gina 0.6.22 → 0.6.23

package/CHANGELOG.md

@@ -6,6 +6,18 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.23 - 2026-09-02
+### Added
+* Security headers are now emitted by the framework itself, on both engines, via `settings.json > server.securityHeaders` (OWASP A02). This closes a gap that made the existing `#HDR` plugins unreachable for most projects: they are Express middleware, and the default `isaac` engine never runs the Express middleware chain for HTTP responses, so mounting the `SecurityHeaders()` orchestrator emitted nothing at all there. Seven headers are on by default, chosen because none can break a working application — `x-content-type-options`, `x-download-options`, `x-permitted-cross-domain-policies`, `x-xss-protection`, `referrer-policy`, `x-dns-prefetch-control` and `origin-agent-cluster`. Four are opt-in behind a single key each, because each breaks a legitimate deployment: `xFrameOptions` (cross-origin embedding), `coop` (severs `window.opener`, so OAuth and payment popups), `corp` (cross-origin asset loading) and `hsts` (a 180-day HTTPS commitment, emitted over plain HTTP too). Precedence is first-writer-wins, so a mounted plugin, an `env.json > server.response.header` entry or an upstream proxy always wins. `coop` and `corp` are never applied to `/_gina/*`, which is deliberately cross-origin. Set `server.securityHeaders.enabled` to `false` to restore the previous behaviour (#OW1)
+* `settings.json > server.maxBodySize` bounds non-multipart request bodies, which previously accumulated with no ceiling at all — a single large body was an unbounded-memory exposure (OWASP A10). A body past the limit is answered 413 and the stream is destroyed. The default `64MB` is deliberately permissive: the ceiling exists to stop unbounded growth, not to police payload shapes, and gina's own inter-bundle `self.query()` hop posts through the same pipeline. A companion `server.maxBodySizeWarn` (default `2MB`) only logs, so you can measure your real distribution before choosing a stricter ceiling. Both accept B/KB/MB/GB (a bare number means MB); `0` disables either. Multipart uploads are unaffected — they remain capped by `upload.maxFieldsSize`. `server.timeout` is now configurable too, and stays `0` (unlimited) by default on purpose: a finite whole-request clock would kill Server-Sent Events and WebSocket connections, and the slow-body case it would otherwise cover is already closed by the body cap (#OW2)
+* Opt-in Subresource Integrity for the asset tags gina emits: set `"sriEnabled": true` in `templates.json > "_common"` and every same-origin `<script>` and `<link rel="stylesheet">` whose file resolves on disk gains `integrity="sha384-..."` plus `crossorigin="anonymous"`, so a tampered or truncated asset is refused by the browser instead of executed. Fail-open by design: external URLs, unresolvable paths and unreadable files simply get no attribute — a wrong hash would hard-block the asset, so nothing is ever guessed. Hashes are cached per file and re-validated by mtime and size on every render, which means a rebuilt asset gets a fresh hash with no restart. Two operational notes: pages already stored by the render/output cache keep the hash they were rendered with, so flush that cache after rebuilding assets; and the HTTP/2 preload hint is suppressed for integrity-checked assets, since a hint carries no integrity metadata and a mismatched preload would be a wasted double fetch (#OW3)
+### Changed
+* `settings.json > server.hidePoweredBy` now defaults to `true`, so the framework no longer advertises its name and exact version on every response. A version banner is free reconnaissance for an attacker and buys the operator nothing. Set it back to `false` to restore the previous behaviour. One interaction worth knowing: with the render/output cache enabled and `server.cache.name` unset, the new default raises the existing boot warning about the cache still naming the framework on the wire via `Cache-Status` — set any token there to close that disclosure too (#OW1)
+### Fixed
+* A JSON body carrying a nested object whose own `constructor` key holds a primitive, null, array or plain object no longer crashes the merge: the plain-object check read `.prototype` off the shadowed value eagerly and threw `Cannot convert undefined or null to object` — request-reachable through PUT bodies and pre-existing (measured identical on 0.6.21). The check now computes lazily with the read guarded, a 24-shape differential sweep pins identical answers on every previously non-crashing input, the guarded key is still dropped per the 0.6.22 disclosure and sibling fields survive (#B450)
+### Security
+* Hardened the escaping of server-side data serialised into inline `<script>` blocks. The previous guard matched only the literal `</script>` and `<!--` sequences, but the HTML5 script-data end tag also accepts a tab, newline, form feed, space or `/` after the tag name, so `</script >` and `</script/>` closed the block and the remainder of a stored value was parsed as HTML. Values are now escaped by neutralising `<` itself, which no terminator spelling can work around, and the same helper is applied at every site that serialises server data into an inline script rather than at one site per renderer. U+2028 and U+2029 are escaped as well, since both are legal in JSON but were line terminators to the JavaScript parser. The escaped output parses back to an identical value, so no data shape changes. Reported as #69. Server-side only: a bundle restart picks this up, no rebuild needed.
+
 ## 0.6.22 - 2026-09-02
 ### Fixed
 * Fixed a form submit that failed at the transport layer settling silently. When the network was down, the connection was refused, or the server was restarting, the request settled with no HTTP status and neither `error.<formId>` nor `error.<formId>.hform` was dispatched, so a handler declared with `data-gina-form-event-on-submit-error` never ran while the form released its submit trigger and reported nothing to the visitor. Such a failure now dispatches both events with `status: 408` and `transportError: true`, the latter distinguishing it from a genuine request timeout. Handlers matching on `status >= 400` keep working unchanged. This code ships in the browser bundle, so consuming bundles need a rebuild as well as a restart.

