gina 0.6.12 → 0.6.13

package/CHANGELOG.md

@@ -9,7 +9,7 @@ and is generated by [Changie](https://github.com/miniscruff/changie).
 ## 0.6.12 - 2026-08-20
 ### Fixed
 * Refreshed the external references carried by the framework READMEs. The country-codes locale README pointed at a Simple Data Format specification URL that no longer exists (404); it now names the Tabular Data Package specification that superseded it, matching the upstream dataset the file mirrors. Every remaining plain-HTTP reference in the locales and frontend-asset READMEs is now HTTPS, with the geonames.org link resolved to the www host because the bare domain redirects back down to HTTP. Documentation only; no runtime or API change.
-* Collection.find(), findOne(), or() and update() now throw a descriptive Error - naming the offending key - when a filter object carries an undefined value, instead of silently dropping the key. Previously the internal JSON round-trip stripped such keys before matching, so a single-key filter degraded to the match-everything {} filter: findOne({ id: source.missingId }) returned the collection's FIRST row instead of null, and update() with such a filter mutated EVERY record. ACTION REQUIRED if you relied on the old behaviour: build filters conditionally (only add a key when its value is defined) - an explicitly empty {} filter still means "no constraint" and null values remain legal needles. The refusal also hardens the FormValidator's conditional-case rules lookup, which could previously merge the first condition's rules when the case field was absent from the form.
+* Collection query methods now throw a descriptive Error - naming the offending key - when a filter object carries an undefined value, instead of silently dropping the key. Every method that accepts a filter object is covered: find(), findOne(), or(), update(), replace(), max(), notIn() and delete() - the last two because notIn() routes a filter-object argument through find(); its array form, notIn(rows, key), is unaffected. Previously the internal JSON round-trip stripped such keys before matching, so a single-key filter degraded to the match-everything {} filter: findOne({ id: source.missingId }) returned the collection's FIRST row instead of null, update() with such a filter mutated EVERY record, and delete({ id: source.missingId }) returned an EMPTY collection with every record removed. ACTION REQUIRED if you relied on the old behaviour: build filters conditionally (only add a key when its value is defined) - an explicitly empty {} filter still means "no constraint" and null values remain legal needles. The refusal also hardens the FormValidator's conditional-case rules lookup, which could previously merge the first condition's rules when the case field was absent from the form.
 * A non-string field value no longer aborts the whole form validation pass. The isEmail, isJsonWebToken and trim rules called a string method on the field value without checking its type, so a value like 123, true or [] - reachable from a JSON request body, or from a checkbox on the client - threw, and the rule driver re-threw, killing every remaining field: server-side the request went unvalidated, client-side the boot-time binding loop died and later forms silently lost validation and CSRF token injection. All three now leave a non-string untouched: isEmail and isJsonWebToken record a normal rule error for it (it is invalid, not silently accepted), and trim passes it through untransformed, matching how isFloat already behaved. Whitespace trimming of real strings is unchanged.
 
 ## 0.6.11 - 2026-08-19

package/README.md

@@ -34,6 +34,7 @@ MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architectur
 | Response caching | Per-route render cache — memory / fs / Redis tiers, cross-replica warm start, event-driven invalidation, RFC 9211 `Cache-Status` |
 | Authentication | `lib.authn` primitives — scrypt password hashing as self-describing PHC strings (argon2 / bcrypt verify-only for migration), NIST SP 800-63B policy, enumeration-safe `dummyVerify`, PCI-DSS account lockout, RFC 6238 TOTP |
 | Route authorization | `requireAuth` / `roles` / `policy` per route or deny-by-default, login bounce with `resumeRequest()`, `self.hasRole()` |
+| Rate limiting | Opt-in identified-caller quotas at the router (#MS6) — fixed-window counters over the KV primitive (per-process, or replica-shared via redis/sqlite), per-route overrides/exemptions, 429 + `Retry-After` + draft `RateLimit` header fields; anonymous flood control stays at your edge by design |
 | Audit trail | Opt-in append-only JSONL audit log (`self.audit()`), authorization denials auto-recorded, always-on request ids; opt-in HMAC hash chain verified offline by `gina audit:verify` |
 | CSRF protection | Signed double-submit token middleware + Origin/Referer pre-filter + hardened session cookie |
 | Security headers | CSP with per-response nonces, HSTS, COOP / COEP / CORP, Referrer-Policy and the X-* family — per-header plugins or one `SecurityHeaders` wrapper |
@@ -61,28 +62,34 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.12
+## What's in 0.6.13
 
 > **Restart your bundles AND rebuild them.** The browser bundle changed in this
-> release — both code fixes below ship in it (`lib/collection` and the
-> FormValidator rule engine), so a restart alone keeps serving the old client
-> code. Run `gina bundle:build` for each bundle as well as `gina bundle:restart`.
