gina 0.6.2-alpha.1 → 0.6.2

package/CHANGELOG.md

@@ -6,6 +6,17 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.2 - 2026-08-01
+### Added
+* Opt-in 503 + Retry-After rendering for transient datastore failures (connector error classification, slice 2): with `server.transientErrors.enabled: true` in a bundle's settings, a connector error stamped `isTransient` that would render as HTTP 500 through `throwError` renders as 503 with a `Retry-After` header (`server.transientErrors.retryAfter`, integer seconds 1..86400, default 30) and the user-facing `error` field replaced by `server.transientErrors.message` (default: the standard 503 status text) — on both engines, JSON and HTML error surfaces alike. Explicit non-500 statuses and permanent errors are never upgraded, and the default (opt-out) behaviour is byte-identical to before. A malformed `server.transientErrors` block warns at boot and leaves the feature off — it never refuses a boot.
+### Changed
+* Render and request-path CPU overhead is sharply reduced: the per-render deep copies of the request options (template-filter configuration and render envelope) are replaced by reference passing after their write surfaces were measured empty, the per-request locale lookups are memoized with the request-local copy materialized lazily on first read, and the id generator sizes its entropy batch to the requested length (one webcrypto call per 16-char id instead of three). Measured on the profiling harness: 4.4x render throughput on the baseline workload (10.7 to 2.4 ms per render), deep-clone CPU share 50.31% to 1.81%, GC time down ~18x. No API change; the browser bundle changed, so bundles pick the id-generator half up on rebuild.
+### Fixed
+* Dead process records are now removed from the `~/.gina/procs.json` registry under the right key. `removeRunningProc()` matched the entry to drop by pid but deleted under the constructing bundle key: self-removal worked by accident, while a non-coinciding dismissal rewrote the dead `gina-*` record back to disk — accumulating stale entries, a documented cause of daemon/boot confusion — and could destroy a live record instead (degrading `gina stop`, whose graceful-kill path locates the daemon through this registry). Pre-existing stale entries are not retroactively cleaned; with the daemon stopped, clearing the file once is safe.
+* A bundle whose project `env.json` carries no configuration block for the environment it starts in now refuses to boot with a message naming the bundle, the environment, the resolved `env.json` path, and whether the file was found at all — instead of dying with an opaque `Cannot read properties of undefined` crash that named none of them. Covers all three shapes that produced the same failure: an `env.json` that is absent entirely, one that is empty, and one that declares only bundles the project manifest does not list. The refusal exits 1 through the same path as the missing `routing.json` refusal, so an external supervisor can retry while a release tree settles. A configuration that boots today is unaffected: the check can only fire where the boot already crashed.
+* A project `env.json` block that did not itself declare `host` left the `${host}` token unsubstituted inside the TLS credentials paths, so an https or HTTP/2 bundle refused to start with an ENOENT naming a literal `${host}` path segment and an error pointing at the server settings rather than at the missing key. `host` was the only value the per-bundle configuration reads that had no framework-side default: it was written solely by the CLI into the project `env.json`, so a hand-written or partial block never received one. The framework env template now carries the same `localhost` default the CLI already writes, so a block that sets only a subset of keys resolves correctly, and a bundle whose project `env.json` omits `host` logs a warning naming the bundle and env instead of defaulting silently. Projects that declare `host` are unaffected.
+* Starting a bundle in an environment its project `env.json` block does not cover now refuses cleanly (exit 1), naming the bundle, the environment and the resolved `env.json` path. It previously died with an opaque `TypeError: Cannot set properties of undefined (setting 'bundlesPath')` at exit 143, which named neither the file nor the bundle. A bundle that is declared for other environments but not the one being started is now also reported as skipped, instead of disappearing from the boot with nothing explaining why.
+
 ## 0.6.1 - 2026-07-31
 ### Added
 * SQLite support under the Bun runtime — the sqlite ORM connector, session store, async-job store and the framework state store now resolve the Bun built-in `bun:sqlite` behind a `node:sqlite`-shaped adapter when `node:sqlite` is absent (Bun does not implement it; previously the connector and both stores failed at boot under Bun, and the state store silently fell back to JSON). Node resolution is unchanged (`node:sqlite` is still tried first), and transient/permanent connector-error classification reads both drivers identically.

package/README.md

@@ -60,33 +60,23 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.1
-
-> **Three behaviour changes to check before upgrading.** None refuses a boot,
-> but each changes how an untouched bundle behaves. A JSON error payload rendered
-> on a genuine HTTP/2 stream now carries its real status code instead of always
-> being served as HTTP 200 — review any client that keyed off the old 200. A form
-> declaring `data-gina-form-live-check-enabled="false"` now genuinely loses
-> live-check everywhere, where two gates previously kept running. And an app that
-> translated only the error keys it can observe will see those messages switch
-> from English to its own language. See the
-> [migration guide](https://gina.io/docs/migration) for each.
