gina 0.6.30-alpha.1 → 0.6.30

package/CHANGELOG.md

@@ -6,6 +6,24 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.30 - 2026-09-10
+### Added
+* Log rotation for the logger's opt-in `file` container, on by default at 10MB with 5 files kept — deliberately the same shape as the kubelet's own `containerLogMaxSize` / `containerLogMaxFiles`. Configure it under `rotate` in `~/.gina/user/extensions/logger/file/config.json`, where the container is already enabled: `enabled` (default true), `when` (`"daily"` or null), `size` (default `"10MB"`), `count` (default 5) and `maxAge` (e.g. `"30d"`, off by default). The live file is renamed and reopened rather than copied and truncated, so no line is lost while rotating, and the sink holds one append stream per group over a synchronously opened descriptor — which is what lets a burst of lines logged in a single tick rotate correctly, since a stream that opens asynchronously has no file to rename yet. A size or age without an explicit unit is refused rather than guessed — `"10"` is never read as bytes — and any invalid value disables rotation with a message naming the key, the value and the consequence, reported through the log flows so it reaches stdout and `gina tail`, while logging itself continues. Each log group is written to its own file, `<logdir>/<bundle>@<project>.log`. Two bounds are worth knowing: bytes still queued when a process exits can be lost, because flushing is asynchronous and making every write synchronous would let a full disk block the request loop; and a file that stops draining past a 4MB buffer drops lines with one warning per outage, the same posture the MQ transport already takes.
+* `gina tail` honours the logger's JSON render mode. When its own logger resolves the output format to `json` — `GINA_LOG_FORMAT=json` on the `gina tail` process — every relayed line is written as one JSON object (`ts`, `level`, `bundle`, `message`, plus the `group`/`msg` aliases) instead of the coloured text. This is the JSON answer for a container that runs a framework daemon (`gina start`, then `gina bundle:start`, with `gina tail` as the foreground process): the daemon discards the bundle's own stdout once the bundle has started, so the tail relay is the only path a runtime line has to `kubectl logs`, and it must stay on — do not set `GINA_LOG_STDOUT=true` in that topology. The relay carries no request context, so `requestId` and `durationMs` are not present on these lines. (#B524)
+### Changed
+* `self.getConfig()` — the bare form and `getConfig('name')` alike — now returns a per-call copy-on-write view of the configuration instead of a deep clone. Reads pass through to the shared configuration at no copy cost, a write lands in the view's own overlay (it never reaches the live configuration and no other call sees it), and the first enumeration of a node (`Object.keys`, `JSON.stringify`, `for…in`, spread) copies that subtree once. Every read, write and serialisation that worked on the clone works on the view. Measured on the profiling harness, a route behind a middleware pair whose constructors each read `this.getConfig()` went from 14,719 ms to 1,884 ms for 3,000 requests and the deep-clone share of its CPU from 72.9 % to 3.1 % — the bare form was deep-copying a 445 KB resolved configuration on a minimal scaffold, megabytes on a large bundle. Three things a deep clone allowed do not work on a node you have not enumerated yet: `structuredClone(result)` throws a `DataCloneError`, `Object.freeze` / `Object.seal` throw a `TypeError` (enumerate the parent first — the node is then a plain copy), and `console.log` / `util.inspect` show the shared values rather than your writes (property reads and `JSON.stringify` are truthful). A bundle whose code relies on one of them opts back into deep clones with the new `settings.json` key `controller.getConfig.mode: "clone"`. The view also preserves the configuration's `settings` / `content.settings` aliasing, which the clone silently broke. New library `lib/conf-view`, on the framework's lib registry as `confView` (`create()` / `isView()`). On the same per-request path, the router no longer deep-clones the whole routing map for every matched request: it shallow-copies the map and the matched rule — the only per-request write there is the replacement of that rule's `param`, and the middleware list the request consumes is already its own copy from the matcher — so every other rule is shared by reference; a large routing table stops paying a per-request deep copy, and nothing observable changes for a bundle. Pickup: a bundle restart; no re-bake. (#P40)
+### Fixed
+* The default swig render path now renders through a per-bundle engine instead of the process-wide swig singleton, so one bundle's template root can no longer reach another bundle's `{% include %}` / `{% extends %}` resolution. `controller.js` stamped a per-bundle loader onto the shared engine with `swig.setDefaults({ loader })` once per render, and the render delegates then await before compiling — the same interleave window that produced the render-context bleed fixed alongside this. In merged-process mode (several bundles sharing one process and port) a concurrent bundle's stamp lands inside that window, so a resumed render resolves its layout and includes against the other bundle's templates root, or trips swig-core's outside-root refusal. Each template root now gets its own `new swig.Swig({ loader })` instance, keyed and owner-guarded exactly like the async delegate's registry, and `self.engine` points at it so a bundle's own `controllers/setup.js` filters register on the engine that actually renders it. A per-call `loader` passed to `swig.compile()` was measured to be incapable of fixing this: swig-core merges per-call options into a local that never leaves `parse`, while the parent-chain walk and `parseFile` read the instance loader unconditionally, and the include codegen carries only `resolveFrom`. The module-level `setDefaults` is deliberately kept, because the framework still compiles inline routing and asset strings through the module. No consumer was measured to be exposed: there is no supported CLI path to a shared port, and the one runtime measurement on record reports that sibling bundles are not served in merged mode at all, so this is a structural fix rather than a response to a reachable trigger. Pickup: a bundle restart; no re-bake. (#B514)
+* The logger's opt-in `file` container is now an in-process transport, and writes. It connected to the MQ, received every log line and wrote nothing to disk: the filename was resolved from an argv-derived bundle list that is structurally always empty in a bundle process, because the framework splices `process.argv` down to `[node, appPath]` for every process loaded through the CLI. Fixing that exposed three further defects, each measured on a live daemon topology. Enabling the flow killed the framework daemon: the container dialled the MQ port at construction, that dial happens before the daemon binds its own listener, and the socket error handler called `process.exit(0)` — so `gina start` died before reporting itself ready, and a bundle started without a daemon exited with status 0 one second after boot (#B526). The MQ listener forwards every line to every file-writing session, so each process carrying the flow wrote every bundle's lines into one shared per-host file and built a full configuration for a bundle it is not, which crashed `gina bundle:start` (#B527). Several processes appending to one file each kept their own rotation state and size counter, so rotation raced and lost lines with no warning. The container now consumes the same in-process event the stdout container consumes and writes only the lines its own process logged, to a file named after the log group — one writer per file, no socket, and no daemon required, so it also works inside a container. Lines whose group is not a bundle, meaning the CLI's and the daemon's own output, are not filed, which is the guard the previous write path already applied. Records are written without ANSI escape sequences, and `GINA_LOG_FORMAT=json` is honoured (#B529). A failed open or write is reported once and retried rather than leaving the sink silently dead (#B530), and the container reports through the log flows instead of a raw stdout write that reached nobody under a daemon (#B528). (#B523)
+* `gina-container` now applies the documented container logging preset itself. Unless `GINA_LOG_STDOUT` is already set, the launcher sets it to `true` before its own logger and the bundle initialise, so a bundle it runs emits JSON lines and skips the MQ transport — instead of writing ANSI-coloured text into the container stdout while two processes, the launcher and the bundle, keep dialling an MQ listener that cannot exist in that topology. Images synthesised by `gina image:build` inherit the change, since their entrypoint runs `gina-container`. Explicit values win: `GINA_LOG_FORMAT=text` keeps the coloured text with the dial still skipped, and `GINA_LOG_STDOUT=false` restores the previous behaviour in full. Bundles started through a framework daemon (`gina start` + `gina bundle:start`) are unaffected — there the MQ transport feeds `gina tail` and stays on. (#B524)
+* The server-side `query` validation rule no longer writes into the shared `app.proxy` configuration. A `query` rule that targets another bundle (`check-user@otherbundle`) bound its request options straight to that bundle's proxy target inside the process-wide `app` config — the global two-argument `getConfig()` hands its result back by reference — then set `method` and `path` on it, and the framework's own query path added a `requestTimeout` taken from the calling route's `queryTimeout` before making its defensive copy. All three persisted for the life of the process. The consequential one is `requestTimeout`, because it is the key the framework reads back. Once a stale value sits on the shared target, the guard that fills it in (`typeof options.requestTimeout === 'undefined'`) can no longer fire, so a later live-check from a different route silently runs on the earlier route's deadline instead of its own — measured: a route asking for 9s governed by a polluted 1s, against an unpolluted control that correctly used its own. On HTTP/2 that does more than end the call early: the stream-timeout handler evicts and destroys the pooled session for that upstream — shared with every other request to the same authority, measured as one reused client object — and then re-issues the request up to three times. So one route's live-check could degrade traffic that never touched the rule. It only affects proxy targets that leave `requestTimeout` unset, and a timeout is always armed, so nothing hangs. A configured `path` prefix was overwritten too, and that is a documented `proxyTarget` property rather than a stray key — but it is worth being exact: no part of the framework consumes that value (the two other readers of the target overwrite it or ignore it, and nothing prepends it to an outgoing request), so its effect is on anything in your own code that reads the proxy configuration back. The rule now clones the proxy target before using it; nothing about the outgoing request changes. Present in every release that carries the rule (measured back to `0.3.7`). Pickup: a bundle restart AND a re-bake — measured by identity, `gina.min.js` changes while `gina.min.css` stays byte-identical. (#B522)
