gina 0.6.1 → 0.6.2

package/framework/{v0.6.1 → v0.6.2}/core/config.js

@@ -348,10 +348,21 @@ function Config(opt, contextResetNeeded) {
      * @param {string} env - Environment name
      * @param {string} scope - Scope name
      * @param {object} conf - Core server configuration object
+     * @throws {Error} When `envConf` carries no block for `bundle`/`env` — i.e.
+     *                 the project's `env.json` never declared it (#B181(b)).
+     *                 The boot path guards this at the `loadBundleConfig` call
+     *                 site, which can refuse through its callback; this throw
+     *                 is the defense-in-depth for any other caller.
      */
     this.setServerCoreConf = function(bundle, env, scope, conf) {
         self.env    = env;
         self.scope  = scope;
+        // #B181(b) — a NAMED failure beats the opaque
+        // `Cannot read properties of undefined (reading '<env>')` deref that
+        // this line produced when env.json declared no block for the bundle.
+        if ( !self.envConf[bundle] || !self.envConf[bundle][env] ) {
+            throw new Error('setServerCoreConf(`'+ bundle +'`, `'+ env +'`): no env.json configuration block for this bundle/env');
+        }
         self.envConf[bundle][env].server['coreConfiguration'] = conf;
     }
 
@@ -772,9 +783,19 @@ function Config(opt, contextResetNeeded) {
             //     newContent[app][env].bundlesPath = newContent[app][env].sources;
             // }
             tmpSettings = {};
-            newContent[app][env].bundlesPath = bundlesPath;
 
             if ( typeof(content[app][env]) != "undefined" ) {
+                // #B183 — this assignment MUST stay inside the guard. `newContent`
+                // is a deep clone of `content` (see its declaration at the top of
+                // this function), so `newContent[app][env]` is undefined for
+                // exactly the apps this guard rejects: an app declared in the
+                // project env.json but NOT for the env being started. Assigning it
+                // one line earlier — outside the guard meant to protect it — threw
+                // an opaque `TypeError: Cannot set properties of undefined (setting
+                // 'bundlesPath')` and killed the boot at exit 143, ~750 lines before
+                // the #B181(b) refusal that names the bundle, the env and the
+                // env.json path could ever fire.
+                newContent[app][env].bundlesPath = bundlesPath;
                 try {
                     // reverted: async readdir (#P33) breaks synchronous Config init contract
                     configFiles = fs.readdirSync(_(appPath + '/config'));
@@ -1147,6 +1168,18 @@ function Config(opt, contextResetNeeded) {
                     newContent[app][env].projectName = self.projectName;
                 }
 
+                // #B181(a) — `host` is the one key the substitution dictionary below
+                // reads off this block that a project can only supply from its own
+                // env.json; the framework template now carries the same `localhost`
+                // default the CLI writes, so a partial block resolves instead of
+                // leaving `${host}` unsubstituted inside the credentials paths.
+                // Report the omission rather than defaulting silently — and test the
+                // RAW `content` block, since the merged one always carries the
+                // default by this point and could never satisfy the condition.
+                if ( typeof(content[app][env].host) == 'undefined' ) {
+                    console.warn('[CONFIG]['+ app +']['+ env +'] no `host` declared in the project env.json — defaulting to `'+ newContent[app][env].host +'`');
+                }
+
 
 
                 // replacement for {bundle}@{project}
@@ -1211,8 +1244,15 @@ function Config(opt, contextResetNeeded) {
                     return;
                 }
 
+            } else {
+                //Else not in the scenario.
+                // #B183 — the app IS declared in the project env.json, but not for
+                // the env being started, so it is skipped here. Say so: without it
+                // the bundle would simply never load, with nothing explaining why.
+                // The STARTING bundle additionally refuses the boot further down,
+                // in loadBundleConfig (#B181(b)).
+                console.warn('[CONFIG]['+ app +']['+ env +'] no `'+ env +'` block in the project env.json — skipping this bundle for this environment');
             }
-            //Else not in the scenario.
 
         }//EO for.
 
