gina 0.6.15 → 0.6.16

package/CHANGELOG.md

@@ -6,6 +6,14 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.16 - 2026-08-25
+### Fixed
+* Fixed #B418 — calling the public link API for a registered url whose anchor is no longer in the DOM threw a bare TypeError. It now throws a named error identifying the link id, the url and the cause: there is no deregistration path, so a registration outlives its element, and a page that re-renders its anchors after binding hits exactly this. The miss is detected beside the unregistered-url guard, before the supersede step, so it never aborts a request already in flight nor invalidates that request's response handling. Click-driven links cannot reach this case.
+* The page whisper no longer exports the forms mocks group (#B344). The RFC5987-encoded page.environment.forms export - parsed by the client loader into gina.forms - now ships the bundle forms catalog minus the mocks group (dev fixture data walked from a bundle forms/mocks/ directory) in EVERY environment, trimming page weight and keeping the client contract uniform across envs; rules and custom validators still ride the whisper unchanged. Server-side surfaces (page.forms, templates, server-side validation, the Inspector forms catalog card) keep the complete catalog, and the shared catalog object is never mutated (shallow copy at export only). ACTION REQUIRED only if your own client code read gina.forms.mocks - the framework client bundle never consumed it; whisper the data yourself from a controller if you need it in the browser. Server-side change: pickup is a bundle restart, no client-bundle rebuild.
+* Fixed #B420 -- the documented fluent upload-persistence form `self.store(target).onComplete(cb)` threw `TypeError: self.store(...).onComplete is not a function` on every recent stable (v0.6.0 through v0.6.15): `store()` was accidentally declared `async`, so the deliberate `{ onComplete }` facade came back wrapped in a Promise that carries no `onComplete`. The declaration is no longer `async` -- the body contains no `await` and nothing anywhere awaits the call, so no behaviour depended on the promise -- the facade returns synchronously as the guide documents, and the 3-argument callback form `self.store(target, files, cb)` is byte-unchanged. The TypeScript declaration now describes the fluent return shape instead of `Promise<void>`.
+### Security
+* Concurrent uploads of the same filename no longer corrupt one another (#B419). The multipart parser wrote every incoming file to <upload dir>/<the filename the client sent>, with nothing in the path to distinguish one part or one request from another - so two uploads sharing a filename opened two write streams on a single path and interleaved their bytes into one hybrid file matching neither upload, while the framework reported success to both callers. Measured on a live bundle before the fix: 12 concurrent uploads of one filename left 1 corrupted file instead of 12 intact ones, and a single request carrying two same-named parts produced one file mixing both. The multipart parse runs before routing and before any middleware, so reaching it needed neither authentication nor a valid route - a POST to an unknown url answers 404 to the client and still writes the file to disk. Uploads now stage under a server-generated random name (32 hex characters plus a .part suffix), which is how multer and formidable have always handled this, and which also keeps client-controlled bytes out of the filesystem and cannot overflow the operating system filename limit. ACTION REQUIRED only if your own code derives a display name or a public URL from the basename of req.files[].path: read req.files[].originalFilename instead - it is unchanged, it is still the name self.store() publishes the file under, and the documented behaviour of keeping each file's original name is unaffected. Server-side change: pickup is a bundle restart, no client-bundle rebuild.
+
 ## 0.6.15 - 2026-08-24
 ### Changed
 * The changie pre-commit guard now also requires that a fragment whose FILENAME names a tracker id cites that id in its body (#B410). Only the body is rendered into CHANGELOG.md and the published tarball, so an id carried by the filename and the commit message but missing from the body ships an UNNUMBERED changelog entry, and anyone triaging by id gets a false zero. Measured across all 937 historical fragments, roughly 60 shipped entries are unnumbered this way; the guard stops the next one at commit time rather than at cut time. Recognised id families are an explicit allowlist rather than a generic letters-then-digits pattern, because the generic form false-positives on real filenames (express5, npm12, s3) and a false positive would block a commit; a filename encoding no recognised id is skipped, never failed.