+* `getRoute()` now hands a caller outside any request a boolean `route.isProxyHost` even when the process never set the proxied-context latch, so cloning that route no longer logs a `JSON.clone(...) possible error detected` warning, with a stack, for a value that was legitimately unset. On the server the proxied classification comes from the request store first and, for a req-less caller (boot, CLI, cron, a bundle's setup hook), from the `isProxyHost` context latch. The boot-time writer of that latch runs only when the project's proxy configuration resolved a record for the running scope and env, so a bundle whose `proxy.json` exists but carries no such record boots with the latch unset, and the fallback read returned `undefined`. Every consumer reads the flag by truthiness, so no behaviour hinged on it; the cost was the warning, which the framework's own test runs reproduce and which trains operators to ignore a diagnostic that is load-bearing elsewhere. The fallback now coerces to `false` — the idiom the sibling readers of the same latch already use — so a proxied route stays proxied, a request-scoped resolution is untouched, and the route matches its documented contract. Reach outside the framework's test runs is code-read rather than live-driven: an application calling `getRoute()` outside a request on such a bundle, then cloning the result. Pickup: a bundle restart; `lib/routing` ships in the browser bundle, so `gina.min.js` changes (measured by identity, `gina.min.css` byte-identical) — but the client branch never produced the value and the client-side clone never warned, so a re-bake changes bytes, not behaviour. (#B537)
+* An error raised by the global `getConfig()` / `getLib()` helpers is now answered to the request whose call failed, rather than to whichever request was routed most recently. Those helpers resolve the response to write through a process-wide context slot that the router fills on every routed request and never clears. With one request in flight and another routed behind it, a callback resuming after an await found the later request's response there: it wrote its own failure to that client, and its own caller was never answered at all — the request simply hung until the caller's timeout, presenting as an upstream fault rather than an error. The incident reference added in the previous release made the diagnosis harder rather than easier here, because it derived the request identifier from the same wrong response, so the correlation line named a request that had nothing to do with the failure. Both now come from the per-request context the server establishes for every request on both engines, which follows the call across `await`; the process-wide slot remains only for callers that have no request context at all — boot, CLI, cron and workers — which is what it was there for. Pickup: a bundle restart. (#B534)
+### Security
+* A response rendered on the default swig path no longer carries a concurrent request's context. The template filters `getUrl`, `getWebroot`, `t` and `tIcu` resolve per-request context through `getRenderCtx()`, which reads an AsyncLocalStorage store first and falls back to the process-wide `SwigFilters.instance._options` singleton — and that store was entered by the two `-async` render delegates alone, leaving every bundle on the DEFAULT path (the one taken unless a bundle opts into `settings.template.swig.loader`) resolving against the singleton. Both default delegates are themselves async and await between the per-request stamp of that singleton and the template invocation, unconditionally so on the layout read, so a concurrent request's stamp lands inside the window and the resumed render emits the other in-flight request's negotiated culture, webroot and proxy classification into its own response — the wrong language for a visitor, and absolute URLs built from a host the other client chose. Measured on a built `--env=prod` release: 50 of 50 concurrent request pairs served one response carrying the other request's context before the fix and 0 of 100 after, with a serialized control and a reused keep-alive connection reading clean throughout. Development mode masked it, because `lib/index.js` re-requires the filter module per request there and no singleton is shared. `controller.render-swig.js` and `controller.render-v1.js` now enter the same store the async delegates use, so the singleton remains only for callers outside a request, such as a bundle's own mail or cron renderer. Pickup: a bundle restart; no re-bake. (#B514)
+* A completion that an emit-style entity method signals AFTER its call has settled is now discarded at the entity's `emit`, never buffered for the next caller. A method that emitted its completion trigger more than once per call — once per iteration of an internal loop, for instance — settled its caller on the first emit correctly, but every later emit reached the entity after the dispatcher had drained the queue and removed itself, so it took the legacy buffering path into `_arguments`; the NEXT detached (`util.promisify`-style) caller of that method then consumed the buffered entry as its own result, the caller after it too, and the buffer grew by one entry per surplus emit until the bundle restarted. Measured on a built `--env=prod` release: callers B and C both received A's record and `_arguments` read 2, 4, 6. Entity-context callers (`entity.method()` returning a Promise) were immune through their per-call clear, and development mode masked the defect entirely because its per-call clear runs on every wrapped call — a clean local reproduction is not evidence a deployment was unaffected. Where such a method reads a user-scoped record, an ownership check could pass on another principal's row. Every settle path now stamps the call's resolver, and the `emit` override treats a completion of an already-settled call as surplus: not buffered, and reported once per call at debug level as `DISPATCH:REPEAT_EMIT` when a method emits its completion a second time (one late completion after a Promise or timeout settle stays silent). `DISPATCH:NO_CONTEXT` now also fires when a completion reaches the entity outside any call's async context with nothing pending — that case used to log nothing, so a zero count was ambiguous. Numbered `<trigger>1`, `<trigger>2` loop variants are unaffected, and the dispatcher lifecycle is unchanged. Pickup: a bundle restart; no re-bake. (#B441)
+* The framework's third `throwError` — the one behind the global `getConfig()` and `getLib()` helpers, reached when a configuration slice or a library cannot be resolved during a live request — no longer writes the error's full stack to the HTTP response, and now records the failure server-side. It used to answer in every scope with the raw stack in the `error` string — the framework's install path and version directory, the application's file paths and line numbers, the bundle, environment and library names — and emitted no log line at all, so an operator could neither see it happen nor search for past occurrences. It now does what the other two error builders have done since 0.5.24: a short incident `ref` is minted and returned as a top-level field on the JSON body, ONE full-detail line (message, stack, cause, request id) is logged before the response is written, keyed by that ref, and outside local scope the response carries the message line only. Local scope keeps the stack in the `error` string, as before, so the dev toolbar is unaffected; a relay-safe `ref` supplied on the error is honoured. The one-argument string form now reports the string instead of `undefined`, and the never-reachable HTML arm of this path is removed. Affects every release since `0.1.0`. Pickup: a bundle restart; no re-bake. (#B533)
+
 ## 0.6.29 - 2026-09-08
 ### Added
 * `bundle:build` and `project:build` gain an opt-in `--skip-unchanged` flag. A release whose bundle source is byte-identical to what it was built from keeps its copy: the build signs the source (the sha1 of every file's bytes and every symlink's target — timestamps do not count, so a fresh checkout or a plain `cp` does not invalidate, and a stat fast path off the previous marker keeps a stable-timestamp source to stats only), records the signature at the release root as `.gina-build.json`, and skips the wipe-and-copy when the marker matches. Everything else still runs: the manifest update, the fingerprint stamp, the `node_modules` link and both hooks. Any doubt rebuilds — no marker, a marker of another spec, a missing release, a changed, added or removed file, or an error while checking — and nothing changes without the flag; the first flagged build always copies. `--force` rebuilds anyway and still records the marker; `--dry-run` prints each release's decision and its reason without touching anything; `--format=json` emits one `{ project, scope, dryRun, skipUnchanged, releases[] }` envelope. The `postbuild` hook receives `GINA_BUILD_SKIPPED_BUNDLES` (the bundles whose every built env was skipped) and `GINA_BUILD_SKIPPED_ALL`, so a hook that bakes its own outputs can skip its own work. Not detected, by design: edits made directly inside a release, file mode changes, and the framework version (recorded in the marker for diagnostics only).

package/README.md

@@ -66,29 +66,38 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.29
+## What's in 0.6.30
 
-> **Restart your bundles *and* rebuild them.** Two of the fixes are
-> browser-bundled — the field-error painter and the staged-upload preview slot —
-> so `gina.min.js` changed and `gina bundle:restart` alone leaves the old client
-> running. Rebuild each consuming bundle, then restart.
+> **Restart your bundles *and* rebuild them.** `lib/routing` and the validator's
+> client half both ship in the browser bundle, so `gina.min.js` changed and
+> `gina bundle:restart` alone leaves the old client running. Rebuild each
+> consuming bundle, then restart.
 