@@ -1510,6 +1550,27 @@ function Config(opt, contextResetNeeded) {
         console.debug('[CONFIG][loadBundleConfig] Loading `'+ bundle +'/'+ env +':'+ scope +'` configuration, please wait ...');
 
 
+        // #B181(b) — the bundle list is built inside the env.json template-merge
+        // loop, so an env.json that is empty, ABSENT (userConf stays false), or
+        // that declares only bundles missing from manifest.json yields an EMPTY
+        // list; `bundles[b]` is then undefined and `bundle` falls back to
+        // startingApp above — a bundle `envConf` was never populated for. The
+        // setServerCoreConf call below would deref `envConf[bundle][env]` and
+        // die as an uncaughtException naming neither env.json nor the bundle.
+        // Refuse here instead, matching the #B132 routing.json refusal further
+        // down this same function (callback(err) leads to process.exit(1)), so
+        // an external supervisor retries while a release tree settles. This
+        // predicate can only be true in a configuration that ALREADY crashed,
+        // so it cannot refuse a boot that works today.
+        if ( !conf[bundle] || !conf[bundle][env] ) {
+            var _envBlockMsg = '[ ' + bundle + ' ][ ' + env + ' ] no configuration block for this bundle/env in '
+                + self.executionPath + '/env.json ('
+                + ( self.userConf ? 'the file declares no `'+ bundle +'.'+ env +'` block' : 'file NOT FOUND' )
+                + ') — every bundle must be declared there for the env it starts in; refusing to start';
+            console.error(_envBlockMsg);
+            return callback(new Error(_envBlockMsg));
+        }
+
         self.setServerCoreConf(bundle, env, scope, conf.core);
 