-
-> **No settings reset.** `0.6.1` is a patch — the `shortVersion` stays `0.6`, so
-> your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
+## What's in 0.6.2
+
+> **Re-bake your bundles, not just restart them.** The browser bundle changed in
+> this release, so a restart alone picks up only the server-side half of the
+> render optimisation. Rebuild each bundle (`gina bundle:build`) to pick up the
+> client-side half as well. Nothing breaks if you only restart — you just leave
+> part of the speedup on the table.
 
-- **Security — the dev-mode Inspector no longer serves files outside its asset root.** A request to `/_gina/inspector/*` carrying a literal `../` escaped the Inspector's asset directory and read any file the bundle process could reach — application config and credentials included. The path helper the handler used *normalizes* `../` rather than rejecting it, so the traversal resolved rather than failing, and both engines were affected. Only bundles running in **dev mode** were ever exposed: production bundles do not serve this handler, and the URL-encoded `%2e%2e` form was never affected because the handler does not decode. A browser could not trigger it — browsers normalize `../` before the request is sent — but any raw HTTP client could. The resolved path is now confined to the Inspector asset root, and anything resolving outside it falls through to the same 404 as a missing file, matching the existing static-resolver guard. Nothing to do beyond upgrading. Worth reviewing while you are here: this endpoint carries no IP allowlist, unlike `/_gina/info` and `/_gina/cache/*`, and a dev bundle binds all interfaces by default — restricting dev hosts at the network layer is still worthwhile. Server-side — restart your bundles. (#B179)
-- **Added — DuckDB connector.** Embedded **analytical** (columnar / OLAP) SQL over the standard entity wiring — the analytics-side sibling of the SQLite connector's embedded OLTP role. A `"connector": "duckdb"` entry opens a file-backed or `":memory:"` database (`file` is optional and defaults to `~/.gina/{version}/{database}.duckdb`), and entity methods load from `models/<database>/sql/` with the same `@param` casting and `@return` shaping as MySQL and PostgreSQL. Row-returning detection covers the analytical dialect — `WITH` CTEs, `FROM`-first, `SUMMARIZE`, `PIVOT`/`UNPIVOT`, `DESCRIBE`, `SHOW` — so CTE-heavy queries return rows instead of being routed to the write path, and Parquet / CSV / JSON files can be queried directly with no ETL hop. Large numeric types (BIGINT / HUGEINT / DECIMAL) and dates arrive as JSON-safe strings; writes report `{ changes }`. `readOnly: true` opens the database read-only so any number of processes can share one file. The `@duckdb/node-api` driver installs in your project, and the `connector:*` CLI group plus the connectors.json schema recognise the new type. Additive — nothing to change. Server-side — restart your bundles. (#CN11)
-- **Added — SQLite works under the Bun runtime.** The SQLite ORM connector, the SQLite session store, the async-job store and the framework state store now resolve Bun's built-in `bun:sqlite` behind a `node:sqlite`-shaped adapter whenever `node:sqlite` is absent. Bun does not implement `node:sqlite`, so all four previously failed at boot under Bun — and the state store silently fell back to its JSON path. Nothing to install and no configuration change; transient/permanent connector-error classification reads both drivers identically. On Node.js nothing changes, since `node:sqlite` is still tried first. MongoDB remains unavailable under Bun — its `bson` dependency calls a `node:v8` API Bun does not implement, an upstream limitation with no framework-side fix.
-- **Fixed — Bun: a bundle declaring any connector boots again.** Two Bun-only crashes stopped model loading outright. `new require(mod)(args)` parses as `(new require(mod))(args)`, and Bun's `require` has no constructor slot, so loading aborted with `function is not a constructor`; and the entity loader reassigned `arguments`, which Bun's parser rejects with `Invalid assignment target`. Both repairs are no-ops on Node by construction — the plain call is exactly what Node was already doing — so only Bun behaviour changes. The release smoke now boots a SQLite-backed bundle and round-trips a real query on every Node leg and on the Bun CI leg, so connector support is gated rather than assumed.
