gina 0.6.5 → 0.6.6

package/CHANGELOG.md

@@ -6,6 +6,16 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.6 - 2026-08-09
+### Added
+* The MQ log speaker now reconnects on its own. It previously dialled the listener exactly once, ever, so anything that ended that connection — a daemon restart, an OOM-killed listener, a container probe — left the bundle logging nowhere, with no error after the first and nothing in the logs to say so. It now redials when the connection closes, backing off exponentially to a 30 second ceiling, and logs a `reconnected` notice when it recovers; a failure is reported once per outage rather than once per attempt. The retry timer is unreferenced, so short-lived CLI processes still exit immediately instead of waiting out a backoff. Frames emitted while the transport is down are dropped rather than queued, which keeps memory bounded during a long outage — the `default` flow still carries those lines to stdout.
+### Fixed
+* Application log lines reach the local MQ listener again when the framework home names another machine — the MQ speaker and file log containers dialled `host_v4` verbatim, so on a `~/.gina` shared across hosts (each host rewriting `settings.json` at boot) or after a stale address was left behind, every runtime log frame was silently shipped off-host while all connection lines read healthy, leaving container logs with only boot output. The two intra-host transports now resolve their dial from the bind side only (`GINA_BIND_HOST`, then `settings.bind_host`): a concrete non-wildcard local bind is dialled, anything else stays on loopback. Pointing `host_v4` at a remote machine to ship logs cross-host was never a supported topology (the listener binds loopback by default) and no longer affects these two clients; `gina tail` and the command socket keep their remote-capable resolution (#B320)
+* The popin `success` event now fires. A popin whose JSON response carried neither a redirect nor a reload previously raised `error` with an HTTP 422 status instead — and because the error branch replaces its payload with the parsed response body, that 422 carried the successful response itself, which read as a server-side failure that had never happened. Subscribers to `success` received nothing at all. If you worked around this by listening on `error` and inspecting its payload, move that handler to `success`.
+* A bundle whose boot blocked the event loop for more than two seconds — the ordinary shape for a container start or a mount off a network filesystem — lost its `mq` log flow for the rest of the process's life, silently. The connect deadline introduced in 0.6.5 read the socket's `connecting` flag from the timers phase, which runs BEFORE the poll phase that clears it, so an overdue deadline destroyed a connection the kernel had already established. Every boot line still read healthy while nothing reached the listener, the file sink or container stdout. The deadline now reaches its verdict one event-loop phase later, so it can no longer cancel a completed connect, while a genuinely unreachable host is still given up on as promptly as before. If you pinned to 0.6.5 or worked around this with `GINA_LOG_STDOUT=true`, you can lift both.
+* Two `data-gina-link` anchors sharing one url no longer collapse onto whichever registered first. The request — and the `data-gina-loading` state, the HTML-callback attribute reads and the per-link XHR events with it — now belongs to the anchor that was actually clicked, on both dispatch paths (a direct click on the anchor, and a click on a nested child element). The public `gina.link.request(url)` call keeps its historical behaviour and resolves the first registration matching the url, since a bare url is all it has.
+* The link plugin now publishes its handler once — `gina.link` is the first activated instance, and a later construction no longer deep-merges itself into the live published one (the same freeze-prone shape the popin and nav plugins were already cured of). Pages constructing a single handler, which is the overwhelmingly common case, behave identically.
+
 ## 0.6.5 - 2026-08-08
 ### Changed
 * The not-ready submit-trigger state is now expressed with the framework-owned `data-gina-form-submit-gated="true"` attribute plus the existing `gina-form-submit-disabled` class, instead of `aria-disabled` (#B312): the trigger is genuinely operable — a click is answered with the validation reveal — so it no longer carries an ARIA claim its behaviour contradicts. `aria-disabled` now has exactly two writers, both honest: your own authored marks, which the click gates enforce and the framework never auto-clears (clear yours when you enable the control — previously a valid form stripped it for you), and the anchor in-flight lock for the request window. A default look ships for the gated state (`cursor: not-allowed` + a modest dim, single-attribute specificity, trivially overridden). If your CSS targeted `[aria-disabled="true"]` on submit triggers, key it on `.gina-form-submit-disabled` (written since 0.5.12) or the new attribute; automation note — a gated trigger no longer fails driver actionability checks, so plain clicks deliver.

package/README.md

@@ -60,47 +60,34 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.5
+## What's in 0.6.6
+
+> **If you run gina in containers or Kubernetes, upgrade.** `0.6.5` shipped a
+> regression that could silence a bundle's logging permanently — for the whole
+> life of the process, with every startup line before it still reading healthy
+> (#B323, first below). Any deployment whose boot is slow enough to block the
+> event loop for two seconds — a container start, a mount off a network
+> filesystem — was exposed.
 
