gina 0.6.22 → 0.6.23

package/framework/{v0.6.22 → v0.6.23}/lib/merge/src/main.js

@@ -41,9 +41,12 @@ function Merge() {
      *
      * Key rejection is the WHOLE guard, deliberately. The first cut of #B446 also
      * skipped inherited enumerable source properties, which broke every entity in
-     * the model registry: lib/model.js setModel round-trips entity instances
-     * through merge, and all six SQL connectors attach their .sql-derived query
-     * methods to the PROTOTYPE, so an own-only copy silently dropped them
+     * the model registry: the model layer round-trips entity instances through
+     * merge — the in-tree path is the relations assembly (core/model/entity.js),
+     * and the registry's setModel (lib/model.js), while it has no in-tree caller,
+     * is published through the modelUtil context and stays consumer-reachable —
+     * and all six SQL connectors attach their .sql-derived query methods to the
+     * PROTOTYPE, so an own-only copy silently dropped them
      * (`db.xEntity.getOneById is not a function`). merge therefore copies the
      * chain, as it always has; only these three key names are refused.
      *
@@ -684,8 +687,22 @@ function Merge() {
 
         var hasOwn              = {}.hasOwnProperty;
         var hasOwnConstructor   = hasOwn.call(obj, 'constructor');
-        // added test for node > v6
-        var hasMethodPrototyped = ( typeof(obj.constructor) != 'undefined' ) ? hasOwn.call(obj.constructor.prototype, 'isPrototypeOf') : false;
+        // #B450 — compute lazily, restoring the original short-circuit. An OWN
+        // `constructor` key (the shape JSON.parse yields for
+        // `{"constructor": <primitive|null|{}|[]>}`) shadows
+        // Object.prototype.constructor, so the eager read
+        // `obj.constructor.prototype` was undefined (or threw outright for null)
+        // and `hasOwn.call(undefined, ...)` crashed the whole merge —
+        // request-reachable, since PUT bodies reach merge as the source. When the
+        // object HAS an own constructor the rejection branch below cannot fire,
+        // so the value is never needed; when it lacks one, guard the `.prototype`
+        // read. A 24-shape differential sweep pins identical answers on every
+        // input the old form did not crash on (test/lib/merge-b450.test.js).
+        // was: var hasMethodPrototyped = ( typeof(obj.constructor) != 'undefined' ) ? hasOwn.call(obj.constructor.prototype, 'isPrototypeOf') : false;
+        var hasMethodPrototyped = false;
+        if ( !hasOwnConstructor && typeof(obj.constructor) != 'undefined' ) {
+            hasMethodPrototyped = ( obj.constructor.prototype ) ? hasOwn.call(obj.constructor.prototype, 'isPrototypeOf') : false;
+        }
 
 
         if (

package/framework/v0.6.23/lib/security-headers-emitter/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "gina-lib-security-headers-emitter",
+  "version": "1.0.0",
+  "description": "Engine-agnostic security-header emission (#OW1)",
+  "authors": [
+    {
+      "name": "Martin Luther ETOUMAN NDAMBWE",
+      "email": "contact@gina.io"
+    }
+  ],
+  "copyright": "Copyright (c) 2009-2026 Rhinostone <contact@gina.io>",
+  "engines": {
+    "node": ">=0.10.22"
+  },
+  "main": "src/main",
+  "license": "MIT",
+  "readmeFilename": "README.md"
+}

package/framework/v0.6.23/lib/security-headers-emitter/src/main.js

@@ -0,0 +1,225 @@
+'use strict';
+/**
+ * @module lib/security-headers-emitter
+ * @description #OW1 — engine-agnostic security-header emission (OWASP A02).
+ *
+ * WHY THIS EXISTS AT THE FRAMEWORK LAYER, not as a mounted middleware.
+ * The `#HDR1-14` plugins are express middleware, and gina's DEFAULT engine is
+ * `isaac`, which never runs the express middleware chain for HTTP responses:
+ * `server.use()` stores functions in `server._expressMiddlewares`, and the ONLY
+ * consumer is the WebSocket session binder, which name-filters the chain down to
+ * `session` / `ginaSessionAbsoluteTimeout` and runs it against an inert response
+ * whose header methods are all no-ops (measured 2026-09-02). So scaffolding
+ * `app.use(gina.plugins.SecurityHeaders())` would emit ZERO headers on the
+ * default engine — security theatre. This module is the same shape as the
+ * `#HDR8` hidePoweredBy gate, which was built framework-side for exactly this
+ * reason and is the established precedent.
+ *
+ * THE DEFAULT SET IS NARROWER THAN THE ORCHESTRATOR'S "SAFE SET", DELIBERATELY.
+ * The orchestrator's 12-plugin safe set is safe to MOUNT deliberately; it is not
+ * all safe to DEFAULT ON for every existing bundle. Four are opt-in here, each
+ * with a named breakage rather than a guess:
+ *   - `corp`  — MEASURED conflict: gina's own `/_gina/*` endpoints emit
+ *               `access-control-allow-origin: *` (metrics, health, SSE; the
+ *               Inspector's cross-origin GET/SSE channels are a documented
+ *               design), and CORP blocks cross-origin LOADING regardless of
+ *               CORS. See the `/_gina/*` exemption below.
+ *   - `hsts`  — emits regardless of transport (documented spec deviation), so
+ *               enabling it commits every https consumer's browsers to 180 days
+ *               without them asking.
+ *   - `coop`  — severs `window.opener`; breaks OAuth/payment popup flows.
+ *   - `xFrameOptions` — breaks a consumer who deliberately embeds their app
+ *               cross-origin. (gina itself uses no iframes — measured — so the
+ *               risk is consumer-facing only; this is the weakest of the four
+ *               and the cheapest to enable.)
+ *
+ * PRECEDENCE: first-writer-wins. Any header already present on the response is
+ * left alone, so an explicitly mounted plugin, an `env.json`
+ * `server.response.header` entry, or an upstream proxy always beats the
+ * framework default. This mirrors the plugins' own idempotent contract.
