gina 0.6.6 → 0.6.7

package/CHANGELOG.md

@@ -6,6 +6,32 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.7 - 2026-08-13
+### Added
+* Pluggable object storage. A storage block in settings.json declares named drivers (an adapter crossed with a strategy), and gina.storage() returns one. The local adapter with the sharded strategy stores every object atomically under a date-and-ULID key — as a published file, or inline in the metadata store when the object is smaller than the driver's size-tiering threshold — and records its metadata (original name, content type, size) through a pluggable store seam - an embedded SQLite file by default, or a connectors.json entry when several processes share one root. Storage keys are opaque, so a later layout change cannot break stored references. A driver root that sits inside a web-served directory refuses the boot, since objects there would be publicly fetchable.
+* Upload groups can now route their self.store() step through the storage layer (#STO1 slice 1): a settings.json upload.groups.<name>.driver key publishes that group's files through the named settings.storage driver — result entries carry an opaque storage key plus group, driver and the layer's measured size instead of a moved-file path, one call may mix routed and moved files (result slots stay 1:1 with the input), and target may be null when every file routes. Files in groups without a driver keep the historical move path byte-for-byte. Boot refuses a group naming an undefined driver; a group path beside a driver stays the parse-time staging dir (a path inside the driver's root earns a boot warning).
+* Size tiering for the storage layer. Objects strictly under a driver's inlineThreshold (a unit-suffixed string, default "64KB"; "0B" disables it per driver) are stored inline in the metadata store in a single transaction instead of the file tree — measured 2.7-13x faster than per-file writes at and below the default threshold. Keys keep the same shape in both tiers, stat() and release() behave identically, resolve() answers {kind:'inline'} for tiered objects, and capabilities.inline says whether a driver tiers. Changing the threshold affects only new writes: existing objects stay readable on either side, and a metadata database created before tiering is migrated in place. Two tradeoffs to know: sub-threshold objects are not individually visible on disk, and the metadata store now carries their bytes — losing it loses those objects, so back it up with the driver root (the embedded database already lives inside it).
+* The cas storage strategy (#STO1). A driver declaring strategy: "cas" stores objects by content address: the key is derived from the object's digest (blobs/<algo>/<aa>/<bb>/<hex>, deliberately extension-less), so identical bytes stored twice yield the SAME key with a reference count of 2 and no second copy on disk — put() results carry a deduplicated flag saying which happened. release() drops a reference instead of deleting: a periodic sweep (sweepInterval, default "15m") collects blobs that have sat at zero references for longer than a grace window (sweepGrace, default "1h"), so re-uploading just-released content is free. findByDigest(algo, hex) answers whether content is already stored without transferring it — capability-gated (capabilities.dedup) and shipped as a driver verb only, because it is a dedup oracle: exposing it over HTTP is the consumer's decision and authentication burden. The digest algorithm is per-driver config (hash, default "sha256", validated at boot against the runtime's own crypto — sha256/sha512 exist on both supported runtimes, blake2b512 is Node-only), and since its name is a path segment, changing it later is additive rather than a re-key; changing a driver's STRATEGY on populated storage remains a re-key migration, and the boot now stamps every driver root with its strategy and warns on mismatch — for sharded drivers too. cas publishes fsync by default (fsync: true — the temp file before the atomic rename, the parent directory best-effort after; the first fsync anywhere in gina), because the strategy exists for immutable content where an acknowledged write must survive power loss; sharded durability is unchanged. Size tiering applies under cas exactly as under sharded. The metadata-store seam gains four refcount verbs the embedded store implements (existing databases migrate in place, idempotently); a connector-backed store must implement them to serve a cas driver.
+* Storage maintenance CLI and endpoints (#STO1): gina storage:stats, storage:gc (--dry-run) and storage:verify (--fix) work per bundle with the cache-command grammar. A RUNNING bundle is served by new always-on, admin-gated /_gina/storage/stats|gc|verify endpoints, so the process that owns the store does the work; a STOPPED bundle is resolved offline from its settings.storage and the real driver is built directly; a bundle that answers neither way (e.g. a timeout) is reported as unknown and its store is never opened. storage:gc drives the cas sweep until drained (--dry-run lists what a pass would collect and touches nothing); storage:verify reports files-without-rows (sweep crash residue — fixable with --fix, offline only) and rows-without-files (loss evidence — reported, never auto-fixed), both age-gated past sweepGrace so in-flight work is never flagged. Drivers gain stats() on both strategies and sweepNow()/verify() on cas; the metadata-store seam gains optional stats and listKeys verbs (a store lacking them degrades gracefully). Connector-backed stores are reachable through the running bundle only; sharded drivers have no sweep and are named and skipped.
+### Changed
+* Framework default styling for the state-hook attributes now ships inside a CSS cascade layer (`@layer gina`): the default looks for `data-gina-loading` and `data-gina-form-submit-gated` are overridden by any un-layered project rule regardless of selector specificity or stylesheet load order, so a project's own CSS always wins without `!important` or specificity games. Functional rules (popin structure, scroll lock) deliberately stay un-layered so generic project resets cannot break them. Browsers without cascade-layer support drop only the default look — the attributes are still written and project CSS keyed on them still applies.
+### Fixed
+* The bundle settings template no longer advertises upload keys the runtime never reads — the per-group filePrefix/subFolder/maxFieldsSize samples and the block-level encoding key are retired and the misleading per-group-redefinability comments corrected — and schema/settings.json now declares the real upload key set at both block and group level, including the new per-group driver binding (#B224).
+* req.files entries now carry the resolved upload group — untagged when the part had no group tag — instead of an undefined group field (#B140), matching what the group gate enforces and what self.store() routes on. A controller testing the field's truthiness now enters the branch for untagged files.
+* FormValidator: a submit can no longer go out while an async `query` rule's verdict is still on the wire (#B332). A concurrent validation pass used to disarm the whole pass's async waiter when the field's `asyncCompleted` listener was already registered, completing on the sync-only verdict — `send()` fired before the query answered and the error rendered after the POST had left. The arm guard is pass-local now, waiters stack and self-detach per pass, and the engine marks each (field, value) request in flight (`ginaFormValidatorQueryPending`) so the same-value fast path never releases a verdict-less field while its request is pending. A failing query now blocks the submit entirely; the submit handler also refuses re-entry while a cycle is between click and settle.
+* FormValidator: a submit trigger without a markup id was bound TWICE at page load, so every click ran two full validation cycles (#B333). `getOwnedElements` deduped collected controls by id — an id-less control entered once from `$form.elements` and again from the in-tree sweep (gina assigns the auto id only later, in the submit-binding loop) — and the rebind guard tested a registry key nothing writes (the bare button id, while `bindSubmitEl` registers `submit.<id>`). Collection is deduped by node identity now and the guard tests the key that actually gets registered. Id-carrying and form-reassociated controls are unaffected.
