gina 0.6.24 → 0.6.25

package/framework/{v0.6.24 → v0.6.25}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3173,6 +3173,8 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         'isStringMinLength': 'Should be at least %s characters',
         'isStringMaxLength': 'Should not be more than %s characters',
         'isJsonWebToken': 'Must be a valid JSON Web Token',
+        'isIban': 'A valid IBAN is required',
+        'isBic': 'A valid BIC is required',
         'query': 'Must be a valid response',
         // #B233 rider - dropped: `isApiError` is not a rule, so nothing ever consulted this
         // label. The API-error path assigns the SERVER's message straight onto the error
@@ -3181,6 +3183,30 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         //'isApiError': 'Condition not satisfied',
         'isInList': 'Must be one of: %s'
     };
+    /**
+     * ISO 13616 registry - official IBAN length per country code, consumed by
+     * the `isIban` rule. Countries absent from this table are validated on
+     * shape + MOD-97 checksum alone (deliberate: the registry grows over time
+     * and an unknown country must not hard-fail a well-formed IBAN).
+     * @constant
+     * @inner
+     * @type {Object.<string, number>}
+     */
+    var _ibanLengths = {
+        'AD': 24, 'AE': 23, 'AL': 28, 'AT': 20, 'AZ': 28, 'BA': 20, 'BE': 16,
+        'BG': 22, 'BH': 22, 'BI': 27, 'BR': 29, 'BY': 28, 'CH': 21, 'CR': 22,
+        'CY': 28, 'CZ': 24, 'DE': 22, 'DJ': 27, 'DK': 18, 'DO': 28, 'EE': 20,
+        'EG': 29, 'ES': 24, 'FI': 18, 'FK': 18, 'FO': 18, 'FR': 27, 'GB': 22,
+        'GE': 22, 'GI': 23, 'GL': 18, 'GR': 27, 'GT': 28, 'HR': 21, 'HU': 28,
+        'IE': 22, 'IL': 23, 'IQ': 23, 'IS': 26, 'IT': 27, 'JO': 30, 'KW': 30,
+        'KZ': 20, 'LB': 28, 'LC': 32, 'LI': 21, 'LT': 20, 'LU': 20, 'LV': 21,
+        'LY': 25, 'MC': 27, 'MD': 24, 'ME': 22, 'MK': 19, 'MN': 20, 'MR': 27,
+        'MT': 31, 'MU': 30, 'NI': 28, 'NL': 18, 'NO': 15, 'OM': 23, 'PK': 24,
+        'PL': 28, 'PS': 29, 'PT': 25, 'QA': 29, 'RO': 24, 'RS': 22, 'RU': 33,
+        'SA': 24, 'SC': 31, 'SD': 18, 'SE': 24, 'SI': 19, 'SK': 24, 'SM': 27,
+        'SO': 23, 'ST': 25, 'SV': 28, 'TL': 23, 'TN': 24, 'TR': 26, 'UA': 29,
+        'VA': 22, 'VG': 24, 'XK': 20
+    };
     /**
      * Rules already warned about by `replace()`'s fail-soft guard, so one mistyped label
      * emits one warning and not one per debounced keystroke. Scoped to this engine
@@ -4588,6 +4614,143 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             return self[this['name']]
         }
 
+        /**
+         * Validates the field value as an IBAN (ISO 13616).
+         *
+         * Tolerant read: validation runs on an uppercased copy with spaces and
+         * hyphens stripped (the ISO 13616 print format groups characters in
+         * blocks of four) - the stored field value and the DOM are NEVER
+         * mutated, so the application receives exactly what the user typed.
+         * Three checks, in order: the ISO shape, the official per-country
+         * length when the country code is in the `_ibanLengths` registry
+         * (unknown countries pass on shape + checksum alone - the registry
+         * grows over time and an unknown country must not hard-fail a
+         * well-formed IBAN), and the ISO 7064 MOD 97-10 checksum.
+         * An empty value is adjudicated by `isRequired` alone (#B78).