+> release. The client-side delta is inert — it is the per-route flag propagation
+> the new rate limiter needs on the server, which is dead code in the browser —
+> but the baked copy each bundle serves is no longer byte-identical to the
+> shipped one, so run `gina bundle:build` for each bundle as well as
+> `gina bundle:restart`. Every behaviour change below is server-side.
 
-> **No settings reset.** `0.6.12` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.13` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**This is a fixes-only release: three fixes, two of them reported through GitHub
-issues (#62, #65).** It closes a silent match-everything defect in the
-`Collection` filter path and a crash in three validator rules that took the rest
-of the validation pass down with it. **Two behaviour changes to check before you
-upgrade** — an undefined-valued `Collection` filter key now throws where it
-previously matched every record, and `isEmail` / `isJsonWebToken` / `trim` now
-record a normal verdict for a non-string value instead of aborting the pass.
-Details are in the [migration guide](https://gina.io/docs/migration).
-
-- **Fixed — `Collection.find()`, `findOne()`, `or()` and `update()` refuse an undefined-valued filter key instead of matching everything (#B396, issue #65).** `find()` round-trips its filter objects through `JSON.stringify`, which silently **drops** keys whose value is `undefined` — so a single-key filter built from a possibly-absent field degraded to the match-everything `{}` filter. `findOne({ id: source.missingId })` returned the collection's **first row** instead of the `null` the calling guard was written for, and `update()` with such a filter wrote its `set` onto **every** record. The refusal always intended for this input could never fire, because the serialization stripped the key before the matcher ran. All four entry points now throw a descriptive error naming the offending key. **ACTION REQUIRED if you relied on the old behaviour** (an undefined value acting as "no constraint"): build the filter conditionally, adding a key only when its value is defined. Deliberately unchanged — an explicitly empty `{}` filter still means "no constraint", `null` remains a legal needle, and `delete()` / `notIn()` never had the defect. The same refusal also hardens the FormValidator's conditional-case rules lookup, which could previously merge the first condition's rules when the case field was absent from the form. Browser-bundled.
-- **Fixed — a non-string field value no longer aborts the whole form validation pass (#B200).** The `isEmail`, `isJsonWebToken` and `trim` rules called a string method on the field value without checking its type, so a value that was not a string — a `123`, `true` or `[]` arriving from a JSON request body, or a checkbox boolean on the client — threw, and the rule driver re-threw, **killing every remaining field in the pass**. Server-side the request went unvalidated; client-side the boot-time binding loop died, and forms bound after the failing one silently lost both validation and CSRF token injection. All three now leave a non-string untouched: `isEmail` and `isJsonWebToken` record their normal rule error for it (the value is *invalid*, not silently accepted), and `trim`, being a transform rather than a check, passes it through untransformed — matching how `isFloat` already behaved. Whitespace trimming of real strings is unchanged. No action is required; if you added a defensive upstream coercion to work around the crash, you can remove it. Browser-bundled.
-- **Fixed — the external references carried by the framework READMEs are current again (issue #62).** The country-codes locale README pointed at a Simple Data Format specification URL that no longer resolves; it now names the Tabular Data Package specification that superseded it, matching the upstream dataset the file mirrors. Every remaining plain-HTTP reference in the locales and frontend-asset READMEs is now HTTPS, with the geonames.org link resolved to the `www` host because the bare domain redirects back down to HTTP. Documentation only — no runtime or API change.
+**Three new opt-in capabilities and three fixes.** The headline is a
+general-purpose key-value primitive with three backends, which the new
+identified-caller rate limiter is built on top of. **One behaviour change to
+check before you upgrade** — an exception thrown by a controller's `onReady` or
+`setup` hook now answers a 500 where it previously crashed the bundle process or
+left the request hanging. Details are in the
+[migration guide](https://gina.io/docs/migration).