 > **Re-bake your bundles, not just restart them.** The browser bundle changed in
-> this release. Nearly every fix below lives in the bundle — the form validator,
-> the popin plugin and the link plugin — so a restart alone will not deliver
-> them. Rebuild each bundle (`gina bundle:build`) as well as restarting.
+> this release. The popin and link fixes below live in the bundle, so a restart
+> alone will not deliver them. Rebuild each bundle (`gina bundle:build`) as well
+> as restarting. The logging fixes are server-side and need only the restart.
 
-> **No settings reset.** `0.6.5` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.6` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-> **If you are on 0.6.4, upgrade.** `0.6.4` shipped a regression that could stop a
-> submit button responding to clicks entirely (#B293, first below). This release
-> fixes it, together with a family of long-standing defects that produced the same
-> signature — a control that looks completely normal and does nothing at all.
-
-**Four items may need action before you upgrade:** the submit-trigger marker
-vocabulary change, `gina.setOptions()` starting to take effect, the new disabled
-gate on links, and `isRequired` accepting padded input. Each is called out below
-and detailed in the [migration guide](https://gina.io/docs/migration).
-
-- **Changed — the not-ready submit-trigger marker is `data-gina-form-submit-gated`, not `aria-disabled`.** While live validation reports a form invalid, its submit control is marked with the framework-owned attribute plus the existing `gina-form-submit-disabled` class. It no longer carries `aria-disabled`, which announces a control as not operable while gina deliberately answers the click — revealing every invalid field and moving focus to the first. Announcing one thing and doing another was the contradiction; the behaviour is unchanged and the vocabulary now matches it. `aria-disabled` keeps exactly two writers, both honest: marks you author yourself, which the click gates now enforce and gina never auto-clears, and the anchor in-flight lock for the request window. A modest default look ships for the gated state (`cursor: not-allowed` plus a dim, single-attribute specificity, trivially overridden). **Action:** if your CSS targets `[aria-disabled="true"]` on submit triggers, key it on the new attribute or on the class. A gated trigger also no longer fails browser-driver actionability checks, so plain clicks deliver in tests. (#B312)
-- **Fixed — a double-submit guard no longer kills the submit.** Since `0.6.4`, a submit trigger stopped responding to clicks when your own handler set the native `disabled` attribute during the click — the shape the near-universal double-submit guard uses. The click was cancelled before anything was sent, and because your handler cleared the attribute again the button looked perfectly normal while every further click was swallowed. The native attribute is now honoured only where the browser does not already enforce it (anchors, custom elements); on a real form control the browser suppresses the click itself, so the check never protected you there. The same shape is fixed for popin and dialog triggers, the legacy popin dispatch path, and in-popin close buttons, where a capture-phase guard could leave a popin stuck open. (#B293, #B296)
-- **Fixed — a submit button keeps working after its DOM node is replaced.** The shape an AJAX update or a popin re-render produces when it swaps in fresh markup: the replacement went permanently and silently dead — no request, no navigation, no error — while Enter and `submit()` still worked. Click handling is delegated to the form and survived the swap, but the step that runs the submit was bound to the original node. Gina now recognises a replaced trigger on its first click and re-binds it. (#B294)
-- **Fixed — an async `query` rule no longer leaves a valid form blocked.** A form whose last rule is an async uniqueness check stayed marked invalid after the check came back clean, because the completion path decided validity from one field's result and only ran its update when that field failed. Invisible until `0.6.4`, when the submit gate began reading the marker — after which the first click following a settled query was silently swallowed. (#B295)
-- **Fixed — Enter and wrapped-label clicks respect the submit gate.** The submit proxy enforced its gate against a `DOMParser` copy of the form that could only see native `disabled`, so a gated trigger still ran the full cycle and **sent** from a click on markup nested inside the button, or from Enter on a form whose trigger is not a native submit button. Trusted gestures now hit the live registered trigger with the same answer as the click path. Programmatic `$forms[id].submit()` deliberately keeps the fresh-validate path. (#B308)
-- **Fixed — an anchor submit trigger's in-flight lock survives a second click.** On an `<a data-gina-form-submit>` the validity gate and the in-flight lock both wrote `aria-disabled` with opposite lifecycles and could erase each other, leaving a form marked to the framework but operable to assistive technology, or announcing a control operable while its request was still running. With the not-ready state on its own attribute, the lock owns `aria-disabled` exclusively. Button triggers were never affected. (#B309, #B313)
-- **Fixed — required fields accept padded input, and `trim` strips both sides.** `isRequired` treated any value *starting* with whitespace as empty, so `" john"` was rejected as *Cannot be left empty* — and when the rule set also declared `trim`, the same pass then trimmed the value after recording the error. Emptiness now means `undefined`, `null`, the empty string, or whitespace-only. `trim` also rewrote only the first whitespace run it found, so a value padded on both sides kept its trailing run. **Action:** if anything relied on leading whitespace being rejected, enforce it explicitly. (#B245)