+         *
+         * @returns {object} the field object (chainable)
+         *
+         * @example
+         *     // rule file
+         *     "accountIban": { "isRequired": true, "isIban": true }
+         */
+        self[el]['isIban'] = function() {
+
+            // #B200 - TYPE-guarded, not merely truthy-guarded: see the isEmail
+            // note above. The guard folds into isValid (rather than letting the
+            // regex coerce) because the checks below call string methods on the
+            // candidate - a toString-spoofing object must record an invalid,
+            // never throw into the rule driver.
+            var candidate   = ( this.value && typeof(this.value) == 'string' )
+                                ? this.value.toUpperCase().replace(/[\s-]+/g, '')
+                                : this.value;
+
+            var rgx         = /^[A-Z]{2}[0-9]{2}[A-Z0-9]{1,30}$/;
+            var isValid     = ( typeof(candidate) == 'string' && rgx.test(candidate) ) ? true : false;
+
+            // Official per-country length when the country is registered;
+            // unknown countries pass on shape + checksum alone.
+            if (isValid) {
+                var country = candidate.slice(0, 2);
+                if ( typeof(_ibanLengths[country]) != 'undefined' && candidate.length !== _ibanLengths[country] ) {
+                    isValid = false;
+                }
+            }
+
+            // ISO 7064 MOD 97-10: move the first four characters to the end,
+            // expand letters (A=10 ... Z=35), then fold the digit string
+            // modulo 97 in <= 7-digit chunks so every intermediate stays far
+            // inside Number.MAX_SAFE_INTEGER - plain Number math only (the
+            // browser-bundle build chain constrains bundled source).
+            if (isValid) {
+                var rearranged  = candidate.slice(4) + candidate.slice(0, 4);
+                var expanded    = '';
+                for (var i = 0, len = rearranged.length; i < len; ++i) {
+                    var code = rearranged.charCodeAt(i);
+                    expanded += ( code >= 65 ) ? (code - 55).toString() : rearranged.charAt(i);
+                }
+                var remainder = 0;
+                for (var p = 0, pLen = expanded.length; p < pLen; p += 7) {
+                    remainder = parseInt(remainder.toString() + expanded.slice(p, p + 7), 10) % 97;
+                }
+                isValid = (remainder === 1);
+            }
+
+            var errors      = self[this['name']]['errors'] || {};
+
+            // #B78 - an empty value is adjudicated by isRequired alone: bypass on empty so a
+            // required+empty field records only isRequired, not a second 'invalid' message.
+            // #B199 - strict: only the literal empty string is "empty".
+            if ( this.value === '' ) {
+                isValid = true;
+            }
+
+            local['data'][this.name] = this.value;
+
+            if (!isValid) {
+                errors['isIban'] = replace(this['error'] || local.errorLabels['isIban'], this, 'isIban')
+            }
+            else if ( isValid && typeof(errors['isIban']) != 'undefined' ) {
+                delete errors['isIban'];
+            }
+
+            // #B78 - keep .valid consistent with a surviving isRequired error.
+            this.valid = isValid && !errors['isRequired'];
+
+            if ( errors.count() > 0 )
+                this['errors'] = errors;
+
+            return self[this['name']]
+        }
+
+        /**
+         * Validates the field value as a BIC (ISO 9362): a 4-letter business
+         * party prefix, a 2-letter country code, a 2-character alphanumeric
+         * location code, and an optional 3-character alphanumeric branch code
+         * (8 or 11 characters). Case-insensitive by regex - the stored field
+         * value and the DOM are NEVER mutated.
+         * An empty value is adjudicated by `isRequired` alone (#B78).
+         *
+         * @returns {object} the field object (chainable)
+         *
+         * @example
+         *     // rule file
+         *     "bankBic": { "isRequired": true, "isBic": true }
+         */
+        self[el]['isBic'] = function() {
+
+            // #B200 - non-strings are adjudicated by the regex (every
+            // non-string coerces to a string that fails the shape), so they
+            // record an invalid - they never throw into the rule driver.
+            var rgx         = /^[A-Za-z]{4}[A-Za-z]{2}[A-Za-z0-9]{2}([A-Za-z0-9]{3})?$/;
+            var isValid     = rgx.test(this['value']) ? true : false;
+            var errors      = self[this['name']]['errors'] || {};
+
+            // #B78 - an empty value is adjudicated by isRequired alone: bypass on empty so a
+            // required+empty field records only isRequired, not a second 'invalid' message.