package/README.md

@@ -62,24 +62,26 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.22
+## What's in 0.6.23
 
 > **Restart your bundles AND rebuild them.** This release changes the browser
-> bundle: both fixes below ship in `gina.min.js`. A restart alone updates the
-> server half only — each bundle bakes its own copy of the client assets, so a
-> restart without `gina bundle:build` leaves the browser running the old code.
-
-> **No settings reset.** `0.6.22` is a patch — the `shortVersion` stays `0.6`, so
-> your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
-
-**A prototype-pollution fix on the request path, and a form submit that failed
-silently when the network did.** The first is a security fix reachable from any
-request that carries field names — upgrade it ahead of the second. The second is
-a client-side fix reported from the field: a submit that failed at the transport
-layer told the visitor nothing.
-
-- **Security — prototype pollution on the request path (#B446).** Client-supplied bracket-notation field names reached an unguarded property assignment in the data helper's key-path nesting: `__proto__[x]=y`, `constructor[prototype][x]=y` and their percent-encoded forms all wrote to `Object.prototype`, and did so silently — the parsed body came back empty, so nothing in the request looked wrong. Separately, `merge()` copied an **own** `__proto__` key — the shape `JSON.parse` produces — through its `for...in` loops. The sources were reachable from query strings, urlencoded and JSON request bodies, `request.query.inheritedData`, and multipart text-field names. A polluted prototype could then influence code that reads a property it expects to be absent: outbound request options (host, port, auth, and the TLS certificate check), and the safe-method and exemption checks. Both sources now reject the same three key names — rejecting the key name is what closes this, since an own `__proto__` (the shape `JSON.parse` produces) satisfies an own-property check. **One thing to check before upgrading.** A field or key whose *path* contains a `__proto__`, `constructor` or `prototype` segment is now dropped from the parsed body instead of being nested — silently, since throwing on the request-parse path would turn one bad field into a 500. `__proto__` was never a usable field name, but `constructor` and `prototype` are ordinary words: if a form posts `job[constructor]=…`, or a JSON body carries a `prototype` key, that value no longer arrives. Flat top-level form fields of those names are unaffected. Grep your field names and API payloads for them. The affected modules also ship in the browser bundle, so a rebuild is part of picking this up, not just a restart.
-- **Fixed — a form submit that fails at the transport layer now reports it (#B447).** When the network was down, the connection was refused, or the server was restarting, the request settled with no HTTP status and neither `error.<formId>` nor `error.<formId>.hform` was dispatched — so a handler declared with `data-gina-form-event-on-submit-error` never ran, while the form released its submit trigger and told the visitor nothing. The failure was indistinguishable from a form that had simply done nothing. Such a failure now dispatches both events with `status: 408` and `transportError: true` — the 408 keeps handlers that match on `status >= 400` working unchanged, and `transportError` is what separates it from a genuine request timeout. **What to check:** if you branch on `result.status`, a transport failure will now enter your error branch where previously it entered nothing at all.
+> bundle: the merge hardening ships in `gina.min.js`. A restart alone updates
+> the server half only — each bundle bakes its own copy of the client assets,
+> so a restart without `gina bundle:build` leaves the browser running the old