+
+- **New — a general-purpose key-value primitive with in-memory, redis and SQLite backends (#KV1).** Declare namespaces under `settings.json > kv.namespaces` and reach them as `gina.kv('<namespace>')`. The handle is promise-native with 13 operations, including the ones that are hard to get right by hand: `setnx` (set-if-absent), `consume` (atomic read-and-delete, so a one-shot token's second reader gets `null`), `delIfEquals` (compare-and-delete — the safe lock-release primitive), `incr`/`decr` with TTL-on-create-only, and `getOrSet` with per-process single-flight. **Redis** serves namespaces shared across hosts and replicas, keeping every guarantee server-side (`SET .. PX .. NX`, `GETDEL` with a Lua fallback below redis 6.2, Lua for compare-and-delete and counters). **SQLite** is the zero-dependency durable option — it survives a restart and is visible to any process opening the same file, with every read-modify-write inside an `IMMEDIATE` transaction so it stays atomic across processes; it uses `node:sqlite` (a `bun:sqlite` adapter under Bun), so there is nothing to install. Namespaces are strict-declared — an unknown name throws at the call site rather than silently minting an empty store — and each owns its `failMode`. All three backends are verified against one shared contract spec. Dormant with no `kv` block. Deliberately **not** a redis client: no data structures, batch operations, key scanning, binary values or first-class locks.
+- **New — identified-caller rate limiting (#MS6).** Opt-in quota enforcement at the router, keyed on the **authenticated principal** — the session user (via the operator-named `server.rateLimit.keyField`) or a machine caller — with fixed-window counters in a kv namespace you declare. That makes the scope your choice: a redis- or SQLite-backed namespace shares one quota across replicas, while an in-memory one counts per process (the boot resolver says so, and also warns about a redis connectors entry missing the fail-fast tuning that would otherwise queue every gated request through an outage). The gate runs **after** route authorization and **before** DTO validation, so the refusal order is `401 → 429 → 422` and a throttled caller never receives a field map. It throttles identified callers **only** — a request with no resolvable principal is skipped, never bucketed by IP, because behind a reverse proxy that would be one bucket for the whole internet; anonymous flood control stays with your edge proxy and the HTTP/2 rapid-reset guard. Denials answer 429 with `Retry-After` plus the `RateLimit` / `RateLimit-Policy` structured fields from `draft-ietf-httpapi-ratelimit-headers-11`, which allowed limited requests carry too. Per-route overrides ride `routing.json`'s top-level `rateLimit` key (`false` exempts a route; an object replaces the policy for it). Store outages follow the namespace's own `failMode`.
+- **New — an opt-in per-authority circuit breaker for `Controller::query()` (#MS5).** After N consecutive **transport-class** failures to one authority (default 5, each already a call whose own retries were exhausted), the circuit opens and further calls fail fast with a machine-readable `CIRCUIT_OPEN` error (status 503, `retryable: false`, plus the authority and `retryAfterMs`) instead of hammering a dead upstream. After the cooldown (default 30s) exactly one **critical** request is admitted as the half-open probe, closing the circuit on success and re-arming it on failure. The gate sits above the HTTP/1.x / HTTP/2 dispatch, so an open circuit rejects before any connection, retry or pre-flight machinery runs — retries can never hammer an open circuit by construction. Only transport-class errors count: an application response, whatever its status, flows through the success terminus as data, so a 500 from a healthy upstream cannot trip the breaker. Configure under `settings.json > server.query.circuitBreaker`.
+- **Fixed — an exception in a controller's `onReady` or `setup` hook can no longer vanish (#B399).** Both router dispatch sites invoked the reserved-action hooks outside the guarded band, so a **synchronous** throw escaped to the process level — on the built-in engine that was an uncaught exception killing the whole bundle process, while Express answered its own 500, an engine asymmetry — and an **asynchronous** rejection was unowned, leaving the request to hang to client or proxy timeout while work after the throw silently never happened. Both hook loops now run inside the dispatch `try`, and every hook's returned promise is owned by the same `.catch` → 500 guard the main action already carried, naming the failing hook in the error detail; the synthesized `setup` wrapper now returns the app call's own result, so an async `setup.js` rejection actually reaches the guard. **ACTION REQUIRED if a hook of yours can throw:** it now answers 500 (with the `#ERRREF` correlation ref) where it previously crashed the process, hung, or let the action's own response mask the failure. Note the hooks are still dispatched without awaiting, in the same synchronous frame as the action — a hook rejection does not prevent the action from running, so its side effects may already have executed when the 500 reaches the client; treat retries of non-idempotent actions accordingly.
+- **Fixed — the entity dispatch diagnostics are readable again (#B395).** The five `DISPATCH` markers in the entity callback machinery were raw `console.log` calls, which in gina is the logger's raw-stdout branch: it bypasses both the container dispatch and the level gate, so the lines never reached a bundle log file or `gina tail`, and a daemon-spawned bundle has its child stdout filtered as well, so they never reached container logs either. They were diagnostics visible only by running a bundle in the foreground. They now go through `console.debug` — off by default, appearing when the log hierarchy is raised to `debug`, which was the original intent.