+            // #B199 - strict: only the literal empty string is "empty".
+            if ( this.value === '' ) {
+                isValid = true;
+            }
+
+            local['data'][this.name] = this.value;
+
+            if (!isValid) {
+                errors['isBic'] = replace(this['error'] || local.errorLabels['isBic'], this, 'isBic')
+            }
+            else if ( isValid && typeof(errors['isBic']) != 'undefined' ) {
+                delete errors['isBic'];
+            }
+
+            // #B78 - keep .valid consistent with a surviving isRequired error.
+            this.valid = isValid && !errors['isRequired'];
+
+            if ( errors.count() > 0 )
+                this['errors'] = errors;
+
+            return self[this['name']]
+        }
+
         /**
          * Check if boolean and convert to `true/false` boolean if value is a string or a number.
          * Accepts `true`/`'true'`/`1` and `false`/`'false'`/`0` — the documented set.
@@ -6029,6 +6192,15 @@ function Routing() {
                 params.rateLimit = routeObject.rateLimit;
             }
 
+            // #FIN6 — propagate the per-route idempotency opt-in to
+            // req.routing.idempotency (top-level, NOT req.routing.param.* — the
+            // #CSRF2 trap). typeof-guarded so `false` survives the copy;
+            // assigned only when declared, so a routing.json that never
+            // mentions `idempotency` produces a byte-identical params object.
+            if ( typeof(routeObject.idempotency) != 'undefined' ) {
+                params.idempotency = routeObject.idempotency;
+            }
+
             // isRoute
             return self.compareUrls(params, routeObject.url, req);
         }
@@ -7258,6 +7430,13 @@ function Routing() {
      * `false` sentinel for every url. Await this method (or `.then()` it); the
      * old "unresolved promises" caveat that used to sit here was this defect.
      *
+     * Browser context, on a miss (#B462): when a rendered `404:` marker or an
+     * alternate-route lookup identifies the missing rule, the composed
+     * "route not found inside your view" diagnostic is registered on the
+     * notFound registry — keyed per rule, `count` incremented on repeats —
+     * and emitted via `console.warn` on the FIRST sighting of each key.
+     * Server context warns on every miss (unchanged).
+     *
      * @function getRouteByUrl
      * @async
      *
@@ -7527,6 +7706,7 @@ function Routing() {
                             count: 1,
                             message: msg
                         };
+                        console.warn(msg); // #B462 — announce the composed diagnostic on the FIRST sighting of each key (the registry dedups repeats)
                     } else if ( isMethodProvidedByDefault && typeof(self.notFound[notFound]) != 'undefined' ) {
                         ++self.notFound[notFound].count;
                     }
@@ -7553,7 +7733,7 @@ function Routing() {
                             count: 1,
                             message: msg
                         };
-                        //console.warn(msg);
+                        console.warn(msg); // #B462 — re-enabled: emit once per new registry key
                     } else if ( isMethodProvidedByDefault && typeof(self.notFound[notFound]) != 'undefined' ) {
                         ++self.notFound[notFound].count;
                     }
@@ -7571,7 +7751,14 @@ function Routing() {
                     notFound = method.toUpperCase() +'::'+ altRoute.request.routing.rule;
                     if ( typeof(self.notFound[notFound]) == 'undefined' ) {
                         msg = msg.replace(/\%r/, notFound);
-                        //console.warn(msg);
+                        // #B462 — the registry write was missing here, leaving the
+                        // increment arm below unreachable; aligned with the sibling
+                        // arms (create + emit once per key)
+                        self.notFound[notFound] = {
+                            count: 1,
+                            message: msg
+                        };
+                        console.warn(msg); // #B462
                     } else {
                         ++self.notFound[notFound].count;
                     }
@@ -7673,6 +7860,362 @@ if ((typeof (module) !== 'undefined') && module.exports) {
         return Routing();
     });
 };
+/*
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * @module money
+ *
+ * Exact-money primitive (#FIN5) — ISO 4217 minor-unit integer arithmetic,
+ * BigInt-safe, dependency-free, dual-context (server + browser bundle).