package/README.md

@@ -62,36 +62,31 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.15
+## What's in 0.6.16
 
 > **Restart your bundles AND rebuild them.** This release changes the browser
-> bundle: both `gina.min.js` and `gina.min.css` differ from `0.6.14`. A restart
-> alone updates the server half only — each bundle bakes its own copy of the
-> client assets, so `gina bundle:build` is required for the client-boot,
-> link and popin fixes below to reach a browser at all.
+> bundle: `gina.min.js` differs from `0.6.15` (`gina.min.css` and
+> `gina.onload.min.js` are unchanged). A restart alone updates the server half
+> only — each bundle bakes its own copy of the client assets, so the link fix
+> below would not reach a browser at all.
 
-> **No settings reset.** `0.6.15` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.16` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**A correctness pass over client boot, and two connector defects that could hang
-a request.** The headline is a race that only a real deployment can lose: the
-client routing table arrives by async fetch, but handlers were released before it
-landed — so anything resolving a route during initialisation ran against an empty
-table, deterministically, on every page load away from loopback. Alongside it,
-the couchbase connector no longer hangs a request on an unparsed `COUNT`, and two
-client plugins stop leaking their behaviour onto pages that never asked for it.
-**Several behaviour changes are worth checking before you upgrade** — each is
-called out in its bullet below, with the details in the
-[migration guide](https://gina.io/docs/migration).
-
-- **Fixed — client handlers now wait for the routing table (#B414, consumer-reported).** The client routing table arrives only by async fetch — the page deliberately whispers an empty stub rather than inlining it — yet `gina.ready` handlers and the auto-boot validator released at `DOMContentLoaded`. Anything calling `getRoute()`/`toUrl()` during handler or form-bind initialisation therefore ran against an empty table. Loopback wins that race by single-digit milliseconds, which is why development and local suites never see it; a real deployment loses it by 150ms or more on *every* load. A validator form rule naming a route then threw inside the init listener, the event dispatch swallowed the throw, and the instance's `ready` never fired — silently, with one uncorrelated console error as the only artefact. All three release paths now gate on the dependency *settling*: the ready-list scheduler, the validator auto-boot poll, and the late-registration path (a handler registered after `DOMContentLoaded` previously bypassed the scheduler and fired immediately). Settled deliberately means loaded **or** failed, so a broken endpoint still releases handlers rather than hanging the page, and a parse-time 5-second fallback force-settles with a console error in degenerate shapes where no fetch is ever issued. **Behaviour change:** on deployed tiers `gina.ready` handlers now fire when routing is actually available — typically 150ms–1.3s later than before; on loopback and in development the difference is single-digit milliseconds. Pages that do not use client routing are unaffected but for the timing.
-- **Fixed — `getRoute()` reports a missing routing table instead of crashing (#B415).** The client `getRouting()` returns `null` by design when nothing matches — an empty table before the fetch lands, or a bundle with no rules — and the bare dereference of that `null` sat one line *above* the very diagnostic built for the degraded-table case, so the case it existed for was exactly the one it could never report. A named guard now throws `bundle X has no routing table for rule Y (client: routing config not loaded yet, or empty)`, on both the client and the server.
-- **Fixed — a failed routing fetch now leaves console evidence (#B416).** The dependency bus fires on fetch failure as well as success — that is what keeps the page booting — but the listener discarded the error it carried. A genuinely failed fetch booted the framework permanently degraded, with an empty routing table and *zero* console output. The listener now reports the carried error and names the consequence: client `getRoute()`/`toUrl()` degraded until reload.
-- **Fixed — a couchbase `COUNT` query can no longer hang the request (#B412, consumer-reported).** The `@return {number}` branch parsed the COUNT alias out of the query text and dereferenced the match unguarded, so `SELECT COUNT(DISTINCT a.b) AS n` — the pattern cannot span the space inside the parentheses — and an unaliased `SELECT COUNT(*)` both produced a null match and threw. The severity was not the throw but where it landed: inside the connector's own result callback, so no 5xx was ever produced, a promisified caller never settled, and the request hung until the client or proxy timed out — leaving one uncorrelated log line, and behind an HTTP/2 inter-bundle client the stall was then retried. It was dev-invisible too: the dev path strips only the first comment block, so a commented-out parsable COUNT elsewhere in the file kept the regex satisfied locally while production, which strips every comment, threw on the identical file. The branch now derives the count from the first projected column with no regex at all, guarded against empty result sets, empty rows and null payloads — exactly as mysql, postgresql, scylladb and sqlite already did, and as the documented contract already stated. **Behaviour change:** for a multi-column projection whose COUNT is not the first column, the returned value is now the first column rather than the aliased one — consistent with every other connector.
