gina 0.6.2 → 0.6.3

package/framework/{v0.6.2 → v0.6.3}/lib/cmd/connector/help.txt

@@ -300,7 +300,7 @@
     comments are lost on rewrite.
 
     Driver resolution uses the framework's built-in driver range table
-    (see `lib/cmd/connector/add.js` DRIVER_MAP):
+    (see `lib/connector-registry/src/main.js` DRIVER_MAP):
 
       couchbase     → couchbase            >= 3.0.0
       redis         → ioredis              >= 5.0.0

package/framework/{v0.6.2 → v0.6.3}/lib/cmd/framework/init.js

@@ -1155,7 +1155,19 @@ function Initialize(opt) {
                 // ps-independent (works on minimal images without procps, and under
                 // Bun) and parses/trims the pid so a trailing newline can't break the
                 // check. Mirrors lib/cmd/framework/reset.js detectRunning.
-                let pid = parseInt(String(fs.readFileSync(filename)).trim(), 10);
+                let pid = null;
+                try {
+                    pid = parseInt(String(fs.readFileSync(filename)).trim(), 10);
+                } catch (readErr) {
+                    // An unreadable run dir entry must never abort the whole init
+                    // chain: a nested directory throws EISDIR, an entry removed by a
+                    // concurrent prune throws ENOENT, an unreadable one EACCES. Skip
+                    // it instead of throwing out of the loop — and deliberately do NOT
+                    // prune it, since the rmSync branches below are only safe for
+                    // entries whose content was actually read.
+                    console.debug('Skipping unreadable run dir entry `'+ filename +'` ['+ ( readErr && readErr.code || readErr ) +']');
+                    continue;
+                }
                 if (!pid || isNaN(pid)) {
                     filenameObj.rmSync();
                     continue;

package/framework/{v0.6.2 → v0.6.3}/lib/dto/src/main.js

@@ -52,14 +52,18 @@
  * The runtime pipe still enforces TYPE (isInteger/isNumber) + enum + length + format
  * + required.
  *
- * ## The `$` guard (#DTO2 — measured)
+ * ## The `$` guard (#DTO2 — measured; rationale updated with #B239)
  * `toRules()` compiles no `$` of its own (see above), but a `$` can still reach the
  * emitted rules through AUTHORED content — an enum value (`dto.enum(['$100'])`), a
- * field NAME, or a date mask. The engine stringifies the whole rules object and, on
- * ANY `$` in it, takes a client-only branch that dereferences the null server-side
- * `$fields` (`validate()` -> `$fields.count()`), throwing a raw TypeError from ABOVE
- * its own try/catch. So `toRules()` REJECTS a `$` anywhere in its output rather than
- * hand the engine a rules object that cannot be evaluated server-side.
+ * field NAME, or a date mask. `$` is the validation engine's RESERVED cross-field
+ * reference sigil, so whether an authored `$` survives as a literal depends on a
+ * runtime field-name COLLISION: a token naming a sibling field is consumed upstream
+ * as a reference (substituted + quoted — #B240 — so the literal can never match),
+ * while a token naming no field stays literal only since #B239 (before that it
+ * crashed the whole pass; earlier still, ANY leftover `$` crashed server-side —
+ * #B127/#B234). Deterministic literal semantics are impossible to guarantee for a
+ * `$`, so `toRules()` REJECTS one anywhere in its output at build/boot rather than
+ * let a DTO validate differently depending on which field names exist beside it.
  * `toJsonSchema()` is deliberately NOT guarded — a `$` is perfectly valid in a JSON
  * Schema enum, so a currency-style DTO still documents (and still serves as a
  * `param.responseDto`); only the runtime-validation projection is constrained.
@@ -426,7 +430,8 @@ DtoObject.prototype.toJsonSchema = function (dialect, opts) {
  * rather than emit a `$` (see the `$` guard in the module header).
  *
  * @throws {Error} when an authored enum value / field name / date mask puts a `$` in
- *                 the emitted rules — server-fatal in the validator engine.
+ *                 the emitted rules — the engine would reinterpret it
+ *                 collision-dependently (reserved sigil; see the module header).
  * @returns {object}
  */
 DtoObject.prototype.toRules = function () {
@@ -434,10 +439,12 @@ DtoObject.prototype.toRules = function () {
     for (var f in this._shape) {
         rules[f] = this._shape[f].toFieldRules();
     }
-    // #DTO2 — a `$` ANYWHERE in the stringified rules sends the engine down its
-    // client-only dynamic-rules branch, which derefs the null server-side `$fields`
-    // and throws from above its own try/catch. Fail at build/boot with a message that
-    // names the culprit, never at request time with a raw TypeError.
+    // #DTO2 — `$` is the engine's reserved cross-field sigil: whether an authored
+    // `$` stays literal depends on a runtime field-name collision (a colliding
+    // token is substituted + quoted upstream — #B240 — so the literal can never
+    // match; a non-colliding one stays literal only since #B239). Fail at
+    // build/boot with a message that names the culprit, never validate
+    // collision-dependently at request time.
     if ( /\$/.test(JSON.stringify(rules)) ) {
         // NOTE: every `$` below is followed by a SPACE, deliberately. A message carrying
         // the sequence `$` + backtick/quote/digit is a String.replace() dollar-pattern