         // bundle paths, ports, protocols

package/framework/{v0.6.1 → v0.6.2}/core/controller/controller.js

@@ -102,6 +102,154 @@ var _mintErrorRef = function(supplied) {
     }
     return crypto.randomBytes(3).toString('hex').toUpperCase();
 };
+
+/**
+ * #CE1 — resolves the bundle's `server.transientErrors` block into its
+ * effective values. Total: never throws, and tolerates any malformed shape
+ * by falling back to the documented defaults (the boot-time warn pass in
+ * `core/gna.js` names each ignored key once at startup — keep both sites'
+ * rules in sync). Strictness rules:
+ *   - `enabled` must be strictly boolean `true` — any other type or value
+ *     leaves the feature off (an error-rendering opt-in must never turn on
+ *     by accident);
+ *   - `retryAfter` must be an integer within 1..86400 seconds, else 30;
+ *   - `message` must be a non-empty string, else null (the caller falls
+ *     back to the standard status text).
+ *
+ * @private
+ * @param {object} bundleConf - the per-request bundle configuration
+ * @returns {{enabled: boolean, retryAfter: number, message: (string|null)}} effective values
+ */
+var _getTransientErrorsConf = function(bundleConf) {
+    var out = { enabled: false, retryAfter: 30, message: null };
+    try {
+        var block = bundleConf && bundleConf.server && bundleConf.server.transientErrors;
+        if ( !block || typeof(block) != 'object' ) {
+            return out;
+        }
+        out.enabled = ( block.enabled === true );
+        if (
+            typeof(block.retryAfter) == 'number'
+            && isFinite(block.retryAfter)
+            && Math.floor(block.retryAfter) === block.retryAfter
+            && block.retryAfter >= 1
+            && block.retryAfter <= 86400
+        ) {
+            out.retryAfter = block.retryAfter;
+        }
+        if ( typeof(block.message) == 'string' && block.message.length > 0 ) {
+            out.message = block.message;
+        }
+    } catch (confReadErr) {
+        // hostile getters on a user-supplied config object — keep the
+        // defaults; rendering of the request error must not be derailed
+        // by a config-read failure (same total-function bar as
+        // lib/connector-error.classify()).
+    }
+    return out;
+};
+
+// #P39 — per-culture locale-resolution memo. setOptions used to build TWO
+// Collections per request over the boot-loaded region sets (a full deep copy
+// of ~500 nested records each time, plus one 16-char id minted per record —
+// ~750 webcrypto calls) to answer two lookups: language → region set, and
+// country → one row. The lookups are pure functions of boot-static data
+// (`getContext('gina').locales` is set once at bundle start), so they are
+// memoized at module level. The memo holds only references into that
+// process-global context — no request state — and rebuilds whenever the
+// context array's identity changes (or when dev-mode eviction re-requires
+// this module, where a rebuild costs one pass over the language rows).
+var _localesIdxSrc = null;
+var _localesIdx    = null;
+var _localeRowMemo = null;
+
+/**
+ * Language index over the boot-loaded locales context.
+ * Maps a language code to its `{ lang, content }` row — first row wins on a
+ * duplicate language, matching the historical first-match lookup semantics.
+ *
+ * @private
+ * @returns {object} lang → locales row (shared, pristine — callers must not mutate)
+ */
+var _resolveLocalesIndex = function() {
+    var src = getContext('gina').locales;
+    if (_localesIdxSrc !== src || !_localesIdx) {
+        _localesIdxSrc = src;
+        _localesIdx    = {};
+        _localeRowMemo = {};
+        for (var i = 0, len = src.length; i < len; ++i) {
+            if ( typeof(_localesIdx[src[i].lang]) == 'undefined' ) {
+                _localesIdx[src[i].lang] = src[i];
+            }
+        }
+    }
+    return _localesIdx;
+};
+
+/**
+ * Country-row lookup within a language's region set, memoized per
+ * `<lang>|<ISO>` culture pair (misses are memoized too).
+ *
+ * Region rows key countries by UPPERCASE `isoShort` (ISO 3166-1 alpha-2 —
+ * #B101), so a strict compare after `toUpperCase()` matches what the former
+ * case-insensitive whole-string lookup resolved on this data.
+ *
+ * @private
+ * @param {array}  contentRows - a language's region set (the index row's `.content`)
+ * @param {string} langCode    - the language the rows were resolved FOR (fallback-resolved lang keys consistently)
+ * @param {string} countryCode - ISO 3166-1 alpha-2 country code, any case
+ * @returns {object|null} the shared pristine row, or null when the country is not in the set
+ */
+var _resolveLocaleRow = function(contentRows, langCode, countryCode) {
+    var iso = countryCode.toUpperCase();
+    var key = langCode + '|' + iso;
+    if ( typeof(_localeRowMemo[key]) != 'undefined' ) {
+        return _localeRowMemo[key];
+    }
+    var row = null;
+    for (var i = 0, len = contentRows.length; i < len; ++i) {
+        if ( contentRows[i] && contentRows[i].isoShort === iso ) {
+            row = contentRows[i];
+            break;
+        }
+    }
+    _localeRowMemo[key] = row;
+    return row;
+};
+
+/**
+ * Defines `conf.locales` as a LAZY, self-replacing accessor: the request's
+ * own deep copy of the region set is materialized on first read and cached
+ * on the request's conf object from then on.
+ *
+ * The render path itself never reads `conf.locales` — its only framework
+ * reader is `self.getLocales()` — so the common request pays nothing, while
+ * a request that does read it gets exactly the isolation the former eager
+ * per-request copy provided (a fresh deep copy, safe to mutate). Whole-conf
+ * consumers (`self.getConfig()`, serializers) materialize it through the
+ * accessor transparently. The accessor is enumerable and writable-through
+ * (assignment replaces it with a plain value), and configurable so a second
+ * `setOptions()` on the same request re-defines it cleanly.
+ *
+ * @private
+ * @param {object} conf    - the request's conf (the router's per-request shallow copy)
+ * @param {array}  srcRows - the resolved language's region set (shared, pristine)
+ * @returns {void}
+ */
+var _defineLazyLocales = function(conf, srcRows) {
+    Object.defineProperty(conf, 'locales', {
+        configurable: true,
+        enumerable: true,
+        get: function() {
+            var rows = JSON.clone(srcRows);
+            Object.defineProperty(this, 'locales', { configurable: true, enumerable: true, writable: true, value: rows });
+            return rows;
+        },
+        set: function(v) {
+            Object.defineProperty(this, 'locales', { configurable: true, enumerable: true, writable: true, value: v });
+        }
+    });
+};
 var _isProdScope    = process.env.NODE_SCOPE_IS_PRODUCTION && process.env.NODE_SCOPE_IS_PRODUCTION.toLowerCase() === 'true';
 
