gina 0.6.16 → 0.6.17

package/CHANGELOG.md

@@ -6,6 +6,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.17 - 2026-08-26
+### Fixed
+* #B422 — a route whose URL structurally matches but whose `requirements` REJECT the request no longer drops the connection once the route cache is warm. The route cache is keyed `method:pathname` and (on the isaac engine) the query string is stripped before dispatch, so every query variant of one pathname shares one cache entry; the warm path re-evaluated `requirements` on each hit but discarded the verdict, force-matching the rejected request and dispatching it with no routing description — an unhandled promise rejection at the dispatch target deref, the connection dropped with no HTTP response at all. The warm path now honors the verdict: a rejecting (or throwing) requirement evaluation is treated as a cache miss and falls through to the routing scan, which answers correctly — 404 when nothing matches, the sibling rule when one does, or a 500 naming the rule when a `validator::` requirement throws (previously also a dropped connection). The cache entry is kept — variants the requirements accept stay warm. Defence in depth: the router now answers a named 500 instead of throwing when dispatched without a resolved `param.control`. Server-side only — pickup is a bundle restart, no re-bake.
+* #B423 — a bundle declaring a `redirect` route no longer floods its log with `JSON.clone(...) possible error detected: source[host] is undefined` warnings. Redirect rules are deliberately excluded from the per-rule host/hostname defaulting, so those keys are absent on them — but the per-request routing copy in the controller assigned them unconditionally, which CREATED properties holding `undefined` on the cached routing clone. Because that clone is kept for the lifetime of the process, every later no-arg `getConfig()` then emitted one `host` and one `hostname` warning per redirect rule, indefinitely — measured by a consumer as roughly three quarters of that log line total volume, drowning the genuine warnings it exists to surface. The copy is now existence-guarded: an absent key stays absent, and rules that do carry a host or hostname are copied exactly as before. Behaviour is otherwise unchanged (the clone had been substituting `null`, which every reader already treated the same as absent) — this removes log noise, not a functional defect. Reached only from template/view routes, so API-only bundles were never affected. Server-side only — pickup is a bundle restart, no re-bake.
+* Validator rules `toFloat`, `set` and `format` are now context-safe (#B398). `toFloat` no longer throws server-side — it reads the live DOM value only when one is reachable and otherwise uses the submitted value, so server-side rule sets can coerce floats (the missing comma that leaked `isFloatingWithCommas` as an implicit global is fixed with it). `set` assigns the field value in both contexts and reflects it onto the DOM element only in the browser. `format` — which already worked in both contexts after `isDate` — now reports a non-Date value as a named rule-authoring error pointing at the missing `isDate`, instead of the opaque `val.format is not a function`.
+
 ## 0.6.16 - 2026-08-25
 ### Fixed
 * Fixed #B418 — calling the public link API for a registered url whose anchor is no longer in the DOM threw a bare TypeError. It now throws a named error identifying the link id, the url and the cause: there is no deregistration path, so a registration outlives its element, and a page that re-renders its anchors after binding hits exactly this. The miss is detected beside the unregistered-url guard, before the supersede step, so it never aborts a request already in flight nor invalidates that request's response handling. Click-driven links cannot reach this case.

package/README.md

@@ -62,31 +62,30 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.16
+## What's in 0.6.17
 
 > **Restart your bundles AND rebuild them.** This release changes the browser
-> bundle: `gina.min.js` differs from `0.6.15` (`gina.min.css` and
+> bundle: `gina.min.js` differs from `0.6.16` (`gina.min.css` and
 > `gina.onload.min.js` are unchanged). A restart alone updates the server half
-> only — each bundle bakes its own copy of the client assets, so the link fix
-> below would not reach a browser at all.
+> only — each bundle bakes its own copy of the client assets, so the validator
+> fix below would not reach a browser at all.
 
