gina 0.6.30 → 0.6.31

package/CHANGELOG.md

@@ -6,6 +6,17 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.31 - 2026-09-14
+### Added
+* RFC 9218 request priorities (#H12): `req.priority` is parsed on both engines from the `Priority` header — urgency 0–7 (default 3) and the incremental flag, with out-of-range, wrong-type or malformed values ignored exactly as the RFC requires — `self.query()` and `self.forward()` propagate a present inbound priority to the target bundle (a caller-set `headers.priority` wins, `priority: false` suppresses, an explicit `priority` option is sent normalized), `self.setPriority()` emits the response header, and `self.startJob(fn, { urgency })` orders the async-job queue: the worker always starts the lowest-urgency queued job first, FIFO within a class, a retried attempt keeps its urgency, and the value is never inherited from the request — an action passes it explicitly. The header is advisory and client-supplied: the framework carries the signal, it never reorders response writes.
+### Fixed
+* Refreshed two external references that had gone dead. The X-Permitted-Cross-Domain-Policies plugin cited an Adobe specification URL that now redirects to a generic documentation portal instead of serving the document; the plugin README and the module JSDoc both carried it, and both now name the current, live Adobe copy of the same specification. The Couchbase connector cited an N1QL architecture page that returns 404 with no migration redirect; it now points at the Query Service page that Couchbase itself redirects that path to. Documentation only; no runtime or API change.
+* A couchbase connector that cannot reach its cluster at boot now fails loudly instead of hanging. Consumers wait on a one-shot `ready` event, and every failure path in `connect()` only re-armed a retry without ever emitting it, so the all-or-nothing ready gate in the model layer never closed, the bundle never signalled that it had started, and `bundle:start` terminated it after roughly 64 seconds with no terminal error logged anywhere. `init()` now arms its own readiness deadline and emits the failure itself, so the existing abort path (log plus exit 1) runs first. Tunable per `connectors.json` entry with `readyTimeout` (milliseconds, default 50000); a value at or above the bundle-start budget cannot take effect, since the CLI terminates the bundle first. Separately, a single failed connect attempt now reports once rather than twice: the SDK settles both its callback and its awaited promise, which armed two competing retry chains and escalated the backoff at twice the intended rate; and a rejection that never calls back no longer throws before arming any retry. Applies to both the SDK v3 and v4 connectors (#B541).
+* A bundle whose release tree carries no `config/` directory no longer moves every other bundle's configuration root. The source-tree fallback that recovers such a bundle wrote that one bundle's own directory into the process-wide `bundles` path — the registry every other writer and reader treats as the container of ALL bundles — and reassigned the shared loop variable the same loop hands to every bundle walked after it. In a non-dev environment a later, perfectly healthy bundle therefore loaded its SOURCE config instead of its release config without a word, or died on a spliced path: the container was derived by stripping the manifest KEY from a path built from the source DIRECTORY NAME, with an unanchored and unescaped regular expression, so it produced a wrong path whenever the two differ, whenever the project path repeats the bundle name earlier (`/demo` inside `/demo-x`), or whenever the name carries a regular-expression metacharacter. The fallback is now scoped to the bundle it recovers, and the container comes from the parent directory rather than a text substitution. Separately, the three config-directory failures that abort a boot named neither the bundle nor the environment, sending up a raw ENOENT whose only clue was a path the operator had never written down; all three now refuse in the same shape as the routing.json refusal, and the last-chance one reports both the release link and the source tree it tried, in that order. And a `getInstance()` call that reaches a Config whose initialisation aborted now reports the retained reason instead of merging the global context wholesale — which on a worker returned the Config constructor itself and surfaced as an opaque `TypeError: Cannot set properties of undefined (setting 'parent')` that named neither the bundle nor the file and repeated forever (#B542).
+### Security
+* A queued async job now runs inside a detached copy of the request context that created it. The worker pumps its queue from the settle chain of the job that just finished, so under load a job created by one request ran inside the per-request context of whichever request's job had freed the worker slot — measured on a single-worker bundle: a job created by request B executed seeing request A's context, response objects included. Everything that reads that context then attributed the job to the wrong request: an absolute URL the job built through `getRoute().toUrl()` used the other request's proxy context and host; a failure the job raised through the global `getConfig()` / `getLib()` helpers was handled as that other request's — written to its response, or handed to its middleware chain once the response had gone out; and a JSON log line the job wrote carried the other request's id. `create()` now captures the creating request's identity and proxy context — never its `req`, `res` or `next` — and the whole lifecycle of the job (its record transitions, the deferred function, a retry it arms, its completion webhook) runs inside that copy; a job created outside any request runs with no request context at all, even when the worker that starts it was freed by a request's job. `throwError` treats a detached context as authoritative: with no live response to answer, a failing job is logged (fatal) or the error is thrown to the job (non-fatal), never written to any client. The per-request context has existed since `0.4.5`, where the misattribution reached JSON log lines only; the URL-host reader arrived in `0.6.28` and the response reader in `0.6.30`. Nothing about the job record changes, so durable stores serialise exactly what they did. Pickup: a bundle restart; this change's own bytes do not reach the client bundle. (#B543)
+* A request carrying a top-level field named `count` no longer crashes the bundle. gina installs a `count()` helper on `Object.prototype`, and the framework reached it as `<container>.count()` on containers whose keys the CLIENT chooses: the parsed request body, the query bag, route params, uploaded files, data handed to `self.query()`, a routing rule's validator data, and whatever a template pipes through `| length`. An own property of that name shadows the helper, so the framework called a string. On the body branches, which parse inside a try, that surfaced as a 500; on the query branches, which do not, it reached the process as an uncaughtException and the bundle EXITED — unauthenticated, one request, on any URL including one matching no route, because the body parse runs before routing resolves. A route param of that name left the request hanging open instead of answering. Every published version is affected. The framework now reaches the helper through a form no own property can shadow, via a small `ownCount()` on each affected module; it is the same function body, so every other receiver shape counts exactly as before, and `null` and `undefined` still throw exactly as the shorthand did — the empty-object seeding in the body-parse branches depends on that. Nested fields (`{"outer":{"count":1}}`) and near-misses (`counter`) were never affected, and are unchanged. Application code calling `x.count()` is untouched: the helper stays on `Object.prototype`. Counts over framework-built objects (response headers, the routing table, config) deliberately keep the shorthand. Pickup: a bundle restart AND a re-bake (#B546).
+
 ## 0.6.30 - 2026-09-10
 ### Added
 * Log rotation for the logger's opt-in `file` container, on by default at 10MB with 5 files kept — deliberately the same shape as the kubelet's own `containerLogMaxSize` / `containerLogMaxFiles`. Configure it under `rotate` in `~/.gina/user/extensions/logger/file/config.json`, where the container is already enabled: `enabled` (default true), `when` (`"daily"` or null), `size` (default `"10MB"`), `count` (default 5) and `maxAge` (e.g. `"30d"`, off by default). The live file is renamed and reopened rather than copied and truncated, so no line is lost while rotating, and the sink holds one append stream per group over a synchronously opened descriptor — which is what lets a burst of lines logged in a single tick rotate correctly, since a stream that opens asynchronously has no file to rename yet. A size or age without an explicit unit is refused rather than guessed — `"10"` is never read as bytes — and any invalid value disables rotation with a message naming the key, the value and the consequence, reported through the log flows so it reaches stdout and `gina tail`, while logging itself continues. Each log group is written to its own file, `<logdir>/<bundle>@<project>.log`. Two bounds are worth knowing: bytes still queued when a process exits can be lost, because flushing is asynchronous and making every write synchronous would let a full disk block the request loop; and a file that stops draining past a 4MB buffer drops lines with one warning per outage, the same posture the MQ transport already takes.

