quantum-framework 0.13.0__tar.gz → 0.14.0__tar.gz

{quantum_framework-0.13.0/quantum_framework.egg-info → quantum_framework-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quantum-framework
-Version: 0.13.0
+Version: 0.14.0
 Summary: Full-stack declarative framework for building web, desktop, and mobile applications
 Author-email: Daniel Gregorio <danielgregorio2611@gmail.com>
 License: MIT
@@ -28,6 +28,7 @@ Provides-Extra: dev
 Requires-Dist: pytest>=7.4.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
 Requires-Dist: pytest-mock>=3.11.1; extra == "dev"
+Requires-Dist: pytest-xdist>=3.5; extra == "dev"
 Requires-Dist: black>=23.0.0; extra == "dev"
 Requires-Dist: ruff>=0.1.0; extra == "dev"
 Provides-Extra: db

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "quantum-framework"
-version = "0.13.0"
+version = "0.14.0"
 description = "Full-stack declarative framework for building web, desktop, and mobile applications"
 readme = "README.md"
 license = {text = "MIT"}
@@ -35,6 +35,7 @@ dev = [
     "pytest>=7.4.0",
     "pytest-cov>=4.1.0",
     "pytest-mock>=3.11.1",
+    "pytest-xdist>=3.5",
     "black>=23.0.0",
     "ruff>=0.1.0",
 ]

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/cli/commands/migrate.py

@@ -167,6 +167,18 @@ class DatabaseConnection:
             self._conn.close()
 
 
+def _paths_migrations(project_path: Path) -> str:
+    """CFG-3: paths.migrations in quantum.config.yaml (default ./migrations)."""
+    try:
+        import yaml
+        from quantum.core.config_env import expand_env
+        with open(project_path / "quantum.config.yaml", encoding="utf-8") as f:
+            config = expand_env(yaml.safe_load(f) or {})
+        return (config.get("paths") or {}).get("migrations") or "migrations"
+    except (OSError, ValueError, AttributeError):
+        return "migrations"
+
+
 class MigrationRunner:
     """Runs database migrations"""
 
@@ -174,7 +186,7 @@ class MigrationRunner:
 
     def __init__(self, project_path: Path = None, datasource: str = None):
         self.project_path = project_path or Path.cwd()
-        self.migrations_dir = self.project_path / "migrations"
+        self.migrations_dir = self.project_path / _paths_migrations(self.project_path)
         self.db = DatabaseConnection(self.project_path, datasource)
 
     def _ensure_migrations_table(self):

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/core/parser.py

@@ -575,10 +575,12 @@ class QuantumParser:
 
         # Parse component-level attributes
         component.port = root.get('port')
-        component.base_path = root.get('basePath')
-        component.health_endpoint = root.get('health')
-        component.metrics_provider = root.get('metrics')
-        component.trace_provider = root.get('trace')
+        # A2: accepted and never read by anything — refused, like FN-2/DB-5.
+        for attr in ('basePath', 'health', 'metrics', 'trace'):
+            if root.get(attr) is not None:
+                raise QuantumParseError(
+                    f'<q:component name="{name}"> {attr}= is not supported: it was accepted '
+                    f'and never did anything.')
 
         # Phase G: Authentication & Security attributes
         require_auth_attr = root.get('require_auth', 'false').lower()
@@ -867,7 +869,14 @@ class QuantumParser:
 
             if self._is_html_element(element):
                 if self._parser_registry.html_parser.can_parse(element_type):
-                    return self._parser_registry.html_parser.parse(element)
+                    node = self._parser_registry.html_parser.parse(element)
+                    # UI-0: a ui:* element inside a page. Parsed as before
+                    # (examples and tests load these files), but flagged so the
+                    # renderer refuses it instead of emitting <window>/<vbox>,
+                    # which no browser lays out.
+                    if self._get_element_ui_namespace(element) == 'ui':
+                        node.ui_tag = element_type
+                    return node
 
             # PARSE-1: a q: tag nobody parses is an error. It used to return
             # None here and vanish — <q:sett>, <q:retrun> and <q:iff> ran as if
@@ -1235,9 +1244,16 @@ class QuantumParser:
             type=element.get('type', 'string'),
             required=element.get('required', 'false').lower() == 'true',
             default=element.get('default'),
-            validation=element.get('validation'),
             description=element.get('description')
         )
+        if element.get('validation') is not None:
+            # A2: accepted and never read. The rules are validate=, type=,
+            # pattern=, min/max, minlength/maxlength and enum=.
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:param name="{element.get("name", "")}"> validation= is not supported: it was '
+                f'accepted and never did anything. Use type=, pattern=, min/max, '
+                f'minlength/maxlength or enum=.')
 