+ *
+ * The one rule this module exists to enforce: an amount of money is an
+ * INTEGER count of a currency's minor units (cents, fils, yen...), never an
+ * IEEE 754 float. `0.10 + 0.20` is wrong out of the box in JavaScript; this
+ * module makes the correct pattern cheap:
+ *
+ *   wire (string, byte-exact)  ->  parse()  ->  { minor: BigInt }  ->  arithmetic
+ *                                                        |
+ *   wire (string)              <-  format() / toMinor()  <
+ *
+ * What it deliberately does NOT do:
+ *  - Display formatting (locale symbols, grouping): that is the i18n layer's
+ *    job — `Intl.NumberFormat(culture, { style: 'currency', currency: code })`
+ *    is native on both runtimes. `format()` here returns the CANONICAL wire
+ *    string ("1234.50"), locale-independent.
+ *  - Rounding policy: `parse()` REJECTS excess precision instead of rounding
+ *    (whether "1.005" rounds up, down or banker's is application domain), and
+ *    `multiply()` accepts INTEGER factors only for the same reason. An
+ *    application that needs fractional factors owns its rounding explicitly,
+ *    on minor units.
+ *  - Currency conversion: rates are application data.
+ *
+ * Amounts internally use BigInt so totals beyond `Number.MAX_SAFE_INTEGER`
+ * minor units stay exact. BigInt values are created exclusively through the
+ * `BigInt()` constructor — no BigInt literals — so the source stays parseable
+ * by every tool in the browser-bundle build chain.
+ *
+ * @example
+ *  var money = require('lib/money'); // server: bare module | browser: gina.money
+ *  var a = money.parse('19.99', 'EUR');
+ *  var b = money.parse('0.01',  'EUR');
+ *  money.format(money.add(a, b));      // '20.00'
+ *  money.toMinor(money.add(a, b));     // '2000'
+ *  money.parse('100', 'JPY').exponent; // 0 — no minor unit
+ *  money.add(a, money.parse('1', 'USD')); // throws TypeError (currency mismatch)
+ * */
+
+var Money = (function() {
+
+    var self = {};
+
+    /**
+     * ISO 4217 minor-unit exponents that differ from the default of 2.
+     * Sourced from the ISO 4217 active-currency table; funds and precious-
+     * metal codes (XAU, XDR, ...) carry no minor unit and are not listed —
+     * they resolve to the default like any unlisted well-formed code.
+     *
+     * @constant
+     * @type {Object<string, number>}
+     * @inner
+     * */
+    var EXPONENT_EXCEPTIONS = {
+        // 0 — no minor unit
+        'BIF': 0, 'CLP': 0, 'DJF': 0, 'GNF': 0, 'ISK': 0, 'JPY': 0,
+        'KMF': 0, 'KRW': 0, 'PYG': 0, 'RWF': 0, 'UGX': 0, 'UYI': 0,
+        'VND': 0, 'VUV': 0, 'XAF': 0, 'XOF': 0, 'XPF': 0,
+        // 3 — mills
+        'BHD': 3, 'IQD': 3, 'JOD': 3, 'KWD': 3, 'LYD': 3, 'OMR': 3, 'TND': 3,
+        // 4
+        'CLF': 4, 'UYW': 4
+    };
+
+    /**
+     * Wire-amount shape: an optional sign, an integer part, an optional
+     * fraction. Nothing else — no grouping separators, no exponent notation,
+     * no currency symbols (those are display concerns).
+     *
+     * @constant
+     * @inner
+     * */
+    var RE_AMOUNT   = /^(-?)(\d+)(?:\.(\d+))?$/;
+
+    /**
+     * Well-formed ISO 4217 alphabetic code.
+     *
+     * @constant
+     * @inner
+     * */
+    var RE_CODE     = /^[A-Za-z]{3}$/;
+
+    /**
+     * Normalizes and validates a currency code.
+     *
+     * @inner
+     * @param {string} code - ISO 4217 alphabetic code, any case
+     * @returns {string} the upper-cased code
+     * @throws {TypeError} when `code` is not a 3-letter string
+     * */
+    var normalizeCode = function(code) {
+        if ( typeof(code) != 'string' || !RE_CODE.test(code) ) {
+            throw new TypeError('[ money ] invalid currency code: expected a 3-letter ISO 4217 code, got `' + code + '`');
+        }
+        return code.toUpperCase();
+    };
+
+    /**
+     * Asserts a value is a money amount produced by this module.