package/framework/{v0.6.2 → v0.6.3}/lib/logger/src/containers/file/index.js

@@ -31,6 +31,19 @@ function FileContainer(opt, loggers) {
     var processProperties = null;
     var filenames   = {};
 
+    /**
+     * Resolves the framework's connection settings for the file container.
+     *
+     * Runs before the framework globals are guaranteed to exist (see the
+     * "hack for early calls" block below), so every global read is guarded.
+     *
+     * @inner
+     * @param {object} opt - Logger options; mqPort/hostV4/bindHost are filled in here.
+     * @returns {void}
+     *
+     * @example
+     * init({ });
+     */
     function init(opt) {
 
         // ---------- BO - hack for early calls
@@ -52,7 +65,22 @@ function FileContainer(opt, loggers) {
 
         var settings = { mq_port: 8125, host_v4: '127.0.0.1' };
         try {
-            settings = require( getUserHome() + '/.gina/' + shortVersion + '/settings.json');
+            // #B160-sibling (3) — honour GINA_HOMEDIR so an isolated home resolves
+            // its OWN settings instead of the invoking user's. The variable already
+            // carries the `/.gina` segment (bin/cli, bin/gina-init both compose it
+            // as `home + '/.gina'`), so it replaces that whole prefix, not just the
+            // home.
+            // Three tiers, and process.env is load-bearing rather than defensive:
+            // this container is constructed BEFORE bin/cli imports the OS env into
+            // process.gina (measured: process.gina is empty here, while
+            // process.env.GINA_HOMEDIR still holds the value), so the framework-env
+            // tier alone would never fire on the CLI path. Framework env still wins
+            // where it is populated (bundle processes, gina-container), matching the
+            // two-tier read used by the secrets backend and resolveHttpHost.
+            var _ginaHome = (typeof getEnvVar === 'function' && getEnvVar('GINA_HOMEDIR'))
+                || process.env.GINA_HOMEDIR
+                || (getUserHome() + '/.gina');
+            settings = require( _ginaHome + '/' + shortVersion + '/settings.json');
         } catch (err) {}
 
         opt.mqPort = settings.mq_port;

package/framework/{v0.6.2 → v0.6.3}/lib/logger/src/containers/mq/speaker.js

@@ -15,6 +15,20 @@ function MQSpeaker(opt, loggers, cb) {
 
 
 
+    /**
+     * Resolves the framework's connection settings, then starts the speaker.
+     *
+     * Runs before the framework globals are guaranteed to exist (see the
+     * "hack for early calls" block below), so every global read is guarded.
+     *
+     * @inner
+     * @param {object} opt - Logger options; mqPort/hostV4/bindHost are filled in here.
+     * @param {function} cb - Passed through to startMQSpeaker.
+     * @returns {*} Whatever startMQSpeaker() returns.
+     *
+     * @example
+     * init({ }, function(err, speaker) { });
+     */
     function init(opt, cb) {
 
