gina 0.7.3-alpha.1 → 0.7.4-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,28 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.7.3 - 2026-10-05
+### Fixed
+* A `GINA_VERSION` that names no installed framework version is now refused before the command runs, whether it was exported or set with `--version=<v>`: the CLI exits 1 with a message naming the path it expected and, for a version number, the `env -u GINA_VERSION gina framework:add <version>` command that installs it side by side. Before, only the installed package's own version was checked, so an exported `GINA_VERSION=latest` (or `--version=latest`, or a version number that is not installed) went on to migrate `~/.gina` to that phantom version (a `latest` entry in `main.json` and `gina.db`, an empty `~/.gina/latest/` directory, `gina version` printing `vlatest`) and the command carried on. A version installed side by side with `framework:add` is accepted as before. A `--<name>=<value>` argument also keeps its value exactly as given: when the flag name had no hyphen of its own, the value's first hyphen was turned into `_`, so `--version=0.7.2-alpha.2` arrived as `0.7.2_alpha.2`. Entries an earlier run already wrote are not removed. Takes effect on the next `gina` command. (#B584)
+* `gina start` (and `gina framework:start`) now exits non-zero when the framework stops before it is ready: with the framework's own exit code, with 1 when that code was 0, or with 128 plus the signal number when a signal stopped it (137 for SIGKILL). It used to exit 0, so a script that tests the exit code read success on a refused `GINA_VERSION` or an error while the framework boots, and a framework killed by a signal made the command crash with a TypeError instead. A start that reaches the ready line, or finds the framework already running, still exits 0. (#B759)
+* A warning on standard error, such as a deprecation notice, no longer aborts `gina start`. The command exited 1 as soon as the framework printed a line containing "warning" before it was ready, and the framework, cut off from its output, then stopped, so the start failed. The warning is now printed and the start carries on; a debugger line or "address already in use" still ends it with exit 1. (#B760)
+* A staged upload's `send()` no longer reads the event being dispatched when it runs. The upload group now comes from the file input the virtual upload form stages for, so `gina.validator.$forms[<virtual form id>].send(formData)` called outside that input's change event stages the file in the input's group: outside any event it used to fail with a TypeError while the request still went out with no multipart boundary and no group, and inside an unrelated event it took that event's element's group. A `send()` with no data now sends an empty body instead of throwing and leaving the form marked as sending. Selecting or dropping a file was not affected. (#B758)
+* After a client navigation (`data-gina-nav`) that closes an open popin, focus now lands on the swapped region and the page keeps the navigation's scroll position, as after any other swap. The popin used to be closed after the region was focused, so closing it returned focus to the popin's trigger and scrolled the page back to it, with modal and non-modal popins alike. (#B762)
+* `gina start` no longer reports another program on the framework port as a running framework. When the port was already in use, it trusted any `~/.gina/procs.json` entry for it without checking: a port held by another program read « already running » (with « PID `null` » when no entry named the port), a stale entry left by a stopped framework was reported as running under a dead pid, and both exited 0 while a half-started framework kept the MQ port busy; any other error opening the port, such as EACCES, made `gina start` hang. « Already running » now needs a recorded pid that is a running gina framework, on Node or Bun. Otherwise the start prints the cause, the fix (`gina framework:set --port=<port>`) and, outside Windows, an `lsof` command that finds the program holding the port, then exits 1 and releases the MQ port; any other error opening the port exits 1 with that error. (#B761)
+* A URL both declared in `templates.json` and written in the layout now appears once in the `link` header of an HTML page, instead of twice. (#B767)
+* The stylesheets (`<link rel="stylesheet">`) and scripts (`<script src>`) written in a layout are now hinted in the `link` header of an HTML page, with `as=style` and `as=script`; they never got an `as`, so they were never hinted. A tag the browser could not match a preload to is left out: one carrying `integrity` or `crossorigin`, a stylesheet whose `media` is not `all` or `screen`, an alternate stylesheet, or a `type="module"` or `nomodule` script. (#B766)
+* The automatic preload hints of an `http/2.0` bundle in production, the 103 Early Hints and the `link` header of the 200, are now limited to `templates.json > preloadHintsMaxSize` bytes, 1,024 by default (`0` = no limit), keeping their entries in order and stopping at the last one that fits; `preloadHintsEnabled: false` sends neither. Both keys can be set in `_common` or in a page's own entry. The hints had no limit, so behind a proxy with a small response-header buffer (nginx's `proxy_buffer_size` is one memory page, 4 KiB on most Linux hosts) a page that declared many stylesheets and scripts, or whose layout held many images, was answered 502 « upstream sent too big header ». This is a behaviour change: such pages now send fewer hints, and the assets left out still load once the browser reads the page. Raise the limit only when every proxy in front of the bundle has room for it. (#B765)