-- **Fixed — a popin holding several forms tears all of them down.** The teardown walked its list of forms while removing entries from it, releasing only every other one; the skipped forms kept stale records pointing at discarded markup, so the next open handed back the stale record and the form came up silently inert. Only popins given a validator explicitly are affected. Teardown is also no longer all-or-nothing. (#B265)
-- **Fixed — a popin trigger shows its busy state when it adopts a preload.** The common path when warm-on-intent preloading is on: an open adopting a still-in-flight hover/focus preload left the trigger with no affordance. It is now armed for the adopted wait exactly like a cold load and released when the preload settles either way. An instant open from cache never flashes a busy state. (#B285)
-- **Fixed — a legacy popin trigger cannot start a second load.** An anchor using the older `data-gina-popin-name` markup was marked `aria-disabled` while loading, but its dispatch path tested only the plain `disabled` attribute, which an anchor never carries — so a second click during a slow load issued a second request. In practice this reached triggers that opt out of preloading, i.e. links whose request has side effects on the server. (#B298)
-- **Fixed — a popin close button works with your own id and with nested markup.** Giving the button your own id stopped it working, because gina recognised its close buttons by an id it had assigned itself. More commonly, an icon inside the button broke it too — a click landing on the inner `svg` or `span` was not recognised. Neither reported an error, and gina suppresses the default action either way, so nothing happened at all. (#B299, #B301)
-- **Fixed — `data-gina-link` leaves native affordances to the browser.** Four cases are no longer intercepted: an anchor carrying `download` saves natively instead of being buffered in memory, one carrying `target` opens its window or tab again, one pointing at a bare `#` fragment moves within the page, and a ctrl/cmd/shift/alt click opens the tab or window the browser would. The tests run against the resolved target, so the documented placeholder form keeps working. Cross-origin links are unaffected. (#B288)
-- **Fixed — a `data-gina-link` with your own id dispatches again.** Gina kept the id you wrote but dispatched only links whose id it had generated itself, so `<a id="my-link" data-gina-link>` registered normally and was then silently ignored on every click — with the default action already suppressed, nothing happened at all. Links with no id, and links wrapping a `span` or image, were unaffected, which is why this could sit unnoticed. (#B302)
-- **Fixed — disabled links are refused.** `data-gina-link` anchors had no disabled gate at all: one marked `aria-disabled="true"` still fired its XHR from both dispatch paths. Both now refuse the click with the same predicate the popin and validator gates use, while still suppressing the default navigation. Programmatic `gina.link.request()` deliberately stays ungated. **Action:** this is an enforcement tightening — remove the attribute from any link you still expect to fire. (#B310)
-- **Fixed — download filenames parse and serialize correctly.** Client-side, a `Content-Disposition` carrying no `filename` no longer throws mid-download (the browser derives a name), a quoted-string filename is unquoted and unescaped rather than saved with its quotes, and a trailing extended parameter is no longer folded into the name. Server-side, both emitters now write the filename as an RFC 6266 quoted-string with `"` and `\` escaped, so a name containing spaces, `;` or `,` produces a conformant header instead of a bare token an intermediary may truncate. (#B290, #B297)
-- **Fixed — `gina.setOptions()` writes the config the framework actually reads.** It merged into an orphan object nothing ever read, and was therefore silently ignored for every key since it shipped — the documented `loadingAttribute` rename could not work. It now merges into the exposed `gina.config` in place, with override semantics. **Action:** anything your project was already passing and silently having ignored **will now take effect** — review those calls. The `data-gina-config` script-tag attribute, documented alongside the rename but parsed by nothing, is no longer documented. (#B305)
-- **Fixed — the dev Inspector's standalone window reports its source mode.** The footer badge naming where the window's data comes from never appeared for a window opened from a `?target=` URL, because it was painted only from the data-poll timer that standalone mode deliberately never starts. The same mode did show when the window was reached through the connect form, so the badge's presence depended on how the Inspector had been opened rather than on the mode it was in. Polling is still not started there, deliberately. (#B306)
-- **Fixed — the documented SQLite and DuckDB default database path.** The connector JSDoc and the `connectors.json` schema described the default as version-segmented; the framework resolves the gina home without a version segment, so the documented default now matches the real path. Documentation only — behaviour is unchanged. (#B317)
-- **Fixed — `npm test` runs the suite.** The script pointed at a glob matching no files: 0 tests, exit 0 — a silent green that could pass for a healthy run. It now runs the full suite CI gates on, with `package.json` as the single source of truth for that file list. Adds `npm run test:coverage`, and a `pretest:e2e` step that installs the matching Chromium build so `npm run test:e2e` works from a clean checkout.