package/README.md

@@ -15,7 +15,7 @@ MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architectur
 
 | Feature | Detail |
 | --- | --- |
-| HTTP/2 server | Built-in `isaac` engine — TLS, h2c, ALPN, HTTP/1.1 fallback, 103 Early Hints, CVE-hardened |
+| HTTP/2 server | Built-in `isaac` engine — TLS, h2c, ALPN, HTTP/1.1 fallback, 103 Early Hints, RFC 9218 request priorities, CVE-hardened |
 | Multi-bundle | One project, N independent bundles with shared config and project layer |
 | Scope isolation | `local` / `beta` / `production` — per-request and per-record |
 | MVC routing | `routing.json` — declare routes in config, not code; O(m) radix trie lookup |
@@ -66,37 +66,32 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.30
+## What's in 0.6.31
 
-> **Restart your bundles *and* rebuild them.** `lib/routing` and the validator's
-> client half both ship in the browser bundle, so `gina.min.js` changed and
-> `gina bundle:restart` alone leaves the old client running. Rebuild each
-> consuming bundle, then restart.
+> **Restart your bundles *and* rebuild them.** The validator's shared rule
+> engine ships in the browser bundle and one of this release's security fixes
+> touches it, so `gina.min.js` changed and `gina bundle:restart` alone leaves
+> the old client running. Rebuild each consuming bundle, then restart.
 
-> **No settings reset.** `0.6.30` is a patch — the `shortVersion` stays `0.6`,
+> **No settings reset.** `0.6.31` is a patch — the `shortVersion` stays `0.6`,
 > so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**The isolation release.** Most of what changed here is one piece of in-flight
-work seeing another's state: a response rendered with a concurrent request's
-language and webroot, a framework error answered to whichever request was routed
-most recently, a later caller of an entity method handed an earlier call's
-record, and one bundle's templates resolving against another bundle's root. Each
-was invisible in development, because dev mode rebuilds per request what
-production shares. Alongside them, `self.getConfig()` stops deep-copying the
-resolved configuration on every call. Full detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — a rendered response no longer carries a concurrent request's context (#B514).** The `getUrl`, `getWebroot`, `t` and `tIcu` filters resolved per-request context through a process-wide singleton on the default render path, and both delegates await between stamping it and invoking the template. Measured on a built release: 50 of 50 concurrent pairs served one response carrying the other's negotiated culture and webroot before the fix, 0 of 100 after.
-- **Security — a later caller no longer receives an earlier call's record (#B441).** An entity method that emitted its completion more than once per call buffered every surplus emit, and the next `util.promisify`-style caller consumed it as its own result. Where such a method reads a user-scoped record, an ownership check could pass on another principal's row. Development mode masked it entirely.
-- **Security — a failed `getConfig()` / `getLib()` no longer writes its stack to the response (#B533).** The helper behind the implicit globals answered in every scope with the raw stack — install path, application file paths and line numbers — and logged nothing. It now mints an incident `ref`, logs one full-detail line, and sends the message alone outside local scope.
-- **Changed — `self.getConfig()` returns a copy-on-write view (#P40).** Reads pass through to the shared configuration at no copy cost and writes land in the call's own overlay. A route behind two middlewares reading `this.getConfig()` went from 14,719 ms to 1,884 ms per 3,000 requests. `structuredClone`, `Object.freeze` and `util.inspect` behave differently on a node you have not enumerated; `controller.getConfig.mode: "clone"` opts back out.
-- **Added — log rotation for the logger's opt-in `file` container.** On by default at 10MB with 5 files kept, the same shape as the kubelet's own limits. The live file is renamed and reopened rather than copied and truncated, so no line is lost while rotating.
-- **Added — `gina tail` honours the logger's JSON render mode (#B524).** With `GINA_LOG_FORMAT=json` on the tail process, every relayed line is written as one JSON object — the JSON answer for a container running a framework daemon, where the tail relay is the only path a runtime line has to `kubectl logs`.
-- **Fixed — the default swig path renders through a per-bundle engine (#B514).** One bundle's template root can no longer reach another's `include` / `extends` resolution, and `self.engine` now points at the engine that actually renders the bundle.
-- **Fixed — a framework error is answered to the request that raised it (#B534).** The response came from a process-wide slot the router fills on every routed request and never clears, so a callback resuming after an `await` wrote its failure to a later request's client while its own caller hung until timeout.
-- **Fixed — the `query` validation rule no longer writes into shared proxy config (#B522).** A rule targeting another bundle set `method`, `path` and a route-derived `requestTimeout` on the process-wide proxy target, so a later live-check from a different route silently ran on the earlier route's deadline — and on HTTP/2 the timeout destroys the pooled session shared with every other request to that authority.
-- **Fixed — the logger's `file` container writes (#B523).** It connected to the MQ, received every line and wrote nothing; it is now an in-process transport writing only its own process's lines, needing no daemon.
-- **Fixed — `gina-container` applies the container logging preset itself (#B524).** A bundle it runs emits JSON and skips the MQ transport, instead of writing coloured text while two processes dial a listener that cannot exist in that topology. Explicit values still win.
-- **Fixed — a req-less `getRoute()` returns a boolean `isProxyHost` (#B537).** Cloning such a route no longer logs a warning, with a stack, for a value that was legitimately unset.
+**The availability release.** Two security fixes lead: a request carrying a
+top-level field named `count` could terminate the bundle process —
+unauthenticated, one request, on any URL, in every published version — and a
+queued async job could run inside another request's context. Alongside them,
+RFC 9218 request priorities arrive on both engines, a Couchbase connector that
+cannot reach its cluster at boot now says so instead of hanging until the CLI
+kills the bundle, and one bundle without a release `config/` no longer moves
+every other bundle's configuration root. Full detail in
+[CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — a request field named `count` no longer terminates the bundle (#B546).** gina installs a `count()` helper on `Object.prototype`, and the framework reached it as `<container>.count()` on containers whose keys the client chooses — the parsed body, the query bag, route params, uploaded files. An own property of that name shadowed the helper, so the framework called a string: a 500 on the body branches, an `uncaughtException` that exited the process on the query branches, and a request left hanging open on a route param. Every published version was affected. The framework now reaches the helper through a form no own property can shadow; application code calling `x.count()` is untouched.
+- **Security — a queued async job runs inside a detached copy of its creator's context (#B543).** The worker pumps its queue from the settle chain of the job that just finished, so under load a job created by one request ran inside the context of whichever request's job had freed the slot: a URL it built through `getRoute().toUrl()` used the other request's host, a failure it raised through the global `getConfig()` / `getLib()` was written to the other request's response, and its JSON log lines carried the other request's id. A job now captures the creating request's identity and proxy context — never `req`, `res` or `next` — and runs its whole lifecycle inside that copy.
+- **Added — RFC 9218 request priorities (#H12).** `req.priority` is parsed on both engines from the `Priority` header (urgency 0–7, the incremental flag; malformed values ignored as the RFC requires), `self.query()` and `self.forward()` propagate it to the target bundle, `self.setPriority()` emits the response header, and `self.startJob(fn, { urgency })` starts the lowest-urgency queued job first. The header is advisory: the framework carries the signal and never reorders response writes.
+- **Fixed — a Couchbase connector that cannot reach its cluster at boot fails loudly (#B541).** Every failure path in `connect()` re-armed a retry without ever emitting `ready`, so the model layer's ready gate never closed and `bundle:start` killed the bundle after roughly 64 seconds with nothing logged. `init()` now arms its own deadline (`readyTimeout` per `connectors.json` entry, default 50000 ms) and reports the failure itself; a single failed attempt also reports once rather than twice. Both SDK v3 and v4 connectors.
+- **Fixed — a bundle without a release `config/` no longer moves every other bundle's configuration root (#B542).** The source-tree fallback wrote that bundle's own directory into the process-wide `bundles` path and reassigned the shared loop variable, so a later, healthy bundle silently loaded its source config in production, or died on a spliced path. The fallback is now scoped to the bundle it recovers, the three config-directory refusals name the bundle and the environment, and an aborted initialisation reports its retained reason instead of an opaque `TypeError`.
+- **Fixed — two dead external references refreshed.** The X-Permitted-Cross-Domain-Policies plugin and the Couchbase connector each cited a page that no longer serves the document; both now point at the live copy. Documentation only.
 