-- **Fixed — reserved-name query files now warn instead of vanishing silently.** A query file whose name collides with an inherited prototype member — most commonly `count.sql`, shadowed by the framework's global `count()` helper — was silently skipped by the MySQL, PostgreSQL, SQLite, DuckDB, ScyllaDB and MongoDB connectors, and calls fell through to the inherited member, returning a plausible but unrelated value. The skip is now reported at startup with the file path and a rename hint (for example `countRows.sql`). Behaviour is unchanged — the file is still skipped — and a file matching a method your entity class itself defines still skips silently, by design: your code wins. A warning appearing on upgrade points at a query file that has never worked. Server-side — restart your bundles. (#B173)
-- **Fixed — Couchbase warns when a query file overwrites or shadows an entity member.** The Couchbase connector attaches every N1QL query file unconditionally, so a file named after an existing member — a stamped entity property like `getCluster`, a previously attached query method, or an inherited member such as EventEmitter's `on` — silently overwrote or shadowed it. The clobber is now reported at startup with the file path and a rename hint (for example `onRows.sql`); shadowing the framework's global `count()`/`functionCount()` helpers stays silent, by design, since there the query file winning is the point. Attachment behaviour is unchanged — the warning never skips the file. Server-side — restart your bundles. (#B174)
-- **Fixed — `renderJSON()`'s `status` key reaches the wire over HTTP/2.** The body path built its header frame with a hardcoded `:status: 200`, so every JSON error rendered on a genuine HTTP/2 stream was served as HTTP 200 with the error payload in the body; HTTP/1.1 was unaffected, and the HEAD branch and the HTML delegates already honoured the resolved code. The `errno` half of the status branch is also guarded like its swig and v1 siblings: an `errno`-only payload with no usable `status` used to poison the status code — the response was silently never sent on HTTP/1.1 and turned into a 500 on HTTP/2 — and is now served as a normal 200 with the payload in the body. **Review any HTTP/2 client that keyed off the old 200.** Server-side — restart your bundles. (#B172)
-- **Fixed — a form submit no longer strands a sibling form's submit button.** FormValidator reused one shared `XMLHttpRequest` for every submit, and re-opening it replayed the previous submit's completion handler — visibly, submitting form B after form A had completed re-disabled A's submit button and re-stamped its `data-gina-form-loading`, with nothing ever releasing them (the lock was armed in four places and released in one). Every send now builds its own XHR, and a `loadend` listener releases the submit trigger and the loading flag on success, error, timeout and abort alike. Along the way `$form.isSending` now genuinely spans the request, where it used to be cleared almost immediately at the first readyState transition, and a timed-out form has its `data-gina-form-loading` removed instead of being left holding the truthy string `"false"`. Browser-bundled — re-bake your bundles. (#B175)
-- **Fixed — the live-check opt-out is honored consistently.** A form declaring `data-gina-form-live-check-enabled="false"` with resolvable rules was only partly opted out: two validation gates evaluated the rules-count boolean inside the regex test, so the truthy string `"false"` short-circuited to that boolean and matched — leaving bind-time silent validation and select-change validation running. Text as-you-type was never affected, since the listener-registration gates already tested the attribute alone, so the pre-fix behaviour was an inconsistent middle rather than the attribute being ignored outright. The two gates now test the attribute alone and check the rules count separately, so an explicit `"false"` is honored everywhere — which is what the framework's own warnings have been advising all along. **An opted-out form genuinely loses those two checks now**; drop the attribute if you were relying on them. Browser-bundled — re-bake your bundles. (#B176)
-- **Fixed — validator error labels: translating the key an app can observe now works.** Four rule families consult a different label key internally than the one an app sees in a field's `errors` object, so translating the observable key had no effect: the float coercion's NaN branch (`toFloat` fills `toFloatNAN`) and the number, integer and string length families (the generic `is<X>Length` fills the `Min`/`Max` variants). An app-supplied specific key still wins. Numbered `is` aliases (`is1`, `is2`, …) with no rule-supplied text now fall back to the shared `is` label instead of rendering an empty message, and catalog or `setErrorLabels()` translations for user-defined validator keys are no longer clobbered by the English default at setup. **An app that translated only observable keys will see those messages switch from English to its own language at pickup.** Browser-bundled — re-bake your bundles. (#B178)
-- **Fixed — duplicate error messages and run-on screen-reader announcements.** Screen-reader announcements now join multiple rule messages with a sentence separator instead of running them together as one string — the visible stacked layout is unchanged — and two rules carrying byte-identical resolved message text render once instead of twice, so a coercion paired with its validator no longer shows the same sentence duplicated. The dev inspector still records every error key. Browser-bundled — re-bake your bundles. (#B178)