-- **Fixed — an unreachable log host no longer stalls gina processes.** With the default `mq` log flow configured and the host unreachable — a powered-off peer, a firewalled segment, a stale `host_v4` after a DHCP reassignment — any fresh gina process, a bare `require()` of framework code included, hung for the OS connect timeout (~75 seconds on macOS) before doing anything. A *refused* connection was always fine; it was the host that answers nothing at all that held the process open, because a still-pending dial is a live request even on an unref'd socket. The dial now carries its own bounded deadline and degrades through the same error path as a refusal — logging stays best-effort, never load-bearing. This fix is server-side: a restart delivers it, no re-bake needed. (#B318)
-- **Fixed — a refused submit keeps its error message visible.** Both refused-submit answers — the gated-trigger reveal and an enabled trigger's failed validation — render the first invalid field's message and then focus that field, and that focus re-engaged the live-check suppression that hides a message while its field is being edited: the answer was clipped to a screen-reader-only state the instant it appeared, so a refused submit looked like a dead click to sighted users. The framework's own answer focus is now exempt, one-shot; the first later keystroke re-engages the mid-typing suppression unchanged, as does clicking into an errored field yourself. Pre-existing — reproduced back to `0.6.4`. (#B319)
+**Two items may need action before you upgrade:** cross-host log shipping via
+`host_v4` no longer reaches the log transports, and popin subscribers that
+worked around the `success` event by listening on `error` should move back. Both
+are called out below and in the [migration guide](https://gina.io/docs/migration).
+
+- **Fixed — a slow boot no longer silences a bundle's logging.** `0.6.5` added a two-second deadline so an unreachable log host could not stall a process. That deadline asked the socket whether it was still connecting — but Node clears that flag in the event loop's *poll* phase, and timers run *before* poll. So a boot that blocked the loop past the deadline resumed, ran the overdue deadline first, read a flag nothing had updated yet, and destroyed a connection the kernel had already established. Because the transport dialled exactly once, the bundle then logged nowhere for the rest of its life, with no error after the first. The deadline now reaches its verdict one phase later; a genuinely unreachable host is still given up on just as promptly.
+- **Added — the log transport reconnects.** Previously anything that ended the connection was permanent: a daemon restart under a live bundle orphaned its transport forever, and in a cluster that is a matter of when — liveness probes, out-of-memory kills, node drains. It now redials when the connection closes, backing off exponentially to a 30-second ceiling and logging a `reconnected` notice when it recovers. A failure is reported once per outage rather than once per attempt. Short-lived CLI processes still exit immediately, and frames emitted while the transport is down are dropped rather than queued, so a long outage cannot grow memory — the `default` flow still carries those lines to stdout.
+- **Fixed — log transports always deliver to the local daemon.** The MQ speaker and the file log container dialled `host_v4` verbatim, but their listener runs on the same machine by construction, while `host_v4` describes the address *external* clients use. On a `~/.gina` shared across hosts — where every host rewrites `settings.json` at boot — or after a stale address was left behind, every runtime log line was silently shipped off-host while all connection lines read healthy. Both now resolve their dial from the bind side only. **Action required only if** you deliberately pointed `host_v4` at a remote machine to ship logs cross-host; that was never a supported topology and no longer affects these two transports. `gina tail` and the CLI command socket keep their remote-capable resolution.
+- **Fixed — the popin `success` event fires again.** A popin whose JSON response carried neither a redirect nor a reload raised `error` with an HTTP 422 instead — and because the error branch replaces its payload with the parsed response body, that 422 carried the successful response itself, reading as a server-side failure that had never happened. Subscribers to `success` received nothing at all. **If you worked around this by listening on `error` and inspecting its payload, move that handler to `success`.**
+- **Fixed — a link request belongs to the anchor you clicked.** Two `data-gina-link` anchors sharing one url collapsed onto whichever appeared first in the document: clicking the second armed the *first* one's loading state, read the first one's callback attributes, and fired the first one's events. The clicked anchor now owns all of it, on both dispatch paths — a direct click, and a click on a nested child element. The programmatic `gina.link.request(url)` call keeps resolving the first registration matching the url, since a bare url is all it has.
+- **Fixed — constructing the link handler twice no longer corrupts the first one.** A second construction merged itself into the live published `gina.link`, freezing accessors and scalar state — the shape the popin and nav plugins were already cured of. The first activated instance is now published once. Pages constructing a single handler, the common case, are unaffected.
 