+ *
+ * @example
+ * // core/server.js (engine-agnostic, setHeader-based)
+ * var secHeaders = require('lib/security-headers-emitter');
+ * secHeaders.applyToResponse(conf.server.securityHeaders, request, response);
+ *
+ * // core/server.isaac.js (writeHead-based, header OBJECT)
+ * headers = secHeaders.applyToHeaders(options.securityHeaders, request, headers);
+ */
+
+/**
+ * The framework-emittable header set, with the values read from each `#HDR`
+ * plugin's own `HEADER_VALUE` / `DEFAULT_VALUE` (measured, never invented) so
+ * the framework default and the mounted plugin agree byte-for-byte.
+ *
+ * `onByDefault: false` entries are Tier B — available, opt-in per the rationale
+ * in the module docblock.
+ *
+ * @constant
+ * @type {Array<{key: string, header: string, value: string, onByDefault: boolean, ginaExempt: boolean}>}
+ * @private
+ */
+var HEADERS = [
+    // ── Tier A — on by default: cannot break a working application ──────────
+    { key: 'xContentTypeOptions',          header: 'x-content-type-options',            value: 'nosniff',                          onByDefault: true,  ginaExempt: false },
+    { key: 'xDownloadOptions',             header: 'x-download-options',                value: 'noopen',                           onByDefault: true,  ginaExempt: false },
+    { key: 'xPermittedCrossDomainPolicies',header: 'x-permitted-cross-domain-policies', value: 'none',                             onByDefault: true,  ginaExempt: false },
+    { key: 'xXssProtection',               header: 'x-xss-protection',                  value: '0',                                onByDefault: true,  ginaExempt: false },
+    { key: 'referrerPolicy',               header: 'referrer-policy',                   value: 'strict-origin-when-cross-origin',  onByDefault: true,  ginaExempt: false },
+    { key: 'xDnsPrefetchControl',          header: 'x-dns-prefetch-control',            value: 'off',                              onByDefault: true,  ginaExempt: false },
+    { key: 'originAgentCluster',           header: 'origin-agent-cluster',              value: '?1',                               onByDefault: true,  ginaExempt: false },
+
+    // ── Tier B — opt-in: each can break a legitimate deployment ─────────────
+    { key: 'xFrameOptions',                header: 'x-frame-options',                   value: 'SAMEORIGIN',                       onByDefault: false, ginaExempt: false },
+    // hsts value = the Hsts plugin's own default composition (max-age only —
+    // DEFAULT_MAX_AGE, no includeSubDomains/preload, which stay plugin/proxy
+    // territory; first-writer-wins defers to either). Parity is asserted in
+    // the tests against the plugin's exported builder, never retyped.
+    { key: 'hsts',                         header: 'strict-transport-security',         value: 'max-age=15552000',                 onByDefault: false, ginaExempt: false },
+    { key: 'coop',                         header: 'cross-origin-opener-policy',        value: 'same-origin',                      onByDefault: false, ginaExempt: true  },
+    // ginaExempt — see applyTo*: never applied to /_gina/*, which is
+    // deliberately cross-origin.
+    { key: 'corp',                         header: 'cross-origin-resource-policy',      value: 'same-origin',                      onByDefault: false, ginaExempt: true  }
+];
+
+/**
+ * `/_gina/*` is the framework's own control/observability surface and is
+ * DELIBERATELY cross-origin (`access-control-allow-origin: *` at the metrics,
+ * health and SSE endpoints; the Inspector's cross-origin GET/SSE channels are a
+ * documented design). A cross-origin-isolating header applied there would break
+ * gina's own endpoints even for a consumer who opted in knowingly — so the
+ * `ginaExempt` entries are skipped on that prefix regardless of configuration.
+ *
+ * @constant
+ * @type {RegExp}
+ * @private
+ */
+var GINA_PREFIX = /^\/_gina\//;
+
+/**
+ * Decide whether a given entry should be emitted for this request.
+ *
+ * @param {object}  entry  - a HEADERS row
+ * @param {object}  cfg    - the resolved `server.securityHeaders` config
+ * @param {string}  url    - `request.url` (may be undefined)
+ * @returns {boolean} true when the header should be written
+ * @private
+ */
+var shouldEmit = function(entry, cfg, url) {
+    var setting = cfg[entry.key];
+    var on = ( typeof(setting) == 'undefined' ) ? entry.onByDefault : (setting === true);
+    if ( !on ) { return false }
+    if ( entry.ginaExempt && typeof(url) == 'string' && GINA_PREFIX.test(url) ) { return false }
+    return true
+};
+
+/**
+ * Normalise the config block. Absent / non-object ⇒ defaults; `enabled: false`
+ * ⇒ the whole emitter is off (one key to restore pre-0.6.23 behaviour).
+ *
+ * @param {object|undefined} raw - `settings.json > server.securityHeaders`
+ * @returns {object|null} the config, or null when disabled entirely
+ * @private
+ */
+var resolveConfig = function(raw) {
+    var cfg = ( raw && typeof(raw) == 'object' ) ? raw : {};
+    if ( cfg.enabled === false ) { return null }
+    return cfg
+};
+
+/**
+ * Apply to a `setHeader`-based response (the engine-agnostic `core/server.js`
+ * path — routed responses, static serves, framework error pages, both engines).
+ *
+ * First-writer-wins: an already-present header is never overwritten.
+ *
+ * @param {object|undefined} raw      - `server.securityHeaders` config
+ * @param {object}           request  - the incoming request (read for `.url`)
+ * @param {object}           response - the outgoing response
+ * @returns {void}
+ * @example
+ * applyToResponse(conf.server.securityHeaders, request, response);
+ */
+var applyToResponse = function(raw, request, response) {
+    var cfg = resolveConfig(raw);
+    if ( !cfg || !response || typeof(response.setHeader) != 'function' ) { return }
+    if ( response.headersSent ) { return }
+
+    var url = ( request && typeof(request.url) == 'string' ) ? request.url : undefined;
+
+    for (var i = 0, len = HEADERS.length; i < len; ++i) {
+        var entry = HEADERS[i];
+        if ( !shouldEmit(entry, cfg, url) ) { continue }
+        // first-writer-wins — a mounted plugin, an env.json
+        // `server.response.header` entry or an upstream proxy always wins.