+* `self.setEarlyHints([a, b])` now sends both entries over HTTP/1.1 (when `server.earlyHintsOverHTTP1` is `true`). It joined the entries with `, ` into one string, which Node.js checks as a single link value and refused, so an explicit hint with several entries was silently never sent over HTTP/1.1; each entry is now handed to Node.js separately. An entry whose parameter holds a space, such as an `imagesrcset`, is still refused by Node.js and drops that 103. (#B770)
+* An `http/2.0` bundle in production no longer sends 103 Early Hints over HTTP/1.1 unless `settings.json > server.earlyHintsOverHTTP1` is `true`. Since 0.6.28 it sent its automatic 103 over HTTP/1.1 too, where it reaches a reverse proxy rather than a browser (browsers act on a 103 only over HTTP/2 and HTTP/3), and nginx older than 1.29, the versions Ubuntu 22.04 and 24.04 and Debian 12 package, takes an upstream 103 for the final response: every HTML page behind it failed (in Chromium: `ERR_HTTP2_PROTOCOL_ERROR`). This is a behaviour change, and it applies to `self.setEarlyHints()` too: a browser connected to the bundle over HTTP/2 gets its 103 as before, and behind a proxy that talks HTTP/1.1 to the bundle the 103 now stops. Turn the key on only behind a proxy that passes 103 responses on (nginx 1.29 or later with `early_hints`, Apache). (#B771)
+* A page entry in `templates.json` that sets a `_common` switch to `false` (`assetVersioningEnabled`, `preloadHintsEnabled`, …) now keeps it: it used to get `_common`'s `true` back. For `javascriptsDeferEnabled`, such a page's scripts now go before `</body>` without `defer`, as documented, instead of in `<head>` with it. (#B772)
+* More of the assets written in a layout get a preload hint in the `link` header of an `http/2.0` page's 200. The layout was read one source line at a time, keeping the last URL on the line, so tags sharing a line were read as one: `<img src="a.png"><script src="b.js"></script>` preloaded the script as an image and left the image out, a stylesheet followed by an image on one line lost both, a one-line `<picture>` lost its `<img>` and gave its `<source>`'s `srcset` to the next image, and a minified layout got no hint at all. Each tag is now read on its own, a start tag written over several lines included; the hints stay within `preloadHintsMaxSize`. (#B768)
+* Under a webroot other than `/`, an asset URL written in a layout with the webroot, such as `{{ page.environment.webroot }}img/logo.png`, now gets its preload hint, behind a path-prefixing proxy too. Such a URL never matched a file, so it got no hint, and a stylesheet linked that way was never read for its `url()` references. (#B769)
+* The `ginaEnabled` key is removed from the framework's `templates.json` baseline. It never had any effect, although the `templates.json` reference said that `false` keeps gina's CSS and JS out of a page and hides the dev toolbar; a bundle that sets it keeps working, the key being ignored as before. To hide the dev status bar on a page, render it with `self.render(data, false)`; to keep gina's own CSS and JS out of a page, set its `javascriptsExcluded` and `stylesheetsExcluded` to `"**"`, which leaves out `_common`'s stylesheets and scripts too. (#B773)
+* A page no longer answers 500 on an `http/2.0` bundle, in dev and in production, when its layout links a stylesheet by hand whose CSS holds an unquoted `url(#id)`, such as the SVG reference in `fill: url(#grad)`, or a `url()` with no dot in its path. The scan that lists the `url()` references of a layout's stylesheets for the Inspector threw on them; it now skips what it cannot read. (#B774)
+* A page no longer answers 500 on an `http/2.0` bundle when the first asset of its layout is an `<img>` with a `srcset` and no `src`. The layout scan kept the previous tag's URL, so such a tag first in a layout threw, and a later one overwrote the previous image's entry; a tag with no `src` or `href` now gets no hint and leaves the other entries alone. (#B775)
+* A layout image keeps its preload hint when one of the layout's stylesheets names the same file in a CSS `url()`: the stylesheet's reference replaced the image's entry, the one that carries the hint. (#B776)
+* A bundle installed under a directory whose name holds `404` now gets its layout preload hints, as does an asset named like `error-404.png`: the layout scan took any file path holding `404` for a missing file. (#B777)
+
 ## 0.7.2 - 2026-10-03
 ### Added
 * Versioned asset URLs, so browsers can keep a bundle's scripts and stylesheets for a year: in production, the `<link>` and `<script>` tags gina writes from `templates.json` (and their HTTP/2 preload hints) end in `?v=` plus the first 10 hex characters of the file's SHA-384, and the statics gina serves answer `Cache-Control: public, max-age=31536000, immutable` when the token names the file's current bytes, `no-cache` for any other token, and exactly as before without one. The client routing table is fetched the same way, its token carried on gina's own script tag. A deploy that changes a file changes its URL, so a returning visitor fetches it once and no stale copy survives. On by default; `assetVersioningEnabled: false` in `templates.json > _common` keeps the plain URLs. Not versioned: dev mode, renders without a layout, `isExternalPlugin` scripts, hand-written tags. A front server that serves the statics, such as nginx, should send requests that carry a token to the bundle, which checks it (see the statics reference). Restart the bundle to pick it up; if your build copies `gina.min.js` into your own static files, rebuild that copy before the restart: an older copy compares script URLs exactly, so it can run a script twice when a popin or a swapped region includes a file the page loaded under its versioned URL. (#P48)