         // ---------- BO - hack for early calls
@@ -36,7 +50,22 @@ function MQSpeaker(opt, loggers, cb) {
 
         var settings = { mq_port: 8125, host_v4: '127.0.0.1' };
         try {
-            settings = require( getUserHome() + '/.gina/' + shortVersion + '/settings.json');
+            // #B160-sibling (3) — honour GINA_HOMEDIR so an isolated home resolves
+            // its OWN settings instead of the invoking user's. The variable already
+            // carries the `/.gina` segment (bin/cli, bin/gina-init both compose it
+            // as `home + '/.gina'`), so it replaces that whole prefix, not just the
+            // home.
+            // Three tiers, and process.env is load-bearing rather than defensive:
+            // this container is constructed BEFORE bin/cli imports the OS env into
+            // process.gina (measured: process.gina is empty here, while
+            // process.env.GINA_HOMEDIR still holds the value), so the framework-env
+            // tier alone would never fire on the CLI path. Framework env still wins
+            // where it is populated (bundle processes, gina-container), matching the
+            // two-tier read used by the secrets backend and resolveHttpHost.
+            var _ginaHome = (typeof getEnvVar === 'function' && getEnvVar('GINA_HOMEDIR'))
+                || process.env.GINA_HOMEDIR
+                || (getUserHome() + '/.gina');
+            settings = require( _ginaHome + '/' + shortVersion + '/settings.json');
         } catch (err) {}
 
         // Guard: settings.mq_port may be an unresolved template placeholder (e.g. '${}'

package/framework/{v0.6.2 → v0.6.3}/lib/math/index.js

@@ -194,10 +194,24 @@ function MathHelper() {
         }
     }
 
+    /**
+     * Serialize an object or array into a stable string for checksumming.
+     *
+     * Plain objects become sorted `key:value` pairs joined with `,` (function
+     * properties skipped); arrays become the JSON of a sorted copy. Both forms
+     * are member-order-insensitive, and the input is never mutated.
+     *
+     * @private
+     * @param {object|array} obj
+     * @returns {string} serialized form
+     * */
     var objectToString = function(obj) {
         var str = '';
         if (Array.isArray(obj)) {
-            obj = JSON.stringify(obj.sort(), null, 0);
+            // #B208 — serialize a sorted COPY into `str`: the previous assignment
+            // targeted `obj` and returned the still-empty `str`, collapsing every
+            // array input to the checksum of '' — and `sort()` mutated the caller's array.
+            str = JSON.stringify(obj.slice().sort(), null, 0);
         } else {
             var arr = [], i = 0;
             for (let k in obj) {
@@ -213,13 +227,29 @@ function MathHelper() {
     };
 
     /**
-     * Check sum from file or form data
+     * Check sum from a file or from form data.
      *
-     * @param {string|ojbect|array} filename|data
-     * @param {string} algorithm
-     * @param {string} encoding
+     * Dispatch: an object or array input is serialized first (a plain object as
+     * sorted `key:value` pairs joined with `,` — see `objectToString`). A string
+     * ending in an extension shape — a dot followed by 1-10 alphanumerics
+     * (`.txt`, `.js`, `.json`, `.TXT`, `.c`, ...) — is then PROBED as a
+     * filename: the file branch is taken only when the WHOLE string resolves to
+     * an existing regular file — anything else (no such entry, name too long, a
+     * directory, a NUL-carrying string) is hashed as data. Note the probe needs
+     * an extension-shaped tail: an extension-less path (`Makefile`, `LICENSE`)
+     * is hashed as a data string, never read from disk. (#B207/#B210)
+     *
+     * @param {string|object|array} filename|data - path to an existing file, or raw data
+     * @param {string} [algorithm] - e.g.: sha1 (defaults to md5)
+     * @param {string} [encoding] - e.g.: hex (default)
      *
      * @returns {string} checksum
+     * @throws {Error} on an unreadable existing file (e.g. EACCES) or a digest failure
+     *
+     * @example
+     *  var math = require('gina').lib.math;
+     *  math.checkSumSync({ contact: 'user@example.com' }, 'sha1'); // hash of `contact:user@example.com`
+     *  math.checkSumSync('/tmp/manifest.txt', 'sha1');             // hash of the file bytes
      * */
     self.checkSumSync = function(filename, algorithm, encoding) {
         var sum = null;
@@ -229,7 +259,28 @@ function MathHelper() {
                 filename = objectToString(filename);
             }
 
