. A warning appearing on upgrade points at a query file that has never worked. Server-side — restart your bundles. (#B173)
+- **Fixed — Couchbase warns when a query file overwrites or shadows an entity member.** The Couchbase connector attaches every N1QL query file unconditionally, so a file named after an existing member — a stamped entity property like `getCluster`, a previously attached query method, or an inherited member such as EventEmitter's `on` — silently overwrote or shadowed it. The clobber is now reported at startup with the file path and a rename hint (for example `onRows.sql`); shadowing the framework's global `count()`/`functionCount()` helpers stays silent, by design, since there the query file winning is the point. Attachment behaviour is unchanged — the warning never skips the file. Server-side — restart your bundles. (#B174)
+- **Fixed — `renderJSON()`'s `status` key reaches the wire over HTTP/2.** The body path built its header frame with a hardcoded `:status: 200`, so every JSON error rendered on a genuine HTTP/2 stream was served as HTTP 200 with the error payload in the body; HTTP/1.1 was unaffected, and the HEAD branch and the HTML delegates already honoured the resolved code. The `errno` half of the status branch is also guarded like its swig and v1 siblings: an `errno`-only payload with no usable `status` used to poison the status code — the response was silently never sent on HTTP/1.1 and turned into a 500 on HTTP/2 — and is now served as a normal 200 with the payload in the body. **Review any HTTP/2 client that keyed off the old 200.** Server-side — restart your bundles. (#B172)
+- **Fixed — a form submit no longer strands a sibling form's submit button.** FormValidator reused one shared `XMLHttpRequest` for every submit, and re-opening it replayed the previous submit's completion handler — visibly, submitting form B after form A had completed re-disabled A's submit button and re-stamped its `data-gina-form-loading`, with nothing ever releasing them (the lock was armed in four places and released in one). Every send now builds its own XHR, and a `loadend` listener releases the submit trigger and the loading flag on success, error, timeout and abort alike. Along the way `$form.isSending` now genuinely spans the request, where it used to be cleared almost immediately at the first readyState transition, and a timed-out form has its `data-gina-form-loading` removed instead of being left holding the truthy string `"false"`. Browser-bundled — re-bake your bundles. (#B175)
+- **Fixed — the live-check opt-out is honored consistently.** A form declaring `data-gina-form-live-check-enabled="false"` with resolvable rules was only partly opted out: two validation gates evaluated the rules-count boolean inside the regex test, so the truthy string `"false"` short-circuited to that boolean and matched — leaving bind-time silent validation and select-change validation running. Text as-you-type was never affected, since the listener-registration gates already tested the attribute alone, so the pre-fix behaviour was an inconsistent middle rather than the attribute being ignored outright. The two gates now test the attribute alone and check the rules count separately, so an explicit `"false"` is honored everywhere — which is what the framework's own warnings have been advising all along. **An opted-out form genuinely loses those two checks now**; drop the attribute if you were relying on them. Browser-bundled — re-bake your bundles. (#B176)
+- **Fixed — validator error labels: translating the key an app can observe now works.** Four rule families consult a different label key internally than the one an app sees in a field's `errors` object, so translating the observable key had no effect: the float coercion's NaN branch (`toFloat` fills `toFloatNAN`) and the number, integer and string length families (the generic `is<X>Length` fills the `Min`/`Max` variants). An app-supplied specific key still wins. Numbered `is` aliases (`is1`, `is2`, …) with no rule-supplied text now fall back to the shared `is` label instead of rendering an empty message, and catalog or `setErrorLabels()` translations for user-defined validator keys are no longer clobbered by the English default at setup. **An app that translated only observable keys will see those messages switch from English to its own language at pickup.** Browser-bundled — re-bake your bundles. (#B178)
+- **Fixed — duplicate error messages and run-on screen-reader announcements.** Screen-reader announcements now join multiple rule messages with a sentence separator instead of running them together as one string — the visible stacked layout is unchanged — and two rules carrying byte-identical resolved message text render once instead of twice, so a coercion paired with its validator no longer shows the same sentence duplicated. The dev inspector still records every error key. Browser-bundled — re-bake your bundles. (#B178)