-> **No settings reset.** `0.6.29` is a patch — the `shortVersion` stays `0.6`,
+> **No settings reset.** `0.6.30` is a patch — the `shortVersion` stays `0.6`,
 > so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**The right-destination release.** Four of the five changes are a value arriving
-somewhere it should not, or failing to arrive where it should: a failed query
-carrying its own result rows into every log that printed the error, a field
-error stopping on a control that could never display it, a staged upload posting
-the literal `[object Object]`, and a retina asset path cut in half at its `@`.
-The fifth is the opposite kind of change — `bundle:build` learns to do nothing
-at all when there is nothing to do. Full detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — a failed N1QL statement no longer carries its own result rows (#B509).** The couchbase connector placed the query service's whole response envelope — result documents included — on `error.stack` and `error.cause.http_body`, so a `RETURNING` statement that lost a CAS race, or a SELECT that timed out part-way, wrote the records it had already produced into any log that printed the error. The controller error path prints the stack in every scope, and a bare `console.error(err)` renders the cause, so there was no interception point for a bundle. Both now carry the envelope with `results` replaced by a row-count marker; `errors`, `requestID`, `status`, `signature` and the classifier's `first_error_code`/`retry` are unchanged, the SDK's own error object is copied rather than mutated, and a body the connector cannot parse is dropped rather than forwarded.
-- **Added — `bundle:build` and `project:build` gain `--skip-unchanged`.** A release whose bundle source is byte-identical to what it was built from keeps its copy. The build signs the source — the sha1 of every file's bytes and every symlink's target, so timestamps do not count and a fresh checkout or a plain `cp` does not invalidate — records that signature at the release root as `.gina-build.json`, and skips the wipe-and-copy when it matches. Everything else still runs: the manifest update, the fingerprint stamp, the `node_modules` link and both hooks. Any doubt rebuilds, and nothing changes without the flag. `--force` rebuilds anyway and still records the marker, `--dry-run` prints each release's decision and its reason without touching anything, and the `postbuild` hook receives `GINA_BUILD_SKIPPED_BUNDLES` / `GINA_BUILD_SKIPPED_ALL` so a hook that bakes its own outputs can skip its own work.
-- **Fixed — a server-side field error reaches the visible control (#B510).** The client-side painter walked the form in document order and stopped on the first control whose name matched, whether or not it could paint it — and a bare `type="hidden"` control never can. So with the recommended shape for a control that must render disabled yet still post (a visible control plus a hidden twin carrying rule `"exclude": false`), a hidden twin listed first consumed the error: no message, no `aria-invalid`, and on a shared wrapper the error class was set with nothing inside it. A bare hidden control is now skipped when another control of the same name can be painted; a lone hidden one keeps the former behaviour, and one inside a `form-item-wrapper` is still painted after its wrapper.
-- **Fixed — a path-form `getUrl` route containing `@` no longer renders a 500 (#B511).** Both the swig and the nunjucks filter split every `@`-bearing route as `rule@bundle` before checking whether it was a path, so the retina-asset idiom the filter's own comment cites — `'/assets/img/common/header@2x.png' | getUrl` — was cut at the `@`, failed the bundle lookup on the remainder and called `throwError(500)` mid-template, returning a 500 while the action's own render was discarded. A route with a leading `/` now bypasses the split on both engines. One consequence to know: a path-form route cannot name a bundle in-string (`'/x.png@web'`) — pass it as the filter's base argument (`| getUrl(null, 'web')`), which was already the working form and is unchanged.
-- **Fixed — a staged upload no longer posts `[object Object]` (#B459).** The client writes one hidden input per metadata field into the real form, auto-creating any the form did not declare — and `preview`, whose value is an object rather than a string, was auto-created like the others, so a form declaring no `[preview][...]` sub-fields got a flat input that the fill loop string-coerced. Such a form now posts no `preview` field at all, matching the documented field set; the thumbnail still renders, and a form that declares the `[preview][location|uri|width|height]` sub-fields is unchanged — declaring them remains the way to persist the preview. Server code that keyed on the *presence* of a `preview` field for such forms should key on its value: it was garbage before and is absent now.
+**The isolation release.** Most of what changed here is one piece of in-flight
+work seeing another's state: a response rendered with a concurrent request's
+language and webroot, a framework error answered to whichever request was routed
+most recently, a later caller of an entity method handed an earlier call's
+record, and one bundle's templates resolving against another bundle's root. Each
+was invisible in development, because dev mode rebuilds per request what
+production shares. Alongside them, `self.getConfig()` stops deep-copying the
+resolved configuration on every call. Full detail in [CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — a rendered response no longer carries a concurrent request's context (#B514).** The `getUrl`, `getWebroot`, `t` and `tIcu` filters resolved per-request context through a process-wide singleton on the default render path, and both delegates await between stamping it and invoking the template. Measured on a built release: 50 of 50 concurrent pairs served one response carrying the other's negotiated culture and webroot before the fix, 0 of 100 after.
+- **Security — a later caller no longer receives an earlier call's record (#B441).** An entity method that emitted its completion more than once per call buffered every surplus emit, and the next `util.promisify`-style caller consumed it as its own result. Where such a method reads a user-scoped record, an ownership check could pass on another principal's row. Development mode masked it entirely.
+- **Security — a failed `getConfig()` / `getLib()` no longer writes its stack to the response (#B533).** The helper behind the implicit globals answered in every scope with the raw stack — install path, application file paths and line numbers — and logged nothing. It now mints an incident `ref`, logs one full-detail line, and sends the message alone outside local scope.
+- **Changed — `self.getConfig()` returns a copy-on-write view (#P40).** Reads pass through to the shared configuration at no copy cost and writes land in the call's own overlay. A route behind two middlewares reading `this.getConfig()` went from 14,719 ms to 1,884 ms per 3,000 requests. `structuredClone`, `Object.freeze` and `util.inspect` behave differently on a node you have not enumerated; `controller.getConfig.mode: "clone"` opts back out.
+- **Added — log rotation for the logger's opt-in `file` container.** On by default at 10MB with 5 files kept, the same shape as the kubelet's own limits. The live file is renamed and reopened rather than copied and truncated, so no line is lost while rotating.
+- **Added — `gina tail` honours the logger's JSON render mode (#B524).** With `GINA_LOG_FORMAT=json` on the tail process, every relayed line is written as one JSON object — the JSON answer for a container running a framework daemon, where the tail relay is the only path a runtime line has to `kubectl logs`.
+- **Fixed — the default swig path renders through a per-bundle engine (#B514).** One bundle's template root can no longer reach another's `include` / `extends` resolution, and `self.engine` now points at the engine that actually renders the bundle.
+- **Fixed — a framework error is answered to the request that raised it (#B534).** The response came from a process-wide slot the router fills on every routed request and never clears, so a callback resuming after an `await` wrote its failure to a later request's client while its own caller hung until timeout.
+- **Fixed — the `query` validation rule no longer writes into shared proxy config (#B522).** A rule targeting another bundle set `method`, `path` and a route-derived `requestTimeout` on the process-wide proxy target, so a later live-check from a different route silently ran on the earlier route's deadline — and on HTTP/2 the timeout destroys the pooled session shared with every other request to that authority.
+- **Fixed — the logger's `file` container writes (#B523).** It connected to the MQ, received every line and wrote nothing; it is now an in-process transport writing only its own process's lines, needing no daemon.
+- **Fixed — `gina-container` applies the container logging preset itself (#B524).** A bundle it runs emits JSON and skips the MQ transport, instead of writing coloured text while two processes dial a listener that cannot exist in that topology. Explicit values still win.
+- **Fixed — a req-less `getRoute()` returns a boolean `isProxyHost` (#B537).** Cloning such a route no longer logs a warning, with a stack, for a value that was legitimately unset.
+
 