+        if ( typeof(response.getHeader) == 'function' && response.getHeader(entry.header) ) { continue }
+        response.setHeader(entry.header, entry.value);
+    }
+};
+
+/**
+ * Apply to a plain header OBJECT (the isaac `writeHead` path — 31 emit sites
+ * funnel through `_setPoweredByHeader`, which `writeHead` commits directly,
+ * bypassing `setHeader` entirely).
+ *
+ * @param {object|undefined} raw     - `server.securityHeaders` config
+ * @param {object}           request - the incoming request (read for `.url`)
+ * @param {object}           headers - the header map about to be written
+ * @returns {object} the same map, mutated and returned for chaining
+ * @example
+ * headers = applyToHeaders(options.securityHeaders, request, headers);
+ */
+var applyToHeaders = function(raw, request, headers) {
+    var cfg = resolveConfig(raw);
+    if ( !cfg || !headers || typeof(headers) != 'object' ) { return headers }
+
+    var url = ( request && typeof(request.url) == 'string' ) ? request.url : undefined;
+
+    // Header maps here are written by hand at each writeHead site with mixed
+    // casing, so the present-check is case-insensitive — a same-header-different-
+    // case entry must still win, or the response carries it twice.
+    var present = {};
+    for (var k in headers) {
+        if ( Object.prototype.hasOwnProperty.call(headers, k) ) { present[String(k).toLowerCase()] = true }
+    }
+
+    for (var i = 0, len = HEADERS.length; i < len; ++i) {
+        var entry = HEADERS[i];
+        if ( !shouldEmit(entry, cfg, url) ) { continue }
+        if ( present[entry.header] ) { continue }
+        headers[entry.header] = entry.value;
+    }
+    return headers
+};
+
+/**
+ * Apply to a header OBJECT that is known to belong to a `/_gina/*` endpoint.
+ *
+ * Every one of isaac's `_setPoweredByHeader()` call sites is a `/_gina/*`
+ * endpoint (measured 29/29, 2026-09-02), and those are deliberately
+ * cross-origin: the metrics/health/SSE handlers emit
+ * `access-control-allow-origin: *`, and the Inspector's cross-origin GET/SSE
+ * channels are a documented design. So the cross-origin-isolating headers are
+ * exempted unconditionally here rather than threading `request` through 29
+ * writeHead sites — an explicit function beats a synthetic request object.
+ *
+ * @param {object|undefined} raw     - `server.securityHeaders` config
+ * @param {object}           headers - the header map about to be written
+ * @returns {object} the same map, mutated and returned for chaining
+ * @example
+ * headers = applyToGinaEndpointHeaders(options.securityHeaders, headers);
+ */
+var applyToGinaEndpointHeaders = function(raw, headers) {
+    return applyToHeaders(raw, { url: '/_gina/' }, headers);
+};
+
+module.exports = {
+    applyToResponse            : applyToResponse,
+    applyToHeaders             : applyToHeaders,
+    applyToGinaEndpointHeaders : applyToGinaEndpointHeaders,
+    // Exposed for unit testing. Do not rely on these in application code.
+    _HEADERS        : HEADERS,
+    _GINA_PREFIX    : GINA_PREFIX,
+    _shouldEmit     : shouldEmit,
+    _resolveConfig  : resolveConfig
+};

package/framework/v0.6.23/lib/sri/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "gina-lib-sri",
+  "version": "1.0.0",
+  "description": "Subresource Integrity attribute computation for emitted asset tags (#OW3)",
+  "authors": [
+    {
+      "name": "Martin Luther ETOUMAN NDAMBWE",
+      "email": "contact@gina.io"
+    }
+  ],
+  "copyright": "Copyright (c) 2009-2026 Rhinostone <contact@gina.io>",
+  "engines": {
+    "node": ">=0.10.22"
+  },
+  "main": "src/main",
+  "license": "MIT",
+  "readmeFilename": "README.md"
+}

package/framework/v0.6.23/lib/sri/src/main.js

@@ -0,0 +1,237 @@
+/**
+ * Gina — Subresource Integrity (SRI) attribute computation (#OW3, OWASP A08).
+ *
+ * Computes `integrity="sha384-<base64>" crossorigin="anonymous"` attribute
+ * strings for same-origin `<script>` and `<link rel="stylesheet">` tags whose
+ * files resolve on disk, so a tampered or truncated asset is refused by the
+ * browser instead of executed. Opt-in per bundle via `templates.json >
+ * "_common" > "sriEnabled": true` — the controller's resource builder calls
+ * this module for every declared asset when that flag is set.
+ *
+ * DESIGN INVARIANTS — each is deliberate, none is incidental:
+ *
+ * - FAIL-OPEN, always. Any condition that prevents an honest hash — external
+ *   URL, unresolvable path, unreadable file, missing configuration — yields
+ *   an EMPTY attribute string, never a guessed or partial hash. An asset
+ *   without `integrity` loads exactly as before; an asset with a wrong
+ *   `integrity` is hard-blocked by the browser. Emitting nothing is the safe
+ *   degradation by construction.
+ * - STAT-VALIDATED CACHE. Hashes are cached per absolute file path, keyed by
+ *   `mtimeMs` + `size`, and re-validated with one `fs.statSync` per lookup.
+ *   A rebuilt or re-baked asset therefore gets a fresh hash on the next
+ *   render with no process restart — the emission side can never serve a
+ *   stale hash for the bytes on disk. (Pages already stored by the
+ *   render/output cache keep the hash they were rendered with; flushing that
+ *   cache after an asset rebuild remains the operator's step.)
+ * - sha384, HARDCODED. 48-byte digests base64-encode to exactly 64 characters
+ *   with ZERO `=` padding — a measured safety property: the server-side asset
+ *   catalog extracts URLs with an unanchored `(src|href|srcset)=` scan, and a
+ *   padding-free alphabet makes a false `src="` match inside a hash value
+ *   structurally impossible. A configurable algorithm (e.g. sha512, whose
+ *   base64 IS padded) would reopen that hazard, so no knob ships.