-            if ( /(\.[a-z]{3})$/.test(filename) ) { // must be a string
+            // #B207 — an extension-shaped tail is only a HINT that the input is a
+            // filename: serialized data ends the same way (`user@example.com`,
+            // `report.pdf`). Only take the file branch when the path resolves to an
+            // actual file; data that merely looks like a name falls through.
+            var isFile = false;
+            // #B210 — any real extension shape (dot + 1-10 alphanumerics), not just
+            // dot+3-lowercase: file.js / file.json / FILE.TXT used to be hashed as
+            // PATH STRINGS because the narrow probe never fired for them.
+            if ( /(\.[A-Za-z0-9]{1,10})$/.test(filename) ) { // must be a string
+                try {
+                    isFile = fs.statSync(filename).isFile();
+                } catch (statErr) {
+                    // ENOENT / ENAMETOOLONG / ENOTDIR / ERR_INVALID_ARG_VALUE: the
+                    // input cannot name an existing file — treat it as data. Anything
+                    // else (e.g. EACCES on a real entry) must keep failing loudly.
+                    if ( !/^(ENOENT|ENAMETOOLONG|ENOTDIR|ERR_INVALID_ARG_VALUE)$/.test(statErr.code) ) {
+                        throw statErr;
+                    }
+                }
+            }
+
+            if (isFile) {
                 // from filename
                 sum = checkSum( fs.readFileSync(filename), algorithm, encoding )
             } else {

package/framework/{v0.6.2 → v0.6.3}/lib/merge/src/main.js

@@ -48,6 +48,7 @@ function Merge() {
      * merge({ a: 1 }, { a: 9 }, true)    // { a: 9 }
      * merge([1, 2],   [3, 4])            // [1, 2, 3, 4]
      * merge([1, 2],   [3, 4], true)      // [3, 4]
+     * merge({ a: [null, 'x'] }, { a: [null, 'x'] })  // { a: [null, 'x'] } — null elements are preserved (#B226)
      */
     var browse = function (_target, _source) {
 
@@ -252,8 +253,25 @@ function Merge() {
         return target;
     };
 
-    // Will not merge functions items: this is normal
-    // Merging arrays is OK, but merging collections is still experimental
+    /**
+     * Merge two arrays. Will not merge function items: this is normal.
+     * Merging plain arrays is OK, merging collections is still experimental.
+     *
+     * `null` elements are VALUES and are preserved (#B226): `typeof null ==
+     * 'object'`, so the object-exclusion guards below each carry an explicit
+     * null exception — without it a no-override merge silently dropped `null`
+     * from arrays (while `''` / `false` / `0` survived), which stripped the
+     * first slot of positional argument arrays such as the documented
+     * validator rule `"setFlash": [null, "message"]` on the client-side
+     * rules path.
+     *
+     * @inner
+     * @private
+     * @param {Array} options  - Source array (merged INTO target)
+     * @param {Array} target   - Target array (wins on conflicts unless `override`)
+     * @param {boolean} override - `true` lets `options` win / replace
+     * @returns {Array|undefined} the merged array
+     */
     var mergeArray = function(options, target, override) {
         newTarget = [];
 