 
 ## Documentation

package/ROADMAP.md

@@ -82,9 +82,10 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.28` ✅ | **Security**: absolute URLs built by an application-level `getRoute().toUrl()` no longer inherit another request's proxy context — after a single request carrying a port-less `Host` (an orchestrator probe, a sibling-bundle call) reached a worker, every later direct request on it built URLs from a worker-global, dropping the port on HTTP/1.1 and emitting the *last port-less client's host* verbatim on HTTP/2 + HTTPS, which is a host-header-injection class for application-built links and redirects; the proxied classification and proxy hostname now resolve from the request itself, and on earlier versions `server.proxy.requireForwardedHeaders` closes the port-less-`Host` path only. **Added**: `self.forward()` relays a `multipart/form-data` request, uploads included, through a new RFC 7578 encoder and a raw-body pass-through, bounded by the source bundle's upload cap (413 on breach, 400 for a body-less method). **Fixed**: `self.forward()` forwards to the route it resolves instead of the target bundle's webroot alone; the browser client no longer stays half-booted on a light page or inside a cross-origin iframe; the HTTP/2 `rel=preload` header is sent on every response rather than only the first per view; the automatic 103 Early Hints response fires at all; the Inspector View tab shows its assets map again; a custom error page carries its preloads and its external plugins; a retried HTTP/1 request goes out with its body; the fluent `.onComplete()` handles of `query()`, `store()`, `run()` and `Shell::run()` refuse a callback they cannot call, and the dead one on entity method objects is removed; `{% extends %}` extraction stops at its own directive and tolerates the layout being named ahead of it; `POST /_gina/maintenance` refuses an invalid `ttlSeconds` instead of arming an unbounded window. Restart your bundles **and rebuild them** — three of the fixes are browser-bundled. |
 | **Q4 2026** | `0.6.29` ✅ | **Security**: a failed Couchbase N1QL statement no longer carries its own result rows into the error it raises — the connector put the query service's whole response envelope, result documents included, on `error.stack` and `error.cause.http_body`, so a `RETURNING` statement that lost a CAS race or a SELECT that timed out part-way wrote the records it had already produced into any log that printed the error, with no interception point for a bundle; both now carry the envelope with `results` replaced by a row-count marker, while `errors`, `requestID`, `status`, `signature` and the classifier's `first_error_code`/`retry` are unchanged. **Added**: `bundle:build` and `project:build` gain an opt-in `--skip-unchanged` — a release whose source is byte-identical to what it was built from keeps its copy, signed by content rather than timestamps and recorded as `.gina-build.json`, with the manifest update, fingerprint stamp, `node_modules` link and both hooks still running and any doubt rebuilding. **Fixed**: a server-side field error reaches the visible control when a hidden twin of the same name comes first in document order; a path-form `getUrl` route containing `@` — the retina-asset idiom — no longer renders a 500 on either template engine; a staged upload no longer posts the literal `[object Object]` into a form that declares no `[preview][...]` sub-fields. Restart your bundles **and rebuild them** — two of the fixes are browser-bundled. |
 | **Q4 2026** | `0.6.30` ✅ | **Security**: the isolation release — a response rendered on the default swig path no longer carries a concurrent request's negotiated culture and webroot (50 of 50 concurrent pairs bled before the fix, 0 of 100 after); a later `util.promisify`-style caller of an entity method no longer receives an earlier call's record, which where the method reads a user-scoped row could pass an ownership check on another principal's data; and the error raised by the global `getConfig()` / `getLib()` helpers no longer writes its stack to the response, minting an incident `ref` and logging one full-detail line instead. **Changed**: `self.getConfig()` returns a per-call copy-on-write view of the configuration instead of a deep clone — reads pass through, your writes stay yours, and a route behind two middlewares reading `this.getConfig()` measured 14,719 ms → 1,884 ms per 3,000 requests. **Added**: log rotation for the logger's opt-in `file` container, and `gina tail` renders JSON when its logger's format is `json`. **Fixed**: bundle templates render through a per-bundle engine; a framework error is answered to the request that raised it rather than the most recently routed one; the server-side `query` validation rule no longer writes into the shared proxy configuration; the `file` container writes at all; and `gina-container` applies the container logging preset itself. |
-| **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
+| **Q4 2026** | `0.6.31` ✅ | **Security**: the availability release — a request carrying a top-level field named `count` no longer terminates the bundle process (unauthenticated, one request, on any URL including one matching no route; every published version was affected), and a queued async job runs inside a detached copy of the request context that created it instead of whichever request's job freed the worker slot. **Added**: RFC 9218 request priorities — `req.priority` on both engines, propagation through `self.query()` / `self.forward()`, `self.setPriority()`, and urgency-ordered async jobs. **Fixed**: a Couchbase connector that cannot reach its cluster at boot reports the failure instead of hanging until the CLI kills the bundle; one bundle without a release `config/` no longer moves every other bundle's configuration root, and the config-directory refusals name the bundle; two dead external references refreshed. Restart your bundles **and rebuild them** — the `count` fix touches the validator's shared rule engine, which is browser-bundled. |
+| **Q1 2027** | `0.6.x` | HTTP/2 priorities ✅ shipped early in `0.6.31` (the `Priority` header half — read, propagated, emitted, job urgency; response ordering stays blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — landed for the next `0.6.x` cut) |
-| **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys |
+| **2027** | `0.8.0` | ⚠️ **Delivered early — this content shipped in `0.6.25` (2026-09-03)**: XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys. No committed content remains against this milestone; re-scope before planning around it. |
 | **2027** | `0.9.0` | Financial-integration heavyweights — entity-layer datastore transaction seam · message-queue connector family (AMQP / Kafka / IBM MQ) |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 
@@ -106,7 +107,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | ✅ | **Stale built-release watch** — For LOCAL production rehearsals. A bundle serving a built release under `local` scope + a non-dev env has no hot-reload, so after you edit source it silently keeps serving the stale build. Opt in via `server.releaseWatch` in `settings.json`: the bundle watches its SOURCE tree, compares fingerprints against the manifest release stamp, and surfaces staleness on `GET /_gina/release/status` and a live `GET /_gina/release/events` SSE stream (notify mode, the default) — or auto-rebuilds on change (opt-in `auto` mode). `POST /_gina/release/rebuild` rebuilds with an **idle-gated restart** that waits on in-flight HTTP requests and `gina.registerBusyProbe` application probes, so a restart never interrupts in-flight work. Hard-gated on `local` scope + a non-dev env — never active on a real cluster. | `0.5.18-alpha` | 2026-07-16 |
 | ✅ | **Popin eager preload** — Opt-in idle warming for AJAX popin content. Mark a trigger with `data-gina-dialog-preload="eager"` (case-insensitive) and the popin plugin fetches its content after `window` load, at browser idle — one trigger at a time, off the critical path — so opening feels instant with no second GET. Same safety gates as the hover/focus warm: the `"false"` opt-out and the disabled skip apply identically, and an eager warm and a hover warm coalesce into a single GET (whichever runs second is a no-op). The pass is skipped when the browser signals Save-Data. Default behavior is unchanged — hover/focus warm remains the default. | `0.5.21-alpha` | 2026-07-19 |
 | ✅ | **Upload progress + drag-and-drop** — Extend the `data-gina-form-upload-*` staged client layer with transfer progress and drop-target support. **Progress shipped** (`0.5.24-alpha.2`): the staging POST reports real upload progress (`xhr.upload.onprogress`) through the registered `uploadProgress.<id>` client event, a `data-gina-form-upload-on-progress` window callback, and a declarative indicator (`data-gina-form-upload-progress`, default `<fieldId>-progress`) with a fully managed lifecycle. **Drag-and-drop shipped** (`0.5.24-alpha.2`): an attribute-marked dropzone (`data-gina-form-upload-dropzone="<elementId>"`, explicit id, opt-in) accepting dropped files through the exact same staging pipeline as the native file input — group tagging, previews, hidden metadata fields, reset/delete and upload progress included — with `idle`/`over`/`dropped` CSS state hooks, file-drags-only reaction, and first-file truncation on single-file inputs. Opt-in attributes, zero new dependencies, no server-contract change. | `0.5.24-alpha.2` | 2026-07-22 |
-| 📋 | **Pluggable object storage** — Named drivers pairing an **adapter** (where the bytes live) with a **strategy** (how keys are laid out), behind one callback-shaped contract. Keys are opaque, so a later layout change never breaks stored references; writes publish atomically by temp-and-rename, so a reader never observes a partial object; and every object carries a metadata row written through a pluggable store seam — an embedded SQLite file by default, or a `connectors.json` entry when several processes share one root. A driver root that sits inside any web-served directory refuses the boot, since objects there would be publicly fetchable. Much of the layer has already shipped: the `local` adapter with the `sharded` (dated), `cas` (content-addressed, deduplicating, refcounted) and `stream` (large sequential media, with resumable out-of-order segment uploads) strategies, size tiering, byte-range reads, the metadata seam and its Couchbase store, boot validation, the `gina.storage()` accessor, upload groups publishing straight to a driver, the `storage:stats` / `storage:gc` / `storage:verify` maintenance CLI with its admin-gated `/_gina/storage/*` endpoints, and HTTP Range serving on both engines (`serveFromStorage()` — 206/416/304, conditional GET, strong key ETags). The `s3` adapter — storeless (the provider owns each object's metadata), S3-compatible, its client a project-side dependency, with presigned-URL offload serving (307) — has shipped on the development branch, completing the layer; the milestone closes with the release that carries it. | `0.8.x` | 2027 |
+| ✅ | **Pluggable object storage** — Named drivers pairing an **adapter** (where the bytes live) with a **strategy** (how keys are laid out), behind one callback-shaped contract. Keys are opaque, so a later layout change never breaks stored references; writes publish atomically by temp-and-rename, so a reader never observes a partial object; and every object carries a metadata row written through a pluggable store seam — an embedded SQLite file by default, or a `connectors.json` entry when several processes share one root. A driver root that sits inside any web-served directory refuses the boot, since objects there would be publicly fetchable. Much of the layer has already shipped: the `local` adapter with the `sharded` (dated), `cas` (content-addressed, deduplicating, refcounted) and `stream` (large sequential media, with resumable out-of-order segment uploads) strategies, size tiering, byte-range reads, the metadata seam and its Couchbase store, boot validation, the `gina.storage()` accessor, upload groups publishing straight to a driver, the `storage:stats` / `storage:gc` / `storage:verify` maintenance CLI with its admin-gated `/_gina/storage/*` endpoints, and HTTP Range serving on both engines (`serveFromStorage()` — 206/416/304, conditional GET, strong key ETags). The `s3` adapter — storeless (the provider owns each object's metadata), S3-compatible, its client a project-side dependency, with presigned-URL offload serving (307) — completed the layer and shipped in `0.6.8`, which closes this milestone. Remaining maintenance verbs (`storage:migrate`, a deep `verify`, sharded verify) are demand-gated and tracked separately. | `0.6.8` | 2026-08-15 |
 