+     *
+     * @inner
+     * @param {object} a
+     * @returns {object} `a`
+     * @throws {TypeError} when the shape is not a money amount
+     * */
+    var assertAmount = function(a) {
+        if ( !a || typeof(a) != 'object' || typeof(a.minor) != 'bigint' || typeof(a.currency) != 'string' ) {
+            throw new TypeError('[ money ] not a money amount: expected the { currency, exponent, minor } shape from parse()/fromMinor()');
+        }
+        return a;
+    };
+
+    /**
+     * Asserts two amounts share one currency.
+     *
+     * @inner
+     * @param {object} a
+     * @param {object} b
+     * @throws {TypeError} on a currency mismatch — mixed-currency arithmetic
+     *  is the corruption this module exists to prevent, so it always throws
+     * */
+    var assertSameCurrency = function(a, b) {
+        assertAmount(a); assertAmount(b);
+        if (a.currency !== b.currency) {
+            throw new TypeError('[ money ] currency mismatch: `' + a.currency + '` vs `' + b.currency + '` — convert explicitly before operating');
+        }
+    };
+
+    /**
+     * Returns the minor-unit exponent for a currency.
+     * Unlisted well-formed codes resolve to the ISO default of 2.
+     *
+     * @param {string} code - ISO 4217 alphabetic code, any case
+     * @returns {number} 0, 2, 3 or 4
+     * @throws {TypeError} when `code` is not a 3-letter string
+     *
+     * @example
+     *  money.exponent('EUR'); // 2
+     *  money.exponent('jpy'); // 0
+     *  money.exponent('BHD'); // 3
+     * */
+    self.exponent = function(code) {
+        code = normalizeCode(code);
+        return ( typeof(EXPONENT_EXCEPTIONS[code]) != 'undefined' ) ? EXPONENT_EXCEPTIONS[code] : 2;
+    };
+
+    /**
+     * Parses a canonical wire string into an exact amount.
+     *
+     * The input is the decimal string an API carries on the wire (`"19.99"`,
+     * `"-0.05"`, `"1234"`). Excess fractional digits are an ERROR, not a
+     * rounding opportunity: `parse('1.005', 'EUR')` throws.
+     *
+     * @param {string} value - decimal string; sign + digits + optional fraction
+     * @param {string} code - ISO 4217 alphabetic code, any case
+     * @returns {{currency: string, exponent: number, minor: bigint}}
+     * @throws {TypeError} on a non-string / malformed value, a malformed
+     *  code, or more fractional digits than the currency's exponent
+     *
+     * @example
+     *  money.parse('19.99', 'EUR');  // { currency:'EUR', exponent:2, minor: 1999n }
+     *  money.parse('19.9',  'EUR');  // minor 1990n — short fractions scale up
+     *  money.parse('100',   'JPY');  // { currency:'JPY', exponent:0, minor: 100n }
+     *  money.parse('1.005', 'EUR');  // throws — precision beyond the exponent
+     *  money.parse(19.99,   'EUR');  // throws — floats are the hazard, not an input
+     * */
+    self.parse = function(value, code) {
+        code = normalizeCode(code);
+        if ( typeof(value) != 'string' ) {
+            throw new TypeError('[ money ] parse() takes the WIRE STRING, not a number — a float has already lost exactness (`' + value + '`)');
+        }
+        var m = RE_AMOUNT.exec(value.trim());
+        if (!m) {
+            throw new TypeError('[ money ] malformed amount `' + value + '`: expected digits with an optional sign and `.` fraction');
+        }
+        var exp      = self.exponent(code);
+        var fraction = m[3] || '';
+        if (fraction.length > exp) {
+            throw new TypeError('[ money ] `' + value + '` carries ' + fraction.length + ' fractional digit(s) but ' + code + ' has ' + exp + ' — rounding is the application\'s decision, apply it before parse()');
+        }
+        while (fraction.length < exp) {
+            fraction += '0';
+        }
+        var minor = BigInt(m[2] + fraction);
+        if (m[1] === '-') {
+            minor = -minor;
+        }
+        return { currency: code, exponent: exp, minor: minor };
+    };
+
+    /**
+     * Builds an amount directly from a minor-unit count.