 ## Documentation
 

package/ROADMAP.md

@@ -57,6 +57,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.3` ✅ | **Security**: the client-served routing map (`/_gina/assets/routing.json`) is now built from an ALLOWLIST instead of a denylist — controller dispatch keys (`param.control`/`file`/`path`/`title`), `namespace`, `scopes`, `cache` configuration including invalidation event names, `csrfExempt`, `middlewareIgnored` and `validator::` requirement bodies all stay server-side, and structurally so does every future route key until deliberately added to the roster; client URL building is unaffected, but code reading other keys off `gina.config.routing` must move server-side · **Added**: opt-in SPA-style client-side navigation — a route declares `negotiate: true` and answers `X-Gina-Navigate: fragment` layoutlessly over the same URL, while the new `gina/nav` module swaps same-origin link targets into a `data-gina-nav` region with history, scroll, focus, title, script re-injection and validator rebinding, falling back to a full-page navigation on every uncertainty; negotiable routes advertise `Vary: X-Gina-Navigate` and opt out of the render cache (#SPA1) · a configurable RFC 9211 `Cache-Status` identifier (`server.cache.name`), with a boot warn naming the residual framework disclosure when `hidePoweredBy` is set (#B238) · a Couchbase SDK soak harness that screens a candidate SDK in a fully isolated throwaway project before a consuming project adopts it (#CN12) · **Changed**: `/_gina/assets/routing.json` now revalidates on each page boot (per-variant weak `ETag` + `no-cache`, was `max-age=86400`), so a restart's new route table reaches returning browsers immediately instead of up to 24 hours later · the dormant transitive `object-assign` dependency overridden to a maintained re-export (gina's own tree only — `overrides` are root-manifest-scoped; the consumer-reaching fix is upstream) · **Fixed**: server-side form-body validation now enforces rules authored on bracket-notation (`account[username]`) and nested keys — previously skipped silently, fail-open, for checks, `exclude` and transforms alike (#B241) · the validator's empty-value contract made uniform: five loose-equality sites let `0`, `false` and `[]` ride the empty bypass so `isEmail`/`isJsonWebToken`/`isFloat` reported them VALID outright, and `is`/`isBoolean` joined the same contract (#B233, #B235) · `isBoolean` is now the single adjudicator on every surface — server auto-validation coerced junk to `false` and persisted it — and `isInteger` digit bounds enforce on real numbers, not only strings (#B236) · a `$` token in a rule no longer crashes the validation pass on either surface (#B234, #B239) · required radio groups now gate, and the submit trigger re-enables on a pick (#B221, #B228) · a field driving its own `_case_` block is validated and keeps the value the user picked (#B229, #B230) · a rejected submit no longer kills a form's live check for the rest of the page's life · the documented `setFlash` `[null, "message"]` form works in the browser (#B226) · `pauseRequest()`/`resumeRequest()` replay the byte-exact halted URL, query string included, on both engines (#B215, #B219) · `Controller.store()` publishes each file atomically and surfaces the real filesystem error instead of a fabricated `No file to upload`, where a source-stream error previously killed the bundle process (#B223) · custom error pages answer with their real HTTP status and keep their resolved template instead of falling back to the failing route's own file (#B190) · session stores no longer write an immortal record for an already-expired session (redis wrote an expiry-less SET; couchbase and scylladb stored a never-expires zero expiry) · a Couchbase N1QL parameter the SDK cannot serialize no longer aborts the whole bundle process (#B243), and range SDK pins like `~4.5.0` resolve instead of mangling past the version floor · `lib/math` `checkSumSync` — every array collapsed to the empty-string checksum, data ending in an extension shape was misrouted to the filesystem, and real file paths were hashed as path strings (#B208, #B209, #B210) · `GINA_*` environment variables are visible to the CLI's own bootstrap, the MQ and file logger containers, the MCP bind tier and `${secret:}` resolution · the client routing map serves under every engine, and a non-2xx boot fetch is no longer installed as the client routing table (#B212, #B213) · Inspector bundle-following across a proxy-routed project, per-tab restore, advertised-channel adoption and six scope/display fixes (#B205, #B222, #B225, #B231, #B237) · `bundle:openapi`/`bundle:mcp` no longer drop three declared bound forms when un-collapsing a `validator::{}` requirement · a sub-directory in the run directory no longer aborts every gina command · the scaffolded bundle template's impossible session-store selection (`expressSession.name = 'myRedis'` silently no-ops) |