-> **No settings reset.** `0.6.16` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.17` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**A concurrent-upload corruption fix, and the documented upload API made true.**
-The headline is a data-integrity defect in the multipart parser: two uploads
-sharing a filename wrote to one path and interleaved their bytes into a single
-hybrid file, while the framework reported success to both callers — reachable
-without authentication and without a valid route, because the parse runs before
-routing. Alongside it, the fluent `store()` form the upload guide documents has
-been dead on every recent stable and now works as written. **Two of the four
-changes carry an action** — each is called out in its bullet below, with the
-details in the [migration guide](https://gina.io/docs/migration).
-
-- **Security — concurrent uploads of the same filename no longer corrupt one another (#B419).** The multipart parser wrote every incoming file to `<upload dir>/<the filename the client sent>`, with nothing in the path to distinguish one part or one request from another — so two uploads sharing a filename opened two write streams on a single path and interleaved their bytes into one hybrid matching neither upload, while the framework answered success to both callers. Measured on a live bundle before the fix: twelve concurrent uploads of one filename left **one** corrupted file where twelve intact ones were sent, and a single request carrying two same-named parts produced one file mixing both. The multipart parse runs before routing and before any middleware, so reaching it needed neither authentication nor a valid route — a POST to an unknown url answers 404 to the client and still writes the file to disk, and no application configuration could avoid it. Uploads now stage under a server-generated random name (32 hex characters plus a `.part` suffix), which is how multer and formidable have always handled this, and which also keeps client-controlled bytes off the filesystem and cannot overflow the operating system's filename limit. **ACTION REQUIRED only if your own code derives a display name or a public URL from the basename of `req.files[].path`:** read `req.files[].originalFilename` instead — it is unchanged, it is still the name `self.store()` publishes the file under, and the documented behaviour of keeping each file's original name is unaffected.
-- **Fixed — the documented fluent `store(target).onComplete(cb)` form works again (#B420).** It threw `TypeError: self.store(...).onComplete is not a function` on every recent stable — `0.6.0` through `0.6.15` — because `store()` was accidentally declared `async`, so the deliberate `{ onComplete }` facade came back wrapped in a Promise that carries no `onComplete`. The upload guide's first worked example was therefore dead code on every published release that documented it. The declaration is no longer `async`: the body contains no `await` and nothing anywhere awaits the call, so no behaviour depended on the promise — which resolved before the upload completed in any case, and so never meant what an awaiting caller would assume. The facade now returns synchronously as the guide documents, the three-argument callback form `self.store(target, files, cb)` is byte-unchanged, and the TypeScript declaration describes the fluent return shape instead of `Promise<void>`.
-- **Fixed — the page whisper no longer exports the forms mocks group (#B344).** The RFC5987-encoded `page.environment.forms` export — parsed by the client loader into `gina.forms` — shipped the entire bundle forms catalog into every page in every environment, mocks group included (dev fixture data walked from a bundle's `forms/mocks/` directory), while the routing exports one line above it were deliberately stubbed to `{}` for page weight. The whisper now ships the catalog minus mocks in **every** environment rather than outside development only, deliberately: the alternative manufactures an env-divergent `gina.forms` shape — a group present in development and absent in production — which is the works-in-dev-fails-in-prod class. Rules and custom validators ride the whisper unchanged, every server-side surface keeps the complete catalog (`page.forms`, templates, server-side validation, the Inspector's forms catalog card), and the shared catalog object is never mutated. **ACTION REQUIRED only if your own client code read `gina.forms.mocks`** — the framework's client bundle never consumed it; whisper the data yourself from a controller if you need it in the browser.