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -52,6 +52,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.25` ✅ | **Added**: microservices readiness — machine-caller authentication (an `Authorization: Bearer` key named in `settings.json > auth.machine.callers` satisfies route authorization without a session, opt-in and fail-closed, constant-time compared against boot-computed hashes, with an optional custom authenticator hook for JWT/HMAC/api-key schemes), cross-service request-id propagation (the always-on request id forwarded as `x-request-id` on every `self.query()` and echoed back on every response, so one logical request stays correlatable across bundles), an ungated `GET /_gina/health/check` on the express engine so container liveness probes no longer require the isaac engine, and the authorization contract in `bundle:openapi` (gated routes emit `401`/`403` entries and a `bearerAuth` security scheme, never role or policy names) · the `controller:` CLI group — `controller:add` scaffolds a namespace controller with per-action stubs and prints paste-ready routing rules, `controller:remove`/`rm` deletes only after a reference-aware scan that refuses while any routing rule or `requireController()` still points at it, and `controller:rename` rewrites the references it can resolve safely and reports the rest (#R9) · transient-vs-permanent classification for datastore connector errors — `err.isTransient` + a normalized `err.transientReason` on every connector query failure across all six datastore connectors, so an application can render an honest retry response without string-matching vendor error text; conservative by design, an unrecognized or genuinely permanent error classifies as permanent (#CE1) · `settings.swig.autoescape` to opt in to Swig output escaping (default unchanged; a non-boolean now refuses boot) · `server.proxy.requireForwardedHeaders` to require `X-Forwarded-Host` for proxy classification, the deterministic alternative to the port-less-Host heuristic · a `processing` state on the staged upload progress indicator, covering the server post-processing window so a full bar reads as working rather than stuck (#R8) · **Fixed**: absolute URLs poisoned by port-less internal calls — a health probe, service-mesh hop or service-DNS sibling call could rewrite the worker's proxy-host context and leak the internal host into later renders' `getUrl`/`url` output and cross-bundle redirect targets; emitting requests now prefer their own classification on both engines (#B152) · the Couchbase connector no longer hangs a request when an N1QL query fails at the socket level with no query-error envelope — the callback went un-fired and the request never settled (#B153) · a file input declaring only its staging upload action no longer emits a spurious warning-and-error pair on every bind · a staged-upload removal matching no preview now logs a diagnostic instead of silently skipping its whole cleanup path, including the temp-file delete (#B150) |
 | **Q3 2026** | `0.5.26` ✅ | **Security**: a route pairing an authorization key (`param.requireAuth` / `param.roles` / `param.policy`) with `cache` now refuses to boot — both render-cache serve points run BEFORE the authorization gate and the cache key carries no user identity, so the first authenticated response was replayed verbatim to every later anonymous caller; as a second layer the render delegates never store a body for a gated route even if the configuration bypassed the lint (#B158) · a `method: "ws"` route declaring an authorization key now refuses to boot — a WebSocket handshake is answered by the engine's extended-CONNECT handler and never reaches the gate, so those keys could never be enforced while the boot line still counted the route as protected; authenticate inside the `wsHandler`, which receives the full request (#B159) · the framework control-plane listeners now bind an explicit host defaulting to loopback — a new `bind_host` setting (env `GINA_BIND_HOST`, `gina framework:set --bind-host=`), separate from `host_v4`, so exposing the command socket and MQ listener beyond the local host is a deliberate opt-in · a command name arriving over the framework socket is constrained to the shipped `lib/cmd/` namespace before it resolves, and an unresolvable name is answered on the connection instead of ending the daemon for every other client · the MCP Streamable HTTP transport refuses to start without a bearer token once an ambient