+     *
+     * @param {string|number|bigint} minor - integer minor units (`1999`, `'1999'`)
+     * @param {string} code - ISO 4217 alphabetic code, any case
+     * @returns {{currency: string, exponent: number, minor: bigint}}
+     * @throws {TypeError} on a malformed code, a non-integer number, or a
+     *  string that is not a plain signed integer
+     *
+     * @example
+     *  money.fromMinor(1999, 'EUR');   // 19.99 EUR
+     *  money.fromMinor('250', 'JPY');  // 250 JPY
+     * */
+    self.fromMinor = function(minor, code) {
+        code = normalizeCode(code);
+        var big;
+        if ( typeof(minor) == 'bigint' ) {
+            big = minor;
+        } else if ( typeof(minor) == 'number' ) {
+            if ( !isFinite(minor) || Math.floor(minor) !== minor ) {
+                throw new TypeError('[ money ] fromMinor() takes an INTEGER minor-unit count, got `' + minor + '`');
+            }
+            big = BigInt(minor);
+        } else if ( typeof(minor) == 'string' && /^-?\d+$/.test(minor.trim()) ) {
+            big = BigInt(minor.trim());
+        } else {
+            throw new TypeError('[ money ] fromMinor() takes an integer as bigint, number or string, got `' + minor + '`');
+        }
+        return { currency: code, exponent: self.exponent(code), minor: big };
+    };
+
+    /**
+     * Exact addition. Same-currency only.
+     *
+     * @param {object} a - amount from parse()/fromMinor()
+     * @param {object} b - amount from parse()/fromMinor()
+     * @returns {{currency: string, exponent: number, minor: bigint}}
+     * @throws {TypeError} on a currency mismatch or a non-amount
+     *
+     * @example
+     *  money.format(money.add(money.parse('0.10','EUR'), money.parse('0.20','EUR'))); // '0.30'
+     * */
+    self.add = function(a, b) {
+        assertSameCurrency(a, b);
+        return { currency: a.currency, exponent: a.exponent, minor: a.minor + b.minor };
+    };
+
+    /**
+     * Exact subtraction (`a - b`). Same-currency only.
+     *
+     * @param {object} a - amount from parse()/fromMinor()
+     * @param {object} b - amount from parse()/fromMinor()
+     * @returns {{currency: string, exponent: number, minor: bigint}}
+     * @throws {TypeError} on a currency mismatch or a non-amount
+     * */
+    self.subtract = function(a, b) {
+        assertSameCurrency(a, b);
+        return { currency: a.currency, exponent: a.exponent, minor: a.minor - b.minor };
+    };
+
+    /**
+     * Exact multiplication by an INTEGER factor (a quantity, a line count).
+     * A fractional factor (a rate, a percentage) needs a rounding decision
+     * the application owns — apply it on minor units, then fromMinor().
+     *
+     * @param {object} a - amount from parse()/fromMinor()
+     * @param {string|number|bigint} factor - integer multiplier
+     * @returns {{currency: string, exponent: number, minor: bigint}}
+     * @throws {TypeError} on a non-amount or a non-integer factor
+     *
+     * @example
+     *  money.format(money.multiply(money.parse('19.99','EUR'), 3)); // '59.97'
+     * */
+    self.multiply = function(a, factor) {
+        assertAmount(a);
+        var big;
+        if ( typeof(factor) == 'bigint' ) {
+            big = factor;
+        } else if ( typeof(factor) == 'number' && isFinite(factor) && Math.floor(factor) === factor ) {
+            big = BigInt(factor);
+        } else if ( typeof(factor) == 'string' && /^-?\d+$/.test(factor.trim()) ) {
+            big = BigInt(factor.trim());
+        } else {
+            throw new TypeError('[ money ] multiply() takes an INTEGER factor, got `' + factor + '` — a fractional rate needs the application\'s own rounding, on minor units');
+        }
+        return { currency: a.currency, exponent: a.exponent, minor: a.minor * big };
+    };
+
+    /**
+     * Three-way comparison. Same-currency only.