+> code.
+
+> **No settings reset.** `0.6.23` is a patch — the `shortVersion` stays `0.6`,
+> so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
+
+**The OWASP Top 10 response release.** The framework now emits security headers
+itself, bounds request bodies, and can stamp integrity hashes on the asset tags
+it builds — plus a hardened inline-script escape and a merge crash fix.
+
+- **Security — hardened inline-script escaping (#B451).** The previous guard for server data serialised into inline `<script>` blocks matched only the literal `</script>` and `<!--` sequences, but the HTML5 script-data end tag also accepts a tab, newline, form feed, space or `/` after the tag name — so `</script >` and `</script/>` closed the block and the remainder of a stored value was parsed as HTML. Values are now escaped by neutralising `<` itself, which no terminator spelling can work around, applied by one shared helper at every site that serialises server data into an inline script. U+2028 and U+2029 are escaped as well. The escaped output parses back to an identical value, so no data shape changes. Server-side only.
+- **Added — the framework now emits security headers itself (#OW1).** On both engines, via `settings.json > server.securityHeaders`. This closes the gap that made the `#HDR` plugins unreachable for most projects: they are Express middleware, and the default `isaac` engine never runs the Express middleware chain for HTTP responses, so mounting the `SecurityHeaders()` orchestrator emitted nothing there. Seven headers are on by default — chosen because none can break a working application; four more (`xFrameOptions`, `coop`, `corp`, `hsts`) are opt-in behind one key each, each with a named breakage. Precedence is first-writer-wins: a mounted plugin, an `env.json` header entry or an upstream proxy always beats the framework default, and `coop`/`corp` are never applied to the deliberately cross-origin `/_gina/*`. `server.hidePoweredBy` now defaults to `true` — a version banner is free reconnaissance. `server.securityHeaders.enabled: false` restores the previous behaviour.
+- **Added — request bodies are bounded (#OW2).** `server.maxBodySize` (default `64MB`) caps non-multipart request bodies, which previously accumulated with no ceiling at all: a body past the limit is answered 413 and the stream is destroyed. A companion `server.maxBodySizeWarn` (default `2MB`) only logs, so you can measure your real distribution before choosing a stricter ceiling. Multipart uploads stay under the `upload.*` caps. `server.timeout` is now configurable too, and stays `0` (unlimited) by default on purpose — a finite whole-request clock would kill SSE and WebSocket connections.
+- **Added — opt-in Subresource Integrity (#OW3).** Set `"sriEnabled": true` in `templates.json > "_common"` and every same-origin `<script>` and `<link rel="stylesheet">` whose file resolves on disk gains `integrity="sha384-..."` plus `crossorigin="anonymous"`, so a tampered or truncated asset is refused by the browser instead of executed. Fail-open by design: external URLs, unresolvable paths and unreadable files simply get no attribute. Hashes are re-validated by mtime and size on every render, so a rebuilt asset gets a fresh hash with no restart; flush the render/output cache after rebuilding assets, since already-cached pages keep the hash they were rendered with.
+- **Fixed — merge crash on shadowed `constructor` keys (#B450).** A JSON body carrying a nested object whose own `constructor` key holds a primitive, null, array or plain object no longer crashes the merge on the PUT path: the plain-object check read `.prototype` off the shadowed value eagerly and threw. The check now computes lazily with the read guarded; the guarded key is still dropped per the 0.6.22 disclosure, and sibling fields survive.
 