package/README.md

@@ -68,46 +68,46 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.7.2
-
-> **Restart your bundles *and* rebuild them.** The staged-upload, popin and asset-URL
-> changes are browser-bundled, so `gina.min.js` changed and `gina bundle:restart`
-> alone leaves the old client running: rebuild each consuming bundle, then restart
-> it. If your build copies `gina.min.js` into your own static files, rebuild that
-> copy before the restart.
-
-> **Read before upgrading — some changes can change an answer.** In production, the
-> asset URLs gina writes now carry a `?v=` content token, and the statics it serves
-> answer `Cache-Control: public, max-age=31536000, immutable` when the token matches.
-> This is on by default: `assetVersioningEnabled: false` in `templates.json > _common`
-> keeps the plain URLs, and a front server that serves your statics should send
-> tokened requests to the bundle. A staged-upload transport failure now says the
-> request "did not complete", the upload form of a staged input whose name has no
-> brackets gets a new id (`gina-upload-<name>-<form id>`), and a route whose `param`
-> already used a key named `lane` for its own data now declares a fast-lane route.
-> The [migration notes](https://gina.io/docs/migration) list every behaviour change.
-
-**The staged-uploads release.** The four reports of issue #83 lead it: the
-staged-upload error slot rendered a server's error text as markup (an advisory), a
-form posted a file input's `C:\fakepath\` placeholder, a submit could leave while
-its upload was still running, and a request that failed in transit said it never
-reached the server. Five more staged-upload and popin fixes found on the way, two
-new features — versioned asset URLs that browsers keep for a year, and an opt-in
-fast lane that answers a JSON route without building a controller — and fixes to
-precompressed statics, HTTP/2 error metrics and the SQLite session store. Full
-detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — a staged upload's error message is shown as text (#B727).** The upload error slot used `innerHTML`, so a proxy's or WAF's HTML error page, or a server error that echoes request text such as a rejected filename, became live markup in the page.
-- **Security — the `engine.io` floor rises to `^6.6.10` (#S12).** On an existing session, a transport-upgrade request could crash a bundle whose `settings.json` sets `ioServer.integrationMode` to `"attach"` (GHSA-2gc4-cqfq-p2gv); an install of this version can no longer resolve an affected release.
-- **Added — versioned asset URLs (#P48).** In production the `<link>` and `<script>` tags gina writes from `templates.json`, their preload hints and the client routing table carry a content token, and the statics gina serves answer `immutable` for a year when the token names the file's current bytes, so a deploy that changes a file changes its URL. On by default.
-- **Added — the fast lane (#P49).** A JSON route can name a function in the bundle's `lanes/` directory (`"param": { "lane": "users", "control": "list" }`) and skip the controller: a median 0.39 times the CPU of the controller route, about 150 µs less per request, in the measurement. Opt-in; this release refuses a lane route that declares a gate.
-- **Fixed — staged uploads, issue #83 parts 1–3 (#B724, #B725, #B726).** A transport failure says the request did not complete (overridable as `gina.config.a11y.transportError`), a staged file input's placeholder value is no longer posted, and a submit made during an upload waits for it, then sends once with its metadata.
-- **Fixed — staged uploads: choosing another file during an upload, an input without an error element, same-named inputs in two forms, and an input in a reopened popin (#B729, #B731, #B732, #B733).**
-- **Fixed — `gina.popin.close(name)` tears down the popin's forms (#B756).** After a reopen they were left unbound.
-- **Fixed — precompressed statics: a `.gz` copy goes out as `Content-Encoding: gzip`, and statics vary on `Accept-Encoding` (#B742, #B743).**
-- **Fixed — on HTTP/2, an error answer is counted with its own status in the metrics, and no `headersSent` error follows a sent response (#B749, #B750).**
-- **Fixed — the SQLite session store reads its path from `file` (#D47).** A path in `database`, as the docs showed, stopped the boot.
-- **Fixed — a page whose query string ends in the routing table's path is answered by the page (#P48).**
+## What's in 0.7.3
+