-- **Fixed — couchbase annotation types are normalised and bounded (#B413).** Both the `@return` type and each `@param` type feed exact-match comparisons whose arms are all lowercase, so a capitalised or space-padded type such as `{Number}` or `{ number }` matched nothing and was silently skipped — handing the caller the raw row array instead of the declared shape, and leaving the parameter uncast. Both are now trimmed and lowercased at extraction, as the sibling connectors already did. Both captures were also greedy, so a second brace pair on the same line bled into the extracted type (`@param {a} and {b}` yielded `a} and {b`), matching no cast arm either; both are bounded to the first brace pair. **Behaviour change:** annotations that previously fell through silently now reach their branch, so a query declaring `@return {Number}` begins returning the declared shape rather than the raw row array. `@options` deliberately keeps its greedy capture — it holds a nestable object literal, not a single type token.
-- **Fixed — the public link API names its error instead of throwing a bare TypeError (#B328).** Calling `gina.link.request(url)` — or a registered link's `.request(url)` with a foreign url — for a url no link is registered for dereferenced the null resolution. It now throws a named error identifying the url and the likely cause: never bound, or bound by a later construction the published instance cannot see. The miss is also detected *before* the supersede step, so a mistyped url no longer aborts a legitimate request still in flight. Click-driven links are unaffected — both click paths always resolve a real registration.
-- **Fixed — the popin stylesheet no longer restyles every dialog on the page (#B329).** Its `::backdrop` rule (dark overlay + blur) shipped unscoped on the bare `dialog` element, so gina painted its backdrop on any `<dialog>` a page opened. It is now scoped to `dialog.gina-popin-container::backdrop`, matching the reduced-motion rules that were already scoped. **Consumer-visible:** a page that relied on the unscoped rule to style its own dialogs must style them itself now, and a popin dialog element supplied by the page's own markup needs the `gina-popin-container` class to keep gina's backdrop.
-- **Changed — a changelog fragment must cite the tracker id its filename names (#B410).** Only the body is rendered into `CHANGELOG.md` and the published tarball, so an id carried by the filename and the commit message but missing from the body ships an unnumbered changelog entry — and anyone triaging by id gets a false zero. Measured across all 937 historical fragments, roughly 60 shipped entries are unnumbered this way; the guard stops the next one at commit time rather than at cut time. Recognised id families are an explicit allowlist rather than a generic letters-then-digits pattern, because the generic form false-positives on real filenames (`express5`, `npm12`, `s3`) and a false positive would block a commit; a filename encoding no recognised id is skipped, never failed.
+**A concurrent-upload corruption fix, and the documented upload API made true.**
+The headline is a data-integrity defect in the multipart parser: two uploads
+sharing a filename wrote to one path and interleaved their bytes into a single
+hybrid file, while the framework reported success to both callers — reachable
+without authentication and without a valid route, because the parse runs before
+routing. Alongside it, the fluent `store()` form the upload guide documents has
+been dead on every recent stable and now works as written. **Two of the four
+changes carry an action** — each is called out in its bullet below, with the
+details in the [migration guide](https://gina.io/docs/migration).
+
+- **Security — concurrent uploads of the same filename no longer corrupt one another (#B419).** The multipart parser wrote every incoming file to `<upload dir>/<the filename the client sent>`, with nothing in the path to distinguish one part or one request from another — so two uploads sharing a filename opened two write streams on a single path and interleaved their bytes into one hybrid matching neither upload, while the framework answered success to both callers. Measured on a live bundle before the fix: twelve concurrent uploads of one filename left **one** corrupted file where twelve intact ones were sent, and a single request carrying two same-named parts produced one file mixing both. The multipart parse runs before routing and before any middleware, so reaching it needed neither authentication nor a valid route — a POST to an unknown url answers 404 to the client and still writes the file to disk, and no application configuration could avoid it. Uploads now stage under a server-generated random name (32 hex characters plus a `.part` suffix), which is how multer and formidable have always handled this, and which also keeps client-controlled bytes off the filesystem and cannot overflow the operating system's filename limit. **ACTION REQUIRED only if your own code derives a display name or a public URL from the basename of `req.files[].path`:** read `req.files[].originalFilename` instead — it is unchanged, it is still the name `self.store()` publishes the file under, and the documented behaviour of keeping each file's original name is unaffected.