+- **Fixed — the published claim that gina ships a companion reverse-proxy service is retired (#MS8).** The service help text, its JSDoc and the docs-site CLI pages all named `proxy` as a framework-internal service you could start, and `gina service:list` reported it with status `ok` — for a bundle that cannot serve a single proxied request. Nothing is being taken away: the services directory is CLI-generated, gitignored and npmignored, and the published tarball carries zero entries for it, so no release ever shipped the bundle the text advertised. Each surface now carries the stance instead: **gina ships no edge or reverse proxy by design** — run nginx, Traefik or an ingress controller in front of your bundles. That is the position the rest of the documentation already assumed.
+- **Documentation — two boundaries the framework deliberately does not cross.** API versioning and database migrations were both absences you could only discover by searching for something that was not there, and an absence with no statement behind it reads as an oversight rather than a decision. The routing guide now states plainly that there is no version route field and no version-aware dispatch — when to cut a version and how long to support the old one are product decisions — and shows the three shapes the existing primitives already cover. The models guide names the per-database migration tools to use instead, plus the two things that actually go wrong: run migrations as a discrete step **before** the new version serves (never at bundle boot, where they race themselves the moment there is more than one replica), and keep changes additive during a rolling deploy. The connector CLI page gains an explicit warning that `connector:migrate` is **not** a database migration — it lints connection configuration and issues no SQL.
+
 ## Documentation
 
 Full installation guide, tutorials, configuration reference, and API docs at **[gina.io/docs](https://gina.io/docs/)**.

package/ROADMAP.md

@@ -63,7 +63,8 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.9` ✅ | **Security**: an engine.io socket's session identity is derived server-side from the upgrade request's own cookie instead of a field the browser asserts on every message — any client could previously claim another user's session and receive the pushes addressed to it, which took strictly less than stealing the cookie, since a rendered page carries the bare session id while the cookie carries the signed form; the binding replays the bundle's own session middleware (same secret, store and cookie name, no new configuration) and fails closed, so an id-less socket receives only deliberate broadcasts · **Added**: `gina.pushToSession()` gives code with no request context — a job handler, a cron tick, a boot hook — a sanctioned route to a user's socket, with a required recipient, no reachable broadcast, and delivery reported rather than assumed; and a bundle can declare which scopes it is deployed in through a `scopes` allow-list on its manifest entry, so one still under development stays out of every other scope · **Fixed**: `engine: "express"` bundles boot and serve on Express 5, with the supported range declared for the first time (`>= 4 < 6`, both majors verified live) · `project:add`/`project:import` no longer empty a project's `bundles` block on a declared-count mismatch, no longer adopt a bundle's invalid `server.protocol`/`server.scheme` into the project's registry lists, and no longer resolve one project's bundles against another project's path · `project:add` writes the `.gitignore` the shipped template's underscore prefix has always implied · the path helper's copier stages to a temp sibling and publishes with an atomic rename, so a failed copy can no longer destroy the destination it was replacing · the secrets resolver reads its two environment tiers independently, so a swept boolean no longer lets a plaintext file shadow `process.env`, and three malformed `settings.secrets.file` shapes that used to pass in silence are caught (ACTION REQUIRED — two of them now refuse to boot) · a bundle whose release tree cannot be linked refuses by name instead of dying as an opaque TypeError · `self.push()` refuses by name when the server instance has no engine.io channel |
 | **Q4 2026** | `0.6.10` ✅ | **Added**: maintenance mode — a bundle can be closed to the public without being stopped. When it is active every request except the framework's own built-in endpoints is answered `503` with a `Retry-After` header and a self-contained maintenance page, and the response is marked never to be stored so a cached copy cannot outlive the window. The gate runs on both engines ahead of static assets, the output cache and routing, so it also covers files and URLs that a route middleware never sees. The liveness endpoint deliberately keeps answering normally, so an orchestrator does not restart healthy instances over a declared window. Chosen visitors can still browse: a shared bypass key presented as a header or once in the address bar (which then sets a short-lived cookie and redirects without the secret) works under any deployment, while the supplementary IP allowlist applies only to requests that did not arrive through a reverse proxy — behind one, every address is the proxy's, so an unconditioned list would let