+> **Restart your bundles *and* rebuild them.** Two client fixes, focus after a
+> client navigation that closes a popin and a staged upload's `send()`, are
+> browser-bundled, so `gina.min.js` changed and `gina bundle:restart` alone leaves
+> the old client running: rebuild each consuming bundle, then restart it. If your
+> build copies `gina.min.js` into your own static files, rebuild that copy before
+> the restart.
+
+> **Read before upgrading — some changes can change an answer.** In production, an
+> `http/2.0` bundle no longer sends 103 Early Hints over HTTP/1.1 unless
+> `settings.json > server.earlyHintsOverHTTP1` is `true`, and its preload hints are
+> limited to `templates.json > preloadHintsMaxSize` bytes, 1,024 by default, so a
+> page that declares many stylesheets and scripts sends fewer hints. `gina start`
+> now exits non-zero when the framework does not start or another program holds
+> its port, a `GINA_VERSION` (or `--version=`) that names no installed framework is
+> refused with exit 1, and a page's own `false` in `templates.json` now overrides a
+> `_common` switch. The [migration notes](https://gina.io/docs/migration) list every
+> behaviour change.
+
+**The preload-hints release.** It leads with two fixes for pages behind a reverse
+proxy. Since 0.6.28 an `http/2.0` bundle sent its 103 Early Hints over HTTP/1.1
+too, and nginx older than 1.29 (the Ubuntu 22.04 and 24.04 and Debian 12 packages)
+takes an upstream 103 for the final response, so every HTML page behind it failed;
+and a page with many preload hints could outgrow a proxy's header buffer and
+answer 502. The layout scan that feeds those hints now reads each tag on its own,
+three layout shapes that answered 500 now render, and `gina start` reports a
+framework that did not start. Full detail in [CHANGELOG.md](./CHANGELOG.md).
+
+- **Fixed — no 103 Early Hints over HTTP/1.1 by default (#B771).** Behind nginx older than 1.29, every HTML page of an `http/2.0` bundle failed (`ERR_HTTP2_PROTOCOL_ERROR` in Chromium). Browsers act on a 103 only over HTTP/2 and HTTP/3, so a browser connected to the bundle over HTTP/2 gets it as before; `server.earlyHintsOverHTTP1: true` brings it back behind a proxy that passes 103 responses on.
+- **Fixed — preload hints are limited to 1,024 bytes (#B765).** A page with many hints was answered 502 « upstream sent too big header » behind a proxy with a small response-header buffer. The hints keep their order and stop at the last entry that fits; `preloadHintsMaxSize` raises the limit (`0` = none) and `preloadHintsEnabled: false` sends none.
+- **Fixed — the stylesheets and scripts written in a layout get a hint, a URL is hinted once, and `self.setEarlyHints([a, b])` sends both entries over HTTP/1.1 (#B766, #B767, #B770).**
+- **Fixed — more of a layout's assets get a hint (#B768, #B769, #B776, #B777).** Tags sharing a line, a one-line `<picture>` and a minified layout are read tag by tag; a URL written with a webroot other than `/`, an image a stylesheet also names in a `url()`, and the assets of a bundle installed under a directory whose name holds `404` get their hints.
+- **Fixed — a page no longer answers 500 because of its layout's assets (#B774, #B775).** A stylesheet linked by hand with an unquoted `url(#id)` or a `url()` with no dot in its path, or a first layout asset that is an `<img>` with a `srcset` and no `src`, made the page answer 500.
+- **Fixed — a page's own `false` overrides a `_common` switch in `templates.json` (#B772).** For `javascriptsDeferEnabled`, such a page's scripts now go before `</body>` without `defer`, as documented.
+- **Fixed — `gina start` exits non-zero when the framework does not start (#B759, #B760, #B761).** It exits with the framework's own exit code, or 128 plus the signal number; another program on the framework port is no longer reported as a running framework; and a warning on standard error no longer aborts the start.
+- **Fixed — a `GINA_VERSION` that names no installed framework is refused (#B584).** It used to migrate `~/.gina` to that version.
+- **Fixed — after a client navigation that closes a popin, focus lands on the swapped region (#B762).**
+- **Fixed — a staged upload's `send()` no longer reads the event being dispatched when it runs (#B758).** Called from your own code, it failed with a TypeError or took another element's upload group.
+- **Fixed — `ginaEnabled` is gone from the framework's `templates.json` baseline and from its reference (#B773).** It never had any effect.
 