+- **Fixed — the documented fluent `store(target).onComplete(cb)` form works again (#B420).** It threw `TypeError: self.store(...).onComplete is not a function` on every recent stable — `0.6.0` through `0.6.15` — because `store()` was accidentally declared `async`, so the deliberate `{ onComplete }` facade came back wrapped in a Promise that carries no `onComplete`. The upload guide's first worked example was therefore dead code on every published release that documented it. The declaration is no longer `async`: the body contains no `await` and nothing anywhere awaits the call, so no behaviour depended on the promise — which resolved before the upload completed in any case, and so never meant what an awaiting caller would assume. The facade now returns synchronously as the guide documents, the three-argument callback form `self.store(target, files, cb)` is byte-unchanged, and the TypeScript declaration describes the fluent return shape instead of `Promise<void>`.
+- **Fixed — the page whisper no longer exports the forms mocks group (#B344).** The RFC5987-encoded `page.environment.forms` export — parsed by the client loader into `gina.forms` — shipped the entire bundle forms catalog into every page in every environment, mocks group included (dev fixture data walked from a bundle's `forms/mocks/` directory), while the routing exports one line above it were deliberately stubbed to `{}` for page weight. The whisper now ships the catalog minus mocks in **every** environment rather than outside development only, deliberately: the alternative manufactures an env-divergent `gina.forms` shape — a group present in development and absent in production — which is the works-in-dev-fails-in-prod class. Rules and custom validators ride the whisper unchanged, every server-side surface keeps the complete catalog (`page.forms`, templates, server-side validation, the Inspector's forms catalog card), and the shared catalog object is never mutated. **ACTION REQUIRED only if your own client code read `gina.forms.mocks`** — the framework's client bundle never consumed it; whisper the data yourself from a controller if you need it in the browser.
+- **Fixed — the link API names its error when the anchor has left the DOM (#B418).** Calling the public link API for a registered url whose anchor is no longer in the document dereferenced the null lookup and threw a bare `TypeError`. There is no deregistration path, so a registration outlives its element — a page that re-renders its anchors after binding hits exactly this. It now throws a named error identifying the link id, the url and the cause, and the miss is detected beside the unregistered-url guard **before** the supersede step, so it no longer aborts a request already in flight nor invalidates that request's response handling. Click-driven links cannot reach this case: both click paths resolve on the element just operated.
 
 ## Documentation
 

package/ROADMAP.md

@@ -67,6 +67,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.13` ✅ | **Added**: a general-purpose key-value primitive — declare namespaces under `settings.json > kv.namespaces` and reach them as `gina.kv('<namespace>')`, a promise-native handle with 13 operations including the ones that are hard to get right by hand: set-if-absent, atomic read-and-delete (a one-shot token's second reader gets `null`), compare-and-delete as the safe lock-release primitive, TTL-on-create-only counters, and fetch-or-compute with per-process single-flight. Three backends: in-memory with zero config, redis for namespaces shared across hosts and replicas (every guarantee server-side — `SET .. PX .. NX`, `GETDEL` with a Lua fallback below redis 6.2), and SQLite as the zero-dependency durable option that survives a restart and stays atomic across processes via `IMMEDIATE` transactions, using `node:sqlite` so there is nothing to install. Namespaces are strict-declared — an unknown name throws at the call site rather than silently minting an empty store — and each owns its failure policy; all three backends are verified against one shared contract spec. Deliberately not a redis client: no data structures, batch operations, key scanning, binary values or first-class locks. Identified-caller rate limiting — opt-in quota enforcement at the router keyed on the authenticated principal (a session user via an operator-named field, or a machine caller), with fixed-window counters in a kv namespace you declare, so choosing that namespace's backend chooses the quota's scope: redis or SQLite share one quota across replicas, in-memory counts per process. The gate runs after route authorization and before payload validation, so the refusal order is 401 → 429 → 422 and a throttled caller never receives a field map; it throttles identified callers only, and a request with no resolvable principal is skipped rather than bucketed by IP, since behind a reverse proxy that would be one bucket for the whole internet — anonymous flood control stays with your edge proxy. Denials answer 429 with `Retry-After` plus the `RateLimit` / `RateLimit-Policy` structured fields, which allowed limited requests carry too, and per-route overrides ride a top-level `rateLimit` key in `routing.json`. An opt-in per-authority circuit breaker for `Controller::query()` — after N consecutive transport-class failures to one authority the circuit opens and further calls fail fast with a machine-readable `CIRCUIT_OPEN` error instead of hammering a dead upstream, admitting exactly one critical request as the half-open probe after the cooldown; the gate sits above the HTTP/1.x / HTTP/2 dispatch so retries can never hammer an open circuit by construction, and only transport-class errors count, so an application response of any status cannot trip it. **Fixed**: an exception in a controller's `onReady` or `setup` hook can no longer vanish — both dispatch sites invoked the reserved-action hooks outside the guarded band, so a synchronous throw escaped to the process level (on the built-in engine an uncaught exception killing the whole bundle process, while Express answered its own 500 — an engine asymmetry) and an asynchronous rejection was unowned, leaving the request to hang to client or proxy timeout while work after the throw silently never happened; both loops now run inside the dispatch `try` and every hook's promise is owned by the same guard the main action carried, with the synthesized `setup` wrapper returning the app call's own result so an async `setup.js` rejection actually reaches it (ACTION REQUIRED if a hook of yours can throw: it now answers 500 where it previously crashed, hung, or was masked — and since hooks are still dispatched without awaiting, a hook rejection does not stop the action, so its side effects may already have run when the 500 lands). The entity dispatch diagnostics are readable again — five markers were raw `console.log` calls, which in gina bypasses both the container dispatch and the level gate, so they reached neither a bundle log file nor container logs and were visible only by running a bundle in the foreground; they now go through `console.debug`, off by default and appearing at the `debug` hierarchy as originally intended. **Documentation**: the published claim that gina ships a companion reverse-proxy service is retired — no release ever carried the bundle the help text advertised, and each surface now states the position the rest of the documentation already assumed, that gina ships no edge or reverse proxy by design; run nginx, Traefik or an ingress controller in front of your bundles. Two deliberate boundaries are now stated rather than left as absences: API versioning (no version route field, no version-aware dispatch — with the three shapes the existing primitives already cover) and database migrations (the per-database tools to use, plus running them as a discrete step before the new version serves rather than at bundle boot where replicas race each other, and keeping changes additive during a rolling deploy), and `connector:migrate` is explicitly flagged as not a database migration. Pickup: restart **and** rebuild your bundles — the browser bundle changed, though its client-side delta is inert. |
 | **Q4 2026** | `0.6.14` ✅ | **Added**: network-backed secrets without a vendor SDK or a hung boot — a bundle may declare one operator-supplied fetch command under `settings.secrets.exec` (argv form, no shell) whose stdout must be a single flat JSON object of string values, layered underneath the environment exactly like the existing file tier and mutually exclusive with it, a bundle inheriting a project-wide file chain opting out with `"file": null` beside its own block. It runs once per bundle per config-load cycle, at boot only, and a failing fetch is always a fast, named per-bundle boot refusal rather than a hang: the child is bounded by its own timeout and killed with SIGKILL on expiry, so a wedged secrets endpoint costs a failed boot instead of a process that never comes up. The fetched output is never echoed into any error, log or report, and `gina secrets:check` validates *and runs* the same command through the same code, so the CI gate's verdict matches the boot's by construction; recipes for vault, kubectl and sops ship with the guide, and decrypting at the container entrypoint remains the better pattern wherever the entrypoint can be controlled. `settings.secrets` is also stricter, deliberately: unknown keys and non-object values now refuse the boot instead of silently degrading to environment-only resolution. **Fixed**: a correctness pass over how `self.query()` hands results back to application code. An exception in an `async` query callback could vanish — every app-callback delivery (the Node-style callback form and the `{onComplete}` facade, on both transports) invoked the callback bare, so an asynchronous rejection was unowned and the request hung to client or proxy timeout; rejections now answer 500 with the correlation ref. A synchronous throw inside a callback invoked on a transport-error delivery escaped to