@@ -358,7 +376,12 @@ function Merge() {
             // ok, but don't merge objects
             a = 0;
             for (; a < target.length; ++a ) {
-                if ( typeof(target[a]) != 'object' && newTarget.indexOf(target[a]) == -1 ) {
+                // #B226 — typeof null == 'object': a null element is a value
+                // (e.g. the first slot of a positional rule-argument array),
+                // not a collection item to exclude; this rebuild dropped it
+                // while '' / false / 0 survived
+                // was: if ( typeof(target[a]) != 'object' && newTarget.indexOf(target[a]) == -1 ) {
+                if ( ( typeof(target[a]) != 'object' || target[a] === null ) && newTarget.indexOf(target[a]) == -1 ) {
                     newTarget.push(target[a]);
                 }
             }
@@ -443,7 +466,11 @@ function Merge() {
                     localKeyComparison = ownPropertyNames;
                     if ( target.indexOf(options[a]) > -1 && override) {
                         target.splice(target.indexOf(options[a]), 1, options[a])
-                    } else if ( typeof(newTarget[a]) == 'undefined' && typeof(options[a]) == 'object' ) {
+                    // #B226 — a null source element must not enter the index-merge:
+                    // `for (var k in null)` is a no-op, so null used to surface as
+                    // `{}` here; let it fall through to the primitive push below
+                    // was: } else if ( typeof(newTarget[a]) == 'undefined' && typeof(options[a]) == 'object' ) {
+                    } else if ( typeof(newTarget[a]) == 'undefined' && typeof(options[a]) == 'object' && options[a] != null ) {
                         // merge using index
                         newTarget = target;
 
@@ -488,7 +515,9 @@ function Merge() {
                                newTarget[a] = target[a]
                         }
                         // array with string key
-                        else if (newTarget.indexOf(options[a]) == -1 && typeof(options[a]) != 'object') {
+                        // #B226 — same typeof-null exception as the rebuild above
+                        // was: else if (newTarget.indexOf(options[a]) == -1 && typeof(options[a]) != 'object') {
+                        else if (newTarget.indexOf(options[a]) == -1 && ( typeof(options[a]) != 'object' || options[a] === null )) {
                             newTarget.push(options[a]);
                         }
                         // collection without keyComparison

package/framework/{v0.6.2 → v0.6.3}/lib/render-cache/src/main.js

@@ -171,6 +171,14 @@ var _l2ErrorWarned = false;
 // a typo that silently disabled caching (#B114) — validateConfig names it loudly.
 var _RC_STRATEGIES = /^(memory|fs|redis)$/i;
 
+// #B238 — accepted `server.cache.name` grammar (the RFC 9211 Cache-Status
+// identifier): a conservative RFC 8941 Token subset — a letter, then up to 63
+// of [A-Za-z0-9._-]. Same charset as resolveReleaseToken's sanitizer, but this
+// one VALIDATES rather than sanitizes: an identifier the operator did not
+// write must never reach the wire, so an invalid value falls back to the
+// default and validateConfig names it at boot.
+var _RC_NAME_RE = /^[A-Za-z][A-Za-z0-9._-]{0,63}$/;
+
 /**
  * Once-per-process L2 failure warn. Fail-open must stay silent per-operation
  * (no log spam during an outage — the store's client `error` listener already
@@ -913,22 +921,36 @@ function RenderCache(options) {
  *   - an unknown `cache.type` (bundle-wide or per-route) — the fold made the config
  *     non-silent; this names the typo (#B114);
  *   - a redis route with no effective ttl but WITH `invalidateOnEvents` — the legit
- *     invalidate-only pattern, still orphaned on a namespace rotation.
+ *     invalidate-only pattern, still orphaned on a namespace rotation;
+ *   - an invalid `server.cache.name` (#B238) — ignored, the Cache-Status identifier
+ *     stays `gina-cache` (see {@link RenderCache.resolveCacheName});
+ *   - `context.hidePoweredBy` + `context.cacheEnabled` with no validly-set name
+ *     (#B238) — the operator declared hide-the-stack intent but every cache-enabled
+ *     GET still names the framework in Cache-Status. Warn-not-flip is deliberate:
+ *     the identifier is a documented-stable wire value (0.5.18 promised
+ *     `gina-cache; hit` grep-stability), so it never changes without an explicit
+ *     operator choice — the warn hands them both one-line exits.
  *
  * @memberof RenderCache
  * @static
- * @param {object}  serverCache - Merged `server.cache` (type/store/ttl/sliding/maxAge/…).
+ * @param {object}  serverCache - Merged `server.cache` (type/store/ttl/sliding/maxAge/name/…).
  * @param {object}  routing     - The bundle routing map (`{ ruleName: { cache, bundle, … } }`).
  * @param {string}  [bundle]    - When set, per-route checks skip routes of another bundle.
+ * @param {object}  [context]   - Caller-supplied boot context for the #B238 disclosure
+ *                                warn: `{ hidePoweredBy: boolean, cacheEnabled: boolean }`
+ *                                (both must be `true` for it to fire). Omitting the
+ *                                argument disables only that warn — every other check
+ *                                is unchanged (back-compat with pre-#B238 callers).
  * @returns {{ fatal: (string|null), warnings: string[], redisConfigured: boolean }}
  *
  * @example
- * var v = RenderCache.validateConfig(serverCache, gna.getConfig('routing'), bundle);
+ * var v = RenderCache.validateConfig(serverCache, gna.getConfig('routing'), bundle,
+ *     { hidePoweredBy: hpb, cacheEnabled: enabled });
  * v.warnings.forEach(function (w) { console.warn('[render-cache] ' + w); });
  * if (v.fatal) { console.emerg('[render-cache] ' + v.fatal); process.exit(1); }
  * if (v.redisConfigured) { process.gina._renderCacheStore = lib.RenderCacheStore(serverCache.store); }
  */
-RenderCache.validateConfig = function(serverCache, routing, bundle) {
+RenderCache.validateConfig = function(serverCache, routing, bundle, context) {
     var out = { fatal: null, warnings: [], redisConfigured: false };
     serverCache = serverCache || {};
     routing     = routing || {};
@@ -938,6 +960,20 @@ RenderCache.validateConfig = function(serverCache, routing, bundle) {
         out.warnings.push('unknown server.cache.type `' + bundleType + '` (expected memory|fs|redis) — this bundle-wide default is ignored; routes inheriting it are NOT cached');
     }
 