+* FormValidator: every validation pass used to leave its `validated.<formId>` listener attached for the page's lifetime (the removal call carried no function reference, which detaches nothing), and each stale listener executed the DISPATCHING pass's callback — one completion dispatch could replay a submit once per leftover listener (#B334). The listener now registers only when the pass carries a callback, consumes only its own pass's dispatch (callback identity on `event.detail`), and detaches itself on consumption. Async query completions also dispatch on the node the pass's listener actually sits on, so a single-element live-check pass is no longer structurally deaf to its own completion.
+* FormValidator: when an async `query` rule settles on a full-form submit, the completion payload now carries the WHOLE form's verdict instead of the query field's slice (#B337). Every other invalid field's error was adjudicated but never rendered on the submit path, and the first-invalid focus could only ever land on the query field; the inverse scene — query passes but another field is invalid — dispatched an empty error set and refused the submit silently. Single-element live-check passes are byte-equivalent (their validator instance holds one field), and the touched-field-only live-check display keeps its scope.
+* getConfig().settings now carries the same substituted values as getConfig().content.settings. A settings value written with a ${bundlePath}, ${libPath}, ${publicPath}, ${handlersPath}, ${mountPath}, ${gina}, ${project}, ${root}, ${source} or ${<name>Port} placeholder used to reach the no-argument getConfig() surface as a literal token, because that alias was bound before the substitution pass and the pass returns a new object rather than rewriting the original one. Placeholders an earlier pass already resolved (${homedir}, ${scope}, ...) and ${secret:...} references were never affected (#B257).
+* FormValidator: the engine's two synchronous `query` releases — the same-value cached verdict and the known-invalid wire skip — now fire through a microtask instead of mid-validation (#B338). A synchronous release completed the pass before fields declared after the query field were adjudicated, so a re-click on an unchanged value delivered a verdict missing those fields and CLEARED their rendered errors; the outcome depended on field declaration order. Every completion now takes the same post-pass shape a real network settle already had.
+* Inspector Data tab no longer lists the framework-internal `__ginaFlow` and `__ginaQueries` transport keys. They are embedded in JSON responses in dev mode only, so a calling bundle can merge the upstream query log and timeline, and they are already shown first-class by the Query and Flow tabs — but they also appeared as top-level rows in the Data tree, in raw-JSON mode and in the download dialog. Any root key prefixed `__gina` is now hidden across every Data tab surface, including the payload size badge, which measures what the tab actually displays. Nested keys carrying the prefix are treated as application data and stay visible, and the response body on the wire is unchanged.
+* A clean form whose async `query` rule sat on a field declared before the last one could never complete its submit: the async completion dispatched only when the query field was last in the rule set or when live-check was mid-validation, so the submit callback starved, no request ever left, and the form's re-entry latch stranded — silently swallowing every later click until the page was reloaded. A latched form's completion now dispatches unconditionally. This hole predates the recent submit-vs-query collision fixes and was masked by them: the duplicate validation pass they removed used to complete such submits prematurely, before the query verdict had arrived.
+* The dev Inspector's Forms tab rendered the bundle's whole forms catalog (the walked forms/ directory groups — rules, mocks, validators) as pseudo-form sections above the page's real forms (#B343). Catalog groups are now demoted into a single collapsed "Bundle catalog" card at the bottom of the tab: page forms keep the prime space, each group stays inspectable inside the card with its fold state preserved, and runtime form state that outlived its DOM form (a closed popin's form) keeps its own card. When the payload carries no pristine catalog snapshot the tab falls back to the previous per-key rendering, so nothing is ever hidden.
+* The `is` rule's security strip removed every `(`, `)` and literal `return` from a regex-literal condition BEFORE compiling it, silently changing what the pattern matched (#B345, issue #59): groups were destroyed and anchors rebound — `/^(a|b)$/` validated as `/^a|b$/`, substring-permissive for middle alternatives — and a quantified group like `(#TAG)?` became a literal `#TA` plus an optional `G`. The strip now runs only inside the binary-comparison branch, which keeps its grammar-locked protection and its tolerance of authored parens, while a regex literal compiles exactly as authored (that branch never evaluates the condition as JS, so parentheses there were never an injection vector). ACTION REQUIRED: parenthesized `is` patterns now match as authored, i.e. STRICTER — a rule such as `/^(a|b)$/` that previously accepted `aX` or `Xb` now rejects them; review `is` rules containing parentheses for values that were passing only through the mangled pattern. Patterns without parentheses are unaffected.
+* A submit click landing while a field's live-check `query` was still on the wire was silently swallowed (#B346): with live-check enabled the submit trigger is gated while the form is not yet valid, and a pending verdict was misread as invalid — the refused click had nothing to reveal, no request left, and the user had to click again after the round trip (the dead window scales with query latency, not typing speed). The gate now recognizes the pending state: the click starts a normal submit cycle that waits for the verdict — the loading state arms while it waits, a valid verdict sends exactly once after the settle, and a failing one renders the errors and releases the form. The same carve-out covers the other submit doors: a click landing on markup nested inside the button (`<button type="submit"><span>`) and a programmatic `submit()` during the pending window now latch, wait for the verdict, and complete instead of stalling silently — and the loading state arms on the waiting trigger for those doors too. Authored `aria-disabled`/`disabled` marks and forms where a settled field carries a committed error keep the existing refuse-and-reveal behaviour.
+### Security
+* Connector query instrumentation no longer discloses bound parameter values by default (gina-io/gina#61): the couchbase dev/instrumentation-window console line (`Found query params`), the per-connector dev console `params` lines, the mongodb resolved-body log line, the couchbase `bulkInsert` statement (which inlines full document values), and the Inspector query-log `params`/`statement` payload fields across couchbase, postgresql, mysql, sqlite, duckdb, scylladb and mongodb now carry count + type markers (e.g. `3 [string, number, string]`) instead of values. A positional bind array has no key names, so the key-based `inspector.redact` matching structurally cannot cover it, and a bind value is routinely a secret owned by the calling application (a session or credential token, an API key, a password hash). Real values ride only when `settings.inspector.queries.captureValues` is `true` (default `false`, fail-closed at boot) - the same opt-in contract as `inspector.ai.captureText` and `inspector.events.captureArgs`. Arity and type diagnostics survive in the redacted forms.
+
 ## 0.6.6 - 2026-08-09
 ### Added
 * The MQ log speaker now reconnects on its own. It previously dialled the listener exactly once, ever, so anything that ended that connection — a daemon restart, an OOM-killed listener, a container probe — left the bundle logging nowhere, with no error after the first and nothing in the logs to say so. It now redials when the connection closes, backing off exponentially to a 30 second ceiling, and logs a `reconnected` notice when it recovers; a failure is reported once per outage rather than once per attempt. The retry timer is unreferenced, so short-lived CLI processes still exit immediately instead of waiting out a backoff. Frames emitted while the transport is down are dropped rather than queued, which keeps memory bounded during a long outage — the `default` flow still carries those lines to stdout.