protection is removed (a non-loopback bind, or `allowedOrigins: ["*"]`), with a new `allowInsecure` waiver for deployments that restrict access upstream · **Added**: deny-by-default authorization — `settings.json > auth.requireAuthByDefault: true` requires an authenticated session on every route unless its `param` block carries `"public": true`; opt-in, strictly boolean, keyed per bundle so one bundle never changes a sibling's posture in merged mode, with the framework-injected routes shipping exempt and boot refusals for the login-route lockout, the `public`-plus-explicit-key contradiction, and a mode-gated route that also declares `cache`; `bundle:openapi` follows the mode (#COMPLY10) · a boot-time production transport posture guard — a cleartext scheme outside the `local` scope warns once at boot, `server.requireHttps` refuses to start instead (pre-listen, so the port is never reachable), and `server.allowInsecure` acknowledges that TLS terminates upstream (#COMPLY9) · **Fixed**: Couchbase client-side query timeouts classify as transient and keep their message — the connector rebuilt the error from the query `cause` envelope the SDK attaches to every query error, so a client-side timeout became an empty-message `Error` that had lost the typed class name the classifier matches on (#B153) · `gina bundle:mcp-start --transport=http` now actually applies `GINA_MCP_AUTH_TOKEN` — the resolver read `process.env` directly while the CLI had already moved every `GINA_*` variable into the framework environment, so a deployment supplying the token only that way ran with no authentication · a `.sql` `@options` annotation that silently did nothing now warns, naming the ignored keys and showing the working form (#B155) · the `settings.json` and `routing.json` schemas now describe the route-authorization vocabulary, so an editor no longer flags a valid deny-by-default configuration as invalid · `lib/merge`'s JSDoc no longer documents an inverted `override` default |
 | **Q4 2026** | `0.6.0` ✅ | **Security**: `req.logout()` now destroys the persisted session record instead of only clearing `req.session.user` — the store record, the session id and every other session key previously survived to TTL, so a leaked or intercepted session id stayed valid server-side long after the user logged out; it now accepts an optional callback, and Passport bundles are unaffected · **Added**: an opt-in tamper-evidence hash chain for the audit trail — `audit.chain` plus a signing key gives every record an HMAC that chains from its predecessor, and the new offline `gina audit:verify <bundle> @<project>` walks the trail and reports either the intact totals or the first break, so any post-hoc edit, deletion, insertion or reordering by someone who does not hold the key is detectable; the boot refuses the deployment shapes a single linear chain cannot hold rather than starting a chain that cannot be trusted (#COMPLY2) · `lib.authn` — the authentication primitives that are dangerous to hand-roll: scrypt password hashing encoded as self-describing PHC strings so the cost can be raised without a flag day, with argon2 and bcrypt verify-only routing through the project's own package so a store arriving with existing credentials keeps working and migrates itself on the next successful login, a `dummyVerify` that closes the user-enumeration oracle, NIST SP 800-63B password policy, a PCI-DSS v4.0.1 §8.3.4 account-lockout engine, and RFC 6238 TOTP; gina still owns no user record, credential store or login route (#COMPLY3) · `req.login(user, done)` now works for gina-native bundles and rotates the session id before binding the user — the session-fixation defence; it previously threw without Passport, so native bundles bound the user by hand with no rotation at all (#COMPLY4) · an opt-in absolute session timeout — `session({ absoluteTimeout })` or `settings.json > session.absoluteTimeout` — caps an authenticated session's total lifetime measured from login regardless of activity, composing with the idle expiry that already existed (#COMPLY4) · **Fixed**: co-located CLIs reach the control plane again — 0.5.26's loopback bind default left CLI-side clients dialling `host_v4` while the daemon binds `bind_host`, so any deployment whose `host_v4` is a non-loopback address of the same machine could not reach its own daemon and `bundle:start` aborted before the HTTP server ever bound (#B160) · `gina framework:set --bind-host=` now persists across the settings regeneration that runs on every command and across container bootstraps (#B161) · session records in the redis, sqlite, mongodb and scylladb stores now honour the cookie `maxAge` when no `ttl` is configured, instead of an implicit