 ## Documentation
 

package/ROADMAP.md

@@ -89,6 +89,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.7.0` ✅ | **Performance**: the inter-bundle throughput arc closes — a candidate index narrows the cold route match to the rules whose URL could match, the warm route cache becomes one constant-time map, an HTTP/2 `self.query()` answer without a `status` field no longer gets `status: 200` added nor a warning logged per call, and the arc's exit benchmark is published (its first five slices shipped in `0.6.33`). **Security**: seven fixes — a `GET` could run a route's `DELETE` action for any client, including from another site; on Express 5 one body-less request could stop the bundle; a stack passed as an error message reached the client; `gina tail --follow` re-ran a start command from the shared tmp directory; a long `X-Forwarded-Prefix` header could tie up an isaac bundle; a malformed frame on the loopback log listener stopped the framework daemon; and the browser bundle no longer carries any dynamic-code call, so custom validators compile without `eval`. **Added**: a boot warning for a Swig bundle that leaves `settings.swig.autoescape` unset (the default becomes `true` in `0.8.0`), and one for routing `requirements` regexes that are not anchored. **Fixed**: the first gina commands after a minor-version upgrade; a `405` lists the allowed methods, and a `HEAD` works on every `GET` route and gives the action `req.get`; on Express, a URL carrying a query string resolves; with `autoescape: true`, Swig pages keep their CSS and JavaScript; `env:add <env> @<project>`, `project:rename`, the values of `project:add`'s flags, six CLI commands that did not exit, and a path with a space in the install, `port:reset` and `bundle:restart`; the path helper's failed copies; the scaffolded Couchbase `pingInterval`. **ISO 27001 supplier evidence**: a published OpenSSF Scorecard and the controller-side error-message sanitizer. **New minor version**: settings move to `~/.gina/0.7/` — an npm install resets the networking and directory settings and the log level to their defaults, while Bun, a `gina-container` image or a git checkout carries them over and resets only the log level; culture, timezone, default environment and scope carry over on every path — and a `^0.6.x` dependency range does not resolve `0.7.0`. 25 fragments; restart **and rebuild** — the browser bundle changed. |
 | **Q4 2026** | `0.7.1` ✅ | **Security**: five advisories — behind a reverse proxy on the bundle's own host, the admin `/_gina/*` endpoints and `/_gina/metrics` admitted every client the proxy relayed; the cross-origin write guard in front of the `/_gina/*` control endpoints missed a leading path segment, the endpoint path at the end of a query string and another letter case; one `GET` of the client routing table spelled in another letter case stopped an isaac bundle; command output logs and the log-listener port file left the shared temp directory; and `settings.swig.autoescape: true` is applied on npm installs — plus CLI hardening: commands that start other gina commands, and an isaac bundle's boot, no longer build shell command lines, and the CLI matches names literally in its registry lookups. **Changed**: new project and bundle names follow a naming rule; less work per routed request — about a third less CPU on a JSON route — and an instance of an `inherits()` class no longer carries its own `prototype`. **Fixed**: the built-in `/_gina/*` endpoints answer a URL with a query string and the health check answers `HEAD`; a page whose query string ends in an endpoint path gets the page; isaac's own event streams answer HTTP/2; the maintenance IP allowlist on an isaac bundle serving HTTP/1.1; the storage endpoints during a maintenance window, and `storage:gc --dry-run` and `--driver=` against a running bundle; a JSON body sent to a control toggle on express; a daemon-started bundle's boot warnings in the `bundle:start` output; project commands from a path with a space, `bundle:stop`'s pid file, lookups that took one name for another extending it, and a `--restart-pid` flag; the Inspector's target URL with a query string; a bundle with templates walking the call stack on every request; the output cache read while disabled; and the path helper's per-path registry. 34 fragments; restart **and rebuild** — the browser bundle changed — and restart the framework daemon and any running `gina tail`. |
 | **Q4 2026** | `0.7.2` ✅ | **Security**: a staged upload's error message is rendered as text — the upload error slot used `innerHTML`, so a proxy's HTML error page, or a server error echoing request text such as a rejected filename, became live markup in the page — and the `engine.io` floor rises to `^6.6.10`, so an install can no longer resolve a release whose transport-upgrade handling could crash an attach-mode bundle. **Added**: versioned asset URLs — in production the asset tags gina writes and the client routing table carry a content token, and the statics gina serves answer `immutable` for a year when it matches (on by default); the fast lane — a JSON route can name a function in the bundle's `lanes/` directory and skip the controller (opt-in; about 150 µs less CPU per request in the measurement). **Fixed**: staged uploads — a request that fails in transit says it did not complete, and the text can be translated; a staged file input's placeholder value is no longer posted; a submit made during an upload waits for it; choosing another file during an upload stages it; a staging error reaches the on-error callback without an error element; same-named staged inputs in two forms keep their uploads apart; a staged input works again after its popin is reopened, and `gina.popin.close(name)` tears down the popin's forms; a precompressed `.gz` static is sent as `Content-Encoding: gzip` and statics vary on `Accept-Encoding`; HTTP/2 error answers are counted with their status in the metrics; no `headersSent` error after a sent response; the SQLite session store reads its path from `file`; and a page whose query string ends in the routing table's path gets the page. 17 fragments; restart **and rebuild** — the browser bundle changed. |
+| **Q4 2026** | `0.7.3` ✅ | **Fixed**: behind a reverse proxy, an `http/2.0` bundle in production no longer sends 103 Early Hints over HTTP/1.1 unless `server.earlyHintsOverHTTP1` is `true` (since 0.6.28, nginx older than 1.29 took that 103 for the final response, so every HTML page behind it failed), and its preload hints are limited to `templates.json > preloadHintsMaxSize`, 1,024 bytes by default, so a page no longer outgrows a proxy's header buffer and answers 502; the layout scan reads each tag on its own, so tags sharing a line, a minified layout, webroot-form URLs and the stylesheets and scripts written in a layout get their hints, and a URL is hinted once; three layout shapes that answered 500 now render; a page's own `false` overrides a `_common` switch; `gina start` exits non-zero when the framework does not start or another program holds its port, and a warning no longer aborts it; a `GINA_VERSION` that names no installed framework is refused; after a client navigation that closes a popin, focus stays on the swapped region; a staged upload's `send()` no longer reads the event being dispatched; `ginaEnabled`, never read, is gone. 19 fragments; restart **and rebuild** — the browser bundle changed. |
 | **2027** | `0.7.x` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — shipped in `0.6.30`) · ISO 27001 supplier evidence — an SBOM attached to every release, once releases are cut by the CI release workflow · Beemaster admin + visual translation editor (moved from `0.6.x`) |
 | **2027** | `0.8.0` | **Swig output auto-escaping on by default** — `settings.swig.autoescape` becomes `true` when a bundle leaves it unset (prepared in `0.7.0`: a boot warning, the scaffold, the asset-tag fix). ⚠️ The financial-messaging content first planned here was **delivered early in `0.6.25` (2026-09-03)**: XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys. |
 | **2027** | `0.9.0` | Financial-integration heavyweights — entity-layer datastore transaction seam · message-queue connector family (AMQP / Kafka / IBM MQ) |