package/README.md

@@ -60,34 +60,37 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.6
-
-> **If you run gina in containers or Kubernetes, upgrade.** `0.6.5` shipped a
-> regression that could silence a bundle's logging permanently — for the whole
-> life of the process, with every startup line before it still reading healthy
-> (#B323, first below). Any deployment whose boot is slow enough to block the
-> event loop for two seconds — a container start, a mount off a network
-> filesystem — was exposed.
+## What's in 0.6.7
 
 > **Re-bake your bundles, not just restart them.** The browser bundle changed in
-> this release. The popin and link fixes below live in the bundle, so a restart
-> alone will not deliver them. Rebuild each bundle (`gina bundle:build`) as well
-> as restarting. The logging fixes are server-side and need only the restart.
+> this release. The form-validation, styling and link fixes below live in the
+> bundle, so a restart alone will not deliver them. Rebuild each bundle
+> (`gina bundle:build`) as well as restarting. The storage layer and the
+> instrumentation change are server-side and need only the restart.
 
-> **No settings reset.** `0.6.6` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.7` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**Two items may need action before you upgrade:** cross-host log shipping via
-`host_v4` no longer reaches the log transports, and popin subscribers that
-worked around the `success` event by listening on `error` should move back. Both
-are called out below and in the [migration guide](https://gina.io/docs/migration).
-
-- **Fixed — a slow boot no longer silences a bundle's logging.** `0.6.5` added a two-second deadline so an unreachable log host could not stall a process. That deadline asked the socket whether it was still connecting — but Node clears that flag in the event loop's *poll* phase, and timers run *before* poll. So a boot that blocked the loop past the deadline resumed, ran the overdue deadline first, read a flag nothing had updated yet, and destroyed a connection the kernel had already established. Because the transport dialled exactly once, the bundle then logged nowhere for the rest of its life, with no error after the first. The deadline now reaches its verdict one phase later; a genuinely unreachable host is still given up on just as promptly.
-- **Added — the log transport reconnects.** Previously anything that ended the connection was permanent: a daemon restart under a live bundle orphaned its transport forever, and in a cluster that is a matter of when — liveness probes, out-of-memory kills, node drains. It now redials when the connection closes, backing off exponentially to a 30-second ceiling and logging a `reconnected` notice when it recovers. A failure is reported once per outage rather than once per attempt. Short-lived CLI processes still exit immediately, and frames emitted while the transport is down are dropped rather than queued, so a long outage cannot grow memory — the `default` flow still carries those lines to stdout.
-- **Fixed — log transports always deliver to the local daemon.** The MQ speaker and the file log container dialled `host_v4` verbatim, but their listener runs on the same machine by construction, while `host_v4` describes the address *external* clients use. On a `~/.gina` shared across hosts — where every host rewrites `settings.json` at boot — or after a stale address was left behind, every runtime log line was silently shipped off-host while all connection lines read healthy. Both now resolve their dial from the bind side only. **Action required only if** you deliberately pointed `host_v4` at a remote machine to ship logs cross-host; that was never a supported topology and no longer affects these two transports. `gina tail` and the CLI command socket keep their remote-capable resolution.
-- **Fixed — the popin `success` event fires again.** A popin whose JSON response carried neither a redirect nor a reload raised `error` with an HTTP 422 instead — and because the error branch replaces its payload with the parsed response body, that 422 carried the successful response itself, reading as a server-side failure that had never happened. Subscribers to `success` received nothing at all. **If you worked around this by listening on `error` and inspecting its payload, move that handler to `success`.**
-- **Fixed — a link request belongs to the anchor you clicked.** Two `data-gina-link` anchors sharing one url collapsed onto whichever appeared first in the document: clicking the second armed the *first* one's loading state, read the first one's callback attributes, and fired the first one's events. The clicked anchor now owns all of it, on both dispatch paths — a direct click, and a click on a nested child element. The programmatic `gina.link.request(url)` call keeps resolving the first registration matching the url, since a bare url is all it has.
-- **Fixed — constructing the link handler twice no longer corrupts the first one.** A second construction merged itself into the live published `gina.link`, freezing accessors and scalar state — the shape the popin and nav plugins were already cured of. The first activated instance is now published once. Pages constructing a single handler, the common case, are unaffected.
+**One item requires action before you upgrade:** the `is` validation rule now
+compiles regex literals as authored, which makes any pattern containing
+parentheses *stricter* than it was. Two more may need a look — `req.files[].group`
+now reports `untagged` instead of `undefined`, and bound query parameter values
+are redacted from dev logs by default. All are called out below and in the
+[migration guide](https://gina.io/docs/migration).
+
+- **Added — pluggable object storage.** A new optional `storage` block in `settings.json` declares named drivers — an *adapter* (where bytes live) crossed with a *strategy* (how keys are laid out) — reachable from application code as `gina.storage()`. Objects are published atomically under an opaque key, with their metadata recorded through a pluggable store seam. A driver root that sits inside a web-served directory refuses the boot, since objects there would be publicly fetchable without passing your authorization. With no `storage` block the whole feature is inert. See the [storage guide](https://gina.io/docs/guides/storage).