one-day default that made the fallback unreachable — record lifetimes move in both directions relative to the old 24-hour cap (#B163) · the SQLite store no longer expires the very session it was asked to refresh, guarding a non-positive resolved ttl as its siblings already did (#B166) · the Couchbase store's `touch()` re-stamps `lastModified` on every extension — an internal idle check compared milliseconds against seconds — and the SDK 4 store writes it as an ISO 8601 UTC string, matching the other stores (#B165) · the Couchbase session store now requires the already-open bucket as `options.db` and fails fast with an actionable error instead of crashing at bundle init inside a dead SDK v2 self-connect path (#B167) · server-side `getRoute()` no longer crashes when a proxied context is active while no proxy hostname is resolvable — the route degrades to its direct hostname instead of throwing, so a render or readiness probe that resolves a route survives the state (#B168) · the `settings.json` schema now describes the `audit` and `session` blocks, and the `connectors.json` schema no longer labels the session-store `ttl` and `prefix` keys "Redis only" nor advertises a stale 86400 default — editor tooling only, runtime behaviour unchanged |
+| **Q4 2026** | `0.6.1` ✅ | **Security**: the dev-mode Inspector no longer serves files outside its asset root — a request to `/_gina/inspector/*` carrying a literal `../` escaped the asset directory and read any file the bundle process could reach, application config and credentials included, on both engines; only dev-mode bundles ever served the handler, and the URL-encoded `%2e%2e` form was never affected (#B179) · **Added**: DuckDB connector — embedded analytical (columnar / OLAP) SQL over the standard entity wiring, with analytical-dialect row detection (`WITH` CTEs, `SUMMARIZE`, `PIVOT`), direct Parquet / CSV / JSON querying with no ETL hop, and a `readOnly` mode so any number of processes can share one database file (#CN11) · **Added**: SQLite under the Bun runtime — the ORM connector, session store, async-job store and framework state store resolve Bun's built-in `bun:sqlite` behind a `node:sqlite`-shaped adapter whenever `node:sqlite` is absent; Node resolution is unchanged · **Fixed**: two Bun-only crashes that stopped any connector-declaring bundle from booting, both no-ops on Node by construction, with the release smoke now booting a SQLite-backed bundle on every Node leg and on Bun · **Fixed**: query files whose names collide with an inherited prototype member were silently skipped by six ORM connectors and now warn at startup with a rename hint, while Couchbase — which attaches unconditionally — warns on the overwrite or shadow instead (#B173/#B174) · **Fixed**: `renderJSON()`'s `status` key now reaches the wire over HTTP/2, where the body path hardcoded a 200 status frame and served every JSON error as HTTP 200 with the error payload in the body (#B172) · **Fixed**: FormValidator — each submit builds its own XHR with a fail-safe release, so a completed form no longer re-disables a sibling form's submit button; the live-check opt-out attribute is honored consistently; error labels for the keys an app can observe are translatable; and byte-identical messages render once, with sentence-separated screen-reader announcements (#B175/#B176/#B178) |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — runtime CPU profiling baseline · multipart & WebSocket hot-path acceleration · render/log hot-path cleanups (SIMD scanner deferred, measure-gated) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |
@@ -318,7 +319,7 @@ New database connectors follow the same interface as the existing Couchbase conn
 | ✅ | **`connector:infer` — one-off AI inference CLI** | `0.5.6-alpha.3` | Q2 2026 | Runs a single inference against a configured `ai` connector **outside a request** — the runtime sibling of the config-only `connector:list`/`add`/`rm`/`migrate` tooling. Resolves the project's shared (or shared+bundle merged) `connectors.json`, resolves `${secret:KEY}` credentials from the CLI's own environment (the resolved value is never echoed), instantiates the connector directly (no bundle boot, no framework socket), and prints the normalised result. `gina connector:infer <connector> [<bundle>] @<project> --message="..."