 ---
 
@@ -438,7 +439,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **Application-level rapid reset rate limiter** (CVE-2023-44487) — per-session stream creation counter | `0.3.13` | 2026-05-14 | The Isaac HTTP/2 session handler counts new streams in a rolling 1s window per session; over `maxStreamsPerSecond` (default 200) it sends a GOAWAY and closes the session. More targeted than `maxSessionRejectedStreams` (which counts refused streams, not created ones). Configurable via `settings.json` `http2Options.maxStreamsPerSecond`; `/_gina/info` exposes a `rapidResetBlocked` counter. |
 | ✅ | **Trailer support** — `stream.sendTrailers()` + `waitForTrailers: true` | `0.4.0` | 2026-05-22 | Opt-in HTTP/2 response trailers via `self.sendTrailers(fields)`. The render pipeline sets `waitForTrailers` and emits the trailing headers after the body (in the `wantTrailers` event), across all render delegates. Activated only when a controller calls `self.sendTrailers(fields)`; HTTP/1.1 and the no-trailers path are unchanged. For gRPC-style streaming (`grpc-status`) and content-integrity (`Digest`) use cases. |
 | ✅ | **Alt-Svc header** — advertise HTTP/3 availability | `0.4.2` | 2026-06-02 | Set `Alt-Svc: h3=":443"; ma=86400` response header to advertise HTTP/3 (QUIC) availability via a QUIC-capable reverse proxy (nginx, Caddy, Cloudflare). Gina does not need to implement QUIC — just announce it. Opt-in via `settings.server.json`. Native HTTP/3 is out of scope: Node.js has no stable QUIC API, and the standard deployment topology (Gina → proxy → client) already delivers HTTP/3 at the edge. |
-| 📋 | **RFC 9218 Extensible Priorities** — read, expose and propagate the `Priority: u=N, i` header | `0.6.x` | Q1 2027 | Read the client's declared urgency, expose it on the request, propagate it on outbound HTTP/2 calls, and use it where gina schedules its own work (async jobs, load shedding). Browsers do send it over HTTP/2 — Chrome spans the full urgency range and distinguishes documents, stylesheets, scripts, images and `fetch()` — while HTTP/1.1 sends nothing. Ordering the response writes themselves is **not** included: Node exposes no `PRIORITY_UPDATE` frame and no send-scheduler hook, so that half waits on the runtime. |
+| ✅ | **RFC 9218 Extensible Priorities** — read, expose and propagate the `Priority: u=N, i` header | `0.6.31` | 2026-09-14 | Shipped: `req.priority` (urgency 0–7, the incremental flag, `present`) parsed on both engines, propagated on outbound `self.query()` / `self.forward()` calls (a caller-set header wins, `priority: false` suppresses), emitted with `self.setPriority()`, and consulted by the async-job worker through `startJob(fn, { urgency })` — explicit, never inherited from the request. Browsers do send it over HTTP/2 — Chrome spans the full urgency range and distinguishes documents, stylesheets, scripts, images and `fetch()` — while HTTP/1.1 sends nothing. Ordering the response writes themselves is **not** included: Node exposes no `PRIORITY_UPDATE` frame and no send-scheduler hook, so that half waits on the runtime. |
 | ✅ | **WebSocket over HTTP/2** (RFC 8441 extended CONNECT) — opt-in via `http2Options.enableConnectProtocol` (default off; https and cleartext h2c HTTP/2 bundles). From `onInitialize`, `app.onWebSocket(path, handler)` registers per-path WebSocket handlers; accepted streams arrive as full sessions backed by a built-in dependency-free RFC 6455 codec (auto-pong, timed close handshake, UTF-8 + close-code validation, payload/fragment DoS caps, backpressure passthrough, graceful shutdown drain). Unknown paths are refused with 404, plain CONNECT keeps its 405, and default-off deployments are byte-identical. **Extended in `0.5.5`:** endpoints are declarable in `routing.json` (`method: "ws"` + `param.wsHandler` → `channels/<name>.js`, `:param` paths, per-route `param.wsOptions`), and handlers can call other bundles over HTTP with `session.query()`. | `0.4.7` | 2026-06-11 |
 