+ *
+ * The cache is module-scope state and this module is registered with a PLAIN
+ * `require` in the lib registry — it must not be hot-swapped per request in
+ * dev mode (the securityHeadersEmitter / authn precedent for security-bearing
+ * leaves), and the cache is only ever a recomputation saver, so staleness
+ * across reload boundaries cannot occur by construction.
+ *
+ * @module sri
+ */
+'use strict';
+
+var fs      = require('fs');
+var crypto  = require('crypto');
+
+/**
+ * Digest algorithm. Fixed on purpose — see the module header for the
+ * padding-free safety property that pins it to sha384.
+ *
+ * @constant
+ * @type {string}
+ * @private
+ */
+var ALGORITHM = 'sha384';
+
+/**
+ * Stat-validated integrity cache.
+ * Key: absolute file path. Value: `{ mtimeMs, size, integrity }`.
+ * Bounded in practice by the number of distinct assets declared across the
+ * bundle's `templates.json` collections (typically a few dozen), so no
+ * eviction is needed.
+ *
+ * @type {object}
+ * @private
+ */
+var _cache = {};
+
+/**
+ * @typedef {object} SriBundleConf
+ * @property {string} publicPath - Absolute path of the bundle's public dir;
+ *                                 the fallback root for URL→disk resolution.
+ * @property {object} [content] - Bundle content configuration slice.
+ * @property {object} [content.statics] - Exact-match URL→absolute-path
+ *                                        overrides (from `statics.json`);
+ *                                        consulted before `publicPath`.
+ */
+
+/**
+ * Computes the SRI integrity value for a file on disk.
+ *
+ * Reads the file synchronously and returns `sha384-<base64>` on success.
+ * Returns `null` — never throws — when the file cannot be read: the caller
+ * treats `null` as "emit no attribute" (fail-open).
+ *
+ * A stat-validated cache makes repeat calls cheap: one `fs.statSync` per
+ * call, and the file is only re-read when its `mtimeMs` or `size` moved.
+ *
+ * @function computeIntegrity
+ * @memberof module:sri
+ * @param {string} filePath - Absolute path of the asset file.
+ * @returns {string|null} `sha384-<base64>` (64 base64 chars, no padding), or
+ *                        `null` when the file is missing or unreadable.
+ *
+ * @example
+ * var sri = require('lib/sri');
+ * sri.computeIntegrity('/var/app/public/js/app.js');
+ * // => 'sha384-agv0K0aWLDzvDxoOWEsm2s7uAUYBgObriGygDyUIi7eQ/fZ00JWCG74nfkKG5qtv'
+ *
+ * @example
+ * // Missing file — fail-open, no throw
+ * sri.computeIntegrity('/var/app/public/js/deleted.js'); // => null
+ */
+var computeIntegrity = function(filePath) {
+    var stats = null;
+    try {
+        stats = fs.statSync(filePath);
+    } catch (statErr) {
+        return null;
+    }
+    if ( !stats.isFile() ) {
+        return null;
+    }
+
+    var cached = _cache[filePath];
+    if (
+        cached
+        && cached.mtimeMs === stats.mtimeMs
+        && cached.size === stats.size
+    ) {
+        return cached.integrity;
+    }
+
+    var content = null;
+    try {
+        content = fs.readFileSync(filePath);
+    } catch (readErr) {
+        return null;
+    }
+
+    var integrity = ALGORITHM + '-' + crypto.createHash(ALGORITHM).update(content).digest('base64');
+    _cache[filePath] = {
+        mtimeMs   : stats.mtimeMs,
+        size      : stats.size,
+        integrity : integrity
+    };
+
+    return integrity;
+};
+
+/**
+ * Builds the attribute string to splice into an emitted asset tag.
+ *
+ * Returns ` integrity="sha384-..." crossorigin="anonymous"` — note the
+ * LEADING SPACE, so the caller concatenates it directly before the tag's
+ * closing bracket — or the EMPTY STRING whenever no honest hash can be
+ * produced (fail-open). Never throws.
+ *
+ * Skipped (empty string returned) for:
+ * - external URLs (`scheme://` or protocol-relative `//host/...`) — their
+ *   bytes are not on this disk;
+ * - URLs that resolve to no readable file under the exact-match statics map
+ *   or the bundle `publicPath` (directory-mapped statics resolve nowhere
+ *   here and are deliberately left uncovered rather than guessed at);
+ * - missing or incomplete bundle configuration.
+ *
+ * URL handling before resolution: any `?query` / `#fragment` suffix is
+ * stripped, and when the emitted URL was prefixed with the bundle webroot
+ * (the resource builder mutates URLs that way when a webroot is configured),
+ * the prefix is stripped back off so resolution happens against the
+ * webroot-free public URL.
+ *
+ * @function getIntegrityAttributes
+ * @memberof module:sri
+ * @param {string} url - The asset URL exactly as it will be emitted in the
+ *                       tag (possibly webroot-prefixed).
+ * @param {SriBundleConf} conf - Bundle/env configuration slice (needs
+ *                               `publicPath`; `content.statics` optional).
+ * @param {string} [webroot='/'] - The bundle webroot; a value other than
+ *                                 `'/'` is stripped off `url` when `url`
+ *                                 starts with it.
+ * @returns {string} ` integrity="..." crossorigin="anonymous"`, or `''`.
+ *
+ * @example
+ * var sri = require('lib/sri');
+ * sri.getIntegrityAttributes('/js/vendor/gina/gina.min.js', conf, '/');
+ * // => ' integrity="sha384-..." crossorigin="anonymous"'
+ *
+ * @example
+ * // External URL — never hashed from disk
+ * sri.getIntegrityAttributes('https://cdn.example.com/lib.js', conf, '/');
+ * // => ''
+ *
+ * @example
+ * // Webroot-prefixed URL: '/myapp/js/app.js' resolves as '/js/app.js'
+ * sri.getIntegrityAttributes('/myapp/js/app.js', conf, '/myapp/');
+ */
+var getIntegrityAttributes = function(url, conf, webroot) {
+    if ( typeof(url) != 'string' || !url ) {
+        return '';
+    }
+    // External assets: scheme-qualified or protocol-relative — not ours to hash.