`, with `--system` / `--model` / `--max-tokens` / `--temperature` per-call overrides; `--message` takes precedence over a messages JSON array piped on stdin. `--format=json` (matched strictly — `jsonl`/`json5` fall back to the text output) emits `{ content, model, usage }`, with `--raw` adding the full provider response as a `raw` field (omitted by default for CLI use); text mode writes the content to stdout and a model/usage footer to stderr. `--stream` streams the inference as newline-delimited JSON (NDJSON) — one frame per line on stdout: a `start` frame, a `delta` frame per token, then a terminal `done` (content, model, usage, latency; plus the provider `raw` object under `--raw` — `null` for OpenAI-family streams) or `error` frame; token counters are passed through verbatim and are `null` (never fabricated) when a provider does not report them. Errors cleanly on a non-`ai` connector, and surfaces missing-SDK / credential / transport failures with a non-zero exit and the reason on stderr. Useful for smoke-testing connectivity + credentials from CI/automation, or scripting a one-off inference from a shell; offline providers such as `ollama://` work with no paid-API key. Implemented 2026-06-30 (`connector:infer` + the `--stream` NDJSON mode; a later output-hardening pass added `--raw`, pipe-safe synchronous writes, and `--message`-over-stdin precedence). |
 | ✅ | **`connector:test` — connector readiness probe CLI** | `0.5.6-alpha.3` | Q2 2026 | Probes a project's configured connectors for readiness **outside a request** — the CI-friendly sibling of `connector:list` (driver-install status only) and `secrets:check` (env presence only), answering "is this connector ready to use?". Default is validate-only and offline: per connector it checks the `connector` type / `ai` protocol is recognised, the npm driver is installed at `<project>/node_modules`, and every `${secret:KEY}` placeholder resolves from the environment — no network, no connector instantiated — exiting non-zero when any connector fails so it can gate a deploy. `gina connector:test [<connector> [<bundle>]] @<project>` tests one connector or every connector in a project (bare → every registered project), mirroring `connector:infer`'s positional grammar and `secrets:check`'s all-mode; `--format=json` emits a machine-readable readiness report. The `--connect` opt-in adds a live connectivity probe: for `ai` connectors it calls the provider's `models.list` (a credentialed request that authenticates with **zero generation tokens**; `ollama://` confirms the local server is up), resolving `${secret:KEY}` the way `connector:infer` does (the value is never printed). For DB/cache connectors the live `--connect` probe is reported as **skipped** for now (config / driver / secrets are still validated) — the live DB/cache probe is a follow-up, since those connector classes load `core/gna` (which exits the process outside a booted bundle) and cannot be instantiated the way the AI connector is. Implemented 2026-06-30. |
 | ✅ | **`connector:models` — list an AI connector's provider models** | `0.5.8` | Q2 2026 | Lists the model catalogue a configured `ai` connector's provider can serve — the read sibling of `connector:test --connect` (which makes the same `models.list()` call but keeps only the count). `gina connector:models <connector> @<project> [<bundle>]` prints one model id per line (a count footer on stderr), or `--format=json` emits `{ project, connector, provider, count, models }` with each entry passed through verbatim from the provider (only `id` is guaranteed across providers — Anthropic and OpenAI-family return different fields). Reuses the direct-`AIConnector` bootstrap of `connector:infer` / `connector:test` (no bundle boot, no framework socket); resolves config only and never prints credentials; offline providers such as `ollama://` work with no internet. `isAIConnector`-gated (a non-AI connector is rejected cleanly), and a provider client without `models.list` reports `supported:false` with a non-zero exit rather than a fabricated empty list. Implemented 2026-07-03. |
-| 📋 | **DuckDB** | `0.6.x` | Q3 2026 | ORM / entity connector for DuckDB — an embedded **analytical** (columnar, OLAP) store: the analytics-side sibling of the SQLite connector's embedded OLTP role. Planned shape follows the MySQL / PostgreSQL architecture: entity wiring, `sql/` layout, positional placeholders (DuckDB accepts `?` and `$name`), `@param`/`@return` annotations, native Promise + `.onComplete()`, driver loaded from the project's `node_modules` as an optional peer dependency. Client: `@duckdb/node-api` (DuckDB's current-generation Node client). Use cases: in-process analytics and reporting bundles over app data, querying Parquet / CSV / JSON files directly without an ETL hop, larger-than-memory local aggregation; both `:memory:` and file-backed databases. Session store is a non-goal — DuckDB is a single-writer analytics engine (Redis / SQLite cover session storage). |