 ---

package/framework/v0.6.31/VERSION

@@ -0,0 +1 @@
+0.6.31

package/framework/{v0.6.30 → v0.6.31}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3037,6 +3037,33 @@ if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
  *      `_validator.<rule>` namespace (catalog wins per key, English defaults fill).
  *      A non-string (e.g. the routing-mode rule object) is ignored by the overlay guard.
  * */
+/**
+ * Own-property count, reached WITHOUT the shadowable `<container>.count()` lookup (#B546).
+ *
+ * gina installs a `count()` helper on `Object.prototype` (`utils/prototypes.js`), so the
+ * shorthand is an ordinary property lookup that an OWN property of the same name shadows.
+ * Every container counted through this function is keyed by the CLIENT — a request body, a
+ * query bag, route params, uploaded files, caller-supplied query data — so one field named
+ * `count` made the framework call a string instead of the helper: a 500 on the guarded body
+ * branches, and an uncaughtException that exited the process on the unguarded query ones.
+ *
+ * `ownCount()` reaches the helper itself, which no own property can
+ * shadow, and is the same function body, so every receiver shape counts exactly as before.
+ * The null/undefined branch is deliberate rather than defensive: `.call(null)` would bind
+ * `this` to the global object and return ITS key count, while the shorthand threw — and the
+ * empty-object seeding in the body-parse branches is built on that throw.
+ *
+ * @param   {*} container - Any value the shorthand would have been called on.
+ * @returns {number} Own enumerable property count.
+ * @inner
+ */
+function ownCount(container) {
+    if (container === null || typeof container === 'undefined') {
+        return container.count(); // preserve the exact TypeError the shorthand raised
+    }
+    return Object.prototype.count.call(container);
+}
+
 function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
     var isGFFCtx        = ( ( typeof(module) !== 'undefined' ) && module.exports ) ? false : true;
@@ -4250,7 +4277,10 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             : serverInstance;
         controller.setOptions(request, response, next, controllerOptions);
 
-        var data = ( typeof(options.data) == 'object' && options.data.count() > 0 )
+        // #B546 — `options.data` carries the rule's declared data merged with the request's
+        // own body/query bag (lib/routing), so its keys are client-chosen; counted through
+        // `Object.prototype.count` so a field named `count` cannot shadow the helper.
+        var data = ( typeof(options.data) == 'object' && ownCount(options.data) > 0 )
                 ? options.data
                 : {};
         // inherited data from current query asking for validation

package/framework/{v0.6.30 → v0.6.31}/core/asset/plugin/dist/vendor/gina/js/gina.min.js