 
@@ -835,24 +983,32 @@ function SuperController(options) {
             var userLangCode    = userCultureCode[0];
             var userCountryCode = userCultureCode[1];
 
-            var locales         = new Collection( getContext('gina').locales );
+            // #P39 — memoized language index over the boot-static locales
+            // context (was: a per-request Collection deep-copying every region
+            // set and minting an id per record, twice, to answer two lookups).
+            var localesIdx      = _resolveLocalesIndex();
+            var userLangRow     = localesIdx[userLangCode];
             var userLocales     = null;
 
             try {
-                userLocales = locales.findOne({ lang: userLangCode }).content;
+                userLocales = userLangRow.content;
             } catch (err) {
                 // #B100 — guarded fallback: the old blind `region.shortCode` deref
                 // threw here when the `region` block was absent, and the unguarded
-                // fallback `findOne().content` threw when the resolved language
-                // was not in the loaded region set.
+                // fallback lookup threw when the resolved language was not in the
+                // loaded region set.
                 var _fallbackLang    = getLocaleFallbackLang(local.options.conf);
                 console.warn('language code `'+ userLangCode +'` not handled by current locales setup: replacing by default: `'+ _fallbackLang +'`');
-                var _fallbackLocales = locales.findOne({ lang: _fallbackLang }) || locales.findOne({ lang: 'en' });
+                var _fallbackLocales = localesIdx[_fallbackLang] || localesIdx['en'];
                 userLocales = ( _fallbackLocales && _fallbackLocales.content ) ? _fallbackLocales.content : [];
             }
 
             // user locales list
-            local.options.conf.locales = userLocales;
+            // #P39 — materialized lazily: the request's own deep copy is built
+            // on first read (see _defineLazyLocales), so a request that never
+            // reads `conf.locales` — the common case — no longer pays a copy
+            // of the whole region set.
+            _defineLazyLocales(local.options.conf, userLocales);
 
             // user locale
             // #B101 — region rows key countries by `isoShort` (uppercase ISO
@@ -862,8 +1018,12 @@ function SuperController(options) {
             // a filter whose only key is undefined-valued serializes to `{}`
             // and matches everything. A country-less culture (bare `en`) now
             // resolves to an explicit `{}` instead.
+            // #P39 — the row comes from the culture memo (shared, pristine) and
+            // is deep-copied per request: the `.date` write a few lines below —
+            // and anything a template or an action does to `page.view.locale` —
+            // must never reach a sibling request.
             options.conf.locale = ( typeof(userCountryCode) == 'string' && userCountryCode.length > 0 )
-                ? ( new Collection(userLocales).findOne({ isoShort: userCountryCode.toUpperCase() }) || {} )
+                ? ( JSON.clone( _resolveLocaleRow(userLocales, userLangCode, userCountryCode) || {} ) )
                 : {};
 
             // current date
@@ -5337,15 +5497,19 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
         if ( typeof(shortCountryCode) != 'undefined' ) {
             shortCountryCode = shortCountryCode.toLowerCase();
-            var locales         = new Collection( getContext('gina').locales );
+            // #P39 — memoized language index (was: a per-call Collection deep-
+            // copying every region set). The rows handed on are shared and
+            // pristine; the only consumer below is the getCountries projection,
+            // which builds fresh output rows and never writes into its input.
+            var localesIdx = _resolveLocalesIndex();
 