-- **Fixed — the link API names its error when the anchor has left the DOM (#B418).** Calling the public link API for a registered url whose anchor is no longer in the document dereferenced the null lookup and threw a bare `TypeError`. There is no deregistration path, so a registration outlives its element — a page that re-renders its anchors after binding hits exactly this. It now throws a named error identifying the link id, the url and the cause, and the miss is detected beside the unregistered-url guard **before** the supersede step, so it no longer aborts a request already in flight nor invalidates that request's response handling. Click-driven links cannot reach this case: both click paths resolve on the element just operated.
+**A dropped-connection routing defect, and three validator rules that could not
+run on the server.** The headline is an availability fix: once a route cache was
+warm, a request rejected by a route's `requirements` was dispatched anyway and the
+connection was dropped with no HTTP response at all — no status, no body. Alongside
+it, three documented validator rules threw on every server-side call, and a
+redirect-route log flood that could account for most of a bundle's warning volume
+is gone. **No action is required for any of the three** — each is a strict
+improvement over behaviour that previously failed; details in the
+[migration guide](https://gina.io/docs/migration).
+
+- **Fixed — a rejected route no longer drops the connection once the cache is warm (#B422).** The route cache is keyed `method:pathname`, and on the isaac engine the query string is stripped before dispatch, so every query variant of one pathname shares a single cache entry. The warm path re-evaluated the route's `requirements` on each hit and then discarded the verdict, force-matching a request the requirements had just rejected and dispatching it with no routing description — an unhandled promise rejection at the dispatch target deref, and the connection closed with no HTTP response at all. The warm path now honours the verdict: a rejecting or throwing requirement evaluation is treated as a cache miss and falls through to the routing scan, which answers correctly — `404` when nothing matches, the sibling rule when one does, or a `500` naming the rule when a `validator::` requirement throws (previously also a dropped connection). The cache entry is kept, so variants the requirements accept stay warm. Defence in depth: the router now answers a named `500` instead of throwing when dispatched without a resolved `param.control`.
+- **Fixed — the `toFloat`, `set` and `format` validator rules are context-safe (#B398).** All three are documented rules that threw on every server-side call. `toFloat` opened by reading the live DOM element unguarded, so server-side rule sets could not coerce a float at all; it now reads the live value only when one is reachable and otherwise uses the submitted value — which on the server *is* the raw value — so it works in both contexts (a missing comma in the same statement, which leaked `isFloatingWithCommas` as an implicit global into every page, is fixed with it). `set` assigns the field value in both contexts and reflects it onto the DOM element only in the browser, where an element exists. `format` — which already worked in both contexts when chained after `isDate`, as its documentation shows — now reports a non-`Date` value as a named rule-authoring error pointing at the missing `isDate`, instead of the opaque `val.format is not a function`. The guide's [middleware page](https://gina.io/docs/guides/middleware) also gained a section on reading configuration efficiently.
+- **Fixed — a redirect route no longer floods the log with `source[host] is undefined` warnings (#B423).** Redirect rules are deliberately excluded from the per-rule host/hostname defaulting, so those keys are absent on them — but the per-request routing copy assigned them unconditionally, creating properties holding `undefined` on the cached routing clone. Because that clone lives for the process lifetime, every later no-arg `getConfig()` emitted one `host` and one `hostname` warning per redirect rule, indefinitely; measured by a consumer at roughly three quarters of that log line's total volume, drowning the genuine warnings it exists to surface. The copy is now existence-guarded: an absent key stays absent, and rules that do carry a host or hostname are copied exactly as before. This removes log noise rather than a functional defect — the clone had been substituting `null`, which every reader already treated the same as absent. Reached only from template and view routes, so API-only bundles were never affected.
 