+> **No settings reset.** `0.6.2` is a patch — the `shortVersion` stays `0.6`, so
+> your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
+- **Changed — render and request-path CPU overhead is sharply reduced: 4.4× render throughput.** Every render was deep-copying the request options twice — once for the template-filter configuration and once for the render envelope — and re-resolving the request locale from scratch. The copies are now passed by reference, after each one's write surface was measured empty; the locale lookups are memoized per culture with the request-local copy materialized lazily on first read; and the id generator sizes its entropy batch to the length actually requested, so a 16-character id costs one webcrypto call instead of three. Measured on the profiling harness introduced in this release: **10.7 ms → 2.4 ms per render** on the baseline workload, deep-clone CPU share **50.31% → 1.81%**, and GC time down roughly **18×** — the stated ~2× ceiling was beaten because the GC and locality knock-on fell along with the allocations. No API change. Server-side gains land on restart; the id-generator half is browser-bundled, so **re-bake your bundles** for the rest. (#P39)
+- **Added — opt-in 503 + `Retry-After` for transient datastore failures.** Set `server.transientErrors.enabled: true` in a bundle's `settings.json` and a connector error stamped `isTransient` that would have rendered as HTTP 500 through `throwError` renders as **503** with a `Retry-After` header instead — so a caller or proxy can back off and retry rather than treating a momentary datastore blip as a permanent server fault. `retryAfter` sets the header's value (integer seconds, 1–86400, default 30) and `message` replaces the user-facing `error` field (default: the standard 503 status text). Applies on both engines, across JSON and HTML error surfaces, over HTTP/1.1 and HTTP/2 alike. Explicit non-500 statuses and permanent errors are never upgraded. **Nothing to do** — the feature is off by default and the default behaviour is byte-identical to 0.6.1. A malformed `server.transientErrors` block warns at boot and leaves the feature off; it never refuses a boot. Server-side — restart your bundles. (#CE1)
+- **Fixed — an `env.json` block that omits `host` no longer breaks HTTPS and HTTP/2 bundles.** `host` was the only value the per-bundle configuration reads that had no framework-side default — it was written solely by the CLI into the project `env.json`, so a hand-written or partial block never received one. The `${host}` token was then left unsubstituted inside the TLS credentials paths, and the bundle refused to start with an ENOENT naming a literal `${host}` path segment, under an error message pointing at the server settings rather than at the missing key. The framework env template now carries the same `localhost` default the CLI already writes, so a block setting only a subset of keys resolves correctly, and a bundle whose `env.json` omits `host` logs a warning naming the bundle and env instead of defaulting silently. Projects that declare `host` are unaffected. Server-side — restart your bundles. (#B181)
+- **Fixed — a bundle whose `env.json` has no block for the environment it starts in now says so.** It previously died with an opaque `Cannot read properties of undefined` crash that named neither the bundle, the environment, nor the file. The boot now refuses with all of them, plus the resolved `env.json` path and whether the file was found at all. All three shapes that produced the same failure are covered: an `env.json` that is absent entirely, one that is empty, and one that declares only bundles the project manifest does not list. The refusal exits **1** through the same path as the missing `routing.json` refusal, so an external supervisor can retry while a release tree settles. A configuration that boots today is unaffected — the check can only fire where the boot already crashed. Server-side — restart your bundles. (#B181)
+- **Fixed — starting a bundle in an environment its `env.json` block does not cover refuses cleanly.** This previously surfaced as `TypeError: Cannot set properties of undefined (setting 'bundlesPath')` at **exit 143**, naming neither the file nor the bundle; it now exits **1** naming the bundle, the environment and the resolved `env.json` path. Separately, a bundle that *is* declared for other environments but not the one being started is now reported as skipped and the project boots on — where previously it took every sibling bundle down with it. If a supervisor or orchestrator keys off the old 143, note the code change. Server-side — restart your bundles. (#B183)
+- **Fixed — dead process records are removed from the `~/.gina/procs.json` registry under the right key.** `removeRunningProc()` located the entry to drop by pid but deleted under the constructing bundle's key: self-removal worked by accident, while a non-coinciding dismissal rewrote the dead `gina-*` record straight back to disk — accumulating stale entries, a documented cause of daemon and boot confusion — and could destroy a live record instead, degrading `gina stop`, whose graceful-kill path locates the daemon through this registry. Pre-existing stale entries are not cleaned retroactively; with the daemon stopped, clearing the file once is safe. Server-side — restart your bundles. (#B180)
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 
 ## Documentation

package/ROADMAP.md