 | **Q4 2026** | `0.6.4` ✅ | **Added**: a framework-owned loading state for busy controls — clicking a submit trigger, a `data-gina-link` anchor or a popin trigger sets `data-gina-loading="true"` on that control and flips it to `"false"` when the work settles, errors, times out, aborts or is rejected by validation (the case that stranded the state on forever, since a refused submit sends no request at all), with a shipped default look gated on `prefers-reduced-motion` and an opt-in attribute rename (#B247) · `gina.config.a11y` overrides for the status strings gina announces on its own behalf · an opt-in `secrets.file` layer resolving `${secret:KEY}` from `.env`-style files **beneath** the environment, so a non-empty environment value can never be shadowed by a stale file on disk, with later array entries winning, empty-value fall-through warning, and fail-closed resolution · **Security**: secret-file ignore rules now match by glob (`.env`, `.env.*`, `*.env`) in both the repository and published-package ignore lists, where the previous exact `.env` entry left `secrets.env` or `db.env` committable and publishable by default · **Fixed**: a submit trigger disabled by live validation was inert in appearance only and still ran the whole submit cycle when clicked (#B246) · a form's first validation error was the one least likely to be heard, because the polite live region was created, inserted and written in a single synchronous step · submitting a form dropped the keyboard user's focus to the document body, and nothing told assistive technology a submit was under way · validation messages kept `aria-invalid` asserted while `display: none` removed the message from the accessibility tree, and the first-invalid focus loop could stop on a control that never actually took focus · staged uploads gained progressbar semantics with the value dropped rather than zeroed while indeterminate, spoken start/complete/error, an operable reset control, and preview `alt` text taken from the user's own filename · a popin opened over another left the superseded one reachable in the tab order behind it · built-in error pages emitted no doctype, head, title or `lang` and never terminated the document on HTTP/1.1, and the `lang` gina emits is now normalised to BCP-47 · the link plugin reused one `XMLHttpRequest` for every click, so a second click aborted the first and its response vanished in total silence · `gina secrets:check` reported `UNSET` for keys a bundle would have started with once `secrets.file` was declared, and could not resolve version- or scope-templated paths (#B263, #B266) · a declared secrets file that exists but cannot be read was mistaken for an absent one, so a bundle booted healthily on the wrong credential (#B267) · an environment variable that is set but empty now warns as it falls through to the file (#B268) · a trailing `#` comment was read as part of the secret, diverging from the POSIX shell that sources the same file · requiring gina outside a bundle context hung the process instead of failing cleanly, because the logger's MQ socket kept the event loop alive (#B276, #B277) · a bundle starting in an undeclared environment could lose its refusal message to a truncated pipe (#B278) · a gina command died mid-run when an MQ speaker disconnected abruptly, leaving a half-created bundle (#B279) |
 | **Q4 2026** | `0.6.5` ✅ | **Fixed**: the silent-dead-control release — a family of defects where a control looked completely normal and did nothing at all. A submit trigger disabled by your own double-submit guard during the click (a `0.6.4` regression), a submit button whose DOM node an AJAX update or popin re-render replaced, a form left blocked after its async uniqueness check came back clean, a popin close button given your own id or wrapping an icon, a `data-gina-link` given your own id, and a popin holding several forms releasing only every other one — all now work. Trusted gestures (Enter, wrapped-label clicks) respect the submit gate; `data-gina-link` stops swallowing `download`, `target`, `#`-fragment and modified clicks, and gains the disabled gate it never had; download filenames parse and serialize per RFC 6266; `gina.setOptions()` writes the config the framework reads, having been silently ignored since it shipped; `isRequired` accepts padded input and `trim` strips both sides · **Changed**: the not-ready submit-trigger state moves off `aria-disabled` onto the framework-owned `data-gina-form-submit-gated`, with a default look — the marker no longer claims a control is inoperable while gina deliberately answers its click |
+| **Q4 2026** | `0.6.6` ✅ | **Fixed**: the logging-transport release. A slow boot no longer silences a bundle's logging for the life of the process — a two-second connect deadline added in `0.6.5` read a socket flag Node clears one event-loop phase later, so any boot that blocked the loop past it destroyed a connection the kernel had already established (every container start and network-filesystem mount was exposed, and the transport never redialled). The MQ and file log transports also stopped dialling `host_v4`, which on a `~/.gina` shared across hosts silently shipped every log line off-host while all connection lines read healthy. Plus: the popin `success` event fires again instead of raising a 422 carrying the successful response body; a link request belongs to the anchor you clicked rather than the first anchor sharing its url; and constructing the link handler twice no longer corrupts the first instance · **Added**: the log transport reconnects — exponential backoff to a 30-second ceiling, one report per outage, frames dropped rather than queued while down so an outage cannot grow memory |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |

package/framework/v0.6.6/VERSION

@@ -0,0 +1 @@
+0.6.6

package/framework/{v0.6.5 → v0.6.6}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -9782,6 +9782,21 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
         var _linkXhr = null;
         var _linkSeq = 0;
 