either everybody or nobody through. Maintenance can be flipped at runtime through an administrator-gated endpoint with an optional expiry; a runtime flip is not persisted, and an expiry reverts to the configured state rather than to off, so a forgotten timer cannot re-open a site that configuration says is closed. **Fixed**: boot-time bundle mounts are idempotent, atomic and concurrency-safe — a mount symlink that already resolves to its source is left untouched (so the steady-state boot writes nothing), a wrong or missing one is published atomically through a temp sibling and a rename, and a process that loses the race to another publishing the identical link treats that as success instead of refusing to boot. Previously every boot re-created every declared bundle's link in two non-atomic steps with no mutual exclusion, so several processes sharing one project tree raced the same directory entries and a contended link could fail a boot or abort the shared configuration load for every bundle in the project. The same race is closed on the directory creation that accompanies a mount. Behaviour change: a real directory occupying a mount path is now refused by name instead of silently deleted. **Security**: cross-origin writes to the administrator-gated built-in endpoints are refused. Those endpoints authorise callers by network address alone — a credential a browser attaches automatically — so an operator browsing from an allowed machine could be lured to a page that silently issued writes to them; and because several of them read their whole input from the address rather than from a request body, the attack needed no scripting and no cross-origin negotiation at all. Such a write is now refused on both engines, using the browser's own request-context signal where it is sent, and otherwise comparing the stated origin against the address the client actually connected to — never against a forwarded header, which an attacker controls. Clients that send no browser origin signal, such as command-line tooling and deployment scripts, are deliberately unaffected, as are safe methods, so existing cross-origin read channels keep working. | `0.6.10` | 2026-08-16 |
 | **Q4 2026** | `0.6.11` ✅ | **Fixed**: `Collection.replace()` no longer silently discards the write when the stored entry carries an internal `_uuid` and the caller's `set` does not — the comparison key is now resolved from both sides (falling back to `id` when both carry one) and the call throws instead of returning quietly when the two sides share no usable key; an explicitly supplied key is honoured exactly as before (issue #64). Concurrent `util.promisify(entity.method)` calls on the same method no longer cross-deliver results or leave a caller hanging — the promisify fast-path now uses the same FIFO queue and single persistent dispatcher as the entity-context path, so every caller settles and in-order completion gives each its own result; out-of-order completion still pairs by arrival order, for which the per-call-identity path is a Promise-returning method. FormValidator: fast typing into a Safari `autocomplete="off"` field no longer scrambles the text (the caret is committed synchronously on every rebuild and the deferred restore re-asserts the latest committed position; issue #63), with three position-0 edge cases in the same interception corrected to native behaviour (Backspace, Delete with a selection, ArrowLeft); a refused submit's answer on an async-`query` form stays visible and focused instead of being re-hidden by a late completion (answer-placed focus is told from user-placed focus until the first genuine interaction); and a stale not-ready submit marker can no longer refuse every click until reload on a form whose async `query` field is not declared last (the reveal pass now carries its own completion identity and always completes). Inspector (development mode): the View tab's page-weight badge and the Flow tab's late timeline bars no longer go missing until a refresh — both data channels are refreshed at the end of the late-bind patch, keyed per tab. Pickup: restart **and** rebuild your bundles (the browser bundle changed). |
-| **Q4 2026** | `0.6.12` ✅ | **Fixed**: an undefined-valued filter key no longer makes a `Collection` query match every record — `find()`, `findOne()`, `or()` and `update()` round-tripped their filter object through `JSON.stringify`, which silently drops keys whose value is `undefined`, so a filter built from a possibly-absent field degraded to the match-everything `{}` filter: `findOne()` returned the collection's first row instead of the `null` the calling guard expected, and `update()` wrote its `set` onto every record. All four now throw a descriptive error naming the offending key (ACTION REQUIRED if you relied on an undefined value meaning "no constraint" — build the filter conditionally; an explicitly empty `{}` still means no constraint, and `null` remains a legal needle). A non-string field value no longer aborts the whole form validation pass — `isEmail`, `isJsonWebToken` and `trim` called a string method on the value without a type check, so a `123`, `true` or `[]` arriving from a JSON body or a checkbox threw and the rule driver re-threw, killing every remaining field: the request went unvalidated server-side, and client-side the boot-time binding loop died so forms bound after it silently lost both validation and CSRF token injection. All three now leave a non-string untouched — the two checks record their normal rule error and `trim` passes it through untransformed, matching how `isFloat` already behaved (no action required; a defensive upstream coercion added to work around the crash can be removed). Documentation: the external references carried by the framework READMEs are current again, the retired Simple Data Format specification link replaced by the Tabular Data Package specification that superseded it, and every remaining plain-HTTP reference moved to HTTPS. Pickup: restart **and** rebuild your bundles (the browser bundle changed). |