+| ✅ | **DuckDB** | `0.6.1-alpha.2` | Q3 2026 | ORM / entity connector for DuckDB — an embedded **analytical** (columnar, OLAP) store: the analytics-side sibling of the SQLite connector's embedded OLTP role. Follows the MySQL / PostgreSQL architecture: entity wiring, `sql/` layout, positional placeholders (`?` and `$1` both bind), `@param`/`@return` annotations, native Promise + `.onComplete()`, driver loaded from the project's `node_modules` (`npm install @duckdb/node-api`). Row-returning detection covers the analytical dialect — `WITH` CTEs, `FROM`-first, `SUMMARIZE`, `PIVOT`/`UNPIVOT`, `DESCRIBE`, `SHOW` — and results come from the driver's JSON-safe getter (BIGINT / DECIMAL / dates arrive as strings). `readOnly` opens a database read-only so any number of processes can share one file (DuckDB is single-writer across processes). Use cases: in-process analytics and reporting bundles over app data, querying Parquet / CSV / JSON files directly without an ETL hop, larger-than-memory local aggregation; both `:memory:` and file-backed databases. Session store is a non-goal — DuckDB is a single-writer analytics engine (Redis / SQLite cover session storage). Implemented 2026-07-29 (#CN11). |
 
 ---
 

package/context7.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "https://context7.com/schema/context7.json",
+  "url": "https://context7.com/gina-io/gina",
+  "public_key": "pk_MGD4ulFUKUHnxmzFGuWc8",
+  "projectTitle": "Gina",
+  "description": "MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency.",
+  "branch": "master",
+  "excludeFolders": [
+    ".changes",
+    ".github",
+    "test",
+    "node_modules",
+    "framework/v[^/]+/node_modules",
+    "framework/v[^/]+/core/asset/plugin/dist",
+    "resources",
+    "services"
+  ],
+  "excludeFiles": [
+    "CONTRIBUTING.md",
+    "GOVERNANCE.md",
+    "AUTHORS"
+  ],
+  "rules": [
+    "Controllers render with self.render(data) for HTML and self.renderJSON(data) for JSON. Never use res.send(), res.json() or res.end() — gina does not expose an Express response API.",
+    "Routes are declared per bundle in config/routing.json as { \"rule-name\": { \"method\": \"GET\", \"url\": \"/users/:id\", \"param\": { \"control\": \"getUser\" } } }. Never register routes in code with app.get()/app.post().",
+    "Gina has no Express dependency. Do not assume Express middleware, req/res helpers or app.get() routing. app.use() appears only when a bundle registers plugin middleware inside onInitialize.",
+    "A project contains one or more bundles; the bundle is the unit of deployment, with its own controllers, models, config, templates and port. Start one with: gina bundle:start <bundle> @<project>.",
+    "CLI scope is positional, never a flag: 'gina <group>:<action> <bundle> @<project>' is bundle-scoped and 'gina <group>:<action> @<project>' is project-wide. Do not invent --scope; scope means data isolation (local/beta/production/testing).",
+    "Return HTTP errors from a controller with self.throwError(res, code, msg); shorter overloads such as self.throwError(err) exist. Do not write a status code and error body onto the response directly.",
+    "Entity methods expose .onComplete(cb) as their public contract. Use .once() and never .on() for entity trigger listeners, and call removeAllListeners([name]) before every .once() registration.",
+    "Never call underscore-prefixed methods or properties from bundle code. The _ prefix marks framework-internal API that is not covered by any compatibility promise.",
+    "Read gina JSON config with the injected global requireJSON(path), never require(). Gina config files legitimately contain // and /* */ comments, which Node's JSON loader rejects.",
+    "Config templates substitute ${variable}, not {variable}. Substitution is single-pass and does not self-resolve, so every placeholder key — including derived ones — must already exist in the dictionary.",
+    "In bundle code console is shadowed by gina's logger (var console = lib.logger). Use console.debug/warn/error/emerg for output; never write to process.stdout directly.",
+    "Inter-bundle HTTP calls go through self.query() from the controller, which carries gina's HTTP/2 client retry and session handling. Do not reach for fetch() or a raw http request.",
+    "Build framework-internal paths with the injected global _(path, isAbsolute). When a local variable named path already exists in the file, import Node's path module as nodePath.",
+    "A controller is a constructor whose actions are assigned as this.action = function(req, res). Capture 'var self = this;' at the top and call self.render()/self.query() from inside actions — an action is not invoked with the controller as its this."
+  ],
+  "previousVersions": [
+    "v0.6.0",
+    "v0.5.26"
+  ]
+}

package/framework/v0.6.1/VERSION

@@ -0,0 +1 @@
+0.6.1