+        /**
+         * #B287 — the registration the user actually operated, handed from the
+         * dispatch listener in `registerLink` to `linkRequest` so that anchors
+         * sharing one url resolve to the anchor that was clicked rather than to
+         * the first registration whose url matches. Both click paths — the
+         * direct anchor listener and `proxyClick`'s child delegation — dispatch
+         * into that same listener, so this single hand-off covers both.
+         * Consumed (and cleared) at `linkRequest` entry, before anything else
+         * runs, so an early exit can never leak it into a later call; the
+         * public `gina.link.request(url)` path never sets it and keeps the
+         * historical first-match lookup.
+         * @type {object|null}
+         */
+        var _operatedLink = null;
+
         /**
          * Build a fresh transport for a single request.
          *
@@ -9947,6 +9962,12 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
          * rather than in the click handlers: `$el` is already the anchor at this point,
          * so no click target ever has to be walked back up to it.
          *
+         * The link object resolves in two steps (#B287): the operated registration
+         * handed off by the dispatch listener wins; only when none was handed off —
+         * the public `gina.link.request(url)` path — does the historical first-match
+         * url lookup run. Before this order existed, two anchors sharing one url
+         * collapsed onto whichever registered first, whichever was clicked.
+         *
          * Side effects: supersedes any request still in flight, arms `data-gina-loading`
          * on the anchor for the duration of this one, and releases it from a `loadend`
          * listener. An indefinite hang is the single outcome that never releases, because
@@ -9964,6 +9985,11 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
          * */
         function linkRequest(url, options) {
 
+            // #B287 — consume the operated registration FIRST so no later step
+            // (nor an early exit) can leak it into a subsequent call.
+            var $operated = _operatedLink;
+            _operatedLink = null;
+
             // One transport per request, and a sequence taken BEFORE the abort so a
             // supersede-abort is stale by construction — its handler sees
             // `seq !== _linkSeq` and drops out, which is what keeps the abort from
@@ -9977,8 +10003,9 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
             var xhr = createXhr();
             _linkXhr = xhr;
 
-            // link object
-            var $link      = getLinkByUrl(url);
+            // link object — #B287: the operated registration wins; the first-match
+            // url lookup remains only for the public `gina.link.request(url)` path.
+            var $link      = $operated || getLinkByUrl(url);
             var id         = $link.id;
 
 
@@ -10195,6 +10222,7 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
                             $localLink.options.withCredentials = false
                         }
 
+                        _operatedLink = $localLink; // #B287 — hand the operated registration to linkRequest
                         linkRequest(localUrl, $localLink.options);
 
                         //delete gina.events[ $localLink.id ];
@@ -10387,14 +10415,24 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
                 // for proxies, use linkInstance.id as target is always `document`
                 addListener(gina, instance.target, evt, function(event) {
 
-                    // A modified click belongs to the browser. Bail before the id backfill
-                    // below, so deferring leaves no trace on the element either.
+                    // A modified click — cmd/ctrl/shift/alt — belongs to the browser (#B288),
+                    // so it bails first and nothing below can cancel the event or dispatch for
+                    // it. This bail used to carry a second justification, "before the id
+                    // backfill below, so deferring leaves no trace on the element either";
+                    // that backfill was dead code and is gone (#B324), so only the primary
+                    // reason remains.
                     if ( isModifiedClick(event) ) return;
 
-                    if ( typeof(event.target.id) == 'undefined' ) {
-                        event.target.setAttribute('id', evt +'.'+ uuid() );
-                        event.target.id = event.target.getAttribute('id')
-                    }
+                    // #B324: an id-backfill block used to sit here, gated on
+                    // `typeof(event.target.id) == 'undefined'`. An element's `id` IDL attribute
+                    // always exists (defaulting to ''), so the gate was never true and the block
+                    // never ran — the popin plugin carried the identical dead pair, removed as
+                    // #B300. Removed rather than "corrected": `instance.target` is `document`
+                    // (see the note above) and `evt` is the literal 'click', so a live body
+                    // would write `id="click.<uuid>"` onto EVERY id-less element clicked
+                    // anywhere in the page; and since #B302 the dispatch below keys on
+                    // `instance.$links[…]` — registration, not the id's SHAPE — so such an id is
+                    // absent from `$links` and dispatches nothing. Pollution for zero gain.
 