+    if ( /:\/\//.test(url) || url.substring(0, 2) === '//' ) {
+        return '';
+    }
+    if ( !conf || typeof(conf.publicPath) != 'string' || !conf.publicPath ) {
+        return '';
+    }
+
+    // The on-disk identity ignores query/fragment suffixes.
+    var urlPath = url.split(/[?#]/)[0];
+
+    // Undo the resource builder's webroot prefixing so resolution happens
+    // against the webroot-free public URL.
+    if (
+        typeof(webroot) == 'string'
+        && webroot.length > 1
+        && webroot !== '/'
+        && urlPath.substring(0, webroot.length) === webroot
+    ) {
+        urlPath = '/' + urlPath.substring(webroot.length);
+    }
+
+    // Exact-match statics mapping wins over the publicPath fallback — same
+    // precedence as the server's static resolver.
+    var filePath = null;
+    if (
+        conf.content
+        && conf.content.statics
+        && typeof(conf.content.statics[urlPath]) == 'string'
+    ) {
+        filePath = conf.content.statics[urlPath];
+    } else {
+        filePath = conf.publicPath + urlPath;
+    }
+
+    var integrity = computeIntegrity(filePath);
+    if (!integrity) {
+        return '';
+    }
+
+    return ' integrity="'+ integrity +'" crossorigin="anonymous"';
+};
+
+module.exports = {
+    computeIntegrity        : computeIntegrity,
+    getIntegrityAttributes  : getIntegrityAttributes
+};

package/framework/{v0.6.22 → v0.6.23}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "dependencies": {
     "@rhinostone/busboy": "^1.6.1",
     "@rhinostone/swig": "^2.7.2",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.6.22/core/gna');
+var _gna = require('./framework/v0.6.23/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.6.22/core/controller');
-var EntitySuper     = require('./framework/v0.6.22/core/model/entity');
+var SuperController = require('./framework/v0.6.23/core/controller');
+var EntitySuper     = require('./framework/v0.6.23/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.6.22/lib/uuid');
+var uuid = require('./framework/v0.6.23/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -1039,4 +1039,5 @@ Dev-mode query instrumentation captures every database query tied to the current
 318. **Validator AJAX bodies are JSON — the Content-Type must say so, on every sender (#FORMCT; query path fixed in #B425).** The browser validator serializes its request bodies with `JSON.stringify`, but its shared `xhrOptions` defaults hardcode `Content-Type: application/x-www-form-urlencoded; charset=UTF-8` (that literal appears exactly once in the whole shipped bundle). When a JSON body goes out under that label the gina server correctly honours it and runs `body.replace(/\+/g, ' ')` plus `decodeURIComponent` BEFORE `JSON.parse` — so a value such as an email `+alias` arrives with the `+` turned into a space. **The failure is silent by construction:** the mangled body is still well-formed JSON, so it parses, no error is raised, and the endpoint answers `200` with a wrong answer. The server half is NOT the bug — for a genuine urlencoded body `+` really does mean space and `%2B` survives the decode — so every fix belongs on the client, at the labelling. **Rule for any new sender: if the body is JSON, resolve the Content-Type as `explicit author declaration, else application/json` — never let the urlencoded default ride a JSON body.** The senders and their state: the form-submit non-binary path and the file-removal POST resolve it correctly (they read an explicit form `enctype` first, else `application/json`); the multipart/binary path sets its own boundary header; a bodiless branch sets a header but sends nothing, so nothing can be corrupted; and the `query` (live-check) request in `core/plugins/lib/validator/src/form-validator.js` was the last one still inheriting the default — fixed by mirroring the same resolution. **Implementation gotcha specific to the query path:** the rule author can override the header per rule (`"headers": { "Content-Type": "application/json" }` inside a rule's `query` block, a supported seam), and that override must keep winning — but the options merge folds the rule block and the defaults into one object, after which a rule-declared `urlencoded` and the inherited default are the same string in the same slot. Provenance is unrecoverable post-merge, so the rule-declared value must be captured BEFORE the merge and consulted afterwards. **Behaviour note at pickup:** live-check bodies now route to the server's parse-verbatim JSON branch, so `+` survives — and `%XX` sequences are no longer URL-decoded either. The client stringifies raw field values without percent-encoding, so no correct consumer depends on that decode, but a bundle that leaned on it will see the literal. **Merge semantics this relies on (measured, and undocumented in the merge JSDoc):** `lib/merge` is variadic — it reads `override` off the LAST argument only when that argument is a boolean, and treats every other argument as an additional source, with EARLIER sources winning and later ones filling gaps. That is why a per-rule header beats the default, and why passing a third object is a merge rather than an override flag.