             try {
-                userLocales = locales.findOne({ lang: shortCountryCode }).content
+                userLocales = localesIdx[shortCountryCode].content
             } catch (err) {
                 // #B100 — same guarded fallback as the setOptions locale bridge.
                 var _fallbackLang    = getLocaleFallbackLang(local.options.conf);
                 console.warn('language code `'+ shortCountryCode +'` not handled to setup locales: replacing by `'+ _fallbackLang +'`');
-                var _fallbackLocales = locales.findOne({ lang: _fallbackLang }) || locales.findOne({ lang: 'en' });
+                var _fallbackLocales = localesIdx[_fallbackLang] || localesIdx['en'];
                 userLocales = ( _fallbackLocales && _fallbackLocales.content ) ? _fallbackLocales.content : [];
             }
         }
@@ -6051,6 +6215,19 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      *   - `throwError(code, err)` — 2-arg form: HTTP status + Error|string
      *   - `throwError(res, code, msg)` — internal 3-arg form used by the router
      *
+     * #CE1 — transient upgrade (opt-in): when the bundle sets
+     * `server.transientErrors.enabled: true` and any call argument carries
+     * `isTransient === true` (a `lib/connector-error`-stamped datastore
+     * error), a resolution that would render 500 renders 503 instead, with
+     * a `Retry-After: <server.transientErrors.retryAfter>` header (default
+     * 30s) and the user-facing `error` field set to
+     * `server.transientErrors.message` (default: the standard 503 status
+     * text). Explicit non-500 statuses are never upgraded; `message` and
+     * `stack` keep their existing scope semantics, and the #ERRREF pairing
+     * line below keeps the full pre-strip detail server-side. Deliberately
+     * NOT mirrored in the server-side throwError twin (core/server.js):
+     * stamped connector errors surface through controller actions only.
+     *
      * Late calls: when throwError fires after a response terminal exit has
      * already released the per-request refs (`local.res` is null — e.g. an
      * entity/query callback resuming after a redirect() sent its 301), the
@@ -6070,6 +6247,68 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      * */
     this.throwError = function(res, code, msg) {
 
+        // #CE1 — capture the transient-classified error source (if any)
+        // BEFORE the call-shape normalizations below reassign res/code/msg.
+        // Only `lib/connector-error.stamp()`ed datastore errors carry
+        // `isTransient === true`, so scanning the raw call arguments is an
+        // unambiguous, total probe (guarded against hostile getters).
+        var _transientSrc = null;
+        var _teConf = null;            // resolved lazily, only when a 500 would upgrade
+        var _transient503Applied = false;
+        try {
+            for (var _ti = 0; _ti < arguments.length && _ti < 3; _ti++) {
+                if ( arguments[_ti] && typeof(arguments[_ti]) == 'object' && arguments[_ti].isTransient === true ) {
+                    _transientSrc = arguments[_ti];
+                    break;
+                }
+            }
+        } catch (_teScanErr) {}
+
+        /**
+         * #CE1 — opt-in transient upgrade: with `server.transientErrors.enabled`,
+         * a transient connector failure that would render as 500 renders as
+         * 503 + `Retry-After` instead; any explicit non-500 status is
+         * respected. Applied at BOTH status-resolution sites below.
+         *
+         * @inner
+         * @param {number|string} resolvedCode - the status the resolution chain settled on
+         * @returns {number|string} 503 when the upgrade applies, else `resolvedCode` unchanged
+         */
+        var _maybeUpgradeTransient503 = function(resolvedCode) {
+            if ( _transientSrc && resolvedCode == 500 ) {
+                if (_teConf === null) {
+                    _teConf = _getTransientErrorsConf(local.options.conf);
+                }
+                if (_teConf.enabled) {
+                    _transient503Applied = true;
+                    return 503;
+                }
+            }
+            return resolvedCode;
+        };
+
+        /**
+         * #CE1 — an upgraded 503 advertises when to retry. A single early
+         * setHeader survives every downstream egress: the JSON writeHead
+         * calls merge per-key (Retry-After is never overwritten), the HTML
+         * fallback writeHead does the same, and the renderCustomError →
+         * render pipeline forwards res.getHeaders() into the HTTP/2 frame
+         * (#H8). Idempotent — safe to call at both upgrade sites; no-ops
+         * unless the upgrade fired.
+         *
+         * @inner
+         * @param {object} targetRes - the normalized live response
+         * @returns {void}
+         */
+        var _setTransientRetryAfterHeader = function(targetRes) {
+            if ( !_transient503Applied || !targetRes || typeof(targetRes.setHeader) != 'function' ) {
+                return;
+            }
+            try {
+                targetRes.setHeader('Retry-After', String(_teConf.retryAfter));
+            } catch (_teHdrErr) {}
+        };
+
         // 2-arg form (statusCode, Error|string) — without this shift, the
         // downstream Error/string branch coerces code via /^\d{3}$/.test(String(code))
         // and falls back to 500 because `code` holds the Error or string, not
@@ -6139,6 +6378,9 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             msg    = ( !/^\d+$/.test(code) && typeof(msg) == 'undefined' ) ?  code : msg;
             // Preserve an explicitly passed 3-digit HTTP status code; fall back to res.status or 500
             code    = ( /^\d{3}$/.test(String(code)) ) ? code : ( res && typeof(res.status) != 'undefined' ) ? res.status : 500;
+            // #CE1 — a transient datastore failure resolving to 500 upgrades
+            // to 503 when the bundle opted in (explicit non-500 preserved above)
+            code    = _maybeUpgradeTransient503(code);
 