+- **Added — content-addressed storage (`strategy: "cas"`).** Keys derived from the object's digest, so identical bytes stored twice yield the same key and no second copy — the blob gains a reference instead. `release()` drops a reference rather than deleting, and a grace-gated sweep reclaims blobs that have sat at zero. `findByDigest()` answers whether content is already stored without transferring it. cas publishes `fsync` by default, because the strategy exists for immutable content.
+- **Added — size tiering.** Objects strictly under a driver's `inlineThreshold` (default `"64KB"`, the measured knee) are stored inline in the metadata store in a single transaction rather than as individual files — 2.7–13× faster than per-file writes at and below the default. Keys, `stat()` and `release()` are identical in both tiers. Two tradeoffs worth knowing: sub-threshold objects are not individually browsable on disk, and the metadata store then carries their bytes. Set `"0B"` per driver to turn it off.
+- **Added — storage maintenance CLI.** `gina storage:stats`, `storage:gc` (`--dry-run`) and `storage:verify` (`--fix`) follow whoever owns the store: a running bundle answers through new always-on, admin-gated `/_gina/storage/*` endpoints, a stopped one is opened offline, and an unreachable one is never touched. `verify` separates fixable sweep residue from loss evidence, and never auto-fixes the latter.
+- **Added — upload groups can publish into a storage driver.** A `driver` key on an `upload` group routes that group's `self.store()` step through the named driver instead of moving files to the target directory. Entirely opt-in and per-group: groups without a `driver` keep the historical move path byte-for-byte. Routed entries come back with an opaque `key` and no `filename`.
+- **Security — bound query parameter values are redacted by default.** Dev-mode console query lines, the Couchbase `bulkInsert` statement, the MongoDB resolved body and the Inspector query log no longer print bound parameter values; they carry count and type markers instead (`3 [string, number, string]`). A bind value is routinely a secret owned by your application — a session or credential token, an API key, a password hash — and a positional bind array has no key names, so the key-based `inspector.redact` matching structurally could not cover it. **Set `inspector.queries.captureValues` to `true`** if your debugging workflow needs the real values back.
+- **Fixed — `is` regex literals compile as authored.** A security transform stripped every `(`, `)` and literal `return` from a regex-literal condition *before* compiling it, silently changing what the pattern matched: `/^(a|b)$/` behaved as `/^a|b$/`, accepting any value merely containing a middle alternative, and `(#TAG)?` became a literal `#TA` plus an optional `G`. The transform now applies only to the binary-comparison form, which keeps its grammar-locked protection. **Action required:** review `is` rules whose pattern contains parentheses — they now match as authored, i.e. stricter, so values that were passing only through the mangled pattern will start failing.
+- **Fixed — forms with an async `query` rule complete correctly.** A cluster of interacting defects, each of which masked the others: a submit could leave before the query answered (with its error rendering after the POST); the completion carried only the query field's verdict, so other invalid fields were adjudicated but never shown; a re-click on an unchanged value cleared later fields' errors, with the outcome depending on field declaration order; a clean form whose query field was not declared last could never submit at all, stranding its re-entry latch and swallowing every later click until reload; stale listeners could replay a submit; and a submit trigger with no markup `id` was bound twice, running two validation cycles per click. A submit gesture landing while a live-check query is still on the wire now waits for the verdict instead of being silently refused.
+- **Changed — framework default looks ship in a CSS cascade layer.** The defaults for `data-gina-loading` and `data-gina-form-submit-gated` now live inside `@layer gina`, so any un-layered project rule beats them regardless of specificity or load order — no `!important` needed. Functional rules (popin structure, scroll lock) deliberately stay un-layered so a generic project reset cannot break them. If your project organises its own CSS in layers, declare `@layer gina, app;` early to order yourself against gina explicitly.
+- **Fixed — `getConfig().settings` resolves path placeholders.** A settings value written with `${bundlePath}`, `${publicPath}`, `${gina}`, `${<name>Port}` and friends reached the no-argument `getConfig()` surface as a literal token, because that alias was bound before the substitution pass and the pass returns a new object. It now agrees with `getConfig().content.settings`. `${secret:…}` references were never affected.
+- **Fixed — `req.files[].group` carries the resolved upload group.** The parser always resolved each part's group — no tag resolves to `untagged` — but pushed the raw disposition parameter into the record, so the field was `undefined` in exactly the default case. **Code shaped like `if (file.group)` now enters the branch for untagged files** where it previously skipped them.
+- **Fixed — the settings template stopped advertising upload keys the framework never read.** The per-group `filePrefix`, `subFolder` and `maxFieldsSize` samples and the block-level `encoding` key were shipped as scaffolding samples and documented as functional, and no code path read any of them. They are retired from the template, the reference page is corrected, and `schema/settings.json` now declares the real key set. Applications declaring their own per-group keys and applying them app-side are unaffected.
+- **Fixed — the Inspector shows your data, not the framework's.** The Data tab no longer lists the `__ginaFlow` and `__ginaQueries` transport keys, which the Query and Flow tabs already present first-class; any root key prefixed `__gina` is hidden across every Data surface, while nested keys carrying the prefix stay visible as application data. The Forms tab demotes the bundle's forms catalog into a single collapsed **Bundle catalog** card at the bottom, so the page's real forms keep the prime space.
 