@@ -52,7 +52,7 @@ G[u]==null||typeof G[u][T]=='undefined'||p[u][T]!=G[u][T]||(v[u]=A?G[u]:p[u]):v.
 !1);return!G.constructor||A||T?!0:!1};K.setKeyComparison=function(G){L.keyComparison=G;return K};K.getKeyComparison=function(){var G=L.keyComparison||'id';L.keyComparison='id';return G};return K}typeof module!=='undefined'&&module.exports?(typeof JSON.clone=='undefined'&&(JSON.clone=require(__dirname+'/../../../../../utils/prototypes.json_clone')),module.exports=Merge()):typeof define==='function'&&define.amd&&define('lib/merge',[],function(){return Merge()});
 var _alphabet='0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz',_mask=63,_step=7;function uuid(g){g=g||4;for(var v=g<=4?_step:Math.ceil(1.6*(_mask+1)*g/_alphabet.length),F='';;)for(var K=crypto.getRandomValues(new Uint8Array(v)),L=0;L<v;L++){var H=K[L]&_mask;if(H<62&&(F+=_alphabet[H],F.length===g))return F}}
 uuid.customAlphabet=function(g,v){v=v||4;for(var F=1;F<g.length-1;)F=F<<1|1;var K=Math.ceil(1.6*(F+1)*v/g.length);K<5&&(K=5);return function(L){L=L||v;for(var H='';;)for(var G=crypto.getRandomValues(new Uint8Array(K)),p=0;p<K;p++){var A=G[p]&F;if(A<g.length&&(H+=g[A],H.length===L))return H}}};
-if(typeof module!=='undefined'&&module.exports){if(typeof crypto==='undefined'||typeof crypto.getRandomValues!=='function'){var _webcrypto=require('crypto').webcrypto||require('crypto');typeof globalThis!=='undefined'?globalThis.crypto=_webcrypto:crypto=_webcrypto}module.exports=uuid}else typeof define==='function'&&define.amd&&define('lib/uuid',[],function(){return uuid});
+if(typeof module!=='undefined'&&module.exports){if(typeof crypto==='undefined'||typeof crypto.getRandomValues!=='function'){var _webcrypto=require('crypto').webcrypto||require('crypto');typeof globalThis!=='undefined'?globalThis.crypto=_webcrypto:crypto=_webcrypto}module.exports=uuid}else typeof define==='function'&&define.amd&&define('lib/uuid',[],function(){return uuid});function ownCount(g){return g===null||typeof g==='undefined'?g.count():Object.prototype.count.call(g)}
 function FormValidatorUtil(g,v,F,K,L){var H=typeof module!=='undefined'&&module.exports?!1:!0,G=H?require('lib/merge'):require('../../../../../lib/merge');H||require('../../../../../helpers');H&&require('helpers/dateFormat');var p=H?require('lib/routing'):require('../../../../../lib/routing'),A=H?null:require('../../../../../lib/i18n'),T=function(){if(typeof document==='undefined'||!document||typeof document.cookie!=='string')return null;var Q=document.cookie||'';if(!Q)return null;Q=Q.split(';');
 for(var X=0,ha=Q.length;X<ha;++X){for(var Fa=Q[X];Fa.charAt(0)===' '||Fa.charAt(0)==='\t';)Fa=Fa.slice(1);var N=Fa.indexOf('=');if(!(N<0)&&Fa.slice(0,N)==='gina-csrf-token'){Q=Fa.slice(N+1);try{return decodeURIComponent(Q)}catch(P){return Q}}}return null},q=function(Q){if(typeof Q!=='string'||!Q)return!1;Q=Q.toUpperCase();return Q!=='GET'&&Q!=='HEAD'&&Q!=='OPTIONS'},u=function(){var Q=!1,X=null;H?H&&typeof gina.forms!='undefined'&&(X=gina.forms):X=getContext('gina').forms||null;X&&typeof X.validators!=
 'undefined'&&(Q=!0);return Q},y={errors:{},keys:{'%l':'label','%n':'name','%s':'size'},errorLabels:{},data:{},excluded:[]},k={is:'Condition not satisfied',isEmail:'A valid email is required',isRequired:'Cannot be left empty',isBoolean:'Must be a valid boolean',isNumber:'Must be a number: allowed values are integers or floats',isNumberLength:'Must contain %s characters',isNumberMinLength:'Should be at least %s characters',isNumberMaxLength:'Should not be more than %s characters',isInteger:'Must be an integer',
@@ -82,7 +82,7 @@ A=async function(Q,X,ha,Fa){var N=(new (require(_(GINA_FRAMEWORK_DIR+'/core/conf
 Ja=JSON.clone(p.getRoute(Q.url,Q.data));var ma=N[da][N.env],Oa=ma.content.server;typeof Oa._cached=='undefined'&&(Oa._cached=new Map);typeof Oa._cachedPath=='undefined'&&(Oa._cachePath=Oa.cache.path);typeof Oa._cacheIsEnabled=='undefined'&&(Oa._cacheIsEnabled=Oa.cache.enable);P||(N.bundle==da&&(P=getConfig(va,'settings').server.credentials,Q.ca=P.ca||null,Q.hostname=ma.server.scheme+'://'+ma.host,Q.port=ma.port[ma.server.protocol][ma.server.scheme],Q.protocol=ma.server.protocol,Q.rejectUnauthorized=
 !1),P={ca:Q.ca,hostname:Q.hostname,port:Q.port,path:Q.path},typeof Q.protocol!='undefined'&&(P.protocol=Q.protocol),typeof Q.rejectUnauthorized!='undefined'&&(P.rejectUnauthorized=Q.rejectUnauthorized));ia={method:Ja.method,requirements:Ja.requirements,namespace:Ja.namespace||void 0,url:decodeURI(Ja.url),rule:ia+'@'+da,param:JSON.clone(Ja.param),middleware:JSON.clone(Ja.middleware),bundle:Ja.bundle,isXMLRequest:X.isXMLRequest,isWithCredentials:X.isWithCredentials};da=ia.rule.replace('@'+da,'')||'_common';
 da={template:typeof ma.content.templates!='undefined'?ma.content.templates[da]||ma.content.templates._common:void 0,isCacheless:ma.isCacheless};da=G(da,ia);ma=JSON.clone(ma);da.conf=ma;da.conf.content.routing[da.rule].param=ia.param;da.template&&typeof da.template.ginaLoader=='undefined'&&(da.template.ginaLoader=da.conf.content.templates._common.ginaLoader);da.conf.content.routing[da.rule].param=ia.param;delete da.middleware;delete da.param;delete da.requirements;ma=new (require(_(GINA_FRAMEWORK_DIR+
-'/core/controller/controller.js'),!0))(da);ma.name=Ja.param.control;ma.serverInstance=process.gina&&process.gina._serverInstance?process.gina._serverInstance:Oa;ma.setOptions(X,ha,Fa,da);X=typeof Q.data=='object'&&Q.data.count()>0?Q.data:{};if(/^get|delete|put$/i.test(Q.method)){ha=0;for(let Ma in X)typeof X[Ma]=='object'&&encodeRFC5987ValueChars(JSON.stringify(X[Ma])),ha++}P.method=Q.method;P.path=Ja.url;Q=require('util').promisify;var ja={isValid:!1},Ca=!1;await Q(ma.query)(P,X).then(function(Ma){ja=
+'/core/controller/controller.js'),!0))(da);ma.name=Ja.param.control;ma.serverInstance=process.gina&&process.gina._serverInstance?process.gina._serverInstance:Oa;ma.setOptions(X,ha,Fa,da);X=typeof Q.data=='object'&&ownCount(Q.data)>0?Q.data:{};if(/^get|delete|put$/i.test(Q.method)){ha=0;for(let Ma in X)typeof X[Ma]=='object'&&encodeRFC5987ValueChars(JSON.stringify(X[Ma])),ha++}P.method=Q.method;P.path=Ja.url;Q=require('util').promisify;var ja={isValid:!1},Ca=!1;await Q(ma.query)(P,X).then(function(Ma){ja=
 Ma}).catch(function(Ma){Ca=Ma});Ca&&(console.error(Ca),ja.error=Ca);return ja};var ea=null;ea=H?la:A;var ta=function(Q,X){var ha=null,Fa=null;typeof m[Q]=='undefined'&&typeof X!='undefined'&&(m[Q]=ha=X);if(typeof m[Q]=='object')try{ha=JSON.parse(JSON.stringify(m[Q]))}catch(N){ha=m[Q]}else ha=m[Q];Fa='';H&&typeof v!='undefined'&&(Fa=v[Q].getAttribute('data-gina-form-field-label')||'');m[Q]={target:H&&typeof v!='undefined'?v[Q]:null,name:Q,value:ha,valid:!1,label:Fa,exclude:!1};m[Q].is=function(N,P,
 ia){var da=!1,va=typeof window!='undefined'?window:typeof global!='undefined'?global:null,Ja=va&&typeof va._currentValidatorAlias!='undefined'?va._currentValidatorAlias:'is';va&&va._currentValidatorAlias&&delete va._currentValidatorAlias;va=m[this.name].errors||{};y.data[this.name]=m[this.name].value;this.value===''&&(da=!0);if(!da&&/^(true|false)$/i.test(N))da=N;else if(!da){var ma=null,Oa=null;if(/[!=>><a-z 0-9]+/i.test(N)){if((Oa=N.match(/\${0}[-_,.\[\]a-z0-9]+/ig))&&Oa.length>0){for(var ja=0,
 Ca=Oa.length;ja<Ca;++ja)typeof m[Oa[ja]]!='undefined'&&Oa[ja]&&(ma=new RegExp('\\$'+Oa[ja]+'(?!\\S+)','g'),N=m[Oa[ja]].value==''?N.replace(ma,'""'):typeof m[Oa[ja]].value=='string'?N.replace(ma,'"'+m[Oa[ja]].value+'"'):N.replace(ma,m[Oa[ja]].value));try{if(/^\//.test(N)){var Ma=N.match(/^\/(.+)\/([a-z]*)$/);if(!Ma)throw Error('Invalid regex literal: `'+N+'`');da=(new RegExp(Ma[1],Ma[2])).test(this.value)}else{N=N.replace(/(\(|\)|return)/g,'');Ma=/^\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;

package/framework/{v0.6.30 → v0.6.31}/core/config.js

@@ -8,6 +8,7 @@
  */
 //Imports.
 var fs              = require('fs');
+var path            = require('path');
 var os              = require('os');
 var dns             = require('dns');
 var util            = require('util');
@@ -241,6 +242,14 @@ function Config(opt, contextResetNeeded) {
                         console.error(_bundlesMsg);
                         // Guarantee the reason survives process.exit() on an async pipe (e.g. bin/gina-container).
                         try { fs.writeSync(2, _bundlesMsg + '\n'); } catch (_e) { /* best-effort */ }
+                        // #B542 — retain the reason. Init is fully SYNCHRONOUS, so this
+                        // branch runs INSIDE `new Config(...)` while the exit below is
+                        // still only scheduled; a caller that chains `.getInstance()` in
+                        // the same statement (helpers/context.js does) gets there first,
+                        // with `Config.initialized` and `Config.instance` both unset.
+                        // Without this, getInstance had nothing to report and invented an
+                        // instance instead — see the guard in getInstance below.
+                        Config.initError = err;
                         setTimeout(() => {
                             process.exit(1);
                         }, 0);
@@ -310,11 +319,34 @@ function Config(opt, contextResetNeeded) {
      * @memberof module:gina/core/config
      * @param {string} [bundle] - Bundle name; omit to return the full envConf
      * @returns {object|undefined} Config instance, envConf slice, or undefined
+     * @throws {Error} If initialisation aborted — the retained reason, named (#B542)
      */
     this.getInstance = function(bundle) {
 