 ## Documentation
 

package/ROADMAP.md

@@ -68,6 +68,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.14` ✅ | **Added**: network-backed secrets without a vendor SDK or a hung boot — a bundle may declare one operator-supplied fetch command under `settings.secrets.exec` (argv form, no shell) whose stdout must be a single flat JSON object of string values, layered underneath the environment exactly like the existing file tier and mutually exclusive with it, a bundle inheriting a project-wide file chain opting out with `"file": null` beside its own block. It runs once per bundle per config-load cycle, at boot only, and a failing fetch is always a fast, named per-bundle boot refusal rather than a hang: the child is bounded by its own timeout and killed with SIGKILL on expiry, so a wedged secrets endpoint costs a failed boot instead of a process that never comes up. The fetched output is never echoed into any error, log or report, and `gina secrets:check` validates *and runs* the same command through the same code, so the CI gate's verdict matches the boot's by construction; recipes for vault, kubectl and sops ship with the guide, and decrypting at the container entrypoint remains the better pattern wherever the entrypoint can be controlled. `settings.secrets` is also stricter, deliberately: unknown keys and non-object values now refuse the boot instead of silently degrading to environment-only resolution. **Fixed**: a correctness pass over how `self.query()` hands results back to application code. An exception in an `async` query callback could vanish — every app-callback delivery (the Node-style callback form and the `{onComplete}` facade, on both transports) invoked the callback bare, so an asynchronous rejection was unowned and the request hung to client or proxy timeout; rejections now answer 500 with the correlation ref. A synchronous throw inside a callback invoked on a transport-error delivery escaped to the process handler on the event- and timer-frame sites, killing the whole bundle on both engines, and re-invoked the callback with its own exception on the caller-frame sites; all fourteen error-path deliveries are now guarded. An HTTP/2 transport failure was answered twice, the session-level error handler racing the stream-level delivery — and on a reused session answering with the *creating* request's context, since session listeners bind once at connect; notification is now owned solely by the stream-level terminals. Handle-mode error deliveries never reached the app's `onComplete` listener, because both facades dereferenced `data.status` on a single-argument error emit and crashed into a 500 that misattributed the failure to the app callback; the listener is now invoked with the error, and owns the outcome as the callback form does. And HTTP/2 callback mode never delivered a non-5xx error status at all, so graceful degradation was impossible for something as ordinary as a 404 from an HTTP/2 upstream and the documented promisify idiom never settled on one — every body-announced non-2xx now reaches the callback on both transports. `self.query()`'s JSDoc no longer claims the no-callback form returns a Promise: it returns a handle exposing `.onComplete(cb)`, which is not a thenable, so `await self.query({...})` resolved immediately with the handle and silently dropped the result — the real contract and the supported `await` idiom are documented with their rejection shapes, each verified against the runtime. A crash during bundle bootstrap now aborts loudly instead of hanging silently — the async boot frame turned a synchronous throw into a rejection logged at error level with no emergency marker and no exit, so `gina bundle:start` sat on its startup timer and reported a timeout with no cause attached. GET and HEAD query parameters keep their backslash-escaped characters: the pipeline stripped every backslash from the whole serialized document, so a newline degraded to the letter `n`, a backslash vanished, and a double quote or JSON-array value produced invalid JSON that silently dropped every parameter on the request. And `gina secrets:check` now agrees with the boot — its hand-kept mirror of the `settings.secrets.file` declaration guards had drifted permissively twice, reporting green on configurations the bundle refuses to start on, and the command now exits non-zero when a declaration is itself invalid or unreachable rather than only when a required key is unset. **Changed**: the config-source walk behind `secrets:scan` and `secrets:check` now lives in `lib.secrets`, so the two commands enumerate the same config sources by construction and cannot drift apart; CLI behaviour and report output are unchanged. Pickup: restart your bundles — no rebuild needed, the browser bundle's executable content is byte-identical to `0.6.13`. |