+| **Q4 2026** | `0.6.12` ✅ | **Fixed**: an undefined-valued filter key no longer makes a `Collection` query match every record — every `Collection` method that accepts a filter object round-tripped it through `JSON.stringify`, which silently drops keys whose value is `undefined`, so a filter built from a possibly-absent field degraded to the match-everything `{}` filter: `findOne()` returned the collection's first row instead of the `null` the calling guard expected, `update()` wrote its `set` onto every record, and `delete()` returned an empty collection with every record removed. All eight filter-object methods now throw a descriptive error naming the offending key — `find()`, `findOne()`, `or()`, `update()`, `replace()`, `max()`, `notIn()` and `delete()`, the last two because `notIn()` routes a filter-object argument through `find()`; only `notIn()`'s array form, `notIn(rows, key)`, is exempt (ACTION REQUIRED if you relied on an undefined value meaning "no constraint" — build the filter conditionally; an explicitly empty `{}` still means no constraint, and `null` remains a legal needle). A non-string field value no longer aborts the whole form validation pass — `isEmail`, `isJsonWebToken` and `trim` called a string method on the value without a type check, so a `123`, `true` or `[]` arriving from a JSON body or a checkbox threw and the rule driver re-threw, killing every remaining field: the request went unvalidated server-side, and client-side the boot-time binding loop died so forms bound after it silently lost both validation and CSRF token injection. All three now leave a non-string untouched — the two checks record their normal rule error and `trim` passes it through untransformed, matching how `isFloat` already behaved (no action required; a defensive upstream coercion added to work around the crash can be removed). Documentation: the external references carried by the framework READMEs are current again, the retired Simple Data Format specification link replaced by the Tabular Data Package specification that superseded it, and every remaining plain-HTTP reference moved to HTTPS. Pickup: restart **and** rebuild your bundles (the browser bundle changed). |
+| **Q4 2026** | `0.6.13` ✅ | **Added**: a general-purpose key-value primitive — declare namespaces under `settings.json > kv.namespaces` and reach them as `gina.kv('<namespace>')`, a promise-native handle with 13 operations including the ones that are hard to get right by hand: set-if-absent, atomic read-and-delete (a one-shot token's second reader gets `null`), compare-and-delete as the safe lock-release primitive, TTL-on-create-only counters, and fetch-or-compute with per-process single-flight. Three backends: in-memory with zero config, redis for namespaces shared across hosts and replicas (every guarantee server-side — `SET .. PX .. NX`, `GETDEL` with a Lua fallback below redis 6.2), and SQLite as the zero-dependency durable option that survives a restart and stays atomic across processes via `IMMEDIATE` transactions, using `node:sqlite` so there is nothing to install. Namespaces are strict-declared — an unknown name throws at the call site rather than silently minting an empty store — and each owns its failure policy; all three backends are verified against one shared contract spec. Deliberately not a redis client: no data structures, batch operations, key scanning, binary values or first-class locks. Identified-caller rate limiting — opt-in quota enforcement at the router keyed on the authenticated principal (a session user via an operator-named field, or a machine caller), with fixed-window counters in a kv namespace you declare, so choosing that namespace's backend chooses the quota's scope: redis or SQLite share one quota across replicas, in-memory counts per process. The gate runs after route authorization and before payload validation, so the refusal order is 401 → 429 → 422 and a throttled caller never receives a field map; it throttles identified callers only, and a request with no resolvable principal is skipped rather than bucketed by IP, since behind a reverse proxy that would be one bucket for the whole internet — anonymous flood control stays with your edge proxy. Denials answer 429 with `Retry-After` plus the `RateLimit` / `RateLimit-Policy` structured fields, which allowed limited requests carry too, and per-route overrides ride a top-level `rateLimit` key in `routing.json`. An opt-in per-authority circuit breaker for `Controller::query()` — after N consecutive transport-class failures to one authority the circuit opens and further calls