gina 0.6.28 → 0.6.29

package/CHANGELOG.md

@@ -6,6 +6,16 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.29 - 2026-09-08
+### Added
+* `bundle:build` and `project:build` gain an opt-in `--skip-unchanged` flag. A release whose bundle source is byte-identical to what it was built from keeps its copy: the build signs the source (the sha1 of every file's bytes and every symlink's target — timestamps do not count, so a fresh checkout or a plain `cp` does not invalidate, and a stat fast path off the previous marker keeps a stable-timestamp source to stats only), records the signature at the release root as `.gina-build.json`, and skips the wipe-and-copy when the marker matches. Everything else still runs: the manifest update, the fingerprint stamp, the `node_modules` link and both hooks. Any doubt rebuilds — no marker, a marker of another spec, a missing release, a changed, added or removed file, or an error while checking — and nothing changes without the flag; the first flagged build always copies. `--force` rebuilds anyway and still records the marker; `--dry-run` prints each release's decision and its reason without touching anything; `--format=json` emits one `{ project, scope, dryRun, skipUnchanged, releases[] }` envelope. The `postbuild` hook receives `GINA_BUILD_SKIPPED_BUNDLES` (the bundles whose every built env was skipped) and `GINA_BUILD_SKIPPED_ALL`, so a hook that bakes its own outputs can skip its own work. Not detected, by design: edits made directly inside a release, file mode changes, and the framework version (recorded in the marker for diagnostics only).
+### Fixed
+* A path-form `getUrl` route containing `@` — the retina-asset idiom `'/assets/img/common/header@2x.png' | getUrl` — no longer renders a 500. Both the swig and the nunjucks filter split every `@`-bearing route as `rule@bundle` before checking whether it was a path, cut the path at the `@`, failed the bundle lookup on the remainder and called `throwError(500)` in the middle of the template, so the page came back as a 500 while the action's own render was discarded. A route with a leading `/` now bypasses the split on both engines. One consequence to know: a path-form route cannot name a bundle in-string (`'/x.png@web'`) — pass the bundle as the filter's base argument (`| getUrl(null, 'web')`), which was already the working form and is unchanged. (#B511)
+* A server-side field error now reaches the visible control when two controls share a `name` and the hidden one comes first in document order. The client-side error painter walked the form in document order and stopped on the first control whose name matched, whether or not it could paint it — and a bare `type="hidden"` control never can — so with the recommended shape for a control that must render disabled yet still post (a visible control plus a hidden twin carrying rule `"exclude": false`), the hidden twin consumed the error: no message, no `aria-invalid`, and on a shared wrapper the error class was set with nothing inside it. A bare hidden control is now skipped when another control of the same name can be painted; a hidden control that is the only one of its name keeps the former behaviour, and a hidden control inside a `form-item-wrapper` is still painted after its wrapper. The fix is in the browser bundle, so bundles must be rebuilt (re-baked) as well as restarted. (#B510)
+* A staged upload no longer writes a flat `<prefix>[i][preview]` hidden input valued `[object Object]` into a form that declares no `[preview][...]` sub-fields. The client layer auto-creates one hidden input per metadata field the form did not declare, and `preview` — whose value is an object, not a string — was auto-created like the others, so when the staging response carried a `preview` object the shared assignment string-coerced it and the real form's submit posted the literal text. That form now posts no `preview` field at all, matching the documented field set; the thumbnail still renders from the response, and a form that declares the `[preview][location|uri|width|height]` sub-fields is unchanged — declaring them remains the way to persist the preview. Server code that keyed on the presence of a `preview` field for such forms should key on its value: the field was garbage before and is absent now. The fix is in the browser bundle, so bundles must be rebuilt (re-baked) as well as restarted. (#B459)
+### Security
+* A failed Couchbase N1QL statement no longer carries its own result rows into the error it raises. The connector used to place the query service's whole response envelope — result documents included — on `error.stack` and `error.cause.http_body`, so a `RETURNING` statement that lost a CAS race, or a SELECT that timed out part-way, wrote the records it had already produced into any log that printed the error (the controller error path prints the stack; a `console.error(err)` prints the cause). Both now carry the envelope with `results` replaced by a row-count marker; `errors`, `requestID`, `status`, `signature` and the classifier's `first_error_code`/`retry` are unchanged, the SDK's own error object is copied rather than mutated, and a body the connector cannot parse is dropped rather than forwarded. Anything that read result rows back out of a query error's stack trace will no longer find them. (#B509)
+
 ## 0.6.28 - 2026-09-06
 ### Added
 * `self.forward()` now relays a `multipart/form-data` request as multipart, uploads included. It handed `req[method]` to `self.query()`, which JSON-encodes its `data` and forces the outbound content-type to the json mime, so a forwarded upload reached the target as a JSON object of its text fields and `req.files` never travelled at all. A new `lib/multipart` encoder rebuilds one RFC 7578 body from the parsed text fields — re-flattened to bracket notation, the exact inverse of the parser's nester — and from the staged files read at their staged paths, under a CSPRNG boundary re-drawn until it occurs in no part; that body travels through `query()`'s new `options.body` raw-body pass-through, so the caller's own content-type survives on both transports and the HTTP/2 request prep no longer relabels it with the incoming request's boundary. The body is buffered and therefore bounded: by the source bundle's `upload.maxFieldsSize` when the parser stamped a usable cap, else by a 16 MB default, checked against the field bytes plus the on-disk sizes before a single byte is read — a breach answers 413 naming both numbers. Files forwarded under a method that carries no body answer 400, an unreadable staged part answers 500 naming the path, and staged files are read but never deleted, so the source's own cleanup still owns them. Server-side only; pickup is a bundle restart. (#B489)

package/README.md

@@ -66,46 +66,29 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.28
+## What's in 0.6.29
 