 319. **Controller render data — the dotted-path `set()` contract, and why a first write must never be walked (#P39 slice 2).** Inside `core/controller/controller.js`, every render is preceded by ~60 calls to a local `set('a.b.c', value)` that builds `local.userData` (`page.view.*`, `page.environment.*`, `page.forms`, `gina.csrfToken`, …). Its contract: missing intermediates are created as plain objects and an intermediate that is not a plain object (`null`, an array, a primitive) is REPLACED; at the leaf, **first write wins** (a later `set()` to an existing leaf is ignored — the `override` argument is accepted but inert), an object written onto an existing object leaf **deep-fills** it (missing keys added, existing kept) through `lib/merge`, and **a first-write value is stored by reference and is never walked, copied or mutated**. That last clause is the load-bearing one: `set('page.forms', conf.content.forms)` stores the shared per-process forms catalog, and the previous implementation — a JSON-string path builder + `JSON.parse` + a whole-subtree `merge` — recursed into every grafted object, re-merged each array inside it with itself, and wrote the copies back into the caller's object: 0.4–1.5 ms of CPU per request for a real catalog, and the catalog's arrays silently swapped for equal copies on every render. (That lib-level rewrite of a grafted source — array identity churn at every depth plus SILENT PRIMITIVE DEDUPE — was #B428, fixed in 0.6.19: `lib/merge` now skips a subtree that is the SAME object on both sides — merging a value into itself is identity — so a grafted source keeps its arrays and duplicates and the result references it; object/array references only, equal primitives keep their path; the root-absent `createMode` shallow-copy path is deliberately unchanged. Measured on a 2000-case seeded corpus: identical results and untouched sources for every non-shared merge. Two by-catches were staked out of it: #B436 — FIXED in 0.6.20: staked as 'nested arrays at depth ≥ 2 merge TWICE' (`[1,2,3,4,3,4]`), the MEASURED root was `mergeArray`'s number top-up deciding 'push again' by INDEX rather than by COUNT — any number the target already held at a shifted index was pushed again at EVERY depth (`merge([9,1],[1])` → `[9,1,1]`; `{ports:[8080,8124]}`+`{ports:[8124]}` → `[8080,8124,8124]`), and the depth-≥2 double pass (`browse()` merged arrays in its prop loop and again in the recursion) merely manufactured the shift; the top-up now compares counts (`[25]`+`[25,25]` still `[25,25]`, a present value is never pushed again, merging the same source twice is a no-op) and the prop-loop array merge runs only on the createMode path, so a nested array is merged once and an array SHARED by both sides at depth ≥ 2 keeps its identity (a #B428 residual); #B437 — FIXED in 0.6.20: a target array repeating a primitive (`['v2','v2']`) merged with an array of objects threw `TypeError: Cannot create property 'id' on string`, because `mergeArray`'s object-fill branch tested for a free index on the DEDUPED rebuild of the target and then wrote into the real target, whose index still held the string (or `null`); an occupied index is now left alone, as it already was for an object landing on one.) The rewrite assigns a first write directly and routes only genuine collisions through `merge` at the leaf, so the observable structure is identical (11,550 states differential-tested against the frozen old implementation) while the catalog is left alone; measured ×4.5 on the primitive writes and ×800+ on the catalog write. **Two generalisable traps from that work.** (1) Until 0.6.19 `lib/merge` MUTATED A SOURCE IT GRAFTED: a source subtree grafted by reference at an existing level was walked by the recursion with `src === copy`, every array inside it re-merged with itself and the copies written back into the caller's object — contents preserved, identity churned, cost proportional to the value. #B428's identity guard closed it, and the lesson stands for any merge-like helper that walks a caller's object by reference: measure identity through it before handing it an object you must keep intact. (2) `lib/merge` is VARIADIC and its copy behaviour depends on depth and shape: a value at depth 1 of a call is shallow-copied, deeper values are referenced (and until 0.6.20 a nested array was merged twice on the same level — once in the graft loop, once in the recursion). The array contract is now in its JSDoc (#B436); still read `browse()` before reasoning about identity through merge, and prefer a measured differential test over a model of it.
 320. **`route.request()` settles its caller exactly once - an outbound-request failure is an error argument, never a hang and never a bundle kill (#B442, 0.6.21).** The routing helper's outbound call (`getRoute(...).request([ignoreWebRoot,] options[, cb])`) DISCARDED the `ClientRequest` returned by `http(s).get`, so nothing could ever attach an `'error'` listener to it. Three consequences, all removed: (a) a dial failure whose code is carved out of the process-level uncaughtException handler (`ECONNREFUSED`/`ECONNRESET`/`EPIPE`/...) left the caller waiting FOREVER with nothing logged - a permanent wedge in any serialized consumer (a worker at concurrency 1, a queue processor), and the SILENCE is the defect, not the carve-out; (b) a code that is NOT carved out (`ETIMEDOUT`, `EHOSTUNREACH`, `ENETUNREACH` - i.e. a peer that stops answering or a route that goes away) escalated to `uncaughtException` and took the bundle down through the process-level `dismiss(pid, 'SIGTERM')`; (c) a response stream dying mid-body assigned its error to a local and waited for an `'end'` event that never arrives, so the assigned error was never delivered either. All four exit paths now run through ONE single-settle latch (`settled` flag + `settle()`), so the callback receives an ordinary error argument - the shape consuming code already handles - and can never be invoked twice. **`options.timeout` was INERT and looked like a consumer workaround:** it does reach `http(s).get`, but Node only EMITS `'timeout'` and never destroys the socket, and the request object was unreachable, so nobody could listen or act. It is now honoured - on expiry the request is destroyed and the callback settles with an `Error` carrying `code === 'ETIMEDOUT'`; absent/falsy `options.timeout` attaches no timeout listener, so the behaviour is opt-in. The no-callback (fire-and-forget) branch attaches its own `'error'` listener and `console.warn`s, so a call nobody awaited can no longer kill the process. Same defect class as the `store()` / `copyFile` movers (#B223/#B227): capture every request or stream you create, listen on BOTH ends, and latch the settle. **`lib/routing` IS browser-bundled** (aliased in the plugin `build.json`), so this ships in `gina.min.js` as well as server-side - pickup is a bundle restart AND a re-bake. Regression test: `test/lib/routing-request-settle.test.js` - source pins plus extract-and-execute behavioural arms driving the real shipped bytes against a fake agent; note the function region is brace-UNBALANCED (a `/^\{/` regex literal in the end handler), so the extraction is terminator-anchored on `} // EO route.request()` and a brace walker must NOT be substituted for it.