the process handler on the event- and timer-frame sites, killing the whole bundle on both engines, and re-invoked the callback with its own exception on the caller-frame sites; all fourteen error-path deliveries are now guarded. An HTTP/2 transport failure was answered twice, the session-level error handler racing the stream-level delivery — and on a reused session answering with the *creating* request's context, since session listeners bind once at connect; notification is now owned solely by the stream-level terminals. Handle-mode error deliveries never reached the app's `onComplete` listener, because both facades dereferenced `data.status` on a single-argument error emit and crashed into a 500 that misattributed the failure to the app callback; the listener is now invoked with the error, and owns the outcome as the callback form does. And HTTP/2 callback mode never delivered a non-5xx error status at all, so graceful degradation was impossible for something as ordinary as a 404 from an HTTP/2 upstream and the documented promisify idiom never settled on one — every body-announced non-2xx now reaches the callback on both transports. `self.query()`'s JSDoc no longer claims the no-callback form returns a Promise: it returns a handle exposing `.onComplete(cb)`, which is not a thenable, so `await self.query({...})` resolved immediately with the handle and silently dropped the result — the real contract and the supported `await` idiom are documented with their rejection shapes, each verified against the runtime. A crash during bundle bootstrap now aborts loudly instead of hanging silently — the async boot frame turned a synchronous throw into a rejection logged at error level with no emergency marker and no exit, so `gina bundle:start` sat on its startup timer and reported a timeout with no cause attached. GET and HEAD query parameters keep their backslash-escaped characters: the pipeline stripped every backslash from the whole serialized document, so a newline degraded to the letter `n`, a backslash vanished, and a double quote or JSON-array value produced invalid JSON that silently dropped every parameter on the request. And `gina secrets:check` now agrees with the boot — its hand-kept mirror of the `settings.secrets.file` declaration guards had drifted permissively twice, reporting green on configurations the bundle refuses to start on, and the command now exits non-zero when a declaration is itself invalid or unreachable rather than only when a required key is unset. **Changed**: the config-source walk behind `secrets:scan` and `secrets:check` now lives in `lib.secrets`, so the two commands enumerate the same config sources by construction and cannot drift apart; CLI behaviour and report output are unchanged. Pickup: restart your bundles — no rebuild needed, the browser bundle's executable content is byte-identical to `0.6.13`. |
 | **Q4 2026** | `0.6.15` ✅ | **Fixed**: client-side handler release now awaits the routing table — the table arrives only by async fetch (the page deliberately whispers an empty stub rather than inlining it) yet `gina.ready` handlers and the auto-boot validator released at `DOMContentLoaded`, so anything calling `getRoute()`/`toUrl()` during handler or form-bind initialisation ran against an empty table; loopback wins that race by single-digit milliseconds, which is why development and the local suites never see it, while a real deployment loses it by 150ms or more on every load, deterministically — a validator form rule naming a route then threw inside the init listener, the event dispatch swallowed the throw, and the instance's `ready` never fired, silently. All three release paths now gate on the dependency settling (the ready-list scheduler, the validator auto-boot poll, and the late-registration path that previously bypassed the scheduler entirely and fired immediately), settled deliberately meaning loaded **or** failed so a broken endpoint still releases handlers rather than hanging the page, with a parse-time 5-second fallback force-settling in degenerate shapes where no fetch is ever issued (ACTION REQUIRED only in the sense of timing: on deployed tiers handlers now fire 150ms–1.3s later than before, when routing is actually available). Alongside it, client `getRoute()` no longer crashes with a context-free TypeError when a bundle's routing table is absent — the client `getRouting()` returns null by design, and the bare dereference of that null sat one line above the very diagnostic built for the degraded-table case, so the case it existed for was exactly the one it could never report — and a failed routing fetch now leaves console evidence instead of booting the framework permanently degraded in silence. The couchbase connector no longer hangs a request when a `@return {number}` COUNT query does not match its alias parser: the branch dereferenced an unguarded regex match, so `SELECT COUNT(DISTINCT a.b) AS n` and an unaliased `SELECT COUNT(*)` both threw inside the connector's own result callback — no 5xx was ever