-> **Restart your bundles *and* rebuild them.** Three of the fixes are
-> browser-bundled — both client-boot fixes and the proxy-context change — so
-> `gina.min.js` changed and `gina bundle:restart` alone leaves the old client
+> **Restart your bundles *and* rebuild them.** Two of the fixes are
+> browser-bundled — the field-error painter and the staged-upload preview slot —
+> so `gina.min.js` changed and `gina bundle:restart` alone leaves the old client
 > running. Rebuild each consuming bundle, then restart.
 
-> **No settings reset.** `0.6.28` is a patch — the `shortVersion` stays `0.6`,
+> **No settings reset.** `0.6.29` is a patch — the `shortVersion` stays `0.6`,
 > so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**The every-request release** — much of it is one shape in several places:
-something that was right *once* and not afterwards. `self.forward()` computed
-the target route and then discarded it. The browser client attached its boot
-listener after the event that would have fired it, so a light page stayed
-half-booted. And a run of HTTP/2 response features — the `rel=preload` header,
-the automatic 103, the Inspector's asset map — were built on the compile path
-only, so the first request of a view carried them and every later one did not.
-Alongside them `self.forward()` learns to relay an upload, five fluent
-`.onComplete()` handles learn to refuse a callback they cannot call, and one
-request's proxy context can no longer steer the absolute URLs another request
-builds. Full detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — one request's proxy context no longer steers another's absolute URLs (#B502).** After a single request carrying a port-less `Host` — an orchestrator probe, a sibling-bundle call, any client sending `Host: name` with no port — reached a worker, every later direct request on that worker built `getRoute().toUrl()` from a worker-global: on an HTTP/1.1 bundle the port vanished, and on an HTTP/2 + HTTPS bundle the *last port-less client's host* was emitted verbatim. Because that host is chosen by the client, it is a host-header-injection class for application-built links and redirects. `getRoute()` now resolves the proxied classification and the proxy hostname from the request itself through a per-request store, and only req-less callers (boot, CLI, cron) still read the worker-global. On earlier versions `server.proxy.requireForwardedHeaders` closes the port-less-`Host` path **only** — it never gated `X-Forwarded-Host` — so the complete interim there is a fronting proxy that overrides both headers before the bundle.
-- **Added — `self.forward()` relays a `multipart/form-data` request, uploads included (#B489).** It used to hand `req[method]` to `self.query()`, which JSON-encodes its `data` and forces the JSON mime, so a forwarded upload arrived as a JSON object of its text fields and `req.files` never travelled at all. A new `lib/multipart` encoder rebuilds one RFC 7578 body from the parsed text fields — re-flattened to bracket notation, the exact inverse of the parser's nester — and from the staged files read at their staged paths, under a CSPRNG boundary redrawn until it appears in no part. The body is buffered and therefore bounded: by the source bundle's `upload.maxFieldsSize` when the parser stamped a usable cap, else 16 MB, checked before a byte is read — a breach answers 413 naming both numbers. Files forwarded under a method carrying no body answer 400; an unreadable staged part answers 500 naming the path. Staged files are read and never deleted, so your own cleanup still owns them.
-- **Fixed — `self.forward()` forwards to the route it resolves (#B488).** It computed the target route and discarded it, sending the request to the target bundle's webroot alone — or, for a raw host, to the *port number* as the path — with placeholder values taken from the routing declaration (`":id"`) rather than the captured URL parameters, an inverted `project` override, and a credentials read that could throw on a bundle without any. The resolved route URL is now the forwarded path, placeholders come from the request, a string answer is relayed verbatim with `renderTEXT()` instead of being re-encoded as JSON, and an unknown target is answered through `throwError()`.
-- **Fixed — the client no longer stays half-booted on a light page (#B483).** `core.js` attached its `ginaloaded` listener only after the async `routing.json` fetch resolved, while the `core` RequireJS factory — which the loader defers by a 4 ms `nextTick` — is what constructs gina and dispatches that event. Whenever the fetch lost the race the event fired with no listener: `isFrameworkLoaded` never flipped, and the popin, validator and nav boot pollers gave up, so every `data-gina-nav` hop degraded to a full navigation and no form ever bound. Pages registering a `gina.ready()` handler had a second route through the ready scheduler, which is why heavier pages booted. The listener is now attached at parse time, above the `core` module definition, so it precedes the dispatch by construction.
-- **Fixed — the client boots inside a cross-origin iframe (#B486).** `construct()` read `parent.window['gina']` unconditionally to inherit a parent frame's instance; under a cross-origin parent that named-property read throws `SecurityError`, and since `construct()` is `async` the throw became an unobserved rejection — `ginaloaded` was never dispatched and the page stayed silently half-booted, with nothing in the console beyond the rejection. The inheritance is optional and is now attempted inside a try/catch: a same-origin parent still shares its instance, a cross-origin one is skipped and the boot proceeds.
-- **Fixed — the HTTP/2 `link` preload header is sent on every response, not only the first per view (#B495).** With `server.cache.enable: true` a bundle served over HTTP/2 built its `rel=preload` header on the compile path only, and the compiled-template cache-hit path returned before reaching it — so in production the first request of a view carried the hints and every later one carried none, with no 103 to compensate. The header is now assembled once per view, memoised on the cache entry and re-emitted on hits under the same gates (never for XHR, never in dev). Two consequences worth knowing: with the template cache on, an XHR request now computes the preload map too, so a page first loaded by fetch no longer leaves it empty; and an empty `link` header is no longer sent when nothing qualifies.