-321. **`merge()` array-element hardening - a null (or hole) element in an id-keyed array is an element with no key, never a crash (#B436/#B437/#B443 arc).** `typeof null == 'object'`, so `mergeArray`'s collection paths historically dereferenced null elements and threw `TypeError: Cannot read properties of null` - and because every configuration overlay and collection merge travels through `lib/merge`, any such shape was a whole-merge (often whole-boot) kill. The hardened contract, in layers: the WRITE side (0.6.20) - the index-merge branch tests for a free slot on the real target, and an occupied slot (a primitive or null left where the deduped rebuild had a hole) is skipped, never written into; number top-up is by COUNT, not index, so merges are idempotent (`[25]+[25,25]` gives `[25,25]`, `[9,1]+[1]` stays `[9,1]`). The READ side (0.6.21) - both collection ENTRY guards null-check the TARGET operand (they already checked the source), both id-ROSTER loops and both WALKS skip a null element, and the per-element collection tests null-check the SOURCE operand; a null element matches nothing, blocks nothing and contributes nothing. Semantics otherwise unchanged and pinned: a target whose slots are primitives/null keeps them (`[null,null]+[{id:1},{id:2}]` returns `[null,null]`, same as `['v2','v2']+...`), and an object BEHIND a primitive/null head is dropped by the per-element branch (pre-existing, `['x',{id:9}]+[{id:1}]` returns `['x']`). `lib/merge` is browser-bundled (aliased in the plugin `build.json`), so array-merge fixes ship in `gina.min.js` too - pickup is a bundle restart AND a re-bake. Regression suites: `test/lib/merge-b436.test.js`, `merge-b437.test.js`, `merge-b443.test.js` (behavioural arms driving the real lib + comment-stripped source pins + artifact-derived dist pins, all red-first validated). **#B446 — the same `for...in` loops are also a prototype-pollution sink.** `merge()` enumerated SOURCE keys with bare `for...in` at five sites (`:136`, `:197`, `:208`, `:237`, `:547` pre-fix; the lone `hasOwnProperty` at `:548` guards the TARGET, not the source), so an OWN `__proto__` key — exactly what `JSON.parse` yields, and what `core/server.js:6657` feeds it on the PUT path — walked through to `Object.prototype`. ⚠️ Subtler still: merge reads `src = target[name]` THROUGH the prototype chain, so with its documented target-wins-on-conflict rule a polluted value BEAT a default the source literal owned (measured: `rejectUnauthorized` flipping true→false on the query-options defaults). All five loops now reject `__proto__`/`constructor`/`prototype` BY NAME — that name check is the whole guard, and it is REQUIRED because own-property checking alone cannot see a JSON-parsed `__proto__` (an own key satisfies an own check by construction). ⚠️ The first cut ALSO skipped non-own keys as extra hardening and that was REVERTED before release: `lib/model.js` setModel round-trips entity instances through `merge()`, and all six SQL connectors attach their `.sql`-derived query methods to the PROTOTYPE, so own-only copying silently dropped every query method (`db.<x>Entity.getOneById is not a function`) while constructor-assigned methods survived — a partial, hard-to-attribute breakage caught by a consumer on the unpublished tree, never shipped. `merge()` walks the prototype chain, as it always has; only the three key names are refused. Regression suite: `test/lib/merge-entity-prototype.test.js` (red-first validated against the own-guard build). The `src`-read is deliberately left prototype-reachable — closing it would change documented conflict semantics for objects that legitimately inherit, and is tracked separately.
+321. **`merge()` array-element hardening - a null (or hole) element in an id-keyed array is an element with no key, never a crash (#B436/#B437/#B443 arc).** `typeof null == 'object'`, so `mergeArray`'s collection paths historically dereferenced null elements and threw `TypeError: Cannot read properties of null` - and because every configuration overlay and collection merge travels through `lib/merge`, any such shape was a whole-merge (often whole-boot) kill. The hardened contract, in layers: the WRITE side (0.6.20) - the index-merge branch tests for a free slot on the real target, and an occupied slot (a primitive or null left where the deduped rebuild had a hole) is skipped, never written into; number top-up is by COUNT, not index, so merges are idempotent (`[25]+[25,25]` gives `[25,25]`, `[9,1]+[1]` stays `[9,1]`). The READ side (0.6.21) - both collection ENTRY guards null-check the TARGET operand (they already checked the source), both id-ROSTER loops and both WALKS skip a null element, and the per-element collection tests null-check the SOURCE operand; a null element matches nothing, blocks nothing and contributes nothing. Semantics otherwise unchanged and pinned: a target whose slots are primitives/null keeps them (`[null,null]+[{id:1},{id:2}]` returns `[null,null]`, same as `['v2','v2']+...`), and an object BEHIND a primitive/null head is dropped by the per-element branch (pre-existing, `['x',{id:9}]+[{id:1}]` returns `['x']`). `lib/merge` is browser-bundled (aliased in the plugin `build.json`), so array-merge fixes ship in `gina.min.js` too - pickup is a bundle restart AND a re-bake. Regression suites: `test/lib/merge-b436.test.js`, `merge-b437.test.js`, `merge-b443.test.js` (behavioural arms driving the real lib + comment-stripped source pins + artifact-derived dist pins, all red-first validated). **#B446 — the same `for...in` loops are also a prototype-pollution sink.** `merge()` enumerated SOURCE keys with bare `for...in` at five sites (`:136`, `:197`, `:208`, `:237`, `:547` pre-fix; the lone `hasOwnProperty` at `:548` guards the TARGET, not the source), so an OWN `__proto__` key — exactly what `JSON.parse` yields, and what `core/server.js:6657` feeds it on the PUT path — walked through to `Object.prototype`. ⚠️ Subtler still: merge reads `src = target[name]` THROUGH the prototype chain, so with its documented target-wins-on-conflict rule a polluted value BEAT a default the source literal owned (measured: `rejectUnauthorized` flipping true→false on the query-options defaults). All five loops now reject `__proto__`/`constructor`/`prototype` BY NAME — that name check is the whole guard, and it is REQUIRED because own-property checking alone cannot see a JSON-parsed `__proto__` (an own key satisfies an own check by construction). ⚠️ The first cut ALSO skipped non-own keys as extra hardening and that was REVERTED before release: the model layer round-trips entity instances through `merge()` — the in-tree path is the relations assembly (`core/model/entity.js`); the registry's `setModel` (`lib/model.js`) has no in-tree caller but is published through the `modelUtil` context and stays consumer-reachable — and all six SQL connectors attach their `.sql`-derived query methods to the PROTOTYPE, so own-only copying silently dropped every query method (`db.<x>Entity.getOneById is not a function`) while constructor-assigned methods survived — a partial, hard-to-attribute breakage caught by a consumer on the unpublished tree, never shipped. `merge()` walks the prototype chain, as it always has; only the three key names are refused. Regression suite: `test/lib/merge-entity-prototype.test.js` (red-first validated against the own-guard build). The `src`-read is deliberately left prototype-reachable — closing it would change documented conflict semantics for objects that legitimately inherit, and is tracked separately. **#B450 — the plain-object check itself CRASHED on shadowed `constructor` keys (pre-existing, measured identical on shipped 0.6.21).** `isObject()`'s eager `hasMethodPrototyped` compute (a "node > v6" edit that broke jQuery isPlainObject's short-circuit) read `.prototype` off an OWN `constructor` value, so `{"job":{"constructor":<primitive|null|{}|[]>}}` — FIVE measured shapes — threw `Cannot convert undefined or null to object` from any PUT body BEFORE the key filter could drop the name (the guard rejects keys at COPY time; this crash fired in the type predicate deciding recursion, one level up). Fixed by restoring the lazy short-circuit and guarding the `.prototype` read; a 24-shape differential sweep pins IDENTICAL answers on every input the old form did not crash on — so the recurse-vs-graft routing (plain objects recurse into fresh clones; class instances and functions graft by REFERENCE, which config singletons and instance registries rely on) is unchanged, and every crash shape now yields the disclosed drop-the-key behaviour with sibling fields surviving. Regression suite: `test/lib/merge-b450.test.js` (red-first: the five crash arms + boolean sibling fail on the pre-fix predicate; pollution/entity/graft controls green on both revisions).