produced, a promisified caller never settled, and the request hung until the client or proxy timed out, a stall then retried behind an HTTP/2 inter-bundle client; it was dev-invisible too, since the dev path strips only the first comment block, so a commented-out parsable COUNT elsewhere in the file kept the regex satisfied locally while production threw on the identical file. The branch now derives the count from the first projected column with no regex at all, guarded against empty result sets, empty rows and null payloads, exactly as mysql, postgresql, scylladb and sqlite already did (ACTION REQUIRED if a multi-column projection puts its COUNT anywhere but first: the returned value is now the first column rather than the aliased one, consistent with every other connector). The same connector now trims and lowercases the types it reads from `@return` and `@param`, and bounds both captures to the first brace pair — the extracted types feed exact-match comparisons whose arms are all lowercase, so `{Number}` or `{ number }` matched nothing and was silently skipped, handing back the raw row array instead of the declared shape and leaving the parameter uncast, while a second brace pair on the same line bled into the greedy capture (ACTION REQUIRED: annotations that previously fell through silently now reach their branch, so a query declaring `@return {Number}` begins returning the declared shape; `@options` deliberately keeps its greedy capture, holding a nestable object literal rather than a single type token). Two client plugins stop leaking behaviour onto pages that never asked for it: the public link API throws a named error identifying the url and the likely cause instead of a bare TypeError, and detects the miss before the supersede step so a mistyped url no longer aborts a legitimate request still in flight; and the popin stylesheet's `::backdrop` rule is scoped to gina's own popin dialogs rather than every `<dialog>` on the page (ACTION REQUIRED if a page relied on the unscoped rule to style its own dialogs, or supplies a popin dialog element from its own markup — that element needs the `gina-popin-container` class to keep gina's backdrop). **Changed**: a changelog fragment whose filename names a tracker id must now cite that id in its body, since only the body renders into `CHANGELOG.md` and the published tarball — an id carried by filename and commit message alone ships an unnumbered entry and anyone triaging by id gets a false zero (roughly 60 of 937 historical fragments shipped that way); recognised id families are an explicit allowlist rather than a generic pattern, because the generic form false-positives on real filenames and a false positive would block a commit. Pickup: restart **and** rebuild your bundles (the browser bundle changed — both `gina.min.js` and `gina.min.css` differ from `0.6.14`). |
+| **Q4 2026** | `0.6.16` ✅ | **Security**: concurrent uploads of the same filename no longer corrupt one another — the multipart parser wrote every incoming file to `<upload dir>/<the filename the client sent>` with nothing in the path distinguishing one part or one request from another, so two uploads sharing a filename opened two write streams on a single path and interleaved their bytes into one hybrid matching neither upload, while the framework reported success to both callers; measured on a live bundle before the fix, twelve concurrent uploads of one filename left ONE corrupted file where twelve intact ones were sent, and a single request carrying two same-named parts produced one file mixing both. The parse runs before routing and before any middleware, so reaching it needed neither authentication nor a valid route — a POST to an unknown url answers 404 to the client and still writes the file to disk — and no application configuration could avoid it; uploads now stage under a server-generated random name, 32 hex characters plus a `.part` suffix, as multer and formidable have always done, which also keeps client-controlled bytes off the filesystem and cannot overflow the operating system filename limit (ACTION REQUIRED only where your own code derives a display name or a public URL from the basename of `req.files[].path`: read `req.files[].originalFilename` instead, which is unchanged and is still the name `self.store()` publishes the file under). **Fixed**: the documented fluent `store(target).onComplete(cb)` form works again — `store()` was accidentally declared `async`, so the deliberate `{ onComplete }` facade came back wrapped in a Promise carrying no `onComplete`, leaving the upload guide's first worked example dead code on every stable from `0.6.0` through `0.6.15`; the body contains no `await` and nothing anywhere awaits the call, so dropping the keyword changed no behaviour, the facade returns synchronously as documented, the three-argument callback form is byte-unchanged, and the TypeScript declaration now describes the fluent return shape instead of `Promise<void>`. The page whisper no longer exports the forms mocks