-- **Fixed — the automatic 103 Early Hints response actually fires (#B496).** `render()` read the accumulated `h2Links` prefix and called `setEarlyHints()` when truthy — but the only writers of that prefix run in `getNodeRes()`, which every one of the five render delegates reaches *after* `render()` has dispatched to it. The read therefore always saw the empty string the router seeds, and the hint was skipped on every request since the feature was added. It was never a regression: the introducing commit already dispatched below the read. The prefix is now computed before the dispatch from the view's declared stylesheets and scripts, and the router's seed is restored immediately afterwards so the final 200 `Link` header is byte-identical, verified on a live HTTP/2 production boot against a same-boot control. No hint for XHR, in dev, or for SRI'd assets — a preload hint carries no integrity metadata. `self.setEarlyHints()` was unaffected and has always worked.
-- **Fixed — the Inspector View tab shows the preload assets map again (#B490, #B481).** Since `0.6.25` it rendered the literal `${assets}`: the layout-level substitution that swapped the placeholder for the real `getAssets()` map stopped matching once inline-script brace escaping landed (#B463), and `0.6.27` then moved the Inspector payload after template execution (#B464), so the placeholder rode `user.view.assets` — and the XHR hidden view input — verbatim for three releases. The payload now reads the per-template parsed assets map at splice time on both cache paths, and under HTTP/1.1, where the preload block never runs, `view.assets` is simply absent instead of a placeholder.
-- **Fixed — a custom error page carries its preloads and its external plugins (#B497).** Rendered over HTTP/2, a custom error page now carries the config-declared CSS/JS `rel=preload` entries in its final `link` header and — when scripts are not in defer mode, the only mode in which the framework injects external plugins into the head — the scripts declared `isExternalPlugin: true`, like every other page. The custom-error render built its options with a *copy* of the template config, so what the framework accumulated while resolving the error page's assets never reached the header or the head it read; error pages had never carried either since both existed. The render now shares the request's template object and re-seeds its per-response accumulators first, so an error struck after the failing route's assets were resolved does not double the preload entries or the plugin tags.
-- **Fixed — a retried HTTP/1 request goes out with its body (#B494).** The handler deleted `options.queryData` after writing the first attempt, and the retry re-entered with the same options object, so the second attempt was sent with `content-length: 0` and an empty body — and whatever the upstream made of that was reported back as the result. It affected any body, but only with `retryUnsafe` enabled, since the methods that auto-retry by default carry none. The body is now stashed on the options the way the HTTP/2 handler already did, and restored on re-entry.
-- **Fixed — `self.store()` no longer drops the outcome of a `null` callback (#B480).** The fluent guard tested only for `undefined`, so `store(target, files, null)` fell into the callback branch, whose arms emitted to an event with zero in-tree listeners: the upload ran and nothing was told. A truthy non-function given to `.onComplete()` threw from inside an fs callback — an uncaughtException on every path but one. The guard now mints the fluent handle for any non-function `cb`, `.onComplete()` throws synchronously at the caller, and the seven unreachable emitter arms are gone with their undocumented event. Behaviour change: `store(target, files, null)` returns the handle and starts the upload when `.onComplete()` is chained, exactly like an omitted `cb`.
-- **Fixed — `self.query()`'s fluent `.onComplete()` rejects a non-function at registration (#B485).** It minted a deliverer for whatever it was given, so `.onComplete(null)` registered silently and the `TypeError` fired only at settle — inside the delivery wrapper's own try/catch, which turned it into a 500 blaming the application callback for an exception it never had. It now throws at the caller's line, mirroring `self.store()`. Anything relying on the old behaviour was relying on a 500.
-- **Fixed — `run()` refuses a callback it cannot call (#B491).** The framework global (also `gna.run`) now throws a `TypeError` at the caller's line when its fluent `.onComplete()` or its positional callback is given anything but a function. A wrong argument used to be accepted silently: the command ran to completion, the resulting `callback is not a function` was caught by the command's close handler and only logged, and the caller's completion never arrived. `null`/`undefined` positionally still mean "use `.onComplete()`".
-- **Fixed — `Shell::run()` refuses one too, on both of its handles (#B491).** `lib/shell` wraps the callback inside its own listener on `.onComplete()` *and* `.onData()`, so either given a non-function was accepted silently and the failure surfaced only as a logged line while the caller's delivery never arrived. Both now throw at the caller's line, with `null` reported as `null` rather than `object`.
-- **Fixed — the dead `onComplete` on entity method objects is gone (#B491).** A leftover of the pre-Promise design, when a method returned the entity function itself with the handle hanging off it. Its own comment claimed it would be overridden; nothing ever wrote to it, so a callback registered on the *method* rather than on the *call* was swallowed and never fired. Disclosed behaviour change: `entity.method.onComplete(cb)` — the wrong form, silently dead in every release that had it — now throws `is not a function` at the call site. The correct `entity.method(args).onComplete(cb)` is untouched.