 | **Q4 2026** | `0.6.15` ✅ | **Fixed**: client-side handler release now awaits the routing table — the table arrives only by async fetch (the page deliberately whispers an empty stub rather than inlining it) yet `gina.ready` handlers and the auto-boot validator released at `DOMContentLoaded`, so anything calling `getRoute()`/`toUrl()` during handler or form-bind initialisation ran against an empty table; loopback wins that race by single-digit milliseconds, which is why development and the local suites never see it, while a real deployment loses it by 150ms or more on every load, deterministically — a validator form rule naming a route then threw inside the init listener, the event dispatch swallowed the throw, and the instance's `ready` never fired, silently. All three release paths now gate on the dependency settling (the ready-list scheduler, the validator auto-boot poll, and the late-registration path that previously bypassed the scheduler entirely and fired immediately), settled deliberately meaning loaded **or** failed so a broken endpoint still releases handlers rather than hanging the page, with a parse-time 5-second fallback force-settling in degenerate shapes where no fetch is ever issued (ACTION REQUIRED only in the sense of timing: on deployed tiers handlers now fire 150ms–1.3s later than before, when routing is actually available). Alongside it, client `getRoute()` no longer crashes with a context-free TypeError when a bundle's routing table is absent — the client `getRouting()` returns null by design, and the bare dereference of that null sat one line above the very diagnostic built for the degraded-table case, so the case it existed for was exactly the one it could never report — and a failed routing fetch now leaves console evidence instead of booting the framework permanently degraded in silence. The couchbase connector no longer hangs a request when a `@return {number}` COUNT query does not match its alias parser: the branch dereferenced an unguarded regex match, so `SELECT COUNT(DISTINCT a.b) AS n` and an unaliased `SELECT COUNT(*)` both threw inside the connector's own result callback — no 5xx was ever produced, a promisified caller never settled, and the request hung until the client or proxy timed out, a stall then retried behind an HTTP/2 inter-bundle client; it was dev-invisible too, since the dev path strips only the first comment block, so a commented-out parsable COUNT elsewhere in the file kept the regex satisfied locally while production threw on the identical file. The branch now derives the count from the first projected column with no regex at all, guarded against empty result sets, empty rows and null payloads, exactly as mysql, postgresql, scylladb and sqlite already did (ACTION REQUIRED if a multi-column projection puts its COUNT anywhere but first: the returned value is now the first column rather than the aliased one, consistent with every other connector). The same connector now trims and lowercases the types it reads from `@return` and `@param`, and bounds both captures to the first brace pair — the extracted types feed exact-match comparisons whose arms are all lowercase, so `{Number}` or `{ number }` matched nothing and was silently skipped, handing back the raw row array instead of the declared shape and leaving the parameter uncast, while a second brace pair on the same line bled into the greedy capture (ACTION REQUIRED: annotations that previously fell through silently now reach their branch, so a query declaring `@return {Number}` begins returning the declared shape; `@options` deliberately keeps its greedy capture, holding a nestable object literal rather than a single type token). Two client plugins stop leaking behaviour onto pages that never asked for it: the public link API throws a named error identifying the url and the likely cause instead of a bare TypeError, and detects the miss before the supersede step so a mistyped url no longer aborts a legitimate request still in flight; and the popin stylesheet's `::backdrop` rule is scoped to gina's own popin dialogs rather than every `<dialog>` on the page (ACTION REQUIRED if a page relied on the unscoped rule to style its own dialogs, or supplies a popin dialog element from its own markup — that element needs the `gina-popin-container` class to keep gina's backdrop). **Changed**: a changelog fragment whose filename names a tracker id must now cite that id in its body, since only the body renders into `CHANGELOG.md` and the published tarball — an id carried by filename and commit message alone ships an unnumbered entry and anyone triaging by id gets a false zero (roughly 60 of 937 historical fragments shipped that way); recognised id families are an explicit allowlist rather than a generic pattern, because the generic form false-positives on real filenames and a false positive would block a commit. Pickup: restart **and** rebuild your bundles (the browser bundle changed — both `gina.min.js` and `gina.min.css` differ from `0.6.14`). |
 | **Q4 2026** | `0.6.16` ✅ | **Security**: concurrent uploads of the same filename no longer corrupt one another — the multipart parser wrote every incoming file to `<upload dir>/<the filename the client sent>` with nothing in the path distinguishing one part or one request from another, so two uploads sharing a filename opened two write streams on a single path and interleaved their bytes into one hybrid matching neither upload, while the framework reported success to both callers; measured on a live bundle before the fix, twelve concurrent uploads of one filename left ONE corrupted file where twelve intact ones were sent, and a single request carrying two same-named parts produced one file mixing both. The parse runs before routing and before any middleware, so reaching it needed neither authentication nor a valid route — a POST to an unknown url answers 404 to the client and still writes the file to disk — and no application configuration could avoid it; uploads now stage under a