 ## Documentation
 

package/ROADMAP.md

@@ -81,8 +81,9 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.27` ✅ | **Security**: Inspector payloads no longer leak across requests through the compiled-template cache — with `server.cache.enable` on and the Inspector block injected, automatic in dev and in production only when a controller calls `self.render(data, true)`, the `window.__ginaData` script was baked into the layout before swig compiled it, so the per-view compiled template and the persisted `.gina-layout-cache` file carried the FIRST request's page data — the controller's data, the session card, the environment — to every later request of that view, to other views compiled after it, and to every later process until the file was removed; the popin hidden inputs were a second pre-compile carrier and `/_gina/reveal` froze with them; the compiled layout now carries only an HTML-comment marker and both cache paths build the payload after the template executes, so a cache hit refreshes the Inspector sinks too, and a stale layout-cache file from an earlier release is healed in place on the next compile. **Changed**: two controller events fire less often now that the fluent `{onComplete}` handles deliver per call — `query#complete` is emitted on the controller only when nothing consumed the outcome, no callback and no `.onComplete()`, one tick after settlement, and `'uploaded'` is no longer emitted for the fluent `store(target).onComplete(cb)` form; neither had a documented listener; `query()` in callback form now returns `undefined` on every path instead of an unusable per-transport handle, and an explicit `null` callback selects the fluent form instead of throwing at delivery time. **Fixed**: the completion-handle release. `lib.archiver` settles each `compress()` and `decompress()` call on its own completion channel — every completion used to be signalled by emitting one fixed event name on the process-wide singleton, so two overlapping calls in one process, two queue consumers or a request handler beside a worker, both received whichever run finished first: the second caller was released early with the first run's archive path and its own archive was left at 0 bytes, and the array form kept its output stream in an implicit global so finishing one run closed another's; errors on the streams the library opens itself now reach the caller too, where an unreadable input used to either crash the process or hang the run forever, leaving a corrupt partial archive on disk. **Fixed**: the directory form of `compress()` no longer drops the first entry of the top-level directory — its walk seeded the work list from index 1, the author evidently expecting `.` first, which node's `readdir` never returns, so a directory holding a single file archived to an empty zip; the in-tree `project:backup` command uses the array form and was never affected. **Fixed**: the single-file form of `compress()` writes a real one-entry zip and `decompress()` reads every form back — it used to pipe the file through a gzip codec and write the result under the `.zip` name, which `unzip` and `decompress()` both rejected, while `method: 'br'` and `'deflate'` were accepted by the option validator and silently produced that same gzip; the bytes change from a gzip member to a DEFLATE zip, so anything that gunzipped the output directly must now read it as a zip, `method` validates against `gzip` alone again, and an input whose path carries a dot-prefixed segment, a `.env` or anything under `~/.config/`, is archived instead of being skipped with a false success, an empty zip and two leaked descriptors. **Fixed**: the fluent `.onComplete()` handles of `self.query()` and `self.store()` deliver to their own call — both registered the application callback on the controller instance's shared EventEmitter, so a second `store()` on the same controller re-invoked every earlier callback with the later result, and a concurrent fluent query evicted the first one: its callback never fired, the survivor could receive the other call's payload and the evicted response was emitted to nobody, on both transports with no log line; the synchronous failure paths of `query()` also returned `emit()`'s boolean instead of the handle, so chaining `.onComplete` threw `TypeError` and the error was lost; `query()` now mints one delivery channel per call and returns the handle on every path, with the delivered shapes unchanged. **Fixed**: a `self.query()` issued while the controller is rendering from another required controller now settles — the guard that refuses it once a second render has been entered, the state `requireController` produces because the required controller shares the caller's options object, returned the literal `false` and delivered nothing, so the callback form never fired and the fluent chain threw `TypeError` on the boolean; the refusal now rides the per-call channel as a coded `NESTED_RENDER` error and the upstream is still never contacted. **Fixed**: FormValidator reacts to a browser or password-manager autofill — a fill lands without any keystroke, and on Chrome without an `input` or `change` event until a later gesture, so the live check never re-ran: the submit control kept the gated look it was given at bind time on a form the user could see was complete, and an autofilled invalid value showed no error; the default stylesheet now gives every autofilled control a 1ms keyframe and the validator routes the resulting `animationstart` into the field's own live check, while a value the browser still withholds from script no longer counts against the gate and renders no false required error. **Fixed**: FormValidator tells the truth about a field the browser autofilled but still withholds from script at submit time — visibly filled yet reading empty to script, it is correctly refused, but the message rendered was the plain required label, naming a problem the user could not see; a new built-in label key `isRequiredAutofill` covers that one case with the verdict, the `errors` key and the submit gate all unchanged, the control is marked `data-gina-form-autofill-withheld` as a styling hook, and the key is alias-filled from an app-supplied `isRequired` label so a localized catalog keeps its own wording until it translates the new key. Restart **and** rebuild your bundles — the browser bundle changed (the two FormValidator autofill fixes ride `gina.min.js` and `gina.min.css`). |
 | **Q4 2026** | `0.6.28` ✅ | **Security**: absolute URLs built by an application-level `getRoute().toUrl()` no longer inherit another request's proxy context — after a single request carrying a port-less `Host` (an orchestrator probe, a sibling-bundle call) reached a worker, every later direct request on it built URLs from a worker-global, dropping the port on HTTP/1.1 and emitting the *last port-less client's host* verbatim on HTTP/2 + HTTPS, which is a host-header-injection class for application-built links and redirects; the proxied classification and proxy hostname now resolve from the request itself, and on earlier versions `server.proxy.requireForwardedHeaders` closes the port-less-`Host` path only. **Added**: `self.forward()` relays a `multipart/form-data` request, uploads included, through a new RFC 7578 encoder and a raw-body pass-through, bounded by the source bundle's upload cap (413 on breach, 400 for a body-less method). **Fixed**: `self.forward()` forwards to the route it resolves instead of the target bundle's webroot alone; the browser client no longer stays half-booted on a light page or inside a cross-origin iframe; the HTTP/2 `rel=preload` header is sent on every response rather than only the first per view; the automatic 103 Early Hints response fires at all; the Inspector View tab shows its assets map again; a custom error page carries its preloads and its external plugins; a retried HTTP/1 request goes out with its body; the fluent `.onComplete()` handles of `query()`, `store()`, `run()` and `Shell::run()` refuse a callback they cannot call, and the dead one on entity method objects is removed; `{% extends %}` extraction stops at its own directive and tolerates the layout being named ahead of it; `POST /_gina/maintenance` refuses an invalid `ttlSeconds` instead of arming an unbounded window. Restart your bundles **and rebuild them** — three of the fixes are browser-bundled. |
 | **Q4 2026** | `0.6.29` ✅ | **Security**: a failed Couchbase N1QL statement no longer carries its own result rows into the error it raises — the connector put the query service's whole response envelope, result documents included, on `error.stack` and `error.cause.http_body`, so a `RETURNING` statement that lost a CAS race or a SELECT that timed out part-way wrote the records it had already produced into any log that printed the error, with no interception point for a bundle; both now carry the envelope with `results` replaced by a row-count marker, while `errors`, `requestID`, `status`, `signature` and the classifier's `first_error_code`/`retry` are unchanged. **Added**: `bundle:build` and `project:build` gain an opt-in `--skip-unchanged` — a release whose source is byte-identical to what it was built from keeps its copy, signed by content rather than timestamps and recorded as `.gina-build.json`, with the manifest update, fingerprint stamp, `node_modules` link and both hooks still running and any doubt rebuilding. **Fixed**: a server-side field error reaches the visible control when a hidden twin of the same name comes first in document order; a path-form `getUrl` route containing `@` — the retina-asset idiom — no longer renders a 500 on either template engine; a staged upload no longer posts the literal `[object Object]` into a form that declares no `[preview][...]` sub-fields. Restart your bundles **and rebuild them** — two of the fixes are browser-bundled. |
+| **Q4 2026** | `0.6.30` ✅ | **Security**: the isolation release — a response rendered on the default swig path no longer carries a concurrent request's negotiated culture and webroot (50 of 50 concurrent pairs bled before the fix, 0 of 100 after); a later `util.promisify`-style caller of an entity method no longer receives an earlier call's record, which where the method reads a user-scoped row could pass an ownership check on another principal's data; and the error raised by the global `getConfig()` / `getLib()` helpers no longer writes its stack to the response, minting an incident `ref` and logging one full-detail line instead. **Changed**: `self.getConfig()` returns a per-call copy-on-write view of the configuration instead of a deep clone — reads pass through, your writes stay yours, and a route behind two middlewares reading `this.getConfig()` measured 14,719 ms → 1,884 ms per 3,000 requests. **Added**: log rotation for the logger's opt-in `file` container, and `gina tail` renders JSON when its logger's format is `json`. **Fixed**: bundle templates render through a per-bundle engine; a framework error is answered to the request that raised it rather than the most recently routed one; the server-side `query` validation rule no longer writes into the shared proxy configuration; the `file` container writes at all; and `gina-container` applies the container logging preset itself. |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
-| **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
+| **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — landed for the next `0.6.x` cut) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys |
 | **2027** | `0.9.0` | Financial-integration heavyweights — entity-layer datastore transaction seam · message-queue connector family (AMQP / Kafka / IBM MQ) |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |

package/bin/gina-container

@@ -25,6 +25,11 @@
  *   GINA_SHUTDOWN_TIMEOUT — graceful drain window in ms (default: 10000)
  *   NODE_ENV              — override project def_env
  *   NODE_SCOPE            — override project def_scope
+ *   GINA_LOG_STDOUT       — container logging preset. Applied as `true` by this
+ *                           launcher when unset (JSON lines, MQ transport skipped —
+ *                           see step 0b). Set it to `false` to keep the transport.
+ *   GINA_LOG_FORMAT       — json|text — the explicit output-format override; it
+ *                           wins over the preset for the format only
  */
 
 var fs    = require('fs');
@@ -56,6 +61,24 @@ function out(msg) {
     try { fs.writeSync(1, msg); } catch (e) { /* stdout gone — nothing better to do */ }
 }
 
+// ── 0b. Container logging preset (#B524) ─────────────────────────────────────
+// This launcher runs a topology with NO framework daemon by construction (see the
+// header), so the logger's default `mq` flow would dial an MQ listener that cannot
+// exist — once from this process, once from the bundle — and the `default` flow
+// would write ANSI-coloured text into a log collector's pipe. `GINA_LOG_STDOUT=true`
+// is the documented container preset (JSON lines, MQ transport skipped): apply it
+// here unless the operator set the variable explicitly. It MUST be a raw
+// `process.env` write — the logger reads `process.env` at init, while `setEnvVar()`
+// populates `process.gina`, which the logger never reads — and it MUST precede the
+// utils/helper require below, which initialises this process's own logger; the
+// bundle child inherits `process.env` through the spawn in step 8. `GINA_LOG_FORMAT`
+// is deliberately untouched: it is the independent format override
+// (`GINA_LOG_FORMAT=text` keeps the coloured text while the dial stays skipped), and
+// `GINA_LOG_STDOUT=false` restores the pre-0.6.30 behaviour in full.
+if (typeof(process.env.GINA_LOG_STDOUT) == 'undefined') {
+    process.env.GINA_LOG_STDOUT = 'true';
+}
+
 // ── 1. Bootstrap utils/helper ─────────────────────────────────────────────────
 // Injects globals: _, setEnvVar, getEnvVar, getUserHome, getTmpDir, etc.
 require(ginaPath + '/utils/helper'); // jshint ignore:line

package/framework/v0.6.30/VERSION

@@ -0,0 +1 @@
+0.6.30

package/framework/{v0.6.30-alpha.1 → v0.6.30}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -4106,11 +4106,19 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             var attr = options.url.split(/@/);
             rule = attr[0];
             bundle = attr[1];
-            var proxyConf = getConfig( currentBundle, 'app' ).proxy;
             try {
                 if (config.bundle !== bundle) { // ignore if same bundle
                     // getting proxy conf when available
-                    opt = getConfig( currentBundle, 'app' ).proxy[bundle];
+                    // #B522 — clone. The GLOBAL two-argument getConfig() hands back the
+                    // bundle's `app` conf BY REFERENCE, so the `opt.method` / `opt.path`
+                    // writes further down — and the `requestTimeout` controller.query()
+                    // adds to the caller's object before its own defensive copy — used to
+                    // persist on the shared content.app.proxy[<bundle>] for the whole
+                    // process lifetime. `path` and `requestTimeout` are documented
+                    // proxyTarget properties, so that clobbered configured values for
+                    // every other reader of this conf, not merely added stray keys.
+                    // opt = getConfig( currentBundle, 'app' ).proxy[bundle];
+                    opt = JSON.clone( getConfig( currentBundle, 'app' ).proxy[bundle] );
                 }
             } catch (proxyError) {
                 throw new Error('Could not retrieve `proxy` configuration for bundle `'+ bundle +'`. Please check your `/config/app.json`.\n'+proxyError.stack);
@@ -7078,7 +7086,9 @@ function Routing() {
      * store that server.js handle() establishes for every request, so a direct
      * request builds direct URLs even after a port-less-Host request has written
      * the worker global. Only a req-less caller (boot, CLI, cron — no store) falls
-     * back to the getContext('isProxyHost') latch and the worker global with an
+     * back to the getContext('isProxyHost') latch — read as `false` when the latch
+     * was never set (#B537), so route.isProxyHost is always a boolean — and the
+     * worker global with an
      * envConf fallback; when neither holds a value the route degrades to its direct
      * hostname (route.isProxyHost is flipped false) instead of failing, and a
      * once-per-process warning is emitted.
@@ -7117,7 +7127,13 @@ function Routing() {
             // from another request's host.
             var _reqStore = ( process.gina && process.gina._reqALS ) ? process.gina._reqALS.getStore() : null;
             _stProxy    = ( _reqStore && _reqStore.proxy ) ? _reqStore.proxy : null;
-            isProxyHost = ( _stProxy ) ? _stProxy.isProxyHost : getContext('isProxyHost');
+            // #B537 — a req-less caller on a process that never set the latch (the
+            // boot-time writer runs only when the proxy configuration resolved a
+            // record for the running scope and env) read `undefined` here, so the
+            // route carried a non-boolean isProxyHost that JSON.clone then flagged
+            // as an authoring error on every clone. Coerce with the `|| false` idiom
+            // the sibling readers of this latch use: the flag is always a boolean.
+            isProxyHost = ( _stProxy ) ? _stProxy.isProxyHost : ( getContext('isProxyHost') || false );
         }
 
         var env         = config.env || GINA_ENV  // by default, takes the current bundle

package/framework/{v0.6.30-alpha.1 → v0.6.30}/core/asset/plugin/dist/vendor/gina/js/gina.min.js