-- **Fixed — `{% extends %}` extraction stops at its own directive (#B484).** Both quantifiers were greedy, so a one-line directive followed by another quoted tag ran the directive match to the last closing delimiter on the line and the quoted-path match to the last quote, producing a layout path that matched nothing — the layout-cache re-point then silently never happened and the page extended the raw layout.
-- **Fixed — a layout named ahead of its `{% extends %}` directive no longer breaks the re-point (#B482).** The rewrite that sends the directive at its assembled cache copy searched the whole template for the layout's bare filename and took the first occurrence anywhere, so a mention in a leading comment was rewritten while the directive kept the raw path. The substitution is now spliced inside the matched directive, leaving a later legitimate mention untouched.
-- **Fixed — `POST /_gina/maintenance` no longer fails open on an invalid `ttlSeconds` (#B498).** The handler validated `enable` but guarded `ttlSeconds` with a single positive condition, so a value that was not an integer from 1 to 86400 — a 25-hour window, a float, a numeric string — was silently ignored and the flip applied with **no timer at all**: the caller asked for a bounded maintenance window and got an unbounded one, with `until: null` as the only tell. Both engines now answer 400, naming the bound and the configuration alternative for a window that must outlive a day. Refused rather than clamped on purpose — a shorter-than-requested window reopens a site mid-deploy, so there is no safe direction to round toward.
+**The right-destination release.** Four of the five changes are a value arriving
+somewhere it should not, or failing to arrive where it should: a failed query
+carrying its own result rows into every log that printed the error, a field
+error stopping on a control that could never display it, a staged upload posting
+the literal `[object Object]`, and a retina asset path cut in half at its `@`.
+The fifth is the opposite kind of change — `bundle:build` learns to do nothing
+at all when there is nothing to do. Full detail in [CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — a failed N1QL statement no longer carries its own result rows (#B509).** The couchbase connector placed the query service's whole response envelope — result documents included — on `error.stack` and `error.cause.http_body`, so a `RETURNING` statement that lost a CAS race, or a SELECT that timed out part-way, wrote the records it had already produced into any log that printed the error. The controller error path prints the stack in every scope, and a bare `console.error(err)` renders the cause, so there was no interception point for a bundle. Both now carry the envelope with `results` replaced by a row-count marker; `errors`, `requestID`, `status`, `signature` and the classifier's `first_error_code`/`retry` are unchanged, the SDK's own error object is copied rather than mutated, and a body the connector cannot parse is dropped rather than forwarded.
+- **Added — `bundle:build` and `project:build` gain `--skip-unchanged`.** A release whose bundle source is byte-identical to what it was built from keeps its copy. The build signs the source — the sha1 of every file's bytes and every symlink's target, so timestamps do not count and a fresh checkout or a plain `cp` does not invalidate — records that signature at the release root as `.gina-build.json`, and skips the wipe-and-copy when it matches. Everything else still runs: the manifest update, the fingerprint stamp, the `node_modules` link and both hooks. Any doubt rebuilds, and nothing changes without the flag. `--force` rebuilds anyway and still records the marker, `--dry-run` prints each release's decision and its reason without touching anything, and the `postbuild` hook receives `GINA_BUILD_SKIPPED_BUNDLES` / `GINA_BUILD_SKIPPED_ALL` so a hook that bakes its own outputs can skip its own work.
+- **Fixed — a server-side field error reaches the visible control (#B510).** The client-side painter walked the form in document order and stopped on the first control whose name matched, whether or not it could paint it — and a bare `type="hidden"` control never can. So with the recommended shape for a control that must render disabled yet still post (a visible control plus a hidden twin carrying rule `"exclude": false`), a hidden twin listed first consumed the error: no message, no `aria-invalid`, and on a shared wrapper the error class was set with nothing inside it. A bare hidden control is now skipped when another control of the same name can be painted; a lone hidden one keeps the former behaviour, and one inside a `form-item-wrapper` is still painted after its wrapper.
+- **Fixed — a path-form `getUrl` route containing `@` no longer renders a 500 (#B511).** Both the swig and the nunjucks filter split every `@`-bearing route as `rule@bundle` before checking whether it was a path, so the retina-asset idiom the filter's own comment cites — `'/assets/img/common/header@2x.png' | getUrl` — was cut at the `@`, failed the bundle lookup on the remainder and called `throwError(500)` mid-template, returning a 500 while the action's own render was discarded. A route with a leading `/` now bypasses the split on both engines. One consequence to know: a path-form route cannot name a bundle in-string (`'/x.png@web'`) — pass it as the filter's base argument (`| getUrl(null, 'web')`), which was already the working form and is unchanged.
+- **Fixed — a staged upload no longer posts `[object Object]` (#B459).** The client writes one hidden input per metadata field into the real form, auto-creating any the form did not declare — and `preview`, whose value is an object rather than a string, was auto-created like the others, so a form declaring no `[preview][...]` sub-fields got a flat input that the fill loop string-coerced. Such a form now posts no `preview` field at all, matching the documented field set; the thumbnail still renders, and a form that declares the `[preview][location|uri|width|height]` sub-fields is unchanged — declaring them remains the way to persist the preview. Server code that keyed on the *presence* of a `preview` field for such forms should key on its value: it was garbage before and is absent now.
 