 ## Documentation
 

package/ROADMAP.md

@@ -58,6 +58,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.4` ✅ | **Added**: a framework-owned loading state for busy controls — clicking a submit trigger, a `data-gina-link` anchor or a popin trigger sets `data-gina-loading="true"` on that control and flips it to `"false"` when the work settles, errors, times out, aborts or is rejected by validation (the case that stranded the state on forever, since a refused submit sends no request at all), with a shipped default look gated on `prefers-reduced-motion` and an opt-in attribute rename (#B247) · `gina.config.a11y` overrides for the status strings gina announces on its own behalf · an opt-in `secrets.file` layer resolving `${secret:KEY}` from `.env`-style files **beneath** the environment, so a non-empty environment value can never be shadowed by a stale file on disk, with later array entries winning, empty-value fall-through warning, and fail-closed resolution · **Security**: secret-file ignore rules now match by glob (`.env`, `.env.*`, `*.env`) in both the repository and published-package ignore lists, where the previous exact `.env` entry left `secrets.env` or `db.env` committable and publishable by default · **Fixed**: a submit trigger disabled by live validation was inert in appearance only and still ran the whole submit cycle when clicked (#B246) · a form's first validation error was the one least likely to be heard, because the polite live region was created, inserted and written in a single synchronous step · submitting a form dropped the keyboard user's focus to the document body, and nothing told assistive technology a submit was under way · validation messages kept `aria-invalid` asserted while `display: none` removed the message from the accessibility tree, and the first-invalid focus loop could stop on a control that never actually took focus · staged uploads gained progressbar semantics with the value dropped rather than zeroed while indeterminate, spoken start/complete/error, an operable reset control, and preview `alt` text taken from the user's own filename · a popin opened over another left the superseded one reachable in the tab order behind it · built-in error pages emitted no doctype, head, title or `lang` and never terminated the document on HTTP/1.1, and the `lang` gina emits is now normalised to BCP-47 · the link plugin reused one `XMLHttpRequest` for every click, so a second click aborted the first and its response vanished in total silence · `gina secrets:check` reported `UNSET` for keys a bundle would have started with once `secrets.file` was declared, and could not resolve version- or scope-templated paths (#B263, #B266) · a declared secrets file that exists but cannot be read was mistaken for an absent one, so a bundle booted healthily on the wrong credential (#B267) · an environment variable that is set but empty now warns as it falls through to the file (#B268) · a trailing `#` comment was read as part of the secret, diverging from the POSIX shell that sources the same file · requiring gina outside a bundle context hung the process instead of failing cleanly, because the logger's MQ socket kept the event loop alive (#B276, #B277) · a bundle starting in an undeclared environment could lose its refusal message to a truncated pipe (#B278) · a gina command died mid-run when an MQ speaker disconnected abruptly, leaving a half-created bundle (#B279) |
 | **Q4 2026** | `0.6.5` ✅ | **Fixed**: the silent-dead-control release — a family of defects where a control looked completely normal and did nothing at all. A submit trigger disabled by your own double-submit guard during the click (a `0.6.4` regression), a submit button whose DOM node an AJAX update or popin re-render replaced, a form left blocked after its async uniqueness check came back clean, a popin close button given your own id or wrapping an icon, a `data-gina-link` given your own id, and a popin holding several forms releasing only every other one — all now work. Trusted gestures (Enter, wrapped-label clicks) respect the submit gate; `data-gina-link` stops swallowing `download`, `target`, `#`-fragment and modified clicks, and gains the disabled gate it never had; download filenames parse and serialize per RFC 6266; `gina.setOptions()` writes the config the framework reads, having been silently ignored since it shipped; `isRequired` accepts padded input and `trim` strips both sides · **Changed**: the not-ready submit-trigger state moves off `aria-disabled` onto the framework-owned `data-gina-form-submit-gated`, with a default look — the marker no longer claims a control is inoperable while gina deliberately answers its click |
 | **Q4 2026** | `0.6.6` ✅ | **Fixed**: the logging-transport release. A slow boot no longer silences a bundle's logging for the life of the process — a two-second connect deadline added in `0.6.5` read a socket flag Node clears one event-loop phase later, so any boot that blocked the loop past it destroyed a connection the kernel had already established (every container start and network-filesystem mount was exposed, and the transport never redialled). The MQ and file log transports also stopped dialling `host_v4`, which on a `~/.gina` shared across hosts silently shipped every log line off-host while all connection lines read healthy. Plus: the popin `success` event fires again instead of raising a 422 carrying the successful response body; a link request belongs to the anchor you clicked rather than the first anchor sharing its url; and constructing the link handler twice no longer corrupts the first instance · **Added**: the log transport reconnects — exponential backoff to a 30-second ceiling, one report per outage, frames dropped rather than queued while down so an outage cannot grow memory |