package/bin/cli

@@ -337,6 +337,35 @@ async function onExec() {
 
 
     filterArgs();// jshint ignore:line
+
+    // #B584 — refuse a GINA_VERSION that names no installed framework, before
+    // the command runs. The guard at the top of this file only sees a version
+    // that is already in the framework environment: an exported GINA_VERSION
+    // is imported after it, and a `--version=<v>` flag is promoted by
+    // filterArgs() just above. Past that guard, the framework init migrated
+    // ~/.gina to the phantom version (a `latest` key in every per-version
+    // dict, an empty <home>/latest/) and the command carried on. A version
+    // installed side by side (`framework:add` links it under
+    // <gina>/framework/v<version>) is accepted as before.
+    var requestedVersion = getEnvVar('GINA_VERSION');// jshint ignore:line
+    if (
+        typeof(requestedVersion) != 'undefined'
+        && requestedVersion !== version
+        && !fs.existsSync(ginaPath + '/framework/v' + requestedVersion)
+    ) {
+        var refusal = 'gina: framework version ' + requestedVersion + ' is not installed (expected at ' + ginaPath + '/framework/v' + requestedVersion + ').\n'
+            + 'GINA_VERSION, exported or set with --version=, must name an installed framework version; the installed package version is ' + packObj.version + '. Unset or correct it.\n';
+        // The install hint only for a value `framework:add` accepts — the
+        // plain `gina framework:add` hint would itself be refused while the
+        // variable is exported.
+        if ( /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(requestedVersion) ) {
+            refusal += 'To install it side by side:\n  $ env -u GINA_VERSION gina framework:add ' + requestedVersion + '\n';
+        }
+        // Synchronous: a pipe write is asynchronous and process.exit() would drop it.
+        fs.writeSync(2, refusal);
+        process.exit(1);
+    }
+
     //check for $HOME path, alert if empty.
     if (!home) {
         console.error('No ' + ((isWin32) ? 'USERPROFILE' : 'HOME') + ' path found.');

package/bin/cmd

@@ -121,32 +121,41 @@ function Cmd(opt, runOffine) {
 
 
         framework.on('error', function(err) {
-            if (err.code === 'EADDRINUSE') {
-                if (process.argv[2] == 'framework:start') {
-                    var pid = null;
-                    var port  = err.port || getEnvVar('GINA_PORT');// jshint ignore:line
-                    var procsFile = _(getEnvVar('GINA_HOMEDIR') +'/procs.json', true);// jshint ignore:line
-                    if ( new _(procsFile).existsSync() ) {
-                        var runningProcs = requireJSON(procsFile);// jshint ignore:line
-                        for (let i in runningProcs) {
-                            if (runningProcs[i].port == port) {
-                                pid = runningProcs[i].pid;
-                                break;
-                            }
-                        }
-                    }
-                    if (!pid) {
-                        console.warn('Framework already running on port`'+ opt.port +'`. Use `gina status` to get the PID to kill.');
-                        return;
-                    }
-
-                    console.warn('Framework already running on port `'+ opt.port +'`: [ '+ pid+' ]');
-                } else {
-
-                }
-            } else {
-                console.emerg('Could not start framework. ', err.stack)
+            // #B761 — an error once the socket listens (an accept failure such as EMFILE) does not
+            // mean the start failed: the running framework logs it and keeps serving, as before.
+            if (framework.listening) {
+                console.emerg('Could not start framework. ', err.stack);
+                return;
+            }
+            // #B761 — was: on EADDRINUSE under framework:start, any procs.json entry for the port
+            // was trusted without a check (« already running » naming even a dead pid), no entry
+            // logged « already running » without a pid and returned, and any other listen error was
+            // only logged. The process never ended: `gina start` exited 0 with a half-started daemon
+            // holding the MQ port, or hung (EACCES). inc/listen-error.js now decides: « already
+            // running » only for a recorded pid that is alive and a framework daemon (titled
+            // gina-v<version>, or on Bun still running bin/cli start); otherwise the reason on
+            // stderr and exit 1, which frees the MQ port (bin/cli's exit handler).
+            // procs.json is machine-written JSON; it is parsed here rather than with requireJSON(),
+            // which exits the process on a file it cannot read or parse.
+            var procsFile = _(getEnvVar('GINA_HOMEDIR') +'/procs.json', true);// jshint ignore:line
+            var procs = null;
+            try {
+                procs = JSON.parse(fs.readFileSync(procsFile, 'utf8'));
+            } catch (procsErr) {
+                procs = null;
+            }
+            var decision = require(local.frameworkPath + '/lib/cmd/framework/inc/listen-error').decide(err, {
+                command   : process.argv[2],
+                port      : err.port || local.port,
+                procsFile : procsFile,
+                procs     : procs
+            });
+            if (decision.action === 'already-running') {
+                console.warn('Framework already running on port `'+ decision.port +'`: [ '+ decision.pid +' ]');
+                return;
             }
+            fs.writeSync(2, decision.message + '\n');
+            process.exit(1);
         });
 