 ## Documentation
 

package/ROADMAP.md

@@ -80,6 +80,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.26` ✅ | **Fixed**: the error-path and orphan-reclaim release. An error response no longer crashes when the rendered payload carries a non-numeric top-level `status` — a page whose own vocabulary includes a field named `status` (say `{status: "draft"}` rendered alongside an error) had that value stamped straight into the HTTP response, which threw `ERR_HTTP_INVALID_STATUS_CODE` and replaced the intended error page with an unhandled 500, i.e. it fired only on the error path, exactly when the error page was needed; every status the error path resolves is now validated against node's own rule (an integer from 100 to 999) and degrades to a 500 error page when it does not qualify, while a numeric status still sets the HTTP status exactly as documented. **Fixed**: error responses now carry the content-type they declare — two branches of the error path, the Internet Explorer override and the branch taken when a request arrives with no `user-agent` header at all (the common shape for machine callers), passed the header NAME as node's status-message argument instead of a headers object, so node read the MIME string character by character: over HTTP/1.1 the response came back with roughly ten to thirty junk headers named `0`, `1`, `2`…, a reason phrase reading `content-type`, and no content-type at all, and over HTTP/2 the headers were dropped entirely — nothing threw, so the malformed response was completely silent. Both branches now pass a headers object, and the plain-text branch declares the bundle encoding as its charset, which is user-visible wherever error copy is not plain ASCII: the body is JSON written as UTF-8, and a charset-less `text/plain` invites the client to guess a single-byte encoding, rendering accented characters and non-Latin scripts as mojibake. **Fixed**: staged multipart upload parts stranded by a previous process are now reclaimed at boot — the `upload.autoTmpCleanupTimeout` deletion timer is per-upload and in-process, so a restart stranded every staged part it was holding and a part that never reached `self.store()` had no reclaim path at all; when the timer is armed, server init now sweeps each configured landing directory for staged-shaped `.part` files older than the configured timeout, floored at one hour so an in-flight upload from a sibling live process on a shared staging directory is never touched, and the sweep is deliberately conservative (exact server-generated name shape only, regular files only, symlinks never followed, non-recursive). A disabled timer — the shipped default — still arms no sweep. **Fixed**: job records stranded by a process death are now reclaimed — the deferred function of an async job lives only in its creating process, so a record left `running` by a crash or an unclean restart could never settle: its `expiresAt` stayed null forever, the TTL sweep's own guard excluded it, listings reported phantom running work and the documented polling pattern never terminated; the sweep is now preceded by an orphan-reclaim pass on durable stores marking a non-terminal record older than `jobs.orphanTimeout` (seconds, default 86400, `0` or `false` disables, floored at 60) as `failed` with error name `JobOrphanedError`, after which normal `ttl` retention removes it on schedule — the built-in memory store is exempt and no completion webhook fires for a reclaim. Restart your bundles — the browser bundle is unchanged, so no rebuild is needed. |
 | **Q4 2026** | `0.6.27` ✅ | **Security**: Inspector payloads no longer leak across requests through the compiled-template cache — with `server.cache.enable` on and the Inspector block injected, automatic in dev and in production only when a controller calls `self.render(data, true)`, the `window.__ginaData` script was baked into the layout before swig compiled it, so the per-view compiled template and the persisted `.gina-layout-cache` file carried the FIRST request's page data — the controller's data, the session card, the environment — to every later request of that view, to other views compiled after it, and to every later process until the file was removed; the popin hidden inputs were a second pre-compile carrier and `/_gina/reveal` froze with them; the compiled layout now carries only an HTML-comment marker and both cache paths build the payload after the template executes, so a cache hit refreshes the Inspector sinks too, and a stale layout-cache file from an earlier release is healed in place on the next compile. **Changed**: two controller events fire less often now that the fluent `{onComplete}` handles deliver per call — `query#complete` is emitted on the controller only when nothing consumed the outcome, no callback and no `.onComplete()`, one tick after settlement, and `'uploaded'` is no longer emitted for the fluent `store(target).onComplete(cb)` form; neither had a documented listener; `query()` in callback form now returns `undefined` on every path instead of an unusable per-transport handle, and an explicit `null` callback selects the fluent form instead of throwing at delivery time. **Fixed**: the completion-handle release. `lib.archiver` settles each `compress()` and `decompress()` call on its own completion channel — every completion used to be signalled by emitting one fixed event name on the process-wide singleton, so two overlapping calls in one process, two queue consumers or a request handler beside a worker, both received whichever run finished first: the second caller was released early with the first run's archive path and its own archive was left at 0 bytes, and the array form kept its output stream in an implicit global so finishing one run closed another's; errors on the streams the library opens itself now reach the caller too, where an unreadable input used to either crash the process or hang the run forever, leaving a corrupt partial archive on disk. **Fixed**: the directory form of `compress()` no longer drops the first entry of the top-level directory — its walk seeded the work list from index 1, the author evidently expecting `.