+| **Q4 2026** | `0.6.7` ✅ | **Added**: the object-storage release — a `storage` block declares named drivers (an adapter crossed with a strategy) reachable as `gina.storage()`, publishing objects atomically under opaque keys with their metadata written through a pluggable store seam; a content-addressed `cas` strategy deduplicates identical bytes behind a reference count, reclaiming them only after a grace-gated sweep; size tiering keeps sub-`64KB` objects inline in the metadata store, measurably faster than per-file writes; `storage:stats` / `storage:gc` / `storage:verify` operate a bundle's drivers whether it is running or stopped, through always-on admin-gated endpoints; and an upload group can route its `self.store()` step straight into a driver · **Security**: bound query parameter values no longer reach dev consoles or the Inspector query log — count and type markers replace them, with `inspector.queries.captureValues` to opt back in · **Fixed**: the `is` rule compiles regex literals as authored instead of stripping their parentheses (stricter — review patterns containing parens), forms with an async `query` rule complete correctly across a cluster of interacting defects (a submit leaving before the verdict landed, a completion carrying only the query field's slice, a re-click clearing later fields' errors, a clean form whose query field was not declared last never submitting at all, replayed submits from stale listeners, and an id-less trigger bound twice), `getConfig().settings` resolves path placeholders, `req.files[].group` reports the resolved group instead of `undefined`, and the Inspector's Data and Forms tabs stop putting framework-internal keys and the bundle catalog above your own data · **Changed**: framework default looks ship inside a `@layer gina` cascade layer, so any un-layered project rule overrides them without `!important` |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |
@@ -82,6 +83,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | ✅ | **Stale built-release watch** — For LOCAL production rehearsals. A bundle serving a built release under `local` scope + a non-dev env has no hot-reload, so after you edit source it silently keeps serving the stale build. Opt in via `server.releaseWatch` in `settings.json`: the bundle watches its SOURCE tree, compares fingerprints against the manifest release stamp, and surfaces staleness on `GET /_gina/release/status` and a live `GET /_gina/release/events` SSE stream (notify mode, the default) — or auto-rebuilds on change (opt-in `auto` mode). `POST /_gina/release/rebuild` rebuilds with an **idle-gated restart** that waits on in-flight HTTP requests and `gina.registerBusyProbe` application probes, so a restart never interrupts in-flight work. Hard-gated on `local` scope + a non-dev env — never active on a real cluster. | `0.5.18-alpha` | 2026-07-16 |
 | ✅ | **Popin eager preload** — Opt-in idle warming for AJAX popin content. Mark a trigger with `data-gina-dialog-preload="eager"` (case-insensitive) and the popin plugin fetches its content after `window` load, at browser idle — one trigger at a time, off the critical path — so opening feels instant with no second GET. Same safety gates as the hover/focus warm: the `"false"` opt-out and the disabled skip apply identically, and an eager warm and a hover warm coalesce into a single GET (whichever runs second is a no-op). The pass is skipped when the browser signals Save-Data. Default behavior is unchanged — hover/focus warm remains the default. | `0.5.21-alpha` | 2026-07-19 |
 | ✅ | **Upload progress + drag-and-drop** — Extend the `data-gina-form-upload-*` staged client layer with transfer progress and drop-target support. **Progress shipped** (`0.5.24-alpha.2`): the staging POST reports real upload progress (`xhr.upload.onprogress`) through the registered `uploadProgress.<id>` client event, a `data-gina-form-upload-on-progress` window callback, and a declarative indicator (`data-gina-form-upload-progress`, default `<fieldId>-progress`) with a fully managed lifecycle. **Drag-and-drop shipped** (`0.5.24-alpha.2`): an attribute-marked dropzone (`data-gina-form-upload-dropzone="<elementId>"`, explicit id, opt-in) accepting dropped files through the exact same staging pipeline as the native file input — group tagging, previews, hidden metadata fields, reset/delete and upload progress included — with `idle`/`over`/`dropped` CSS state hooks, file-drags-only reaction, and first-file truncation on single-file inputs. Opt-in attributes, zero new dependencies, no server-contract change. | `0.5.24-alpha.2` | 2026-07-22 |
+| 📋 | **Pluggable object storage** — Named drivers pairing an **adapter** (where the bytes live) with a **strategy** (how keys are laid out), behind one callback-shaped contract. Keys are opaque, so a later layout change never breaks stored references; writes publish atomically by temp-and-rename, so a reader never observes a partial object; and every object carries a metadata row written through a pluggable store seam — an embedded SQLite file by default, or a `connectors.json` entry when several processes share one root. A driver root that sits inside any web-served directory refuses the boot, since objects there would be publicly fetchable. Much of the layer has already shipped: the `local` adapter with the `sharded` and `cas` (content-addressed, deduplicating, refcounted) strategies, size tiering, the metadata seam, boot validation, the `gina.storage()` accessor, upload groups publishing straight to a driver, and the `storage:stats` / `storage:gc` / `storage:verify` maintenance CLI with its admin-gated `/_gina/storage/*` endpoints. This milestone completes the layer — the `stream` strategy with resumable large-media uploads, an `s3` adapter, and HTTP Range serving in both engines. | `0.8.x` | 2027 |
 