 ## Documentation
 

package/ROADMAP.md

@@ -74,6 +74,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.20` ✅ | **Security**: concurrent calls to an emit-style entity method are now paired to the call each completion came from. Both call forms (`await entity.method()` and `util.promisify(entity.method)`) paired by arrival order with no call identity, so one call that never signalled completion — it neither emitted its trigger nor returned a Promise that settled, typically because something threw inside an asynchronous callback and was swallowed as an unhandled rejection — left its slot at the head of that method's queue forever: every caller after it received the *next* caller's record, the last one hung, and each further lost completion made it one caller worse. Where the method reads a user-scoped or ownership-bearing record, a check performed on the returned row could pass for the wrong principal. The trigger is data-dependent, not load-dependent — invisible in a load test, present in any long-lived process. Every call now runs inside its own async context, a completion for an already-settled call is dropped rather than handed to the next caller, one reaching the entity outside every call's context still pairs in arrival order and logs `DISPATCH:NO_CONTEXT` at debug level, and the `promisify` form chains on a Promise the method returns instead of discarding it. New opt-in `settings.json > model.emitTimeout` (ms) bounds a call that never completes. **Fixed**: `merge()` no longer duplicates a number the target already holds at a different index, and merges a nested array once per level instead of twice. **Fixed**: `merge()` no longer throws `TypeError: Cannot create property 'id' on string` when a target array that repeats a primitive is merged with an array of objects — a configuration overlay hitting that shape killed the boot. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.19`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.21` ✅ | **Fixed**: an outbound `route.request()` now settles its callback on every outcome — the request object was discarded, so nothing could attach an `error` listener, and a dial failure either never invoked the callback at all (a permanent stall for anything serialized, with nothing logged) or reached `uncaughtException` and terminated the bundle; a response stream dying mid-body waited on an `end` event it would never emit. `options.timeout` was accepted but inert — Node only emits a `timeout` event and never destroys the socket — and is now honoured, so a value set in the belief that it capped the call will begin aborting requests at that budget. **Fixed**: `merge()` no longer throws `TypeError: Cannot read properties of null` on an id-keyed array carrying a `null` element, on either operand at any index — the read-side counterpart of the write-side fix that shipped in `0.6.20`. **Fixed**: on Safari, modifier chords (paste, select-all, copy, cut, undo) work again in live-checked fields carrying `autocomplete="off"` — the form-level keydown proxy cancelled the native keydown before the typing interception could decide anything, and `preventDefault` on a native keydown suppresses the browser's editing command itself, so no `paste` event was dispatched anywhere; Chromium-family browsers were never affected. Restart **and** rebuild your bundles (the browser bundle changed — all three fixes ship in `gina.min.js`). |
 | **Q4 2026** | `0.6.22` ✅ | **Security**: prototype pollution on the request path — client-supplied bracket-notation field names (`__proto__[x]`, `constructor[prototype][x]`, and their percent-encoded forms) reached an unguarded property assignment in the data helper's key-path nesting and wrote to `Object.prototype` silently (the parsed body came back empty, so nothing in the request looked wrong), and `merge()` copied an **own** `__proto__` key — the shape `JSON.parse` produces — through its `for...in` loops. Reachable from query strings, urlencoded and JSON request bodies, `request.query.inheritedData` and multipart text-field names; a polluted prototype could then influence code reading a property it expects to be absent — outbound request options (host, port, auth, the TLS certificate check) and the safe-method and exemption checks. Both sources now reject the same three key names — rejecting the key name is what closes this, since an own `__proto__` (the shape `JSON.parse` produces) satisfies an own-property check. **Fixed**: a form submit that fails at the TRANSPORT layer (network down, connection refused, server restarting) settled with no HTTP status and dispatched neither `error.<formId>` nor `error.<formId>.hform`, so a handler declared with `data-gina-form-event-on-submit-error` never ran while the form released its submit trigger and reported nothing to the visitor; both events now fire with `status: 408` and `transportError: true`, the latter distinguishing it from a genuine request timeout, and handlers matching on `status >= 400` keep working unchanged. Restart **and** rebuild your bundles (the browser bundle changed — both fixes ship in `gina.min.js`). |
+| **Q4 2026** | `0.6.23` ✅ | **Security**: hardened inline-script escaping — the previous guard matched only the literal `</script>` and `<!--`, but the HTML5 script-data end tag also accepts a tab, newline, form feed, space or `/` after the tag name, so `</script >` closed the block and the remainder of a stored value parsed as HTML; serialised values now neutralise `<` itself at every site, with U+2028/U+2029 escaped too, and escaped output parses back to an identical value. **Added**: the framework itself now emits seven security headers by default on both engines (`server.securityHeaders`; four more opt-in — `xFrameOptions` / `coop` / `corp` / `hsts`), first-writer-wins so mounted plugins, `env.json` headers and proxies keep winning, with `/_gina/*` exempt from the cross-origin-isolating pair; `server.hidePoweredBy` now defaults to `true`. **Added**: `server.maxBodySize` (default 64MB, 413 + stream destroyed) bounds non-multipart request bodies, with warn-only `server.maxBodySizeWarn` (2MB) and a configurable `server.timeout` that stays `0` on purpose (SSE/WebSocket). **Added**: opt-in Subresource Integrity — `templates.json > "sriEnabled": true` adds `integrity` + `crossorigin` to same-origin script and stylesheet tags that resolve on disk; fail-open, hashes stat-validated per render. **Fixed**: a JSON body whose nested object shadows `constructor` with a primitive, null, array or plain object no longer crashes the merge on the PUT path. Restart **and** rebuild your bundles (the browser bundle changed — the merge fix ships in `gina.min.js`). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |
@@ -263,6 +264,18 @@ HTTP security response headers as opt-in `gina.plugins.*` middlewares, mirroring
 