` first, which node's `readdir` never returns, so a directory holding a single file archived to an empty zip; the in-tree `project:backup` command uses the array form and was never affected. **Fixed**: the single-file form of `compress()` writes a real one-entry zip and `decompress()` reads every form back — it used to pipe the file through a gzip codec and write the result under the `.zip` name, which `unzip` and `decompress()` both rejected, while `method: 'br'` and `'deflate'` were accepted by the option validator and silently produced that same gzip; the bytes change from a gzip member to a DEFLATE zip, so anything that gunzipped the output directly must now read it as a zip, `method` validates against `gzip` alone again, and an input whose path carries a dot-prefixed segment, a `.env` or anything under `~/.config/`, is archived instead of being skipped with a false success, an empty zip and two leaked descriptors. **Fixed**: the fluent `.onComplete()` handles of `self.query()` and `self.store()` deliver to their own call — both registered the application callback on the controller instance's shared EventEmitter, so a second `store()` on the same controller re-invoked every earlier callback with the later result, and a concurrent fluent query evicted the first one: its callback never fired, the survivor could receive the other call's payload and the evicted response was emitted to nobody, on both transports with no log line; the synchronous failure paths of `query()` also returned `emit()`'s boolean instead of the handle, so chaining `.onComplete` threw `TypeError` and the error was lost; `query()` now mints one delivery channel per call and returns the handle on every path, with the delivered shapes unchanged. **Fixed**: a `self.query()` issued while the controller is rendering from another required controller now settles — the guard that refuses it once a second render has been entered, the state `requireController` produces because the required controller shares the caller's options object, returned the literal `false` and delivered nothing, so the callback form never fired and the fluent chain threw `TypeError` on the boolean; the refusal now rides the per-call channel as a coded `NESTED_RENDER` error and the upstream is still never contacted. **Fixed**: FormValidator reacts to a browser or password-manager autofill — a fill lands without any keystroke, and on Chrome without an `input` or `change` event until a later gesture, so the live check never re-ran: the submit control kept the gated look it was given at bind time on a form the user could see was complete, and an autofilled invalid value showed no error; the default stylesheet now gives every autofilled control a 1ms keyframe and the validator routes the resulting `animationstart` into the field's own live check, while a value the browser still withholds from script no longer counts against the gate and renders no false required error. **Fixed**: FormValidator tells the truth about a field the browser autofilled but still withholds from script at submit time — visibly filled yet reading empty to script, it is correctly refused, but the message rendered was the plain required label, naming a problem the user could not see; a new built-in label key `isRequiredAutofill` covers that one case with the verdict, the `errors` key and the submit gate all unchanged, the control is marked `data-gina-form-autofill-withheld` as a styling hook, and the key is alias-filled from an app-supplied `isRequired` label so a localized catalog keeps its own wording until it translates the new key. Restart **and** rebuild your bundles — the browser bundle changed (the two FormValidator autofill fixes ride `gina.min.js` and `gina.min.css`). |
 | **Q4 2026** | `0.6.28` ✅ | **Security**: absolute URLs built by an application-level `getRoute().toUrl()` no longer inherit another request's proxy context — after a single request carrying a port-less `Host` (an orchestrator probe, a sibling-bundle call) reached a worker, every later direct request on it built URLs from a worker-global, dropping the port on HTTP/1.1 and emitting the *last port-less client's host* verbatim on HTTP/2 + HTTPS, which is a host-header-injection class for application-built links and redirects; the proxied classification and proxy hostname now resolve from the request itself, and on earlier versions `server.proxy.requireForwardedHeaders` closes the port-less-`Host` path only. **Added**: `self.forward()` relays a `multipart/form-data` request, uploads included, through a new RFC 7578 encoder and a raw-body pass-through, bounded by the source bundle's upload cap (413 on breach, 400 for a body-less method). **Fixed**: `self.forward()` forwards to the route it resolves instead of the target bundle's webroot alone; the browser client no longer stays half-booted on a light page or inside a cross-origin iframe; the HTTP/2 `rel=preload` header is sent on every response rather than only the first per view; the automatic 103 Early Hints response fires at all; the Inspector View tab shows its assets map again; a custom error page carries its preloads and its external plugins; a retried HTTP/1 request goes out with its body; the fluent `.onComplete()` handles of `query()`, `store()`, `run()` and `Shell::run()` refuse a callback they cannot call, and the dead one on entity method objects is removed; `{% extends %}` extraction stops at its own directive and tolerates the layout being named ahead of it; `POST /_gina/maintenance` refuses an invalid `ttlSeconds` instead of arming an unbounded window. Restart your bundles **and rebuild them** — three of the fixes are browser-bundled. |
+| **Q4 2026** | `0.6.29` ✅ | **Security**: a failed Couchbase N1QL statement no longer carries its own result rows into the error it raises — the connector put the query service's whole response envelope, result documents included, on `error.stack` and `error.cause.http_body`, so a `RETURNING` statement that lost a CAS race or a SELECT that timed out part-way wrote the records it had already produced into any log that printed the error, with no interception point for a bundle; both now carry the envelope with `results` replaced by a row-count marker, while `errors`, `requestID`, `status`, `signature` and the classifier's `first_error_code`/`retry` are unchanged. **Added**: `bundle:build` and `project:build` gain an opt-in `--skip-unchanged` — a release whose source is byte-identical to what it was built from keeps its copy, signed by content rather than timestamps and recorded as `.gina-build.json`, with the manifest update, fingerprint stamp, `node_modules` link and both hooks still running and any doubt rebuilding. **Fixed**: a server-side field error reaches the visible control when a hidden twin of the same name comes first in document order; a path-form `getUrl` route containing `@` — the retina-asset idiom — no longer renders a 500 on either template engine; a staged upload no longer posts the literal `[object Object]` into a form that declares no `[preview][...]` sub-fields. Restart your bundles **and rebuild them** — two of the fixes are browser-bundled. |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys |
@@ -148,6 +149,7 @@ Stub commands confirmed in source — handler files exist but are empty or comme
 