 ---
 

package/bin/cli

@@ -394,6 +394,7 @@ async function onExec() {
         'scheme:',
         'secrets:',
         'service:',
+        'storage:',
         'view:',
         '--', //options or other aliases.
         '-' //options or other aliases.

package/framework/v0.6.7/VERSION

@@ -0,0 +1 @@
+0.6.7

package/framework/v0.6.7/core/asset/plugin/dist/vendor/gina/css/gina.min.css

@@ -0,0 +1 @@
+@charset "UTF-8";@keyframes gina-popin-skeleton-shimmer{0%{background-position:200%0}to{background-position:-200%0}}@layer gina{[data-gina-loading=true]{cursor:progress}@keyframes gina-loading-pulse{0%{opacity:1}to{opacity:.55}}@media (prefers-reduced-motion:no-preference){[data-gina-loading=true]{animation:gina-loading-pulse .9s ease-in-out infinite alternate}}@media (prefers-reduced-motion:reduce){[data-gina-loading=true]{opacity:.7}}[data-gina-form-submit-gated=true]{cursor:not-allowed;opacity:.7}}@font-face{font-family:"have_heart_oneregular";src:url(fonts/have_heart_one-webfont.woff2)format("woff2"),url(fonts/have_heart_one-webfont.woff)format("woff");font-weight:400;font-style:normal}.gina-popin-container{background:#fff}.gina-popins-overlay,div.gina-popin-container{visibility:hidden;opacity:0;z-index:1;transition:opacity .3s,visibility 0 .3s}.gina-popins-overlay.gina-popin-is-active,div.gina-popin-container.gina-popin-is-active{opacity:1;visibility:visible;transition-delay:0}dialog.gina-popin-container{padding:0;border:0;z-index:1}@media (prefers-reduced-motion:no-preference){dialog.gina-popin-container{opacity:0;transform:translateY(-.5rem);transition:opacity .2s ease,transform .2s ease,overlay .2s ease allow-discrete,display .2s ease allow-discrete}dialog.gina-popin-container[open]{opacity:1;transform:translateY(0)}@starting-style{dialog.gina-popin-container[open]{opacity:0;transform:translateY(-.5rem)}}dialog.gina-popin-container::backdrop{opacity:0;transition:opacity .2s ease,overlay .2s ease allow-discrete,display .2s ease allow-discrete}dialog.gina-popin-container[open]::backdrop{opacity:1}@starting-style{dialog.gina-popin-container[open]::backdrop{opacity:0}}}body[data-gina-popin-scroll-lock]{overflow:hidden}.gina-popins-overlay{position:fixed;left:0;top:0;display:grid;place-items:center;width:100%;height:100%;transition:opacity .3s,visibility .3s;overflow:auto;background:rgba(0,0,0,.75)}.gina-popins-overlay.gina-popin-is-active{backdrop-filter:blur(6px)}dialog::backdrop{background-color:rgba(0,0,0,.75);backdrop-filter:blur(6px)}.gina-popin-skeleton{padding:1.5rem;min-width:18rem;max-width:90vw}.gina-popin-skeleton .gina-popin-skeleton-line{height:.85rem;margin-bottom:.75rem;border-radius:4px;background:linear-gradient(90deg,#ededed 25%,#f7f7f7 50%,#ededed 75%);background-size:200% 100%;animation:gina-popin-skeleton-shimmer 1.4s ease-in-out infinite}.gina-popin-skeleton .gina-popin-skeleton-line:last-child{margin-bottom:0}.gina-popin-skeleton .gina-popin-skeleton-title{height:1.4rem;width:60%;margin-bottom:1.25rem}.gina-popin-skeleton .gina-popin-skeleton-line--short{width:40%}@media (prefers-reduced-motion:reduce){.gina-popin-skeleton .gina-popin-skeleton-line{animation:none}}

package/framework/{v0.6.6 → v0.6.7}/core/asset/plugin/dist/vendor/gina/inspector/inspector.css

@@ -1362,6 +1362,33 @@ body {
   color: var(--accent);
 }
 
+/* Forms tab — demoted bundle catalog card (#B343): whole-bundle `forms/`
+   groups (rules, mocks, validators, …), collapsed + muted so page forms keep
+   the prime space. Placed after the base .bm-form-card rules on purpose —
+   the [open] overrides tie on specificity and must win by source order. */
+.bm-catalog-card {
+  margin-top: 14px;
+  background: transparent;
+  border-style: dashed;
+}
+.bm-catalog-card > .bm-form-header {
+  color: var(--text-dim);
+  font-size: 10px;
+}
+.bm-catalog-card[open] {
+  border-color: var(--border);
+}
+.bm-catalog-card[open] > .bm-form-header .bm-form-chevron {
+  fill: var(--text-dim);
+}
+.bm-catalog-card .bm-catalog-hint {
+  font: normal 9px/1.6 var(--sans);
+  text-transform: none;
+  letter-spacing: 0.4px;
+  color: var(--text-dim);
+  opacity: 0.7;
+}
+
 /* ── JSON tree ────────────────────────────────────────────────────────────── */
 .bm-tree-root {
   font: 12px/1.7 var(--font);

package/framework/{v0.6.6 → v0.6.7}/core/asset/plugin/dist/vendor/gina/inspector/inspector.js

@@ -151,6 +151,46 @@
     /** @constant {Object} Keys whose children are recursively flattened into PROPERTIES */
     var VIEW_FLATTEN = { html: 1, properties: 1 };
 
+    /**
+     * @constant {string} Prefix marking framework-internal transport keys.
+     *
+     * `controller.render-json.js` embeds `__ginaQueries` / `__ginaFlow` at the
+     * ROOT of a JSON body so a calling bundle can merge an upstream bundle's
+     * query log and timeline (dev-gated there — no production leak). They are
+     * transport, not application data, and the Query and Flow tabs already
+     * render them first-class, so the Data tab hides them on every surface it
+     * reads the payload from. #B340
+     */
+    var INTERNAL_KEY_PREFIX = '__gina';
+
+    /**
+     * Shallow-copy a data payload without its framework-internal transport keys.
+     *
+     * Root level only: {@link INTERNAL_KEY_PREFIX} keys are produced at the root
+     * of the JSON body, so a NESTED key carrying the prefix is application data
+     * and is deliberately left alone. Arrays and non-objects pass through by
+     * reference — a root payload is a plain object, and copying arrays would
+     * change how the tree renders them.
+     *
+     * @inner
+     * @param   {*} obj - Data payload; only plain objects are filtered
+     * @returns {*} Filtered shallow copy, or `obj` unchanged when not a plain object
+     * @example
+     * stripInternalKeys({ status: 200, __ginaFlow: [] }); // → { status: 200 }
+     * stripInternalKeys({ a: { __ginaX: 1 } });           // → { a: { __ginaX: 1 } } (nested kept)
+     * stripInternalKeys([1, 2]);                          // → [1, 2] (unchanged, same ref)
+     */
+    function stripInternalKeys(obj) {
+        if (!obj || typeof obj !== 'object' || Array.isArray(obj)) return obj;
+        var out  = {};
+        var keys = Object.keys(obj);
+        for (var i = 0; i < keys.length; i++) {
+            if (keys[i].indexOf(INTERNAL_KEY_PREFIX) === 0) continue;
+            out[keys[i]] = obj[keys[i]];
+        }
+        return out;
+    }
+
     // ── State ──────────────────────────────────────────────────────────────
     /** @type {?Window|string} Data source — `Window` (opener), `'localStorage'`, or `null` */
     var source  = null;
@@ -1321,11 +1361,17 @@
      * and sent data sub-sections.
      *
      * Forms from the data payload that do not match any DOM form are rendered
-     * separately at the bottom.
+     * separately at the bottom — split in two (#B343): keys also present in
+     * the pristine gina half (`__ginaData.gina.forms` — the server-emitted
+     * bundle catalog built from the bundle's `forms/` directory groups such
+     * as `rules`, `mocks`, `validators`, which the statusbar merge never
+     * writes to) are demoted into one collapsed "Bundle catalog" card; keys
+     * only present in the user half are runtime form state (e.g. a departed
+     * popin form) and keep their own card.
      *
      * @inner
      * @param {Object} formsData - Forms data from `__ginaData.user.forms`
-     * @param {Object} [ginaFormsData] - Gina forms data (for diff overlay)
+     * @param {Object} [ginaFormsData] - Gina forms data (pristine server half; also the diff overlay source)
      * @returns {string} HTML string
      */
     function renderFormsContent(formsData, ginaFormsData) {
@@ -1460,10 +1506,22 @@
             h += '</div></details>';
         }
 