fail fast with a machine-readable `CIRCUIT_OPEN` error instead of hammering a dead upstream, admitting exactly one critical request as the half-open probe after the cooldown; the gate sits above the HTTP/1.x / HTTP/2 dispatch so retries can never hammer an open circuit by construction, and only transport-class errors count, so an application response of any status cannot trip it. **Fixed**: an exception in a controller's `onReady` or `setup` hook can no longer vanish — both dispatch sites invoked the reserved-action hooks outside the guarded band, so a synchronous throw escaped to the process level (on the built-in engine an uncaught exception killing the whole bundle process, while Express answered its own 500 — an engine asymmetry) and an asynchronous rejection was unowned, leaving the request to hang to client or proxy timeout while work after the throw silently never happened; both loops now run inside the dispatch `try` and every hook's promise is owned by the same guard the main action carried, with the synthesized `setup` wrapper returning the app call's own result so an async `setup.js` rejection actually reaches it (ACTION REQUIRED if a hook of yours can throw: it now answers 500 where it previously crashed, hung, or was masked — and since hooks are still dispatched without awaiting, a hook rejection does not stop the action, so its side effects may already have run when the 500 lands). The entity dispatch diagnostics are readable again — five markers were raw `console.log` calls, which in gina bypasses both the container dispatch and the level gate, so they reached neither a bundle log file nor container logs and were visible only by running a bundle in the foreground; they now go through `console.debug`, off by default and appearing at the `debug` hierarchy as originally intended. **Documentation**: the published claim that gina ships a companion reverse-proxy service is retired — no release ever carried the bundle the help text advertised, and each surface now states the position the rest of the documentation already assumed, that gina ships no edge or reverse proxy by design; run nginx, Traefik or an ingress controller in front of your bundles. Two deliberate boundaries are now stated rather than left as absences: API versioning (no version route field, no version-aware dispatch — with the three shapes the existing primitives already cover) and database migrations (the per-database tools to use, plus running them as a discrete step before the new version serves rather than at bundle boot where replicas race each other, and keeping changes additive during a rolling deploy), and `connector:migrate` is explicitly flagged as not a database migration. Pickup: restart **and** rebuild your bundles — the browser bundle changed, though its client-side delta is inert. |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |
@@ -285,7 +286,7 @@ Technical-safeguard primitives that map to the **PCI-DSS**, **SOC2**, and **HIPA
 | ✅ | **Authentication hardening** — `lib.authn` supplies the primitives that are dangerous to hand-roll, without becoming an identity provider: Gina still owns no user record, credential store, or login route, and the module ends where `req.login()` begins. `hashPassword` mints scrypt hashes encoded as self-describing PHC strings, so the cost parameters travel with the hash and can be raised later without a flag day — `needsRehash` reports which stored hashes are below policy and the next successful login upgrades them transparently, the one moment the plaintext is in hand. `verifyPassword` compares in constant time and also verifies existing argon2 and bcrypt hashes through your own project's package, so a bundle arriving with credentials already hashed keeps working; `dummyVerify` spends matching work on the account-not-found branch to close the user-enumeration oracle; `validatePasswordPolicy` checks length first per NIST SP 800-63B, with composition rules and a deny-list available. `createLockout()` adds the credential-stuffing brake — PCI-DSS §8.3.4 defaults of 10 consecutive failures and a 30-minute lock, a caller-chosen key with optional normalisation, per-key serialization so failures arriving concurrently cannot lose the count, a pluggable shared store for multi-replica correctness, and one `auth.lockout` audit record on the transition into locked; it is per-account credential lockout, not per-client request-rate limiting, which remains a separate roadmap item. RFC 6238 TOTP completes the set: secret generation, the `otpauth://` enrolment URI every standard authenticator scans, and constant-time verification returning the matched step as an absolute `counter` so your application can enforce replay defence. Maps to PCI-DSS req 8 (8.3.2 authentication-factor storage, 8.3.4 lockout, 8.4 MFA), HIPAA §164.312(d). | `0.6.0` | shipped |