 ### Tier 3 — `0.5.x`
 
+
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
 | ✅ | **`project:move`** — Relocate a project's source directory (atomic `renameSync`) and rewrite the `~/.gina/` registry `path`. Refuses while a bundle is running or across filesystems; `--to=/new/path`. | `0.5.5-alpha.2` | 2026-06-19 |
@@ -165,6 +167,12 @@ Stub commands confirmed in source — handler files exist but are empty or comme
 | ✅ | **`controller:remove` / `controller:rm`** — Remove a namespace controller from a bundle, reference-aware and refuse-unless-clean: scans the bundle's `routing.json` `namespace` keys (rule-level and `param.namespace`), `requireController('<name>')` call sites, and the namespace template tree, lists every blocking reference, and deletes the controller file + `templates/html/<name>/` tree only after interactive confirmation. `--dry-run` previews, `--force` deletes the file only (never editing `routing.json`, listing what remains to clean), `--format=json` emits a machine-readable envelope; the default `controller.js` is never removable. | `0.5.25-alpha.2` | 2026-07-23 |
 | ✅ | **`controller:rename`** — Rename a namespace controller and rewrite the references that point at it: moves the controller file, moves its `templates/html/<old>/` tree, and rewrites the `routing.json` `namespace` values + `requireController('<old>')` literals with comment-preserving string ops. Reports (does not rewrite) anything a static rewrite cannot resolve — a `param.namespace` `:variable`, a non-literal `requireController()` argument, the cosmetic class name. Shows the full plan then confirms interactively; `--dry-run` previews, `--force` applies non-interactively, `--format=json` emits the plan envelope. | `0.5.25-alpha.2` | 2026-07-23 |
 
+### Tier 4 — `0.6.x`
+
+| Status | Feature | Version | Target |
+| --- | --- | --- | --- |
+| ✅ | **`bundle:build` / `project:build` `--skip-unchanged`** — Opt-in: skip the wipe-and-copy of a release whose source is byte-identical to what it was built from — a content signature (sha1 of every file's bytes + every symlink's target, timestamp-insensitive, with a stat fast path off the previous marker) recorded as `.gina-build.json` at the release root; the manifest update, fingerprint stamp, `node_modules` link and hooks still run, and any doubt rebuilds. `--force` / `--dry-run` / `--format=json`, plus a `GINA_BUILD_SKIPPED_BUNDLES` / `GINA_BUILD_SKIPPED_ALL` signal for the `postbuild` hook. | `0.6.29-alpha.2` | 2026-09-08 |
+
 ---
 
 ## Modernisation

package/framework/v0.6.29/VERSION

@@ -0,0 +1 @@
+0.6.29

package/framework/{v0.6.28 → v0.6.29}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -13268,6 +13268,38 @@ function ValidatorPlugin(rules, data, formId, culture) {
         return true;
     };
 