         // The command socket is a local control plane: a connection to it

package/bin/gina

@@ -98,14 +98,12 @@ function runAsSubProcess() {
 
         // If framework is already running
         if ( new RegExp('Framework already running','gmi').test(data) ) {
-            pid = ''+data.match(/\[\s+\d+\s+\]/);
-            if (pid && pid.length > 0) {
-                if (Array.isArray(pid) ) {
-                    pid = pid[0].replace(/\[|\]|\s+/g, '');
-                } else {
-                    pid = pid.replace(/\[|\]|\s+/g, '');
-                }
-
+            // #B761 — was: `pid = ''+data.match(/\[\s+\d+\s+\]/)`: a line without a pid made the
+            // string « null », so it printed « …with PID `null` » and the branch without a pid was
+            // unreachable (the Array.isArray branch was dead: the value was always a string).
+            var pidMatch = data.match(/\[\s+(\d+)\s+\]/);
+            if (pidMatch) {
+                pid = pidMatch[1];
                 console.info('Gina server is already running with PID `'+ pid +'`');
             } else {
                 console.info('Gina server is already running');
@@ -127,7 +125,14 @@ function runAsSubProcess() {
         if (/ExperimentalWarning/.test(error)) {
             return;
         }
-        if (/Debugger listening|Debugger attached|Warning|address already in use/i.test(error)) {
+        // #B760 — `Warning` was in this pattern too, matched case-insensitively, so a benign
+        // notice before the ready line (a deprecation, a MaxListeners warning, or Node's
+        // « (Use `node --trace-warnings …` » line) made the wrapper exit 1 at once, and the daemon
+        // child, its pipes gone, then died on its next write (EPIPE): the start was aborted. A
+        // warning is now printed below like any other stderr output, and the start ends on the
+        // ready line or on the child's exit (#B759).
+        // was: if (/Debugger listening|Debugger attached|Warning|address already in use/i.test(error)) {
+        if (/Debugger listening|Debugger attached|address already in use/i.test(error)) {
             console.warn(error);
             return process.exit(1);
         }
@@ -135,16 +140,51 @@ function runAsSubProcess() {
     });
 
 
-    child.on('exit', function(code, signal) {
-        // handles only signals that cannot be caught or ignored
-        // ref.: `framework/<version>/lib/proc.js`
-        if (/(SIGKILL|SIGSTOP)/i.test(signal)) {
-            console.emerg('[' + this.pid + '] exiting with signal: ', signal);
-            return;
+    // #B759 — the child ended before the ready or already-running line (both exit above).
+    // The old `exit` handler only logged SIGKILL/SIGSTOP, through a `console.emerg` that does
+    // not exist on this global console (it threw), so otherwise the wrapper's event loop ran dry
+    // and `gina start` exited 0 on a refused or failed start. `close` fires once the child's
+    // stdout and stderr are drained, so everything it printed (the #B584 refusal, a stack) is
+    // relayed first; `process.exitCode` lets the wrapper's own pending writes flush.
+    child.on('close', function(code, signal) {
+        if (signal) {
+            fs.writeSync(2, 'gina: the framework was stopped by ' + signal + ' before it was ready.\n');
+        } else if (code === 0) {
+            fs.writeSync(2, 'gina: the framework exited before it was ready (exit code 0).\n');
         }
+        process.exitCode = exitCodeBeforeReady(code, signal);
     });
 }
 
+/**
+ * #B759 — the exit code `gina start` returns when the daemon child ends before it reported
+ * « Framework ready for connections » or « Framework already running » (both exit 0 on their
+ * own, so they never get here).
+ *
+ * @inner
+ * @private
+ * @param {?number} code - The child's exit code; null when a signal ended it
+ * @param {?string} signal - The signal that ended the child; null when it exited
+ * @returns {number} The child's code when it is not 0; 128 + the signal number when a signal
+ *   ended it (137 for SIGKILL), or 1 for a signal with no known number; 1 when the child
+ *   exited 0 without reporting ready
+ *
+ * @example
+ * exitCodeBeforeReady(3, null);         // 3
+ * exitCodeBeforeReady(null, 'SIGKILL'); // 137
+ * exitCodeBeforeReady(0, null);         // 1
+ */
+function exitCodeBeforeReady(code, signal) {
+    if (typeof code === 'number' && code !== 0) {
+        return code;
+    }
+    if (signal) {
+        var signo = require('os').constants.signals[signal];
+        return (typeof signo === 'number') ? 128 + signo : 1;
+    }
+    return 1;
+}
+
 /**
  * Will spawn gina CLI with its arguments
  * This is done to allow gina to run in background