+    // #B238 — `server.cache.name` (the Cache-Status identifier) sanity + disclosure.
+    var _declaredName = serverCache.name;
+    var _nameIsSet    = ( typeof(_declaredName) === 'string' && _RC_NAME_RE.test(_declaredName) );
+    if ( typeof(_declaredName) !== 'undefined' && !_nameIsSet ) {
+        out.warnings.push('invalid server.cache.name `' + String(_declaredName) + '` — must be a letter followed by up to 63 of [A-Za-z0-9._-] (a conservative RFC 8941 token subset); ignored, the Cache-Status identifier stays `gina-cache`');
+    }
+    // Gated on the caller context: cacheEnabled (a disabled cache emits no
+    // Cache-Status — no disclosure, no noise) and hidePoweredBy (no declared
+    // intent, no nag). An explicit `"name": "gina-cache"` counts as validly
+    // set — the documented silence path for keeping the default wire.
+    if ( context && context.hidePoweredBy === true && context.cacheEnabled === true && !_nameIsSet ) {
+        out.warnings.push('server.hidePoweredBy is set but the Cache-Status identifier still names the framework (`gina-cache`) — set server.cache.name (any token, e.g. "cache") to close the disclosure, or explicitly "gina-cache" to keep the current wire and silence this warning');
+    }
+
     for (var name in routing) {
         var route = routing[name];
         if ( !route || typeof(route) !== 'object' ) { continue; } // skip $schema / annotations
@@ -990,6 +1026,43 @@ RenderCache.validateConfig = function(serverCache, routing, bundle) {
     return out;
 };
 