+     *
+     * @param {object} a - amount from parse()/fromMinor()
+     * @param {object} b - amount from parse()/fromMinor()
+     * @returns {number} -1 when a < b, 0 when equal, 1 when a > b
+     * @throws {TypeError} on a currency mismatch or a non-amount
+     * */
+    self.compare = function(a, b) {
+        assertSameCurrency(a, b);
+        if (a.minor < b.minor) { return -1; }
+        if (a.minor > b.minor) { return 1; }
+        return 0;
+    };
+
+    /**
+     * Renders the canonical wire string: sign, integer part, and EXACTLY the
+     * currency's exponent in fractional digits (`'20.00'`, `'-0.05'`, `'150'`
+     * for a 0-exponent currency). Locale display belongs to the i18n layer
+     * (`Intl.NumberFormat`); this string is for wires, stores and logs.
+     *
+     * @param {object} a - amount from parse()/fromMinor()
+     * @returns {string}
+     * @throws {TypeError} on a non-amount
+     *
+     * @example
+     *  money.format(money.fromMinor(-5, 'EUR'));  // '-0.05'
+     *  money.format(money.fromMinor(150, 'JPY')); // '150'
+     * */
+    self.format = function(a) {
+        assertAmount(a);
+        var neg   = a.minor < BigInt(0);
+        var s     = (neg ? -a.minor : a.minor).toString();
+        if (a.exponent === 0) {
+            return (neg ? '-' : '') + s;
+        }
+        while (s.length <= a.exponent) {
+            s = '0' + s;
+        }
+        var cut = s.length - a.exponent;
+        return (neg ? '-' : '') + s.substring(0, cut) + '.' + s.substring(cut);
+    };
+
+    /**
+     * Returns the minor-unit count as a JSON-safe decimal string.
+     *
+     * @param {object} a - amount from parse()/fromMinor()
+     * @returns {string} e.g. `'1999'`, `'-5'`
+     * @throws {TypeError} on a non-amount
+     * */
+    self.toMinor = function(a) {
+        assertAmount(a);
+        return a.minor.toString();
+    };
+
+    return self;
+
+})();
+
+if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
+    // Publish as node.js module
+    module.exports = Money
+} else if ( typeof(define) === 'function' && define.amd) {
+    // Publish as AMD module
+    define('lib/money',[],function() { return Money })
+}
+;
 function registerEvents(plugin, events) {
     if ( typeof(gina) == 'undefined' && typeof(window.gina) != 'undefined' ) {
         gina = window.gina;
@@ -9382,7 +9925,7 @@ if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
     // Publish as AMD module
     define( 'helpers/dateFormat',[],function() { return DateFormatHelper })
 };
-define('gina', [ 'require', 'lib/merge', 'lib/uuid', 'lib/routing', 'utils/events', 'helpers/prototypes', 'helpers/dateFormat' ], function (require) {
+define('gina', [ 'require', 'lib/merge', 'lib/uuid', 'lib/routing', 'lib/money', 'utils/events', 'helpers/prototypes', 'helpers/dateFormat' ], function (require) {
 
     /**
      * Imports & definitions
@@ -9391,6 +9934,7 @@ define('gina', [ 'require', 'lib/merge', 'lib/uuid', 'lib/routing', 'utils/event
     var merge           = require('lib/merge');
     var uuid            = require('lib/uuid');
     var routing         = require('lib/routing');
+    var money           = require('lib/money'); // #FIN5 — exposed as gina.money below
     var dateFormat      = require('helpers/dateFormat')();
     var prototypes      = require('helpers/prototypes')({ dateFormat: dateFormat });
     if (!window.process ) {
@@ -9484,7 +10028,13 @@ define('gina', [ 'require', 'lib/merge', 'lib/uuid', 'lib/routing', 'utils/event
             'registeredEvents'  : {},
             'events'            : {},
 
-            'setOptions'        : setOptions
+            'setOptions'        : setOptions,
+            // #FIN5 — exact-money primitive (ISO 4217 minor-unit BigInt
+            // arithmetic), the same module the server registers as lib.money:
+            // gina.money.parse('19.99','EUR') / add / subtract / multiply /
+            // compare / format / toMinor / fromMinor / exponent. Display
+            // formatting stays with Intl.NumberFormat.
+            'money'             : money
         };
 
         // iframe case