 
 
@@ -10434,7 +10472,12 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
 
                 instance.isReady = true;
                 gina.hasLinkHandler = true;
-                gina.link = merge(gina.link, instance);
+                // #B326 — publish ONCE: `gina.link` IS the first activated
+                // instance (a LIVE object); later constructions have nothing
+                // to publish, and re-merging would freeze accessors/state (#B90).
+                if ( typeof(gina.link) == 'undefined' || !gina.link ) {
+                    gina.link = instance;
+                }
                 // trigger link ready event
                 triggerEvent(gina, instance.target, 'ready.' + instance.id, instance);
             });
@@ -22853,10 +22896,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                     return false;
                 }
 
-                if ( typeof(event.target.id) == 'undefined' ) {
-                    event.target.setAttribute('id', evt +'.'+ _nextId() );
-                    event.target.id = event.target.getAttribute('id')
-                }
+                // #B300: an id-stamping block used to sit here, gated on
+                // `typeof(event.target.id) == 'undefined'`. An element's `id` IDL attribute
+                // always exists (it defaults to ''), so the gate was never true and the block
+                // never ran. Removed rather than "corrected": making it run would stamp
+                // `click.<n>` — this proxy's own `evt` — onto EVERY id-less element clicked
+                // anywhere in the document, an id matching neither prefix tested below.
 
                 if ( /^popin\.close\./.test(event.target.id) ) {
                     cancelEvent(event);
@@ -22972,10 +23017,14 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                         //console.debug('This is an action ', event.target);
                     }*/ else { // close
 
-                        if ( typeof(event.target.id) == 'undefined' ) {
-                            event.target.setAttribute('id', evt +'.'+ _nextId() );
-                            event.target.id = event.target.getAttribute('id')
-                        }
+                        // #B300: an id-stamping block used to sit here, gated on
+                        // `typeof(event.target.id) == 'undefined'` — never true, since an
+                        // element's `id` IDL attribute always exists (defaulting to ''), so it
+                        // never ran. Removed rather than "corrected": making it run would
+                        // rewrite the clicked node's id to `evt + '.' + _nextId()`, which is
+                        // exactly what the note below forbids — the `$close` teardown sweep
+                        // finds this listener via `gina.events[eId] == eId`, i.e. it depends on
+                        // the element id and the event name being the SAME string.
 
                         // #B299/#B301: reaching this branch ALREADY proves the element is a
                         // `.gina-popin-close` — register('close', …) has a single call site, fed
@@ -23259,13 +23308,15 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 i = 0; len = $forms.length;
                 for(; i < len; ++i) {
 
-                    if ( !$forms[i]['id'] || typeof($forms[i]) != 'string' ) {
-                        _id = $forms[i].getAttribute('id') || 'form.' + _nextId();
-                        $forms[i].setAttribute('id', _id);// just in case
-                        $forms[i]['id'] = _id
-                    } else {
-                        _id = $forms[i]['id']
-                    }
+                    // #B300: this was gated on
+                    // `!$forms[i]['id'] || typeof($forms[i]) != 'string'`, whose second clause
+                    // tested the form ELEMENT rather than its id — always true for an object —
+                    // so the guard was always true and its `else` (`_id = $forms[i]['id']`)
+                    // unreachable. Behaviour is unchanged by removing it: for a form that
+                    // already carries an id, `getAttribute('id')` returns that same id.
+                    _id = $forms[i].getAttribute('id') || 'form.' + _nextId();
+                    $forms[i].setAttribute('id', _id);// just in case
+                    $forms[i]['id'] = _id
 
                     //console.debug('pushing ', _id, $forms[i]['id'], typeof($forms[i]['id']), $forms[i].getAttribute('id'));
                     if ($popin['$forms'].indexOf(_id) < 0)
@@ -23895,7 +23946,15 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                                     if (GINA_ENV_IS_DEV)
                                             updateToolbar(result);
 
-                                    triggerEvent(gina, $forms[0], 'success.' + id, result);
+                                    // #B315 — this used to dispatch on `$forms[0]`, a free variable:
+                                    // `$forms` is declared only in `popinBind` (a sibling function), so
+                                    // reading it here threw ReferenceError into the catch below, which
+                                    // converted every successful JSON load into `error.<id>` with a 422.
+                                    // `success` therefore never fired. Dispatching on `$el` matches the
+                                    // two sibling triggers in this same handler (`loaded.` and `error.`)
+                                    // — and popinLoad is the CONTENT loader, so a JSON response need not
+                                    // involve a form at all.
+                                    triggerEvent(gina, $el, 'success.' + id, result);
 
                                 }