+/**
+ * #B238 — resolve the Cache-Status response-header identifier for a bundle (pure, static).
+ *
+ * RFC 9211 §2 leaves the cache identifier to the deployment (a free-form
+ * structured-field Token). gina's default is `gina-cache`; an operator picks
+ * their own via `server.cache.name` (the settings.json `cache` block — rides
+ * the same #B114 fold as `type`/`store`, so an env.json `server.cache.name`
+ * wins over it like every sibling key). An invalid value is IGNORED here
+ * (default returned) and named loudly by {@link RenderCache.validateConfig}
+ * at boot — never sanitized into a name the operator did not write.
+ *
+ * Accepted grammar is a deliberate STRICT SUBSET of the RFC 8941 Token
+ * (a letter, then up to 63 of `[A-Za-z0-9._-]`) — every accepted value is a
+ * valid sf-token, and the charset matches the release-namespace sanitizer
+ * (`resolveReleaseToken`), keeping the two token surfaces aligned.
+ *
+ * Resolved ONCE at boot (server.js stamps `instance._cacheName` beside the
+ * sibling cache scalars) and read by all three Cache-Status mint sites —
+ * both engines, hit and miss — so the identifier can never disagree across
+ * engines or outcomes.
+ *
+ * @memberof RenderCache
+ * @static
+ * @param {object} [serverCache] - Merged `server.cache` (the #B114 post-fold block).
+ * @returns {string} The identifier to mint (`serverCache.name` when valid, else `'gina-cache'`).
+ *
+ * @example
+ * RenderCache.resolveCacheName({ name: 'cache' });      // 'cache'
+ * RenderCache.resolveCacheName({ name: 'bad name!' });  // 'gina-cache' (validateConfig warns at boot)
+ * RenderCache.resolveCacheName({});                     // 'gina-cache'
+ * RenderCache.resolveCacheName(null);                   // 'gina-cache'
+ */
+RenderCache.resolveCacheName = function(serverCache) {
+    var name = ( serverCache ) ? serverCache.name : null;
+    return ( typeof(name) === 'string' && _RC_NAME_RE.test(name) ) ? name : 'gina-cache';
+};
+
 /**
  * #B130 — CSP-nonce re-stamp for served cache hits (pure, static).
  *

package/framework/{v0.6.2 → v0.6.3}/lib/routing/src/main.js

@@ -230,6 +230,13 @@ function Routing() {
             if ( typeof(routeObject.queryTimeout) != 'undefined' ) {
                 params.queryTimeout = parseTimeout(routeObject.queryTimeout);
             }
+            // #SPA1 — propagate the per-route content-negotiation capability to
+            // req.routing.negotiate (top-level, NOT req.routing.param.* — the #CSRF2
+            // trap). Assigned only when declared, so a routing.json that never mentions
+            // `negotiate` produces a byte-identical params object.
+            if ( typeof(routeObject.negotiate) != 'undefined' ) {
+                params.negotiate = routeObject.negotiate;
+            }
 
             // isRoute
             return self.compareUrls(params, routeObject.url, req);
@@ -1221,7 +1228,12 @@ function Routing() {
         route.toUrl = function (ignoreWebRoot) {
 
             var urlProps = null;
-            if ( /^redirect$/i.test(this.param.control) ) {
+            // Slice 3 (#SPA1) — the client-served map ships the derived boolean
+            // `isRedirect` instead of `param.control` (a dispatch key that stays
+            // server-side); server-side routes still carry the full `param`, so
+            // both forms are honoured. The `this.param &&` guard also keeps a
+            // param-less route from throwing here.
+            if ( this.isRedirect === true || /^redirect$/i.test(this.param && this.param.control) ) {
                 urlProps = self.getUrlProps(this.bundle, (env||GINA_ENV));
             }
 

package/framework/{v0.6.2 → v0.6.3}/lib/routing-introspect/src/main.js

@@ -174,11 +174,63 @@ var requirementToPattern = function(raw) {
     return { type: 'pattern', value: cleaned };
 };
 