@@ -53,8 +53,9 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.26` ✅ | **Security**: a route pairing an authorization key (`param.requireAuth` / `param.roles` / `param.policy`) with `cache` now refuses to boot — both render-cache serve points run BEFORE the authorization gate and the cache key carries no user identity, so the first authenticated response was replayed verbatim to every later anonymous caller; as a second layer the render delegates never store a body for a gated route even if the configuration bypassed the lint (#B158) · a `method: "ws"` route declaring an authorization key now refuses to boot — a WebSocket handshake is answered by the engine's extended-CONNECT handler and never reaches the gate, so those keys could never be enforced while the boot line still counted the route as protected; authenticate inside the `wsHandler`, which receives the full request (#B159) · the framework control-plane listeners now bind an explicit host defaulting to loopback — a new `bind_host` setting (env `GINA_BIND_HOST`, `gina framework:set --bind-host=`), separate from `host_v4`, so exposing the command socket and MQ listener beyond the local host is a deliberate opt-in · a command name arriving over the framework socket is constrained to the shipped `lib/cmd/` namespace before it resolves, and an unresolvable name is answered on the connection instead of ending the daemon for every other client · the MCP Streamable HTTP transport refuses to start without a bearer token once an ambient protection is removed (a non-loopback bind, or `allowedOrigins: ["*"]`), with a new `allowInsecure` waiver for deployments that restrict access upstream · **Added**: deny-by-default authorization — `settings.json > auth.requireAuthByDefault: true` requires an authenticated session on every route unless its `param` block carries `"public": true`; opt-in, strictly boolean, keyed per bundle so one bundle never changes a sibling's posture in merged mode, with the framework-injected routes shipping exempt and boot refusals for the login-route lockout, the `public`-plus-explicit-key contradiction, and a mode-gated route that also declares `cache`; `bundle:openapi` follows the mode (#COMPLY10) · a boot-time production transport posture guard — a cleartext scheme outside the `local` scope warns once at boot, `server.requireHttps` refuses to start instead (pre-listen, so the port is never reachable), and `server.allowInsecure` acknowledges that TLS terminates upstream (#COMPLY9) · **Fixed**: Couchbase client-side query timeouts classify as transient and keep their message — the connector rebuilt the error from the query `cause` envelope the SDK attaches to every query error, so a client-side timeout became an empty-message `Error` that had lost the typed class name the classifier matches on (#B153) · `gina bundle:mcp-start --transport=http` now actually applies `GINA_MCP_AUTH_TOKEN` — the resolver read `process.env` directly while the CLI had already moved every `GINA_*` variable into the framework environment, so a deployment supplying the token only that way ran with no authentication · a `.sql` `@options` annotation that silently did nothing now warns, naming the ignored keys and showing the working form (#B155) · the `settings.json` and `routing.json` schemas now describe the route-authorization vocabulary, so an editor no longer flags a valid deny-by-default configuration as invalid · `lib/merge`'s JSDoc no longer documents an inverted `override` default |
 | **Q4 2026** | `0.6.0` ✅ | **Security**: `req.logout()` now destroys the persisted session record instead of only clearing `req.session.user` — the store record, the session id and every other session key previously survived to TTL, so a leaked or intercepted session id stayed valid server-side long after the user logged out; it now accepts an optional callback, and Passport bundles are unaffected · **Added**: an opt-in tamper-evidence hash chain for the audit trail — `audit.chain` plus a signing key gives every record an HMAC that chains from its predecessor, and the new offline `gina audit:verify <bundle> @<project>` walks the trail and reports either the intact totals or the first break, so any post-hoc edit, deletion, insertion or reordering by someone who does not hold the key is detectable; the boot refuses the deployment shapes a single linear chain cannot hold rather than starting a chain that cannot be trusted (#COMPLY2) · `lib.authn` — the authentication primitives that are dangerous to hand-roll: scrypt password hashing encoded as self-describing PHC strings so the cost can be raised without a flag day, with argon2 and bcrypt verify-only routing through the project's own package so a store arriving with existing credentials keeps working and migrates itself on the next successful login, a `dummyVerify` that closes the user-enumeration oracle, NIST SP 800-63B password policy, a PCI-DSS v4.0.1 §8.3.4 account-lockout engine, and RFC 6238 TOTP; gina still owns no user record, credential store or login route (#COMPLY3) · `req.login(user, done)` now works for gina-native bundles and rotates the session id before binding the user — the session-fixation defence; it previously threw without Passport, so native bundles bound the user by hand with no rotation at all (#COMPLY4) · an opt-in absolute session timeout — `session({ absoluteTimeout })` or `settings.json > session.absoluteTimeout` — caps an authenticated session's total lifetime measured from login regardless of activity, composing with the idle expiry that already existed (#COMPLY4) · **Fixed**: co-located CLIs reach the control plane again — 0.5.26's loopback bind default left CLI-side clients dialling `host_v4` while the daemon binds `bind_host`, so any deployment whose `host_v4` is a non-loopback address of the same machine could not reach its own daemon and `bundle:start` aborted before the HTTP server ever bound (#B160) · `gina