package/framework/v0.7.4-alpha.1/VERSION

@@ -0,0 +1 @@
+0.7.4-alpha.1

package/framework/{v0.7.3-alpha.1 → v0.7.4-alpha.1}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -16116,9 +16116,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
      * send
      * N.B.: no validation here; if you want to validate against rules, use `.submit()` or `.validateFormById(formId)` before
      *
+     * Reads nothing from the event being dispatched when it runs (#B758): with no `data` it
+     * sends an empty body, and a staged upload's group comes from the file input its virtual
+     * upload form stages for (`data-gina-form-upload-group`, `untagged` when unset).
      *
-     * @param {object} data - FormData object (https://developer.mozilla.org/en-US/docs/Web/API/FormData/Using_FormData_Objects)
+     * @param {object|FormData} [data] - the payload: a plain object (sent as JSON) or a FormData object (https://developer.mozilla.org/en-US/docs/Web/API/FormData/Using_FormData_Objects); omitted, an empty body is sent
      * @param {object} [ options ] : { isSynchrone: false, withCredentials: true, withRateLimit: true }
+     * @returns {void}
+     *
+     * @example
+     * // after your own validation, post the form's data over AJAX
+     * gina.validator.$forms['signup'].send(result.toData());
      * */
     var send = function(data, options) {
 
@@ -17413,8 +17421,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
 
             // sending
-            if (!data)
-                data = event.detail.data;
+            // #B758 — a no-data send() no longer reads `event.detail.data` from the implicit
+            // global `event`: outside a dispatch it is undefined, so the call threw here, after
+            // `isSending` was claimed above, and left the form in sending. A no-data call now
+            // takes the empty-body branch below; nothing in gina calls send() without data.
+            // was: if (!data)
+            // was:     data = event.detail.data;
 
             if (data) {
 
@@ -17430,7 +17442,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         if ( !(data instanceof FormData) ) {
                             data = JSON.stringify(data)
                         } else {
-                            var uploadGroup   = event.currentTarget.getAttribute('data-gina-form-upload-group') || 'untagged';
+                            // #B758 — the group comes from the file input this virtual upload form
+                            // stages for (`uploadProperties.uploadTriggerId`), not from the implicit
+                            // global `event`: the picker and the dropzone call send() inside that
+                            // input's change dispatch, but a direct `$forms[<virtual id>].send(formData)`
+                            // ran outside any dispatch (a TypeError, reported as a staging error) or
+                            // inside an unrelated one (that event's element's group, silently).
+                            // was: var uploadGroup   = event.currentTarget.getAttribute('data-gina-form-upload-group') || 'untagged';
+                            var $uploadGroupInput = ( $target.uploadProperties && $target.uploadProperties.uploadTriggerId )
+                                ? document.getElementById($target.uploadProperties.uploadTriggerId)
+                                : null;
+                            var uploadGroup   = ( $uploadGroupInput && $uploadGroupInput.getAttribute('data-gina-form-upload-group') ) || 'untagged';
                             for (var [key, value] of data.entries() ) {
                                 // file upload case
                                 if (value instanceof File) {
@@ -30556,6 +30578,11 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events', 'utils/
          * would have unloaded it, and after a fragment swap it would sit over
          * content it no longer belongs to.
          *
+         * `applyFragment()` calls it BEFORE it moves focus and scroll (#B762):
+         * closing a popin returns focus to the popin's trigger, which scrolls
+         * the page to it, and while a popin is open the page outside it is
+         * inert, so the region cannot take focus until the popin is closed.
+         *
          * @inner
          * @private
          */
@@ -30590,9 +30617,11 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events', 'utils/
         /**
          * Applies a fetched fragment: swaps the region content, applies the
          * optional `[data-gina-nav-title]` document title, pushes/updates
-         * history, restores scroll and focus, closes any open popin, binds the
-         * new region (scripts, opted-in forms, links — the shared `bindRegion()`
-         * policy) and fires `success`.
+         * history, closes any open popin, moves focus to the region and applies
+         * the scroll decision, binds the new region (scripts, opted-in forms,
+         * links — the shared `bindRegion()` policy) and fires `success`. The
+         * popin closes before the focus and scroll (#B762), so the region keeps
+         * the focus and the navigation's scroll position stands.
          *
          * @inner
          * @private
@@ -30625,6 +30654,13 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events', 'utils/
             }
             _currentUrl = window.location.pathname + window.location.search;
 
+            // #B762 — close the active popin BEFORE the focus and scroll below.
+            // The close returns focus to the popin's trigger (scrolling the page
+            // to it), and while a popin is open the page outside it is inert, so
+            // the region's focus() did nothing: closed after them, the popin left
+            // focus on its trigger and the page scrolled back down to it.
+            closeActivePopin();
+
             // Focus first (preventScroll where supported), then the explicit
             // scroll decision wins: restored position on popstate, `#hash`
             // target or top on a forward navigation.
@@ -30649,7 +30685,7 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events', 'utils/
                 }
             }
 
-            closeActivePopin();
+            // was: closeActivePopin(); — here, after the focus and scroll (#B762)
             // #gh76 — the one region-binding policy nav shares with the validator's
             // form-answer swaps (utils/dom). Forms follow the #B549 opt-in gate here
             // too: a bare id-bearing form in a fragment used to be bound — and its