@@ -78,7 +78,7 @@ let Ia=[],Pa=ba.match(/^([A-Za-z_$][\w$]*)/);if(!Pa)throw Error('Invalid propert
 'undefined'&&delete e[ja.name].query[ja.value];var B=ja.target.id||ja.target.getAttribute('id');console.debug('prematurely completed event `asyncCompleted.'+B+'`');return triggerEvent(gina,ja.target,'asyncCompleted.'+B,m[ja.name])}catch(Z){return mb(Z)}};Oa&&(Oa.onerror=function(Ha,sb){try{var ib={status:Oa.status,error:'Transaction error: might be due to the server CORS settings.\nPlease, check the console for more details.'};console.debug('query error [2] detected !! ',sb,'Transaction error: might be due to the server CORS settings.\nPlease, check the console for more details.');
 isOnException=!0;ib=this.responseText;var Eb=this.getResponseHeader('Content-Type');if(/\/json/.test(Eb))ib=JSON.parse(this.responseText),typeof ib.status=='undefined'&&(ib.status=this.status);else if(ib={status:Oa.status,message:''},/^(\{|\[)/.test(Oa.responseText))try{ib=G(ib,JSON.parse(Oa.responseText))}catch(Hb){ib=G(ib,Hb)}return yb(ib)}catch(Hb){return mb(Hb)}},Oa.onload=function(){try{db=this.responseText;var Ha=this.getResponseHeader('Content-Type');if(/\/json/.test(Ha))db=JSON.parse(this.responseText),
 typeof db.status=='undefined'&&(db.status=this.status);else if(db={status:Oa.status,message:''},/^(\{|\[)/.test(Oa.responseText))try{db=G(db,JSON.parse(Oa.responseText))}catch(sb){db=G(db,sb)}return yb(db)}catch(sb){return mb(sb)}},ja.target&&ja.target.dataset&&(ja.target.dataset.ginaFormValidatorQueryPending=ja.value),g?Oa.send(ha):Oa.send())}else{console.debug('stopping on errors ...');var zb=this.target,gb=this.name;queueMicrotask(function(){triggerEvent(gina,zb,'asyncCompleted.'+Fa,m[gb])})}};
-A=async function(Q,X,ha,Fa){var N=(new (require(_(GINA_FRAMEWORK_DIR+'/core/config.js',!0)))).getInstance(),P=null,ia=null,da=null,va=getContext('bundle');if(/@/.test(Q.url)){var Ja=Q.url.split(/@/);ia=Ja[0];da=Ja[1];getConfig(va,'app');try{N.bundle!==da&&(P=getConfig(va,'app').proxy[da])}catch(Ma){throw Error('Could not retrieve `proxy` configuration for bundle `'+da+'`. Please check your `/config/app.json`.\n'+Ma.stack);}Ja=null}else throw Error('external url/domain not  handled at this moment, please contact us if you need support for it.');
+A=async function(Q,X,ha,Fa){var N=(new (require(_(GINA_FRAMEWORK_DIR+'/core/config.js',!0)))).getInstance(),P=null,ia=null,da=null,va=getContext('bundle');if(/@/.test(Q.url)){var Ja=Q.url.split(/@/);ia=Ja[0];da=Ja[1];try{N.bundle!==da&&(P=JSON.clone(getConfig(va,'app').proxy[da]))}catch(Ma){throw Error('Could not retrieve `proxy` configuration for bundle `'+da+'`. Please check your `/config/app.json`.\n'+Ma.stack);}Ja=null}else throw Error('external url/domain not  handled at this moment, please contact us if you need support for it.');
 Ja=JSON.clone(p.getRoute(Q.url,Q.data));var ma=N[da][N.env],Oa=ma.content.server;typeof Oa._cached=='undefined'&&(Oa._cached=new Map);typeof Oa._cachedPath=='undefined'&&(Oa._cachePath=Oa.cache.path);typeof Oa._cacheIsEnabled=='undefined'&&(Oa._cacheIsEnabled=Oa.cache.enable);P||(N.bundle==da&&(P=getConfig(va,'settings').server.credentials,Q.ca=P.ca||null,Q.hostname=ma.server.scheme+'://'+ma.host,Q.port=ma.port[ma.server.protocol][ma.server.scheme],Q.protocol=ma.server.protocol,Q.rejectUnauthorized=
 !1),P={ca:Q.ca,hostname:Q.hostname,port:Q.port,path:Q.path},typeof Q.protocol!='undefined'&&(P.protocol=Q.protocol),typeof Q.rejectUnauthorized!='undefined'&&(P.rejectUnauthorized=Q.rejectUnauthorized));ia={method:Ja.method,requirements:Ja.requirements,namespace:Ja.namespace||void 0,url:decodeURI(Ja.url),rule:ia+'@'+da,param:JSON.clone(Ja.param),middleware:JSON.clone(Ja.middleware),bundle:Ja.bundle,isXMLRequest:X.isXMLRequest,isWithCredentials:X.isWithCredentials};da=ia.rule.replace('@'+da,'')||'_common';
 da={template:typeof ma.content.templates!='undefined'?ma.content.templates[da]||ma.content.templates._common:void 0,isCacheless:ma.isCacheless};da=G(da,ia);ma=JSON.clone(ma);da.conf=ma;da.conf.content.routing[da.rule].param=ia.param;da.template&&typeof da.template.ginaLoader=='undefined'&&(da.template.ginaLoader=da.conf.content.templates._common.ginaLoader);da.conf.content.routing[da.rule].param=ia.param;delete da.middleware;delete da.param;delete da.requirements;ma=new (require(_(GINA_FRAMEWORK_DIR+
@@ -139,7 +139,7 @@ w=(new RegExp(y.requirements[C])).test(u),w)m[oa[0].substring(1)]=u;else return!
 'undefined'&&typeof u[l]!='undefined'){var oa=new RegExp('(:'+l+'/|:'+l+'$)','g');typeof q.param.path!='undefined'&&/:/.test(q.param.path)&&(q.param.path=q.param.path.replace(oa,u[l]));typeof q.param.title!='undefined'&&/:/.test(q.param.title)&&(q.param.title=q.param.title.replace(oa,u[l]));typeof q.param.namespace!='undefined'&&/:/.test(q.param.namespace)&&(q.param.namespace=q.param.namespace.replace(oa,u[l]));typeof q.param.file!='undefined'&&/:/.test(q.param.file)&&(p.variable=u[l],q.param.file=
 q.param.file.replace(oa,p));if(/,/.test(q.url)){y=q.url.split(/,/g);var w=0;for(k=y.length;w<k;++w)p.variable=u[l],y[w]=y[w].replace(oa,p);q.url=y.join(',')}else p.variable=u[l],q.url=q.url.replace(oa,p)}}if(y){w=0;k=y.length;na=na.split(/,/g);var x=0;for(q.urlIndex=0;w<k;++w)if(y=0,oa=na[0].match(/:[-_a-z0-9]+/ig)){S=0;for(l=oa.length;S<l;S++){var C=oa[S].substring(1);typeof u[C]!='undefined'&&u[C]&&y++}y>x&&(x=y,q.urlIndex=w)}}return q},T=!1;v.getRoute=function(q,u,y){var k=null,na=!1,S=null;if(g)window.location.port||
 window.location.hostname!=window.gina.config.hostname.replace(/^(https|http|wss|ws):\/\//,'').replace(/:\d+$/,'')||(na=!0,window.gina.config.hostname=window.gina.config.hostname.replace(/^(https|http|wss|ws):\/\//,'').replace(/:\d+$/,'')),k=window.gina.config;else{k=getContext('gina').config;typeof getContext('argvFilename')!='undefined'&&(k.getRouting=getContext('gina').Config.instance.getRouting);var l=process.gina&&process.gina._reqALS?process.gina._reqALS.getStore():null;na=(S=l&&l.proxy?l.proxy:
-null)?S.isProxyHost:getContext('isProxyHost')}var oa=k.env||GINA_ENV,w=null;l=k.bundle;/@/.test(q)||typeof l=='undefined'||l==null||(q=q.toLowerCase(),q+='@'+l);if(/@/.test(q)){var x=q.replace(/(.*):\/\//,'').split(/@/);l=x[1];/\/(.*)$/.test(q)&&(w=q.replace(/(.*):\/\//,'').split(/\/(.*)$/)[1],l=l.replace(/\/(.*)$/,''),oa=w||oa);q=x[0].toLowerCase()+'@'+l}w=k.getRouting(l,oa);if(!w)throw Error('[ RoutingHelper::getRoute(rule, params) ] : bundle `'+l+'` has no routing table for rule `'+q+'` (client: routing config not loaded yet, or empty)');
+null)?S.isProxyHost:getContext('isProxyHost')||!1}var oa=k.env||GINA_ENV,w=null;l=k.bundle;/@/.test(q)||typeof l=='undefined'||l==null||(q=q.toLowerCase(),q+='@'+l);if(/@/.test(q)){var x=q.replace(/(.*):\/\//,'').split(/@/);l=x[1];/\/(.*)$/.test(q)&&(w=q.replace(/(.*):\/\//,'').split(/\/(.*)$/)[1],l=l.replace(/\/(.*)$/,''),oa=w||oa);q=x[0].toLowerCase()+'@'+l}w=k.getRouting(l,oa);if(!w)throw Error('[ RoutingHelper::getRoute(rule, params) ] : bundle `'+l+'` has no routing table for rule `'+q+'` (client: routing config not loaded yet, or empty)');
 if(typeof w[q]=='undefined')throw Error('[ RoutingHelper::getRouting(rule, params) ] : `'+q+'` not found ! (bundle `'+l+'` holds '+Object.keys(w).length+' rules)');l=JSON.clone(w[q]);x=null;l=A(l,u);(l.isProxyHost=na)?(l.proxy_hostname=g?window.location.protocol+'//'+document.location.hostname:S&&S.proxyHostname||process.gina.PROXY_HOSTNAME||k.envConf._proxyHostname,l.proxy_hostname?l.proxy_host=l.proxy_hostname.replace(/^(https|http):\/\//,''):(delete l.proxy_hostname,l.isProxyHost=!1,T||(T=!0,console.warn('[ RoutingHelper::getRoute() ] Proxied context is active but no proxy hostname is resolvable (worker global and envConf fallback both unset) - falling back to the route direct hostname. Warned once per process.')))):
 !g&&typeof process.gina.PROXY_HOSTNAME!='undefined'&&process.gina.PROXY_HOSTNAME&&(l.proxy_hostname=process.gina.PROXY_HOSTNAME,l.proxy_host=l.proxy_hostname.replace(/^(https|http):\/\//,''),console.debug('[getRoute#2]['+na+'] process.gina.PROXY_HOSTNAME ('+process.gina.PROXY_HOSTNAME+') VS config.envConf._proxyHostname ('+k.envConf._proxyHostname+')'));/,/.test(l.url)&&(typeof l.urlIndex!='undefined'&&(y=l.urlIndex,delete l.urlIndex),y=typeof y!='undefined'?y:0,l.url=l.url.split(/,/g)[y]);/\/$/.test(l.url)&&
 l.url!='/'&&(l.url=l.url.substring(0,l.url.length-1));if(/GET/i.test(l.method)&&typeof u!='undefined'){y='?';k=w[q].url;na=[];S=0;for(let C in l.param)v.reservedParams.indexOf(C)>-1||(new RegExp(l.param[C])).test(k)||typeof u[C]=='undefined'||(y+=C+'='+encodeRFC5987ValueChars(u[C])+'&',na[S]=u[C],++S);for(let C in u)v.reservedParams.indexOf(C)>-1||l.requirements&&typeof l.requirements[C]!='undefined'||na.indexOf(C)>-1||(y=typeof u[C]=='object'?y+(C+'='+encodeRFC5987ValueChars(JSON.stringify(u[C]))+