framework:set --bind-host=` now persists across the settings regeneration that runs on every command and across container bootstraps (#B161) · session records in the redis, sqlite, mongodb and scylladb stores now honour the cookie `maxAge` when no `ttl` is configured, instead of an implicit one-day default that made the fallback unreachable — record lifetimes move in both directions relative to the old 24-hour cap (#B163) · the SQLite store no longer expires the very session it was asked to refresh, guarding a non-positive resolved ttl as its siblings already did (#B166) · the Couchbase store's `touch()` re-stamps `lastModified` on every extension — an internal idle check compared milliseconds against seconds — and the SDK 4 store writes it as an ISO 8601 UTC string, matching the other stores (#B165) · the Couchbase session store now requires the already-open bucket as `options.db` and fails fast with an actionable error instead of crashing at bundle init inside a dead SDK v2 self-connect path (#B167) · server-side `getRoute()` no longer crashes when a proxied context is active while no proxy hostname is resolvable — the route degrades to its direct hostname instead of throwing, so a render or readiness probe that resolves a route survives the state (#B168) · the `settings.json` schema now describes the `audit` and `session` blocks, and the `connectors.json` schema no longer labels the session-store `ttl` and `prefix` keys "Redis only" nor advertises a stale 86400 default — editor tooling only, runtime behaviour unchanged |
 | **Q4 2026** | `0.6.1` ✅ | **Security**: the dev-mode Inspector no longer serves files outside its asset root — a request to `/_gina/inspector/*` carrying a literal `../` escaped the asset directory and read any file the bundle process could reach, application config and credentials included, on both engines; only dev-mode bundles ever served the handler, and the URL-encoded `%2e%2e` form was never affected (#B179) · **Added**: DuckDB connector — embedded analytical (columnar / OLAP) SQL over the standard entity wiring, with analytical-dialect row detection (`WITH` CTEs, `SUMMARIZE`, `PIVOT`), direct Parquet / CSV / JSON querying with no ETL hop, and a `readOnly` mode so any number of processes can share one database file (#CN11) · **Added**: SQLite under the Bun runtime — the ORM connector, session store, async-job store and framework state store resolve Bun's built-in `bun:sqlite` behind a `node:sqlite`-shaped adapter whenever `node:sqlite` is absent; Node resolution is unchanged · **Fixed**: two Bun-only crashes that stopped any connector-declaring bundle from booting, both no-ops on Node by construction, with the release smoke now booting a SQLite-backed bundle on every Node leg and on Bun · **Fixed**: query files whose names collide with an inherited prototype member were silently skipped by six ORM connectors and now warn at startup with a rename hint, while Couchbase — which attaches unconditionally — warns on the overwrite or shadow instead (#B173/#B174) · **Fixed**: `renderJSON()`'s `status` key now reaches the wire over HTTP/2, where the body path hardcoded a 200 status frame and served every JSON error as HTTP 200 with the error payload in the body (#B172) · **Fixed**: FormValidator — each submit builds its own XHR with a fail-safe release, so a completed form no longer re-disables a sibling form's submit button; the live-check opt-out attribute is honored consistently; error labels for the keys an app can observe are translatable; and byte-identical messages render once, with sentence-separated screen-reader announcements (#B175/#B176/#B178) |
+| **Q4 2026** | `0.6.2` ✅ | **Changed**: render and request-path CPU overhead sharply reduced — the per-render deep copies of the request options (template-filter configuration and render envelope) are passed by reference after each one's write surface was measured empty, per-request locale lookups are memoized with the request-local copy materialized lazily on first read, and the id generator right-sizes its entropy batch to the requested length; measured on the profiling harness at **4.4× render throughput** (10.7 → 2.4 ms per render), deep-clone CPU share 50.31% → 1.81%, GC time down ~18× — no API change, but the browser bundle changed so bundles pick the id-generator half up on rebuild (#P39) · **Added**: opt-in 503 + `Retry-After` rendering for transient datastore failures — with `server.transientErrors.enabled`, a connector error stamped `isTransient` that would render as HTTP 500 through `throwError` renders as 503 carrying `Retry-After`, with a configurable retry delay and user-facing message, on both engines across JSON and HTML error surfaces; off by default and byte-identical when off, and a malformed block warns at boot rather than refusing it (#CE1) · **Fixed**: an `env.json` block that omits `host` no longer leaves the `${host}` token unsubstituted inside the TLS credentials paths, which refused https and HTTP/2 boots with an ENOENT naming a literal `${host}` segment under an error pointing at the server settings — `host` was the only per-bundle value with no framework-side default, so a hand-written or partial block never received one (#B181) · **Fixed**: a bundle whose project `env.json` carries no block for the environment it starts in now refuses with the bundle, the environment, the resolved path and whether the file was found all named — covering the absent, empty and unlisted-bundles shapes — instead of an opaque `Cannot read properties of undefined` crash, exiting 1 so an external supervisor can retry (#B181) · **Fixed**: starting a bundle in an environment its `env.json` block does not cover refuses cleanly at exit 1 rather than dying at exit 143 on `Cannot set properties of undefined (setting 'bundlesPath')`, and a bundle declared only for other environments is now reported as skipped instead of taking every sibling bundle down with it (#B183) · **Fixed**: dead process records are removed from the `~/.gina/procs.json` registry under the right key — `removeRunningProc()` matched the entry by pid but deleted under the constructing bundle key, rewriting dead records back to disk and able to destroy a live one, degrading `gina stop`'s graceful-kill path (#B180) |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