group — the RFC5987-encoded `page.environment.forms` export shipped the entire bundle forms catalog into every page in every environment, mocks included, while the routing exports one line above it were deliberately stubbed to `{}` for page weight; mocks are now excluded in every environment rather than outside development only, deliberately, since an env-divergent `gina.forms` shape is the works-in-dev-fails-in-prod class, and rules, custom validators and every server-side surface keep the complete catalog (ACTION REQUIRED only for client code that read `gina.forms.mocks`, which the framework's own client bundle never consumed). And the link API names its error when the anchor has left the DOM: there is no deregistration path, so a registration outlives its element and a page that re-renders its anchors after binding dereferenced the null lookup and threw a bare TypeError — it now throws a named error identifying the link id, the url and the cause, detected beside the unregistered-url guard before the supersede step so it no longer aborts a request already in flight nor invalidates that request's response handling. Pickup: restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.15`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |

package/framework/v0.6.16/VERSION

@@ -0,0 +1 @@
+0.6.16

package/framework/{v0.6.15 → v0.6.16}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -10086,7 +10086,10 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
          *
          * A url that resolves to no registration throws a named error BEFORE the
          * supersede step (#B328) — a miss can never abort a request already in
-         * flight, and the message names the url plus the likely cause.
+         * flight, and the message names the url plus the likely cause. A
+         * registration whose anchor has left the DOM throws the same way (#B418):
+         * there is no deregistration path, so registrations outlive their
+         * elements, and the link contract cannot proceed without the anchor.
          *
          * Side effects: supersedes any request still in flight, arms `data-gina-loading`
          * on the anchor for the duration of this one, and releases it from a `loadend`
@@ -10096,7 +10099,8 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
          * @param {string} url - URL to request
          * @param {object} [options] - XHR options, merged over the link's own
          *
-         * @throws {Error} when `url` matches no registration (the public-path miss)
+         * @throws {Error} when `url` matches no registration, or the matched
+         *  registration's anchor is no longer in the DOM (both public-path misses)
          *
          * @returns {void}
          *
@@ -10125,6 +10129,21 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
                 // which the published instance's walk cannot see (#B326).
                 throw new Error('[ LinkHandler::request(url, options) ] : no link is registered for url `'+ url +'` (never bound, or bound by a later construction — the published instance walks only its own registrations)');
             }
+            // link element — #B418: same shape, second miss. A registration can
+            // outlive its anchor (there is no deregistration path, so a page that
+            // re-renders its anchors leaves the registration pointing at nothing),
+            // and the bare `$el.getAttribute` below then threw a raw TypeError —
+            // after the supersede block had aborted an in-flight request and
+            // bumped the sequence, whose stale-response wrapper drops that
+            // request's completion. Resolved and guarded HERE so a miss of either
+            // kind leaves transport state untouched. The link contract is
+            // DOM-coupled — loading state, hlink attributes and response events
+            // all target the anchor — so this cannot proceed without one.
+            var id  = $link.id;
+            var $el = document.getElementById(id) || null;
+            if ( !$el ) {
+                throw new Error('[ LinkHandler::request(url, options) ] : link `'+ id +'` is registered for url `'+ url +'` but its anchor is no longer in the DOM — registrations are not removed when their element is');
+            }
 
             // One transport per request, and a sequence taken BEFORE the abort so a
             // supersede-abort is stale by construction — its handler sees
@@ -10139,12 +10158,6 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
             var xhr = createXhr();
             _linkXhr = xhr;
 
-            var id         = $link.id;
-
-
-            // link element
-            var $el         = document.getElementById(id) || null;
-
             var hLinkIsRequired = null;
             // forward callback to HTML data event attribute through `hlink` status
             hLinkIsRequired = ( $el.getAttribute('data-gina-link-event-on-success') || $el.getAttribute('data-gina-link-event-on-error') ) ? true : false;