+322. **OWASP Top 10 response — framework-side security headers, request-body bounds, opt-in SRI (#OW1/#OW2/#OW3, 0.6.23).** Three framework-layer hardenings shipped together. **#OW1 headers:** `settings.json > server.securityHeaders` — the framework itself emits security headers on BOTH engines, because the #HDR plugins are express middleware and the default isaac engine never runs the express chain for HTTP responses (`server.use` middlewares are only ever drained by the WebSocket session binder against an inert response), so a mounted `SecurityHeaders()` orchestrator emitted NOTHING there; the emitter (`lib/security-headers-emitter`) is the framework-side twin of the #HDR8 hidePoweredBy gate. Tier A on by default (cannot break a working app): x-content-type-options / x-download-options / x-permitted-cross-domain-policies / x-xss-protection / referrer-policy / x-dns-prefetch-control / origin-agent-cluster. Tier B opt-in, one key each, each with a NAMED breakage: xFrameOptions (cross-origin embedding) / coop (severs window.opener — OAuth/payment popups) / corp (conflicts with gina's own `access-control-allow-origin: *` on `/_gina/*`) / hsts (180-day commitment, emitted over http too). First-writer-wins (a mounted plugin / `env.json` header / upstream proxy beats the framework default); coop/corp never applied to `/_gina/*`; header VALUES are asserted in tests against each plugin's own exported constant so framework and mounted plugin cannot diverge; `server.hidePoweredBy` default flipped to `true` (note the render-cache interaction: with the cache enabled and `server.cache.name` unset, the boot warning about `Cache-Status` still naming the framework fires — set a token there). `server.securityHeaders.enabled: false` restores the previous behaviour. **#OW2 body bounds:** `server.maxBodySize` (`"64MB"`, ENFORCED: 413 + `request.destroy()`, plus a `_bodyRejected` guard on the `end` handler because destroy racing buffered chunks would otherwise double-respond) and `server.maxBodySizeWarn` (`"2MB"`, warn-only) bound non-multipart bodies counting RAW wire bytes (a multi-byte UTF-8 body is larger on the wire than its decoded string length); `0` disables either; B/KB/MB/GB accepted (bare number = MB); multipart stays under the `upload.*` caps; `server.timeout` is exposed and defaults to `0` DELIBERATELY — a finite whole-request clock kills SSE/WebSocket, and the slow-body case is closed by the cap. **#OW3 SRI:** `templates.json > "_common" > "sriEnabled": true` (default false, bare boolean per that file's `*Enabled` convention) makes the controller's resource builder add ` integrity="sha384-..." crossorigin="anonymous"` to same-origin `<script>` AND `<link rel=stylesheet>` tags whose files resolve on disk — including `gina.min.js`/`gina.min.css`, which ride the framework conf's `_common` collections through the same emission path. `lib/sri` is FAIL-OPEN always (external `://` and protocol-relative `//` URLs, unresolvable paths, unreadable files, missing conf → NO attribute, never a guess — an absent attribute loads as before, a wrong one hard-blocks); resolution = query/fragment strip → webroot un-prefix → `content.statics[url]` exact match → `publicPath + url` (directory-mapped statics resolve nowhere → fail-open, deliberate); the hash cache is STAT-VALIDATED (mtimeMs + size, one statSync per lookup) so a rebuilt/re-baked asset re-hashes on the next render with NO restart — but pages already stored by the render/output cache keep the hash they were rendered with, so flush that cache after an asset rebuild; the HTTP/2 preload hint is SUPPRESSED for SRI'd assets (a hint carries no integrity metadata — a mismatched preload is a wasted double-fetch); sha384 is HARDCODED as a measured safety property (48-byte digest → 64 base64 chars, ZERO `=` padding, keeping integrity values structurally inert to the asset catalog's unanchored `(src|href|srcset)=` scan — sha512's padded base64 would reopen that hazard, so no algorithm knob ships); coverage caveats, both fail-safe: popin re-creates injected scripts copying only `src` (SRI not enforced on popin-injected loads) and the client loader's dynamic gina.min.css injection is likewise uncovered. Pickup: all three are server-side — bundle restart, no dist rebuild (`lib/sri` is not browser-bundled).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -76,12 +76,12 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.6.22/core/gna",
+  "main": "./framework/v0.6.23/core/gna",
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
       "import": "./index.mjs",
-      "require": "./framework/v0.6.22/core/gna.js"
+      "require": "./framework/v0.6.23/core/gna.js"
     },
     "./gna": {
       "types": "./types/gna.d.ts",