+        // #B542 — refuse rather than fabricate. When init aborted, `Config.instance`
+        // is undefined (it is only assigned on the success branch) and the process is
+        // already scheduled to exit; a caller reaching here in the meantime used to
+        // fall into the merge below and get something that is not a Config back. Say
+        // what actually went wrong, once, instead of a downstream TypeError that names
+        // neither the bundle nor the file.
+        if ( typeof(Config.initialized) == 'undefined' && Config.initError ) {
+            throw new Error('[ CONFIG ] initialisation failed — '
+                + (Config.initError.message || Config.initError));
+        }
+
         if ( typeof(Config.instance) == 'undefined' && typeof(getContext('gina')) != 'undefined' ) {
-            Config.instance = merge( self, getContext('gina').config, true );
+            // #B542 — lib/merge returns a non-object source WHOLESALE, and the worker
+            // branch of helpers/context.js puts the Config CONSTRUCTOR on `gina.config`.
+            // Unguarded, that made `Config.instance === Config`, whose `.Env` is
+            // undefined — the self-sustaining `Cannot set properties of undefined
+            // (setting 'parent')` two lines down, which survives every later call
+            // because this block's own guard then reads as satisfied.
+            var _merged = merge( self, getContext('gina').config, true );
+            if ( typeof(_merged) != 'object' || !_merged ) {
+                throw new Error('[ CONFIG ] cannot resolve an instance: the global context holds no usable `gina.config` (got '
+                    + (_merged === null ? 'null' : typeof(_merged)) + ')');
+            }
+            Config.instance = _merged;
             self.envConf = Config.instance.envConf
         }
 
@@ -916,11 +948,50 @@ function Config(opt, contextResetNeeded) {
                         // reverted: async readdir (#P33) breaks synchronous Config init contract
                         configFiles = fs.readdirSync(_(appSrcPath + '/config'));
                     } catch (srcReadErr) {
-                        return callback(srcReadErr);
+                        // #B542 — the last-chance branch: the release tree had no
+                        // readable config/ and neither does the source tree. Report
+                        // BOTH paths. `appPath` still holds the release link here
+                        // (the `appPath = appSrcPath` reassignment is below), so the
+                        // operator sees exactly what was tried and in what order,
+                        // instead of a bare ENOENT naming only the second attempt.
+                        let _noConfigMsg = '[ ' + app + ' ][ ' + env + ' ] no readable config/ in the release tree ('
+                            + appPath + ') nor in the source tree (' + appSrcPath + ') — '
+                            + (srcReadErr.message || srcReadErr) + '; refusing to start';
+                        console.error(_noConfigMsg);
+                        // Guarantee the reason survives process.exit() on an async pipe (e.g. bin/gina-container).
+                        try { fs.writeSync(2, _noConfigMsg + '\n'); } catch (_e) { /* best-effort */ }
+                        return callback(new Error(_noConfigMsg));
                     }
-                    setPath('bundles', _(appSrcPath, true));
+                    // #B542 — this fallback is PER-APP and must stay per-app. It used to
+                    // do two things that outlived the one bundle it was recovering:
+                    //
+                    //   1. `setPath('bundles', _(appSrcPath, true))` wrote this ONE
+                    //      bundle's own directory into the process-global `bundles`
+                    //      registry, which every other writer (gna.js, helpers/context.js)
+                    //      and reader (this function's own `bundlesPath` initialiser,
+                    //      lib/proc.js's unmount) treats as the CONTAINER of all
+                    //      bundles. Nothing restored it. It is not load-bearing here —
+                    //      `appPath = appSrcPath` on the next line is what makes the
+                    //      src config readable — so it is simply gone.
+                    //   2. `= bundlesPath =` reassigned the function-scoped loop local
+                    //      declared at the top of loadWithTemplate, which the guarded
+                    //      assignment above hands to every LATER app in this same loop.
+                    //      One bundle whose release tree carries no config/ therefore
+                    //      rewrote the config root of every bundle walked after it: in
+                    //      a non-dev env they silently loaded their SRC config instead
+                    //      of their release config, or died on a spliced path with an
+                    //      unnamed ENOENT.
+                    //
+                    // The old value was also computed by stripping `'/'+ app` from the
+                    // path with an UNANCHORED, UNESCAPED RegExp keyed on the manifest
+                    // KEY while the path carries the src DIRNAME — so it silently
+                    // produced a wrong path whenever the two differ, whenever the
+                    // project path contains the bundle's name earlier (`/demo` inside
+                    // `/demo-x` is stripped first), or whenever the name carries a
+                    // regex metacharacter. `path.dirname()` answers the same question
+                    // ("which directory contains this bundle?") without any of that.
                     appPath = appSrcPath;
-                    newContent[app][env].bundlesPath = bundlesPath = appSrcPath.replace( new RegExp('/'+ app), '' );
+                    newContent[app][env].bundlesPath = path.dirname(appSrcPath);
                     console.warn('[CONFIG] Dependency bundle config loaded from '+ appSrcPath);
                 }
 
@@ -1783,7 +1854,20 @@ function Config(opt, contextResetNeeded) {
         try {
             configFiles = fs.readdirSync(_(appPath + '/config', true));
         } catch (configReadErr) {
-            return callback(configReadErr);
+            // #B542 — name it. This abort ends the SHARED config load for every
+            // bundle in the project, and the bare `callback(err)` it replaces sent
+            // up a raw ENOENT whose only clue was a path — which, when it came from
+            // loadWithTemplate's src fallback, was a path no operator had ever
+            // written down. `bundle`, `env` and `appPath` are all in scope here, so
+            // "which bundle?" costs nothing to answer. Same shape as the #B132
+            // routing.json refusal below, with #B181(b)'s stderr flush.
+            e = '[ ' + bundle + ' ][ ' + env + ' ] config directory not readable at '
+                + appPath + '/config — ' + (configReadErr.message || configReadErr)
+                + '; refusing to start';
+            console.error(e);
+            // Guarantee the reason survives process.exit() on an async pipe (e.g. bin/gina-container).
+            try { fs.writeSync(2, e + '\n'); } catch (_e) { /* best-effort */ }
+            return callback(new Error(e));
         }
 
         if ( sharedConfigPathObj.existsSync() ) {
@@ -1792,7 +1876,17 @@ function Config(opt, contextResetNeeded) {
             try {
                 sharedConfigFiles = fs.readdirSync(sharedconfigPath);
             } catch (sharedReadErr) {
-                return callback(sharedReadErr);
+                // #B542 — same treatment as the bundle config/ refusal above. The
+                // path reached existsSync() one line earlier, so a failure here is a
+                // permissions or race condition, not a typo — say which bundle's load
+                // it killed and which directory it was.
+                e = '[ ' + bundle + ' ][ ' + env + ' ] shared config directory not readable at '
+                    + sharedconfigPath + ' — ' + (sharedReadErr.message || sharedReadErr)
+                    + '; refusing to start';
+                console.error(e);
+                // Guarantee the reason survives process.exit() on an async pipe (e.g. bin/gina-container).
+                try { fs.writeSync(2, e + '\n'); } catch (_e) { /* best-effort */ }
+                return callback(new Error(e));
             }
             for (let i=0, len = sharedConfigFiles.length; i<len; i++) {
                 let file = sharedConfigFiles[i];

package/framework/{v0.6.30 → v0.6.31}/core/connectors/couchbase/index.js

@@ -818,7 +818,7 @@ function Couchbase(conn, infos) {
                     //
                     // For more, visit :
                     // - https://blog.couchbase.com/high-performance-consistency/
-                    // - https://developer.couchbase.com/documentation/server/current/architecture/querying-data-with-n1ql.html
+                    // - https://docs.couchbase.com/server/current/learn/services-and-indexes/services/query-service.html
                     // Query options values by default
                     var queryOptions = {
                         // Do not turn off the adhoc flag for each query since

package/framework/{v0.6.30 → v0.6.31}/core/connectors/couchbase/lib/connector.v3.js