+/**
+ * #B201 — annotates a numeric-type schema fragment with the rule's DIGIT bounds.
+ *
+ * `isInteger` / `isNumber` bounds constrain the LENGTH OF THE VALUE'S STRING
+ * FORM (a negative sign counts toward it), not the value's range — so they are
+ * deliberately NOT mapped to `minimum`/`maximum` (wrong for any negative:
+ * digit bounds [2,4] admit `[-999,-1] ∪ [10,9999]`, which no single range
+ * expresses) nor to `minLength`/`maxLength` (string-only assertions, inert on
+ * numeric types — a documented bound nothing enforces). Instead the fragment
+ * gains an honest human-readable `description` plus a namespaced
+ * machine-readable `x-gina-digitBounds` extension; both bundle:openapi and
+ * bundle:mcp copy fragment keys verbatim, so the annotations reach the
+ * generated schemas as-is.
+ *
+ * @inner
+ * @param   {object} s - the fragment being built (mutated)
+ * @param   {number|Array|boolean} v - the rule's declared value
+ * @returns {undefined}
+ */
+var annotateDigitBounds = function(s, v) {
+    var min = null, max = null;
+    if ( typeof(v) === 'number' ) {
+        min = v; // scalar N supplies minLength only — same arity contract as isString
+    } else if ( Array.isArray(v) ) {
+        if ( typeof(v[0]) === 'number' ) min = v[0];
+        if ( typeof(v[1]) === 'number' ) max = v[1];
+    }
+    if ( min === null && max === null ) return; // bare `true` — nothing declared
+
+    var bounds = {};
+    var text = null;
+    if ( min !== null && max !== null ) {
+        text = (min === max) ? ('exactly ' + min + ' digits') : (min + '-' + max + ' digits');
+    } else if ( min !== null ) {
+        text = 'at least ' + min + ' digits';
+    } else {
+        text = 'at most ' + max + ' digits';
+    }
+    if ( min !== null ) bounds.min = min;
+    if ( max !== null ) bounds.max = max;
+
+    s.description = text + ' (string-form length; a negative sign counts)';
+    s['x-gina-digitBounds'] = bounds;
+};
+
 /**
  * Maps a single-field form-validator rules-object to a JSON Schema fragment
  * (the inverse of the DTO builder's toRules, for the curated vocabulary). Pure
  * and inline — routing-introspect does not require lib.dto (its purity contract).
  *
+ * Length bounds (#B201): `isString` maps its scalar and array forms to real
+ * `minLength`/`maxLength` facets (`isString: 8` === `isString: [8]` — the
+ * scalar supplies a minimum, per the engine's arity contract). `isInteger` /
+ * `isNumber` digit bounds are annotated via {@link annotateDigitBounds}
+ * (description + `x-gina-digitBounds`) rather than mapped to value facets —
+ * see that function's JSDoc for why both facet mappings would be wrong.
+ *
  * @memberof module:gina/lib/routing-introspect
  * @param   {object} rules - e.g. `{ isEmail: true, isString: [7] }`
  * @returns {object} a JSON Schema fragment (always includes `type`)
@@ -186,6 +238,12 @@ var requirementToPattern = function(raw) {
  * @example
  * rulesToSchemaFragment({ isEmail: true, isString: [7] });
  * // { type: 'string', format: 'email', minLength: 7 }
+ *
+ * @example
+ * rulesToSchemaFragment({ isInteger: [2, 4] });
+ * // { type: 'integer',
+ * //   description: '2-4 digits (string-form length; a negative sign counts)',
+ * //   'x-gina-digitBounds': { min: 2, max: 4 } }
  */
 var rulesToSchemaFragment = function(rules) {
     var s = {};
@@ -201,10 +259,14 @@ var rulesToSchemaFragment = function(rules) {
                 if ( Array.isArray(v) ) {
                     if ( typeof(v[0]) === 'number' ) s.minLength = v[0];
                     if ( typeof(v[1]) === 'number' ) s.maxLength = v[1];
+                } else if ( typeof(v) === 'number' ) {
+                    // #B201 - the scalar form was silently dropped; the engine
+                    // treats `isString: 8` as a minimum, identical to `[8]`.
+                    s.minLength = v;
                 }
                 break;
-            case 'isInteger': s.type = 'integer'; break;
-            case 'isNumber':  s.type = 'number';  break;
+            case 'isInteger': s.type = 'integer'; annotateDigitBounds(s, v); break;
+            case 'isNumber':  s.type = 'number';  annotateDigitBounds(s, v); break;
             case 'isBoolean': s.type = 'boolean'; break;
             case 'isDate':    s.type = 'string';  s.format = 'date'; break;
             case 'isInList':  if ( Array.isArray(v) ) s.enum = v.slice(); break;