-| **2027** | `0.7.0` | Performance — runtime CPU profiling baseline · multipart & WebSocket hot-path acceleration · render/log hot-path cleanups (SIMD scanner deferred, measure-gated) |
+| **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |
 | **2027** | `0.9.0` | Financial-integration heavyweights — entity-layer datastore transaction seam · message-queue connector family (AMQP / Kafka / IBM MQ) |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
@@ -429,11 +430,12 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **Route radix trie — compile `routing.json` at startup** | `0.3.0-alpha.1` | 2026-04-01 | `lib/routing/src/radix.js` builds a segment-level trie once at startup. O(m) candidate lookup per request (m = segment count). `Set.has()` check skips non-candidates in the `for…in` loop. Internal change — no user-facing API change. |
 | ✅ | **Bun runtime support** | `0.5.5` | 2026-06-21 | Gina runs on the [Bun](https://bun.sh) runtime (Bun `>= 1.2`) as a supported, CI-gated target — `bun add -g gina` installs and boots end-to-end, validated by a blocking CI Bun smoke. Both investigated blockers cleared: dev-mode `require.cache` hot-reload and `node:http2` work under Bun (one upstream gap remains: RFC 8441 extended-CONNECT advertisement, affecting only opt-in WebSocket-over-HTTP/2). Gina self-bootstraps on first run; Node `>= 22 < 27` remains fully supported. |
 | ✅ | **V8 pointer compression support** | `0.2.0` | Q2 2026 | Node.js built with `--experimental-enable-pointer-compression` (e.g. [node-caged](https://github.com/platformatic/node-caged) or a custom build) delivers ~50% heap memory reduction across all pointer-heavy structures. Gina is pure JS — compatible out of the box. Adds: startup detection + `GINA_V8_POINTER_COMPRESSED` env var, Dockerfile guide with custom build recipe (full-icu + pointer compression), 4 GB ceiling documentation, N-API-only connector policy. |
-| 📋 | **Runtime CPU profiling baseline** | `0.7.x` | 2027 | Flame-graph profiles of representative bundles under load — render, concurrent-upload, and WebSocket arms — so every hot-path candidate below is convicted or acquitted by measurement before it is optimised. "No further acceleration needed" is a valid verdict. |
-| 📋 | **Multipart boundary-scan fast path** | `0.7.x` | 2027 | The multipart parser's boundary search is the one unbounded byte-by-byte JS loop on a request path. Delegating the in-chunk needle search to the runtime's native `Buffer.indexOf` (JS keeps only the chunk-boundary carry) relieves the event loop under large concurrent uploads. Wire and event contract unchanged; validated by differential tests against the current matcher. |
-| 📋 | **WebSocket unmask fast path** | `0.7.x` | 2027 | Every inbound client frame must be unmasked, and that XOR currently runs byte-by-byte in JS. Word-at-a-time unmasking in the built-in RFC 6455 codec, with the `ws` engine path picking up `bufferutil` acceleration where it is installed — optional only; the pure-JS behaviour remains the permanent fallback. |
-| 📋 | **Render & logging hot-path cleanups** | `0.7.x` | 2027 | Repair the per-render asset-scan memoization (the cache guard can never hit as written, so the full document is re-scanned every HTTP/2 render), precompile the logger's per-line token regexes, and consolidate whole-document render passes where the profiling baseline convicts them. |
-| ⏸ | **SIMD boundary scanner (Rust → WebAssembly)** | — | on demand | **Deferred — measure-gated.** Built only if the profiling baseline still convicts the multipart scan after the JS fast path lands. WebAssembly first: sandboxed, a single artifact for every platform including Bun, no process crash surface. Native N-API prebuilds — published as separate per-platform packages so the framework tarball never carries a compiled binary — only if WASM leaves measured headroom. No install scripts ever; the JS implementation remains the permanent fallback. *Interim:* the JS fast path above. |
+| ✅ | **Runtime CPU profiling baseline** | `0.6.2` | 2026-07-31 | Shipped — a three-arm baseline (HTTP/2 render, concurrent multipart upload, WebSocket echo) profiled a production-built bundle under load. Outcome: the multipart-scan, WebSocket-unmask, and render/log-cleanup candidates below all measured small under their own arms and moved to measure-gated deferral, while the dominant cost found is per-request deep-clone traffic — half of render-arm CPU — plus per-item random-id minting (~1 ms per render), now planned as its own row below. "No further acceleration needed" was an accepted verdict shape, and for the byte-loop candidates it is the verdict. |
+| ⏸ | **Multipart boundary-scan fast path** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07):** the boundary scan measured 7.2% of upload-arm CPU (0.73 ms per MB, ~47 µs per 64 KB chunk) with the event loop far from saturated — the loop-relief win does not materialize at these magnitudes. Re-armed by a profiled workload where the scan is a leading loop consumer. Original scope, unchanged when re-armed: the multipart parser's boundary search is the one unbounded byte-by-byte JS loop on a request path; delegating the in-chunk needle search to the runtime's native `Buffer.indexOf` (JS keeps only the chunk-boundary carry) relieves the event loop under large concurrent uploads; wire and event contract unchanged; validated by differential tests against the current matcher. |