             if ( typeof(statusCodes[code]) != 'undefined' ) {
                 standardErrorMessage = statusCodes[code];
@@ -6242,6 +6484,10 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             responseHeaders = res.getHeaders() || local.res.getHeaders();
         }
         // var responseHeaders = res.getHeaders() || local.res.getHeaders();
+        // #CE1 — first upgrade site fired above: `res` is the normalized live
+        // response by this point, so the Retry-After header lands here, ahead
+        // of every branch (JSON writeHead trio, HTML fallback, custom pages).
+        _setTransientRetryAfterHeader(res);
         var req             = local.req;
         var next            = local.next;
         if (!headersSent()) {
@@ -6274,6 +6520,12 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 if ( typeof(code) == 'object' && !msg && typeof(code.status) != 'undefined' && typeof(code.error) != 'undefined' ) {
                     msg     = code.error || code.message;
                     code    = code.status || 500;
+                    // #CE1 — second upgrade site: the 2-arg errorObj shape
+                    // resolves its status only here, after the early header
+                    // point above — so this site sets its own header too
+                    // (idempotent with the first call).
+                    code    = _maybeUpgradeTransient503(code);
+                    _setTransientRetryAfterHeader(res);
                 }
                 if ( typeof(statusCodes[code]) != 'undefined' ) {
                     standardErrorMessage = statusCodes[code];
@@ -6319,6 +6571,15 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     }
                 }
 
+                // #CE1 — on an upgraded 503 the user-facing `error` field
+                // carries the configured (or standard) service-unavailable
+                // text instead of the raw datastore error; `message`/`stack`
+                // keep their existing scope semantics, and the full detail
+                // stays in the #ERRREF pairing line below.
+                if ( _transient503Applied && errorObject ) {
+                    errorObject.error = _teConf.message || standardErrorMessage || statusCodes['503'];
+                }
+
                 // #ERRREF — mint/honour the incident ref + the ONE full-detail
                 // pairing line, emitted BEFORE the egress strip below: outside
                 // local scope this is the only server-side capture of the full
@@ -6382,6 +6643,14 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     errorObject.ref = _errRef;
                 }
 
+                // #CE1 — custom error pages (eData) get the clean
+                // service-unavailable text on an upgraded 503; the eData
+                // merge below carries it. The inline fallback page keeps
+                // rendering the thrown error's own fields, as before.
+                if ( _transient503Applied && errorObject ) {
+                    errorObject.error = _teConf.message || standardErrorMessage || statusCodes['503'];
+                }
+
                 if ( errorObject && errorObject != 'null' && /object/i.test(typeof(errorObject)) ) {
                     // replaced: (errorObject.stack||errorObject.message) — both may be undefined for plain
                     // object errors forwarded from query() (e.g. an upstream non-2xx). Fall back to serializing

package/framework/{v0.6.1 → v0.6.2}/core/controller/controller.render-nunjucks.js