server-generated random name, 32 hex characters plus a `.part` suffix, as multer and formidable have always done, which also keeps client-controlled bytes off the filesystem and cannot overflow the operating system filename limit (ACTION REQUIRED only where your own code derives a display name or a public URL from the basename of `req.files[].path`: read `req.files[].originalFilename` instead, which is unchanged and is still the name `self.store()` publishes the file under). **Fixed**: the documented fluent `store(target).onComplete(cb)` form works again — `store()` was accidentally declared `async`, so the deliberate `{ onComplete }` facade came back wrapped in a Promise carrying no `onComplete`, leaving the upload guide's first worked example dead code on every stable from `0.6.0` through `0.6.15`; the body contains no `await` and nothing anywhere awaits the call, so dropping the keyword changed no behaviour, the facade returns synchronously as documented, the three-argument callback form is byte-unchanged, and the TypeScript declaration now describes the fluent return shape instead of `Promise<void>`. The page whisper no longer exports the forms mocks group — the RFC5987-encoded `page.environment.forms` export shipped the entire bundle forms catalog into every page in every environment, mocks included, while the routing exports one line above it were deliberately stubbed to `{}` for page weight; mocks are now excluded in every environment rather than outside development only, deliberately, since an env-divergent `gina.forms` shape is the works-in-dev-fails-in-prod class, and rules, custom validators and every server-side surface keep the complete catalog (ACTION REQUIRED only for client code that read `gina.forms.mocks`, which the framework's own client bundle never consumed). And the link API names its error when the anchor has left the DOM: there is no deregistration path, so a registration outlives its element and a page that re-renders its anchors after binding dereferenced the null lookup and threw a bare TypeError — it now throws a named error identifying the link id, the url and the cause, detected beside the unregistered-url guard before the supersede step so it no longer aborts a request already in flight nor invalidates that request's response handling. Pickup: restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.15`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
+| **Q4 2026** | `0.6.17` ✅ | **Fixed**: a route whose URL structurally matches but whose `requirements` reject the request no longer drops the connection once the route cache is warm — the cache is keyed on method and pathname with the query string stripped before dispatch, so every query variant of one pathname shares a single entry, and the warm path re-evaluated the requirements on each hit and then discarded the verdict, force-matching a request that had just been rejected and dispatching it with no routing description, which closed the connection with no HTTP response at all — no status and no body; the warm path now honours the verdict, treating a rejecting or throwing evaluation as a cache miss that falls through to the routing scan and answers correctly (404 when nothing matches, the sibling rule when one does, or a 500 naming the rule when a `validator::` requirement throws, which was previously also a dropped connection), while the cache entry is kept so the variants the requirements accept stay warm. **Fixed**: the `toFloat`, `set` and `format` validator rules are context-safe — all three are documented rules that threw on every server-side call, with `toFloat` opening by reading the live DOM element unguarded so server-side rule sets could not coerce a float at all (it now reads the live value only when one is reachable and otherwise uses the submitted value, which on the server is the raw value, and a missing comma in the same statement that leaked `isFloatingWithCommas` as an implicit global into every page is fixed with it), `set` now assigning the field value in both contexts while reflecting it onto the DOM element only in the browser where an element exists, and `format` — which already worked in both contexts when chained after `isDate`, as its documentation shows — now reporting a non-`Date` value as a named rule-authoring error pointing at the missing `isDate` instead of the opaque `val.format is not a function`. **Fixed**: a bundle declaring a redirect route no longer floods its log with `source[host] is undefined` warnings — redirect rules are deliberately excluded from the per-rule host and hostname defaulting so those keys are absent on them, but the per-request routing copy assigned them unconditionally, creating properties holding `undefined` on a clone kept for the lifetime of the process, so every later no-arg `getConfig()` emitted one `host` and one `hostname` warning per redirect rule indefinitely, measured by a consumer at roughly three quarters of that log line's total volume and drowning the genuine warnings it exists to surface; the copy is now existence-guarded, so an absent key stays absent and rules that do carry a host are copied exactly as before, which removes log noise rather than a functional defect, and only template and view routes reach it so API-only bundles were never affected. Pickup: restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.16`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |

package/framework/v0.6.17/VERSION

@@ -0,0 +1 @@
+0.6.17

package/framework/{v0.6.16 → v0.6.17}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -4303,10 +4303,29 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             return self[this.name]
         }
 
+        /**
+         * Set the field value — downstream rules and the validated payload both
+         * consume it — and reflect it onto the live element when one exists.
+         *
+         * Context-safe (#B398): the DOM reflection is browser-only. `target` is
+         * null server-side by construction, where the value assignment alone is
+         * the whole effect; pre-fix, the unguarded `setAttribute` made every
+         * server-side call throw.
+         *
+         * @param {string|number|boolean} value - value to assign
+         *
+         * @returns {object} field object (chainable)
+         *
+         * @example
+         *     // rule file
+         *     "status": { "set": "pending" }
+         * */
         self[el]['set'] = function(value) {
             this.value  = local['data'][this.name] = value;
-            //  html
-            this.target.setAttribute('value', value);
+            //  html reflection (browser only) — #B398: `target` is null server-side
+            if ( isGFFCtx && this.target ) {
+                this.target.setAttribute('value', value);
+            }
             // Todo : select and radio case to apply change
 
             return self[this.name]
@@ -4680,12 +4699,47 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         }
 
 
+        /**
+         * Coerce the field value to a float (`decimals` places, default 2),
+         * normalizing spaces and thousand/decimal separators (`,` vs `.`).
+         *
+         * Context-safe (#B398): in the browser the live DOM value is preferred
+         * when one is reachable — the rendered input may carry a display-filtered
+         * value (swig::formatNumber()) that differs from the snapshot. Server-side
+         * — and whenever no live element is reachable (null `target`, detached
+         * node) — the submitted `this.value` IS the raw value and is used
+         * directly. Pre-fix, an unguarded `document` read here made every
+         * server-side call throw, valid inputs included; the same statement was
+         * missing a comma, leaking `isFloatingWithCommas` as an implicit global.
+         *
+         * @param {number} [decimals=2] - decimal places kept on the coerced value
+         *
+         * @returns {object} field object (chainable)
+         *
+         * @example
+         *     // rule file
+         *     "price": { "toFloat": 2, "isFloat": true }
+         * */
         self[el]['toFloat'] = function(decimals) {
             // Fixed on 2025-03-12
-            // In case we are dealing with a filtered value (swig::formatNumber())
-            var val                     = document.getElementById(this.target.getAttribute('id')).value || this.value
-                isFloatingWithCommas    = false
+            // In case we are dealing with a filtered value (swig::formatNumber()),
+            // prefer the live DOM value when one is reachable. #B398 — guarded:
+            // `target` is null server-side (see the field construction) and
+            // `document` only exists in a browser(-like) context.
+            // was: var val = document.getElementById(this.target.getAttribute('id')).value || this.value
+            //          isFloatingWithCommas = false  // <- missing comma: implicit global
+            var $liveElement            = null
+                , val                   = null
+                , isFloatingWithCommas  = false
             ;
+            if (
+                this.target
+                && typeof(document) !== 'undefined' && document
+                && typeof(document.getElementById) === 'function'
+            ) {
+                $liveElement = document.getElementById(this.target.getAttribute('id'));
+            }
+            val = ( $liveElement && typeof($liveElement.value) != 'undefined' ) ? ($liveElement.value || this.value) : this.value;
             if ( typeof(val) == 'string' ) {
                 val = val.replace(/\s+/g, '');
                 // Fixed on 2025-03-12
@@ -5181,19 +5235,34 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         }
 
         /**
-         * Formating date using DateFormatHelper
+         * Formating date using DateFormatHelper.
          * Check out documentation in the helper source: `lib/helpers/dateFormat.js`
-         * e.g.:
+         *
+         * Designed to follow `isDate`, which leaves the parsed `Date` on the
+         * field's `.value`. Works in BOTH contexts — `Date.prototype.format` is
+         * installed server-side too (helpers/prototypes). Returns the formatted
+         * STRING by design: terminal, do not chain another rule after it.
+         *
+         * #B398: a non-`Date` value here means `isDate` was not applied first —
+         * a rule-authoring error, reported as a named throw instead of the
+         * opaque `val.format is not a function`.
+         *
+         * @param {string} mask - DateFormatHelper mask (e.g. `isoDateTime`)
+         * @param {boolean} [utc] - render in UTC
+         *
+         * @returns {string} formatted date (terminal — not chainable)
+         *
+         * @example
          *      d.start
          *        .isDate('dd/mm/yyyy')
          *        .format('isoDateTime');
-         *
-         *
          * */
         self[el]['format'] = function(mask, utc) {
             var val = this.value;
             if (!val) return self[this.name];
-
+            if ( typeof(val.format) !== 'function' ) {
+                throw new Error('[FormValidator::format] field `'+ this.name +'`: value is not a Date - apply isDate(mask) before format(mask)');
+            }
             return val.format(mask, utc)
         };