 ---
 
+## OWASP Top 10 Response
+
+Direct response to an OWASP Top 10:2025 review of the framework (September 2026): close the weak areas at the framework layer rather than leaving them as consumer homework. Three items shipped together in `0.6.23`; the remaining review findings stay tracked as candidates and get rows here only if promoted.
+
+| Status | Feature | Version | Target |
+| --- | --- | --- | --- |
+| ✅ | **Framework-side security headers + `X-Powered-By` off by default (A02)** — Security headers are now emitted by the framework itself, on both engines, via `settings.json > server.securityHeaders` — closing the gap that made the `#HDR` plugins unreachable for most projects: they are Express middleware, and the default `isaac` engine never runs the Express middleware chain for HTTP responses, so mounting the `SecurityHeaders()` orchestrator emitted nothing there. Seven headers on by default — `x-content-type-options`, `x-download-options`, `x-permitted-cross-domain-policies`, `x-xss-protection`, `referrer-policy`, `x-dns-prefetch-control`, `origin-agent-cluster` — chosen because none can break a working application. Four opt-in behind one key each, each with a named breakage: `xFrameOptions` (cross-origin embedding), `coop` (severs `window.opener` — OAuth/payment popups), `corp` (cross-origin asset loading, incl. gina's own deliberately cross-origin `/_gina/*` endpoints), `hsts` (a 180-day HTTPS commitment). Precedence is first-writer-wins: a mounted plugin, an `env.json` header override or an upstream proxy always beats the framework default. `coop`/`corp` are never applied to `/_gina/*`. `server.hidePoweredBy` now defaults to `true` — a version banner is free reconnaissance and buys the operator nothing. `server.securityHeaders.enabled: false` restores the previous behaviour. | `0.6.23` | 2026-09-02 |
+| ✅ | **Request-body size cap + configurable server timeout (A10)** — `settings.json > server.maxBodySize` (default `64MB`, enforced: 413 + stream destroyed) bounds non-multipart request bodies, which previously accumulated with no ceiling at all. A companion `server.maxBodySizeWarn` (default `2MB`) only logs, so the real payload distribution can be measured before choosing a stricter ceiling. Raw wire bytes are counted, not decoded string length. Both accept B/KB/MB/GB (a bare number means MB); `0` disables either. Multipart uploads remain governed by the `upload.*` caps. `server.timeout` is exposed and stays `0` (unlimited) by default on purpose — a finite whole-request clock would kill Server-Sent Events and WebSocket connections, and the slow-body case is already closed by the body cap. | `0.6.23` | 2026-09-02 |
+| ✅ | **Opt-in Subresource Integrity for emitted asset tags (A08)** — `templates.json > "_common" > "sriEnabled": true` adds `integrity="sha384-..."` plus `crossorigin="anonymous"` to every same-origin `<script>` and `<link rel="stylesheet">` whose file resolves on disk, so a tampered or truncated asset is refused by the browser instead of executed. Fail-open by design: external URLs, unresolvable paths and unreadable files get no attribute — a wrong hash would hard-block the asset, so nothing is ever guessed. Hashes are stat-validated per render (mtime + size), so a rebuilt asset re-hashes with no restart; pages already stored by the render/output cache keep the hash they were rendered with (flush that cache after rebuilding assets). The HTTP/2 preload hint is suppressed for integrity-checked assets, since a hint carries no integrity metadata and a mismatched preload would be a wasted double fetch. sha384 is fixed deliberately: its padding-free base64 output keeps integrity values inert to the framework's own asset-catalog URL scan. | `0.6.23` | 2026-09-02 |
+
+---
+
 ## Accessibility
 