@@ -661,8 +661,12 @@ function registerGinaFilters(env, self, local, localOptions, req, res) {
         typeof(process.gina) != 'undefined' && typeof(process.gina.PROXY_HOSTNAME) != 'undefined'
     ) ? true : false;
 
+    // #P39 — `options` passed by REFERENCE, mirroring render-swig: the filter
+    // singleton only READS the stash, and the former per-render deep copy of
+    // the whole `local.options` (routing tables + templates + settings + forms
+    // + locales) was one of the heaviest CPU sites in the render profile.
     var filters = nunjucksFilters({
-        options:     JSON.clone(localOptions),
+        options:     localOptions,
         isProxyHost: isProxyHost,
         throwError:  self.throwError,
         req:         req,

package/framework/{v0.6.1 → v0.6.2}/core/controller/controller.render-swig.js

@@ -780,8 +780,20 @@ module.exports = async function render(userData, displayInspector, errOptions, d
 
 
         // Setup swig default filters
+        // #P39 — `options` is passed by REFERENCE. The former per-render deep
+        // copy here was one of the two heaviest CPU sites in the whole render
+        // path (the payload carries the all-bundle routing tables, the full
+        // templates conf, settings, forms and locales), and it bought nothing:
+        // SwigFilters' `_options` write-set is empty beyond the stash itself —
+        // every filter only READS it — and the request path already shares
+        // `conf.routing` / `conf.reverseRouting` / `conf.forms` by reference
+        // (setOptions grafts the shared per-worker objects), so the filters see
+        // the same objects the controller itself uses. The stash-then-await
+        // interleave window is unchanged: with the copy, an interleaved render
+        // overwrote the singleton with ITS copy; by reference it overwrites it
+        // with ITS options — same wrongness class, zero new exposure.
         var filters = SwigFilters({
-            options     : JSON.clone(localOptions),
+            options     : localOptions,
             isProxyHost : isProxyHost,
             throwError  : self.throwError,
             req         : req,

package/framework/{v0.6.1 → v0.6.2}/core/gna.js

@@ -1525,6 +1525,37 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
                                     console.warn('[render-cache] config validation skipped: ' + (rcErr.message || rcErr));
                                 }
 
+                                // #CE1 — `server.transientErrors` boot-time shape check
+                                // (warn-only, NEVER fatal: the opt-in governs how a
+                                // transient datastore error RENDERS — a bad value must
+                                // not refuse a boot, and the controller-side reader
+                                // (`controller.js` `_getTransientErrorsConf()`, kept in
+                                // sync with these rules) independently falls back to
+                                // the same defaults at request time).
+                                try {
+                                    var _teBlock = null;
+                                    try {
+                                        _teBlock = config.getInstance()[gna.core.startingApp][env].server.transientErrors;
+                                    } catch (teConfErr) { _teBlock = null; }
+                                    if ( typeof(_teBlock) != 'undefined' && _teBlock !== null ) {
+                                        if ( typeof(_teBlock) != 'object' || Array.isArray(_teBlock) ) {
+                                            console.warn('[transient-errors] `server.transientErrors` must be an object — ignoring the whole block (feature off)');
+                                        } else {
+                                            if ( typeof(_teBlock.enabled) != 'undefined' && _teBlock.enabled !== true && _teBlock.enabled !== false ) {
+                                                console.warn('[transient-errors] `server.transientErrors.enabled` must be a strict boolean — treating as disabled');
+                                            }
+                                            if ( typeof(_teBlock.retryAfter) != 'undefined' && !( typeof(_teBlock.retryAfter) == 'number' && isFinite(_teBlock.retryAfter) && Math.floor(_teBlock.retryAfter) === _teBlock.retryAfter && _teBlock.retryAfter >= 1 && _teBlock.retryAfter <= 86400 ) ) {
+                                                console.warn('[transient-errors] `server.transientErrors.retryAfter` must be an integer between 1 and 86400 seconds — using the default (30)');
+                                            }
+                                            if ( typeof(_teBlock.message) != 'undefined' && ( typeof(_teBlock.message) != 'string' || _teBlock.message.length === 0 ) ) {
+                                                console.warn('[transient-errors] `server.transientErrors.message` must be a non-empty string — falling back to the standard status text');
+                                            }
+                                        }
+                                    }
+                                } catch (teErr) {
+                                    console.warn('[transient-errors] config validation skipped: ' + (teErr.message || teErr));
+                                }
+
                                 // setting default global middlewares
                                 if ( typeof(instance.use) == 'function' ) {
 