+    /**
+     * hasPaintableTwin — does another control of the same name exist that CAN receive
+     * the error paint? (#B510)
+     *
+     * A BARE hidden control (`type=hidden`, not sitting in a `form-item-wrapper`) can never
+     * receive the error-message node nor the `aria-invalid` state: every paint gate in
+     * `handleErrorsDisplay` skips it. When the same name is also carried by a control that
+     * can be painted — the recommended shape for a control that must render disabled yet
+     * still post, i.e. a visible control plus a hidden twin with rule `"exclude": false` —
+     * the bare hidden one must not consume the error, or the visible twin is never reached.
+     * A bare hidden twin does not count as paintable; a wrapped hidden one does (its message
+     * is inserted after the wrapper).
+     *
+     * @param {object} $form - the HTMLFormElement being walked
+     * @param {object} $el - the bare hidden control under consideration
+     * @returns {boolean} true when at least one other same-named control can be painted
+     *
+     * @inner
+     */
+    var hasPaintableTwin = function($form, $el) {
+        var name = $el.name;
+        if (!name) return false;
+        for (var t = 0, tLen = $form.length; t<tLen; ++t) {
+            var $other = $form[t];
+            if ( $other === $el || $other.name != name ) continue;
+            // a bare hidden twin cannot be painted either
+            if ( $other.type == 'hidden' && !/form\-item\-wrapper$/.test($other.parentNode.className) ) continue;
+            return true;
+        }
+        return false;
+    };
+
     /**
      * handleErrorsDisplay
      * Attention: if you are going to handle errors display by hand, set data to `null` to prevent Toolbar refresh with empty data
@@ -13276,10 +13308,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
      * this reflects each managed field's committed validity into `aria-invalid` ("true" on a
      * committed error, "false" when valid — mirroring the native ValidityState where the field has
      * native HTML constraints so it agrees with `:user-invalid`). Soft live-check warnings are not asserted.
+     *
+     * #B510 — a bare hidden control (no `form-item-wrapper`) is not a paint target when another
+     * control of the same name can be painted; see `hasPaintableTwin`.
      * @param {object} $form - Target (HTMLFormElement)
      * @param {object} errors
      * @param {object|null} data
-     * @param {string|null} [fileName]
+     * @param {string|null} [fieldName] - restricts the pass to one field (the per-field / live-check path)
      */
     var liveCheckErrors = {}; // Per Form & Per Element
     var handleErrorsDisplay = function($form, errors, data, fieldName) {
@@ -13406,6 +13441,18 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
             if (!name) continue;
 
+            // #B510 — a BARE hidden control (no form-item-wrapper) can never receive the
+            // message node nor the aria state below (every paint gate skips `type=hidden`),
+            // yet it used to consume the error: it took the box's error class and, on the
+            // per-field path, the name-match exit at the end of this loop stopped the walk
+            // on it — so a visible twin listed AFTER it (the disabled-control + hidden-twin
+            // pattern) was never painted, and on a shared box the pre-marked class blocked
+            // the twin's first-error branch too. Skip it when a paintable same-named control
+            // exists; a LONE bare hidden keeps the former behaviour (box class, no message).
+            if ( $target === $el && $el.type == 'hidden' && hasPaintableTwin($form, $el) ) {
+                continue;
+            }
+
             // #A11Y1 (slice 2) — detect a consumer-provided aria-errormessage association. When
             // present, the field already references its own error element, so we must NOT inject a
             // competing form-item-error-message div (aria-invalid alone exposes it). Any wire we add
@@ -15735,7 +15782,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         continue;
                     }
                     //fieldsObjectList[key].value = (/object/i.test(typeof(files[f][key])) ) ? JSON.stringify( files[f][key] ) : files[f][key];
-                    fieldsObjectList[key].value = files[f][key];
+                    // #B459 — the preview slot is a sub-field map, never an input (see the
+                    // auto-create loop at bind time): its object is delivered key by key by
+                    // the `handle preview` block below, never through `.value`.
+                    if ( key != 'preview' ) {
+                        fieldsObjectList[key].value = files[f][key];
+                    }
                     // update submited $fields ??
 
                     // handle preview
@@ -19340,6 +19392,18 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                             hiddenFields[_f] = {};
 
                                         if ( typeof(hiddenFields[_f][ mandatoryFields[m] ]) == 'undefined' ) {
+                                            // #B459 — `preview` is the one slot that is never a flat input:
+                                            // its value is an OBJECT (`{location, uri, tmpUri, width, height}`),
+                                            // which an input's `.value` can only hold as "[object Object]".
+                                            // A form that declares no `[preview][...]` sub-fields gets an
+                                            // EMPTY sub-field map instead, so the fill loop still visits the
+                                            // key (the nested thumbnail is rendered from there) and posts
+                                            // nothing for it — the documented field set. Declaring the
+                                            // sub-fields stays the opt-in for persisting the preview.
+                                            if ( mandatoryFields[m] == 'preview' ) {
+                                                hiddenFields[_f].preview = {};
+                                                continue;
+                                            }
 
                                             _name = fieldPrefix +'['+ _f +']['+ mandatoryFields[m] +']';
                                             // create input & add it to the form