-        // Render forms from data that were NOT matched to a DOM form
+        // Render forms from data that were NOT matched to a DOM form.
+        // Keys also present in the pristine gina half are the server-emitted
+        // bundle catalog (the walked `<bundle>/forms/` groups), not page
+        // forms — collect them for the demoted catalog card below (#B343).
+        // The statusbar merge only ever writes `u.forms[<id>]`, so `g.forms`
+        // stays the untouched server snapshot: presence there is the
+        // discriminator. When `g.forms` is absent every key falls through to
+        // the legacy per-key card, so nothing is ever hidden.
+        var catalogKeys = [];
         for (var dk = 0; dk < formKeys.length; dk++) {
             var dkName = formKeys[dk];
             if (rendered[dkName]) continue;
+            if (Object.prototype.hasOwnProperty.call(ginaFormsData, dkName)) {
+                catalogKeys.push(dkName);
+                continue;
+            }
             h += '<details class="bm-form-card" data-path="form.' + escHtml(dkName) + '">';
             h += '<summary class="bm-form-header">'
                 + escHtml(dkName.toUpperCase())
@@ -1473,6 +1531,29 @@
             h += '</div></details>';
         }
 
+        // Bundle catalog — whole-bundle definitions, one group per
+        // `<bundle>/forms/` subdirectory, demoted to a single collapsed and
+        // visually muted card at the bottom so page forms keep the prime
+        // space (#B343).
+        if (catalogKeys.length > 0) {
+            h += '<details class="bm-form-card bm-catalog-card" data-path="form.__catalog">';
+            h += '<summary class="bm-form-header bm-catalog-header">BUNDLE CATALOG'
+                + '<span class="bm-catalog-hint">' + escHtml(catalogKeys.join(' · ')) + '</span>'
+                + chevronSvg + '</summary>';
+            h += '<div class="bm-form-body">';
+            for (var ck = 0; ck < catalogKeys.length; ck++) {
+                var ckName = catalogKeys[ck];
+                h += '<details class="bm-form-card bm-catalog-sub" data-path="form.' + escHtml(ckName) + '">';
+                h += '<summary class="bm-form-header">'
+                    + escHtml(ckName.toUpperCase())
+                    + chevronSvg + '</summary>';
+                h += '<div class="bm-form-body">';
+                h += renderFormDataSections(formsData[ckName], ginaFormsData[ckName]);
+                h += '</div></details>';
+            }
+            h += '</div></details>';
+        }
+
         return h || '<span class="bm-empty">No forms detected on this page</span>';
     }
 
@@ -1960,8 +2041,12 @@
 
         switch (name) {
             case 'data':
-                var dataObj = hasXhr ? u['data-xhr'] : u.data;
-                var ginaObj = hasXhr ? (g['data-xhr'] || g.data) : g.data;
+                // #B340 — strip at the source resolution point so every Data
+                // surface agrees: tree, root scalars, size badge and search all
+                // read from `dataObj`. `ginaObj` is stripped in step so the diff
+                // overlay does not report the hidden keys as removed.
+                var dataObj = stripInternalKeys(hasXhr ? u['data-xhr'] : u.data);
+                var ginaObj = stripInternalKeys(hasXhr ? (g['data-xhr'] || g.data) : g.data);
                 var q = getDataSearchQuery();
                 if (q && dataObj && typeof dataObj === 'object') {
                     // Try exact dot-path resolve first
@@ -2242,7 +2327,7 @@
         if (!ginaData) { treeEl.innerHTML = '<span class="bm-hint">No data to display</span>'; return; }
         var src = (_revealActive && _revealedData) ? _revealedData : ginaData;
         var u = src.user || {};
-        var data = u['data-xhr'] || u.data;
+        var data = stripInternalKeys(u['data-xhr'] || u.data); // #B340
         treeEl.innerHTML = '<pre class="bm-raw-view">' + escHtml(JSON.stringify(data, null, 2)) + '</pre>';
     }
 
@@ -3574,7 +3659,7 @@
         if (!ginaData || !ginaData.user) return;
         var src = (_revealActive && _revealedData) ? _revealedData : ginaData;
         var u = src.user || {};
-        var dataObj = u['data-xhr'] || u.data;
+        var dataObj = stripInternalKeys(u['data-xhr'] || u.data); // #B340
         if (!dataObj || typeof dataObj !== 'object') return;
 
         var keys = Object.keys(dataObj).sort();
@@ -3602,7 +3687,7 @@
         if (!ginaData || !ginaData.user) return;
         var src = (_revealActive && _revealedData) ? _revealedData : ginaData;
         var u = src.user || {};
-        var dataObj = u['data-xhr'] || u.data;
+        var dataObj = stripInternalKeys(u['data-xhr'] || u.data); // #B340
         var checks = qsa('#bm-dl-checks input:checked');
         var result = {};
         for (var i = 0; i < checks.length; i++) {