package/framework/{v0.6.1 → v0.6.2}/core/template/conf/env.json

@@ -28,6 +28,18 @@
       //  - the `rootDomain` defined in your bundle/config/settings.server.json
       // Since overrides are possible, last defined value will be the one taken in consideration by gina
       "rootDomain": "",
+      // This is the FQDN the bundle answers on, and the value substituted into
+      // every `${host}` token — notably the `server.credentials` paths declared
+      // in `core/template/conf/settings.json`.
+      // It is normally written per bundle/env into the project's own `env.json`
+      // by the CLI, which seeds exactly this value. The default lives here too
+      // so that a hand-written or partial block (one that sets, say, only
+      // `server.cache`) still resolves: without it `host` was the single key the
+      // configuration reads off this block with no framework-side default, and
+      // an unset one left `${host}` unsubstituted inside a filesystem path
+      // (#B181(a) — unknown tokens are preserved verbatim and silently, by
+      // design since #B12). Override it in your project `env.json`.
+      "host": "localhost",
       "projectPath": "${executionPath}",
       "projectVersion": "${projectVersion}",
       "projectVersionMajor": "${projectVersionMajor}",

package/framework/{v0.6.1 → v0.6.2}/lib/nunjucks-filters/src/main.js

@@ -110,7 +110,13 @@ function NunjucksFilters(conf) {
 
     var getInstance = function() {
         if (conf) {
-            self.options = NunjucksFilters.instance._options = JSON.clone(conf);
+            // #P39 — stash by REFERENCE, mirroring lib/swig-filters: `_options`
+            // has no writer beyond this assignment (the getUrl/getWebroot merge
+            // fills a fresh `{}` target), the wrapper's `.options` is the
+            // render's per-request `local.options` (#M1), and `req`/`res` were
+            // by-reference through the former deep copy anyway. The per-call
+            // copy was pure CPU waste on every render.
+            self.options = NunjucksFilters.instance._options = conf;
         }
         return NunjucksFilters.instance;
     };

package/framework/{v0.6.1 → v0.6.2}/lib/proc.js

@@ -527,6 +527,16 @@ function Proc(bundle, proc, usePidFile){
         generator.createFileFromDataSync( JSON.stringify(runningProcs, null, 2), runningProcsPath);
     }
 
+    /**
+     * Remove the running-process record matching `pid` from the
+     * `~/.gina/procs.json` registry. Entries are keyed by bundle name and
+     * matched here by their `pid` field; the matched entry is removed under
+     * its own key, whatever bundle this instance was constructed for.
+     *
+     * @param {number} pid - PID of the process whose record must be dropped
+     *
+     * @private
+     * */
     var removeRunningProc = function(pid) {
         var runningProcsPath = _(GINA_HOMEDIR + '/procs.json', true)
             , runningProcsPathObj = new _(runningProcsPath)
@@ -536,7 +546,11 @@ function Proc(bundle, proc, usePidFile){
             runningProcs = requireJSON(runningProcsPath);
             for (let name in runningProcs) {
                 if (runningProcs[name].pid == pid) {
-                    delete runningProcs[bundle];
+                    // Fixed #B180: was `delete runningProcs[bundle]` — the constructor's
+                    // closure-captured parameter, so the delete targeted the constructing
+                    // instance's own key instead of the entry matched by pid: dead records
+                    // survived (and a live one was destroyed when the keys differed).
+                    delete runningProcs[name];
                     generator.createFileFromDataSync( JSON.stringify(runningProcs, null, 2), runningProcsPath);
                     break;
                 }