package/framework/{v0.6.30-alpha.1 → v0.6.30}/core/controller/controller.js

@@ -119,6 +119,185 @@ var routingLib      = lib.routing;
 // already-loaded instance without re-running the resolver. Falls back to
 // require('@rhinostone/swig') when no bundle has loaded yet (tests, etc).
 var swig            = lib.swigResolver.get();
+
+/**
+ * #B535 — bridge a per-bundle engine's registration setters to the module.
+ *
+ * swig-core's `install()` gives every `new Swig()` instance FRESH filter, tag
+ * and extension maps — copied from the frontend's built-in library, NOT from
+ * the module's runtime registrations — and keeps them closure-private
+ * afterwards (measured: a filter registered on the module before OR after
+ * construction never reaches an instance, and vice versa). So once #B514
+ * pointed `self.engine` at a per-bundle instance, every filter a bundle's
+ * `controllers/setup.js` registered through `this.engine.setFilter()` — and
+ * every gina filter the render delegates register per request — stopped
+ * reaching any compile made through the MODULE: an application's own
+ * `require('@rhinostone/swig').compile()` (an entity compiling a message
+ * outside any request), and gina's own `core/server.js` asset-URL compile.
+ * On 0.6.29 they all landed on the module because `self.engine` WAS the module.
+ *
+ * The maps cannot be copied out later, so the reach is restored where it is
+ * lost: each setter registers on the instance first (its own validation throws
+ * before the module is touched), then on the module. The instance keeps its
+ * OWN options — in particular its loader — so #B514's include/extends
+ * isolation is untouched; only the registration maps are shared again, which
+ * is exactly the state every released version had. The reverse direction
+ * (module → instance) is not bridged: registering anywhere other than through
+ * `this.engine` in `setup.js` is documented as unsupported.
+ *
+ * Idempotent per (instance, module): a second call is a no-op, and the
+ * owner-guard rebuild in `getDefaultSwigEngine` bridges each fresh instance.
+ *
+ * @inner
+ * @param {*} engine  - A per-bundle `new swigMod.Swig()` instance
+ * @param {*} swigMod - The resolved swig module the instance was built from
+ * @returns {*} the same instance, its three setters bridged
+ *
+ * @example
+ * var engine = bridgeRegistrationsToModule(new swig.Swig(opts), swig);
+ * engine.setFilter('stamp', fn);   // visible to engine.compile() AND swig.compile()
+ */
+function bridgeRegistrationsToModule(engine, swigMod) {
+    if (engine._ginaModuleBridge === swigMod) {
+        return engine;
+    }
+    var _setFilter    = engine.setFilter;
+    var _setTag       = engine.setTag;
+    var _setExtension = engine.setExtension;
+    engine.setFilter = function (name, method) {
+        var result = _setFilter.apply(engine, arguments);
+        swigMod.setFilter(name, method);
+        return result;
+    };
+    engine.setTag = function (name, parse, compile, ends, blockLevel) {
+        var result = _setTag.apply(engine, arguments);
+        swigMod.setTag(name, parse, compile, ends, blockLevel);
+        return result;
+    };
+    engine.setExtension = function (name, object) {
+        var result = _setExtension.apply(engine, arguments);
+        swigMod.setExtension(name, object);
+        return result;
+    };
+    engine._ginaModuleBridge = swigMod;
+    return engine;
+}
+
+/**
+ * #B538 — give a per-bundle engine the `getOptions()` accessor the module
+ * carries, so `self.engine.getOptions()` keeps working now that `self.engine`
+ * is the instance.
+ *
+ * The constructor below installs `swig.getOptions` on the MODULE once per
+ * request — a closure over that request's `local._swigOptions` — and until
+ * #B514 `self.engine` WAS the module, so the documented call shape
+ * `self.engine.compile(tpl, self.engine.getOptions())(data)` resolved. #B514
+ * pointed `self.engine` at a per-bundle instance, which never received the
+ * accessor, and the #B535 bridge carries registrations, not methods. That is
+ * the whole defect: `TypeError: self.engine.getOptions is not a function`,
+ * thrown on the accessor before any compile — and inside an async controller
+ * callback it surfaces as an unhandled rejection that leaves the request
+ * unanswered until the caller's own stream timeout, which reads as a proxy
+ * fault rather than a render fault.
+ *
+ * The accessor cannot simply be copied from the module: that closure is
+ * per-REQUEST and the instance is per-BUNDLE, shared by every request to the
+ * bundle, so assigning it here would be the cross-request-bleed shape. The
+ * instance instead reports what IT was built with: `opts` is snapshotted ONCE
+ * at mint (per-bundle lifetime, matching the instance — measured: neither
+ * `new Swig(opts)` nor `setDefaults(opts)` mutates the object handed in, so
+ * the snapshot equals the pre-`setDefaults` clone every released version
+ * returned), and every call hands back a fresh `JSON.clone` of it. The
+ * per-call copy is a strict hardening over 0.6.29, which returned the same
+ * object by reference on every call: a caller can no longer corrupt the
+ * engine, or the next caller, by mutating the result. `JSON.clone` is gina's
+ * own deep copy and preserves the loader's functions — the copy is a working
+ * loader — which matters because swig-core validates a per-call loader and
+ * refuses a bare `{}`. Handing the result back to `compile()` is a no-op
+ * relative to calling `compile()` with no options (measured: identical
+ * output, with a differing option as the control), so the round-trip is
+ * supported for compatibility, never required.
+ *
+ * Not touched: the module-side `swig.getOptions` (still assigned per request
+ * below; `core/server.js` reads it for its inline routing/asset compiles),
+ * and the no-template-root fallback, where `self.engine` is the module and
+ * the accessor was never lost.
+ *
+ * @inner
+ * @param {*}      engine - A per-bundle `new swigMod.Swig()` instance
+ * @param {object} opts   - The options it was built with (`{ autoescape, cache, loader }`)
+ * @returns {*} the same instance, `getOptions()` attached
+ *
+ * @example
+ * var engine = exposeOptionsOnEngine(new swig.Swig(opts), opts);
+ * engine.compile(tpl, engine.getOptions())(data);   // the documented call shape
+ */
+function exposeOptionsOnEngine(engine, opts) {
+    var snapshot = JSON.clone(opts);
+    engine.getOptions = function () {
+        return JSON.clone(snapshot);
+    };
+    return engine;
+}
+
+/**
+ * Per-bundle swig ENGINE for the DEFAULT render path, keyed on the bundle
+ * template root. Mirrors `controller.render-swig-async.js`'s `_swigEngines`
+ * registry, for the same reason and with the same owner guard.
+ *
+ * #B514 sibling limb — `swig.setDefaults({ loader })` below stamps a loader on
+ * the PROCESS SINGLETON once per render, and the delegates then await before
+ * compiling. In merged-process mode (several bundles, one process) a concurrent
+ * bundle's stamp lands in that window and `{% include %}` / `{% extends %}`
+ * resolve against the OTHER bundle's templates root — or trip swig-core's
+ * outside-root refusal. A per-call `loader` handed to `swig.compile()` cannot
+ * fix it: swig-core merges per-call options into a local that never escapes
+ * `self.parse` (engine.js:477), while `getParentsInternal` (:321) and
+ * `parseFile` (:490) read `self.options.loader` unconditionally, and the
+ * `{% include %}` codegen emits only `resolveFrom` (backend.js:420). An engine
+ * INSTANCE per template root is the only shape the engine actually honours.
+ *
+ * Note this is structural rather than an invariant about who awaits when: the
+ * narrower alternative (re-stamping the loader immediately before each compile)
+ * would re-create exactly the "nothing awaits in between" assumption that
+ * silently became false and produced #B514 in the first place.
+ *
+ * `engine.install` gives every instance FRESH tag and filter maps, so the gina
+ * filters register per request through the delegates' existing `setFilter` loop
+ * (they read per-request context from `process.gina._renderALS`, so a shared
+ * engine cannot bleed), and a bundle's own `controllers/setup.js` filters land
+ * here too because `self.engine` points at this instance before setup runs
+ * (`router.js:944` hands `controller.engine` to the setup module). Two things
+ * the move off the module lost are restored per instance at mint: #B535
+ * bridges the three registration setters back to the module, and #B538 gives
+ * the instance its own `getOptions()` accessor (`exposeOptionsOnEngine`) —
+ * the module's per-request one never reaches an instance.
+ *
+ * @inner
+ * @param {*}      swigMod      - The resolved swig module (exposes `.Swig`)
+ * @param {string} templateRoot - Registry key: the bundle templates root
+ * @param {object} opts         - `{ autoescape, cache, loader }` for this bundle
+ * @returns {*} the cached-or-built per-bundle engine
+ */
+function getDefaultSwigEngine(swigMod, templateRoot, opts) {
+    if (!process.gina._swigDefaultEngines) {
+        process.gina._swigDefaultEngines = Object.create(null);
+    }
+    // Instances are bound to the module that built them — drop the whole
+    // registry on a dev-mode swig hot-swap (mirrors _swigEnginesOwner).
+    if (process.gina._swigDefaultEnginesOwner !== swigMod) {
+        process.gina._swigDefaultEngines      = Object.create(null);
+        process.gina._swigDefaultEnginesOwner = swigMod;
+    }
+    if (!process.gina._swigDefaultEngines[templateRoot]) {
+        process.gina._swigDefaultEngines[templateRoot] = new swigMod.Swig(opts);
+        // #B535 — registrations made on this instance must still reach the module.
+        bridgeRegistrationsToModule(process.gina._swigDefaultEngines[templateRoot], swigMod);
+        // #B538 — the module's getOptions() accessor must exist on the instance too.
+        exposeOptionsOnEngine(process.gina._swigDefaultEngines[templateRoot], opts);
+    }
+    return process.gina._swigDefaultEngines[templateRoot];
+}
 const { type }      = require('node:os');
 var SwigFilters     = lib.SwigFilters;
 var statusCodes     = requireJSON( _( getPath('gina').core + '/status.codes') );
@@ -1318,7 +1497,21 @@ function SuperController(options) {
             defaultTZOffset = null;
 