+| ⏸ | **WebSocket unmask fast path** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07):** the built-in codec measured 8% of an echo arm deliberately isolated to maximize its visibility (~3.4 µs per 4 KB frame); real in-bundle traffic would only shrink that share. Re-armed by a WebSocket-heavy profile showing the codec as a leading consumer. Original scope, unchanged when re-armed: every inbound client frame must be unmasked, and that XOR currently runs byte-by-byte in JS; word-at-a-time unmasking in the built-in RFC 6455 codec, with the `ws` engine path picking up `bufferutil` acceleration where it is installed — optional only; the pure-JS behaviour remains the permanent fallback. |
+| ⏸ | **Render & logging hot-path cleanups** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07):** the asset-scan, logger-regex, and render-splice candidates each measured at or under about 1% of render CPU under the arm built for them (the broken asset-scan memo guard remains real, but as a correctness fix that can ride any future work on that surface). Re-armed if any of them turns leading in a future profile. Original scope, unchanged when re-armed: repair the per-render asset-scan memoization (the cache guard can never hit as written, so the full document is re-scanned every HTTP/2 render), precompile the logger's per-line token regexes, and consolidate whole-document render passes where a profile convicts them. |
+| ⏸ | **SIMD boundary scanner (Rust → WebAssembly)** | — | on demand | **Deferred — measure-gated, doubly dormant since the 2026-07 baseline.** Built only if a profile still convicts the multipart scan after the JS fast path lands — and the JS fast path is itself deferred-acquitted, so this trigger cannot fire today. WebAssembly first: sandboxed, a single artifact for every platform including Bun, no process crash surface. Native N-API prebuilds — published as separate per-platform packages so the framework tarball never carries a compiled binary — only if WASM leaves measured headroom. No install scripts ever; the JS implementation remains the permanent fallback. *Interim:* the JS fast path above. |
+| ✅ | **Render-path deep-clone & id-mint reduction** | `0.6.2` | 2026-08-01 | **Convicted by the profiling baseline, shipped ahead of schedule:** half of render-arm CPU was per-request deep-clone traffic, concentrated in three framework call sites (the template-filter configuration was re-cloned on every render; the render delegate cloned its envelope; the options collection deep-cloned its content and minted a random id per collected item — about 1 ms per render of entropy alone), with GC time consistent with the clone garbage. Shipped JS-side only: the filter configuration is now passed and stashed by reference (its write surface was measured empty before the change), the per-request locale lookups are memoized with the per-request copy materialized lazily on first read, and the id generator right-sizes its entropy batch to the requested length. Measured on the profiling harness with fresh runs on both sides: **4.4× render throughput** on the baseline workload (10.7 → 2.4 ms per render), deep-clone share 50.31% → 1.81%, GC down ~18×, and entropy out of the top profile frames on both arms. The remaining clone sites on this surface stay measure-gated for a future profile. Porting the object-graph work to native code remains an anti-candidate. |
 
 ---
 

package/framework/v0.6.2/VERSION

@@ -0,0 +1 @@
+0.6.2

package/framework/{v0.6.2-alpha.1 → v0.6.2}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -2772,7 +2772,7 @@ if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
 
 var _alphabet = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
 var _mask = 63;  // smallest (2^n - 1) >= 62 — rejects 62,63 (~3% waste, no bias)
-var _step = 7;   // ceil(1.6 * 63 * 4 / 62) — enough random bytes per iteration
+var _step = 7;   // ceil(1.6 * 63 * 4 / 62) — random bytes per iteration for the DEFAULT size 4 (#P39: larger sizes compute their own)
 
 /**
  * Generate a cryptographically secure random ID.
@@ -2782,10 +2782,19 @@ var _step = 7;   // ceil(1.6 * 63 * 4 / 62) — enough random bytes per iteratio
  */
 function uuid(size) {
     size = size || 4;
+    // #P39 — size the random-byte batch to the REQUESTED length, the same
+    // formula customAlphabet() below already uses for its default size. The
+    // fixed 7-byte batch was sized for the 4-char default, so uuid(16) — the
+    // form lib/collection mints per item — needed ~3 webcrypto calls per id;
+    // one right-sized call replaces them. Each getRandomValues call pays a
+    // full randomFillSync regardless of byte count, so the cost is the call
+    // count, not the bytes. Output distribution is untouched: the bitmask
+    // rejection below is applied per byte exactly as before.
+    var step = (size <= 4) ? _step : Math.ceil(1.6 * (_mask + 1) * size / _alphabet.length);
     var id = '';
     while (true) {
-        var bytes = crypto.getRandomValues(new Uint8Array(_step));
-        for (var j = 0; j < _step; j++) {
+        var bytes = crypto.getRandomValues(new Uint8Array(step));
+        for (var j = 0; j < step; j++) {
             var idx = bytes[j] & _mask;
             if (idx < 62) {
                 id += _alphabet[idx];