 Client-side form-validation accessibility — keeping `FormValidator`'s ARIA state in sync with field validity so screen-reader users get the same error feedback sighted users already get from native `:user-invalid` styling. No new public API; behaviour applies to fields that opt in through their existing ARIA markup. Models the `isInList` rule + CSP-nonce (#HDR16) rollout: ship behind the existing validator API, default-on for opted-in markup, no consuming-app code change.

package/framework/v0.6.23/VERSION

@@ -0,0 +1 @@
+0.6.23

package/framework/{v0.6.22 → v0.6.23}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -2190,9 +2190,12 @@ function Merge() {
      *
      * Key rejection is the WHOLE guard, deliberately. The first cut of #B446 also
      * skipped inherited enumerable source properties, which broke every entity in
-     * the model registry: lib/model.js setModel round-trips entity instances
-     * through merge, and all six SQL connectors attach their .sql-derived query
-     * methods to the PROTOTYPE, so an own-only copy silently dropped them
+     * the model registry: the model layer round-trips entity instances through
+     * merge — the in-tree path is the relations assembly (core/model/entity.js),
+     * and the registry's setModel (lib/model.js), while it has no in-tree caller,
+     * is published through the modelUtil context and stays consumer-reachable —
+     * and all six SQL connectors attach their .sql-derived query methods to the
+     * PROTOTYPE, so an own-only copy silently dropped them
      * (`db.xEntity.getOneById is not a function`). merge therefore copies the
      * chain, as it always has; only these three key names are refused.
      *
@@ -2833,8 +2836,22 @@ function Merge() {
 
         var hasOwn              = {}.hasOwnProperty;
         var hasOwnConstructor   = hasOwn.call(obj, 'constructor');
-        // added test for node > v6
-        var hasMethodPrototyped = ( typeof(obj.constructor) != 'undefined' ) ? hasOwn.call(obj.constructor.prototype, 'isPrototypeOf') : false;
+        // #B450 — compute lazily, restoring the original short-circuit. An OWN
+        // `constructor` key (the shape JSON.parse yields for
+        // `{"constructor": <primitive|null|{}|[]>}`) shadows
+        // Object.prototype.constructor, so the eager read
+        // `obj.constructor.prototype` was undefined (or threw outright for null)
+        // and `hasOwn.call(undefined, ...)` crashed the whole merge —
+        // request-reachable, since PUT bodies reach merge as the source. When the
+        // object HAS an own constructor the rejection branch below cannot fire,
+        // so the value is never needed; when it lacks one, guard the `.prototype`
+        // read. A 24-shape differential sweep pins identical answers on every
+        // input the old form did not crash on (test/lib/merge-b450.test.js).
+        // was: var hasMethodPrototyped = ( typeof(obj.constructor) != 'undefined' ) ? hasOwn.call(obj.constructor.prototype, 'isPrototypeOf') : false;
+        var hasMethodPrototyped = false;
+        if ( !hasOwnConstructor && typeof(obj.constructor) != 'undefined' ) {
+            hasMethodPrototyped = ( obj.constructor.prototype ) ? hasOwn.call(obj.constructor.prototype, 'isPrototypeOf') : false;
+        }
 
 
         if (