@@ -10,6 +10,9 @@ var lib             = gina.lib;
 var console         = lib.logger;
 var merge           = lib.merge;
 var modelUtil       = new lib.Model();
+// #B432 — per-call at-most-once settle guard for a connector outcome
+// (core/connectors/settle-once.js).
+var settleOnce      = require('./../../settle-once');
 
 
 /**
@@ -24,6 +27,10 @@ var modelUtil       = new lib.Model();
  *      `1m` will set the ping interval to 1 minute
  *      `1h` will set the ping interval to 1 hour
  *      `1d` will set the ping interval to 1 day
+ *  - readyTimeout (default: 50000)
+ *      milliseconds to wait for the connector to become ready at boot before
+ *      failing loudly. Values at or above the CLI's ~64s bundle-start budget
+ *      (`lib/cmd/bundle/start.js`) cannot take effect.
  *
  * @class
  * */
@@ -39,6 +46,8 @@ function Connector(dbString) {
                 collection: '_default', // by default
                 keepAlive: true,
                 pingInterval : "2m",
+                // #B541 — boot readiness deadline, in milliseconds.
+                readyTimeout: 50000,
                 configProfile: "wan"
             }
         }
@@ -47,6 +56,38 @@ function Connector(dbString) {
         }
     ;
 
+    // #B541 — boot readiness state. `_markSettled()` records that `ready` has
+    // been settled and disarms the boot deadline armed in init(); it does NOT
+    // gate `self.emit('ready', …)`. Repeat emits are load-bearing:
+    // `core/model/index.js` attaches a persistent `.on('ready')` that surfaces
+    // reconnect churn on the Inspector event signal, and both `onReady`
+    // consumers register `once`, which already drops a late delivery.
+    var _settled        = false
+        , _deadlineId   = null
+    ;
+
+    /**
+     * Record that `ready` has been settled and disarm the boot deadline.
+     *
+     * Idempotent — a reconnect calls it again, by which point the timer is
+     * already `null`.
+     *
+     * @memberof Connector
+     * @inner
+     * @returns {void}
+     *
+     * @example
+     * _markSettled();
+     * self.emit('ready', false, self.instance);
+     */
+    var _markSettled = function() {
+        _settled = true;
+        if (_deadlineId) {
+            clearTimeout(_deadlineId);
+            _deadlineId = null;
+        }
+    };
+
     /**
      * arrayToValues
      * Eg.: array like: ['a', 0.5, 'b', false]
@@ -72,7 +113,25 @@ function Connector(dbString) {
         // Attention: the connection is lost 5 minutes once the bucket is opened.
         var conn        = null;
 
-        var onError = function (err, next) {
+        // #B541 — one outcome per connect attempt.
+        //
+        // On failure the couchbase SDK settles BOTH of its channels: it invokes
+        // the onBucketOpened callback AND rejects the awaited promise. So a
+        // single failed attempt called onError twice, arming TWO retry chains —
+        // and each of those, failing in turn, armed two more (2 -> 4 -> 8 ...) —
+        // while double-counting _reconnectAttempts, so the backoff escalated at
+        // twice the intended rate and reached its 60s cap after five real
+        // attempts instead of ten. The guard is minted PER connect() invocation,
+        // never at module scope, so a later reconnect's own attempt stays
+        // independently reportable.
+        var onError = settleOnce('couchbase-v' + sdk.version + ':connector#connect', function onErrorImpl(err, next) {
+            // The promise channel can run WITHOUT the callback channel having
+            // run first (a rejection that never calls back), and only the
+            // callback channel assigns self.instance — which is not initialised
+            // at construction. Without this guard that ordering throws here,
+            // before any retry is armed, and the throw surfaces only as an
+            // unhandled rejection of the bare self.connect(dbString) call.
+            if (!self.instance) self.instance = {};
             delete self.instance.reconnecting;
             self.instance.reconnected = self.instance.connected = false;
             console.debug('[CONNECTOR][' + local.bundle +'] Scope is: '+ process.env.NODE_SCOPE );
@@ -98,7 +157,7 @@ function Connector(dbString) {
                 }
             }, _backoffDelay)
 
-        };
+        }, console);
 
         // once
         var onConnect = function onConnect(cb){
@@ -239,6 +298,8 @@ function Connector(dbString) {
             // setTimeout(() => {
             //     self.emit('ready', false, self.instance);
             // }, 300);
+            // #B541 — disarm the boot deadline; the emit itself stays ungated.
+            _markSettled();
             self.emit('ready', false, self.instance);
         }
 
@@ -392,6 +453,40 @@ function Connector(dbString) {
             dbString        = merge(dbString, local.options);
             local.options   = dbString;
 
+            // #B541 — arm the boot readiness deadline.
+            //
+            // Every failure path in connect() routes to onError(), which only
+            // re-arms a retry — it never emits. Without this, a connector that
+            // cannot reach couchbase at boot NEVER settles: lib/model.js's
+            // all-or-nothing ready gate never closes, the bundle never prints
+            // the flags bundle:start watches for, and the CLI SIGKILLs it at
+            // ~64s (lib/cmd/bundle/start.js: maxRetry 15 x maxTimeout 4000ms)
+            // with no terminal error logged anywhere.
+            //
+            // lib/model.js's onModelReady ALREADY handles an error correctly —
+            // console.error + process.exit(1) — and that is how every other
+            // connector reports a dead database. It was simply unreachable
+            // here. So if nothing has settled by the deadline, emit the error
+            // ourselves and let that existing path run.
+            //
+            // NOT a retry cap: onError's uncapped reconnect is untouched, so a
+            // connector that HAS settled still recovers from a later blip.
+            // Deliberately NOT unref'd — were this the only handle holding the
+            // event loop, unref would let node exit 0 silently instead of
+            // reporting, and onError's retry timer already holds the loop.
+            var _readyTimeout = ( typeof(local.options.readyTimeout) == 'number' && local.options.readyTimeout > 0 )
+                ? local.options.readyTimeout
+                : 50000;
+
+            if ( !_settled && !_deadlineId ) {
+                _deadlineId = setTimeout(function onReadyDeadline() {
+                    _deadlineId = null;
+                    if (_settled) return;
+
+                    _markSettled();
+                    self.emit('ready', new Error('[CONNECTOR][' + local.bundle +'][' + dbString.connector +'][' + dbString.database +'] Couchbase did not become ready within '+ (_readyTimeout/1000) +'s @`'+ dbString.protocol + dbString.host +'`\nCheck:\n - if couchbase is running and reachable from this host\n - if bucket `'+ dbString.database +'` exists\n - if the credentials are valid\nRaise `readyTimeout` on this connector entry to wait longer; it must stay under the ~64s bundle-start budget to take effect.'), null);
+                }, _readyTimeout);
+            }
 
             console.info('[CONNECTOR][' + local.bundle +'][' + dbString.connector +'][' + dbString.database +'] authenticating to couchbase cluster @'+ dbString.protocol + dbString.host);
 
@@ -410,6 +505,8 @@ function Connector(dbString) {
 
         } catch (err) {
             console.error(err.stack);
+            // #B541 — a synchronous throw already settles; disarm the deadline.
+            _markSettled();
             self.emit('ready', err, null)
         }
     }