 
-            self.engine = swig;
+            // #B514 sibling limb — render through a per-bundle ENGINE instead of the
+            // process singleton, so a concurrent bundle's loader stamp cannot reach
+            // this render's include/extends resolution. The setDefaults call above is
+            // deliberately KEPT: core/server.js still compiles inline strings through
+            // the module with swig.getOptions(), and leaving the module's defaults
+            // alone keeps that path byte-identical. Nothing renders a bundle template
+            // through the module any more, so the stamp it races is now inert.
+            // Falls back to the module when there is no template root, or when the
+            // resolved swig exposes no `.Swig` constructor (older forks / test doubles).
+            local._swigEngine = ( dir && typeof(swig.Swig) === 'function' )
+                ? getDefaultSwigEngine(swig, dir, swigOptions)
+                : swig;
+            // Must precede controllers/setup.js: router.js hands `controller.engine`
+            // to the setup module, so a bundle's own filters register HERE.
+            self.engine = local._swigEngine;
 
             dir = null;
             swigOptions = null;
@@ -2048,7 +2241,7 @@ function SuperController(options) {
             getData     : getData,
             hasViews    : hasViews,
             setResources: setResources,
-            swig        : swig,
+            swig        : (local._swigEngine || swig),
             SwigFilters : SwigFilters,
             headersSent : headersSent
         }); //(userData, displayInspector, errOptions)
@@ -7052,21 +7245,52 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
     /**
      * Get config
      *
-     * @param {string} [name] - Conf name without extension.
-     * @returns {object} config
+     * Returns the bundle configuration — the whole per-request conf, or one
+     * config file's content by name. Since #P40 the result is a per-call
+     * COPY-ON-WRITE VIEW (`lib/conf-view`) rather than a deep clone: reads pass
+     * through to the shared configuration at no copy cost, a write lands in the
+     * view's private overlay (never in the live configuration, never visible to
+     * another call), and the first enumeration of a node (`Object.keys`,
+     * `JSON.stringify`, `for…in`, spread, `JSON.clone`) materialises that
+     * subtree once into a private plain copy. Three things a deep clone allowed
+     * do not work on an un-enumerated view: `structuredClone(result)` throws a
+     * `DataCloneError`, `Object.freeze` / `seal` on a node you have not
+     * enumerated throws a `TypeError`, and `console.log` / `util.inspect` show
+     * the shared values rather than your writes (property reads and
+     * `JSON.stringify` are truthful). `settings.json > controller.getConfig.mode`
+     * set to `"clone"` restores the deep clone for the bundle. Both forms
+     * resolve `hostname` / `host` against this request's proxy classification
+     * (#B66) — a write that lands in the overlay too.
+     *
+     * @param {string} [name] - Conf name without extension (`'app'`, `'settings'`, …); omit for the whole conf.
+     * @returns {object|undefined} the view (or clone) — `undefined` for an unknown `name`
      *
+     * @example
+     * var app = self.getConfig('app');   // a private view of config/app.json
+     * app.proxy.api.port = 8443;         // your write; the live configuration is untouched
+     * var conf = self.getConfig();       // the whole conf: conf.settings === conf.content.settings
+     * @example
+     * // settings.json — the opt-out, per bundle
+     * { "controller": { "getConfig": { "mode": "clone" } } }
      * */
     this.getConfig = function(name) {
         var tmp = null;
+        // #P40 — `view` (the default) is a per-call copy-on-write view over the
+        // per-request conf; `clone` (settings.json > controller.getConfig.mode) is
+        // the deep copy this method used to hand back, kept as the opt-out for the
+        // three shapes a view cannot serve (structuredClone, freeze before
+        // enumerating, inspect). Read per call: the conf is per request and the
+        // check is a few property reads.
+        var _cSettings  = ( local.options && local.options.conf && local.options.conf.content ) ? local.options.conf.content.settings : null;
+        var _cloneMode  = ( _cSettings && _cSettings.controller && _cSettings.controller.getConfig && _cSettings.controller.getConfig.mode == 'clone' ) ? true : false;
         if ( typeof(name) != 'undefined' ) {
             try {
-                // Needs to be read only
-                tmp = JSON.clone(local.options.conf.content[name]);
+                tmp = ( _cloneMode ) ? JSON.clone(local.options.conf.content[name]) : lib.confView.create(local.options.conf.content[name]);
             } catch (err) {
                 return undefined;
             }
         } else {
-            tmp = JSON.clone(local.options.conf);
+            tmp = ( _cloneMode ) ? JSON.clone(local.options.conf) : lib.confView.create(local.options.conf);
         }
 
         // #B66 S2b — prefer THIS request's per-request proxy classification (the