 | ✅ | **Session lifecycle hardening** — `req.login(user, done)` now works without Passport and rotates the session id BEFORE binding the user (the session-fixation defense): the pre-login record is destroyed, the principal lands at `req.session.user`, and the absolute-timeout anchor is stamped — with a graceful bind-and-warn when the session provider exposes no `regenerate()`, and Passport bundles untouched. The Session plugin gained an opt-in absolute session cap: `session({ absoluteTimeout: <ms> })` or `settings.json > session.absoluteTimeout` (bundle code wins, `false` disables) destroys an authenticated session older than the cap on its next request — regardless of activity — and the request proceeds anonymously, exactly like a naturally-expired record; fail-closed when the record cannot be destroyed, anonymous sessions never touched so `saveUninitialized: false` keeps its meaning. Composes with the existing idle expiry (cookie `maxAge` + store-record TTL, both rolling with activity). Declared in the published settings.json schema. Maps to PCI-DSS req 8.2. | `0.6.0` | shipped |
 | ⏸ | **PII/PHI protection** — Production log-field redaction, data classification, and retention helpers (today's redaction is a dev-only inspector tool). **Deferred — built on request.** *Interim:* keep credentials and identifiers out of query strings, since the always-on access log records full request URLs. Maps to HIPAA and SOC2 Privacy. | — | on demand |
-| ⏸ | **Application-level rate limiting** — Per-endpoint / per-client throttling at the route layer (today only an HTTP/2 rapid-reset limiter exists). **Deferred — built on request.** *Interim:* throttle at your reverse proxy or ingress. Distinct from `lib.authn` account lockout, which brakes credential failures per account, not requests per client. Maps to PCI-DSS anti-automation and SOC2 availability. | — | on demand |
+| ✅ | **Application-level rate limiting** — Opt-in identified-caller quotas at the router (#MS6): fixed-window counters over the key-value primitive (per-process in-memory, or replica-shared via redis/sqlite), keyed on the session user (operator-named field) or the machine caller, enforced after route authorization and before DTO validation (401 → 429 → 422). 429 carries `Retry-After` plus the draft `RateLimit` / `RateLimit-Policy` fields; per-route `rateLimit` overrides/exemptions in routing.json; store outages follow the namespace's `failMode` (open admits, closed answers 503). Anonymous flood control stays at the edge proxy and the HTTP/2 rapid-reset guard by design. Distinct from `lib.authn` account lockout, which brakes credential failures per account, not requests per client. Maps to PCI-DSS anti-automation and SOC2 availability. | `0.6.x` | 2026-08-22 |
 | ⏸ | **Data-at-rest / field-level encryption helpers** — Field-level encryption + key-management utilities. **Deferred — built on request.** *Interim:* encrypt at the application layer with your platform's KMS SDK; `${secret:KEY}` delivers the key material. Maps to PCI-DSS req 3 and HIPAA §164.312(a)(2)(iv). | — | on demand |
 | ✅ | **Compliance control-mapping guide** — [Compliance control mapping](https://gina.io/docs/guides/compliance) maps every control Gina ships to the PCI-DSS v4.0.1, SOC 2 (2017 TSC), and HIPAA §164.312 requirement it supports, and states plainly where a framework's responsibility ends. Controls still on the roadmap are listed separately as unavailable, each with the interim pattern to use until it ships, so a planned control can never be mistaken for one you have. An explicit "what Gina does not — and cannot — cover" section names what no framework provides: the certification itself, legal instruments, network and physical security, personnel and process, operations, key-management infrastructure, and vendor risk. A living reference — rows move from planned to available as controls ship. | `0.5.26-alpha.2` | shipped |
 | ✅ | **Transport-security posture** — A bundle resolving a cleartext scheme outside the local scope warns once at boot, naming the bundle, scheme, and scope alongside both remediations. `server.requireHttps: true` refuses the boot instead — the throw lands pre-listen, so the cleartext port is never reachable at all. `server.allowInsecure: true` is the "TLS terminates upstream" acknowledgment for the mesh / ingress / reverse-proxy topology, turning the warning into a single info line; declaring both is a boot-refused contradiction. Both are strict booleans resolved exactly like `scheme` itself — the bundle's settings win and `env.json`'s `server` block fills — and a non-boolean value refuses the boot in every scope. Terminating mTLS stays a mesh/ingress concern by design. Maps to the "encrypt everywhere / no implicit network trust" principle of NIST SP 800-207 (Zero Trust). | `0.5.26-alpha.2` | shipped |

package/framework/v0.6.13/VERSION

@@ -0,0 +1 @@
+0.6.13

package/framework/{v0.6.12 → v0.6.13}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -5794,6 +5794,14 @@ function Routing() {
             if ( typeof(routeObject.negotiate) != 'undefined' ) {
                 params.negotiate = routeObject.negotiate;
             }
+            // #MS6 — propagate the per-route rate-limit override/exempt to
+            // req.routing.rateLimit (top-level, NOT req.routing.param.* — the
+            // #CSRF2 trap). typeof-guarded so `false` (exempt) survives the copy;
+            // assigned only when declared, so a routing.json that never mentions
+            // `rateLimit` produces a byte-identical params object.
+            if ( typeof(routeObject.rateLimit) != 'undefined' ) {
+                params.rateLimit = routeObject.rateLimit;
+            }
 
             // isRoute
             return self.compareUrls(params, routeObject.url, req);