         # REST-specific
         param.source = element.get('source', 'auto')

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/core/parsers/control_flow/set_parser.py

@@ -53,7 +53,12 @@ class SetParser(BaseTagParser):
         set_node.nullable = self.get_bool_attr(element, 'nullable', True)
         set_node.validate_rule = self.get_attr(element, 'validate')
         set_node.pattern = self.get_attr(element, 'pattern')
-        set_node.mask = self.get_attr(element, 'mask')
+        if element.get('mask') is not None:
+            # A2: accepted and never applied.
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:set name="{set_node.name}"> mask= is not supported: it was accepted and '
+                f'never did anything. To validate a format use pattern=.')
         set_node.range = self.get_attr(element, 'range')
         set_node.enum = self.get_attr(element, 'enum')
         set_node.unique = self.get_attr(element, 'unique')

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/core/parsers/data/invoke_parser.py

@@ -70,7 +70,12 @@ class InvokeParser(BaseTagParser):
 
         # Response handling
         invoke_node.response_format = self.get_attr(element, 'responseFormat', 'auto')
-        invoke_node.transform = self.get_attr(element, 'transform')
+        if element.get('transform') is not None:
+            # A2: accepted and never applied.
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:invoke name="{invoke_node.name}"> transform= is not supported: it was '
+                f'accepted and never did anything. Transform the result with q:set.')
         invoke_node.cache = self.get_bool_attr(element, 'cache', False)
         invoke_node.ttl = self.get_int_attr(element, 'ttl', 0) or None
         invoke_node.result = self.get_attr(element, 'result')

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/core/parsers/functions/function_parser.py

@@ -65,6 +65,13 @@ class FunctionParser(BaseTagParser):
 
         # Core attributes
         func_node.return_type = element.get('returnType', 'any')
+        # FN-4: returnType is checked on every return (see ComponentRuntime).
+        from quantum.runtime.param_validation import RETURN_TYPES
+        if func_node.return_type.lower() not in RETURN_TYPES:
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:function name="{name}"> returnType="{func_node.return_type}" is not a type; '
+                f'use one of: {", ".join(sorted(RETURN_TYPES))}')
         func_node.description = element.get('description')
         func_node.hint = element.get('hint')
 

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/core/parsers/functions/param_parser.py

@@ -29,9 +29,16 @@ class ParamParser(BaseTagParser):
             type=element.get('type', 'string'),
             required=element.get('required', 'false').lower() == 'true',
             default=element.get('default'),
-            validation=element.get('validation'),
             description=element.get('description')
         )
+        if element.get('validation') is not None:
+            # A2: accepted and never read. The rules are validate=, type=,
+            # pattern=, min/max, minlength/maxlength and enum=.
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:param name="{element.get("name", "")}"> validation= is not supported: it was '
+                f'accepted and never did anything. Use type=, pattern=, min/max, '
+                f'minlength/maxlength or enum=.')
 
         # REST-specific
         param.source = element.get('source', 'auto')

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/runtime/component.py

@@ -68,6 +68,7 @@ from quantum.runtime.executors.control_flow.loop_executor import (
     as_return_value, produced_return,
 )
 from quantum.runtime.service_container import ServiceContainer
+from quantum.runtime.conditions import evaluate_condition
 import re
 import logging
 
@@ -462,57 +463,8 @@ class ComponentRuntime:
         return None
     
     def _evaluate_condition(self, condition: str, context: Dict[str, Any], guard: bool = False) -> bool:
-        """Evaluate a condition string using databinding"""
-        if not condition:
-            return False
-
-        # Evaluate the condition as an expression, without interpolating any
-        # values into it first. Stripping the braces leaves the variable NAMES
-        # in place for the evaluator to resolve, so no value is ever parsed as
-        # syntax — unlike the databinding-then-evaluate path below, which
-        # assembles code out of data. Same change as HTMLRenderer.
-        stripped = self._databinding_pattern.sub(lambda m: m.group(1), condition).strip()
-
-        # IF-2: `1` and `{1}` are the number 1, true. There used to be a
-        # regex-quantifier check here that made every such condition false;
-        # a condition is never a regex, and HTMLRenderer never had the check.
-        try:
-            return bool(self._expressions.evaluate(stripped, context or {}, absent_scope_key_is_none=True))
-        except UndefinedError as exc:
-            if guard:
-                # AUTH-6: a guard decides whether the page (and its actions)
-                # may run. Reading a failure as false lets everything through,
-                # so in a guard it is an error: the page fails closed.
-                raise ExpressionError(
-                    f"guard condition {condition!r} could not be evaluated: {exc}. A guard "
-                    f"must decide; test each part first, e.g. "
-                    f"`not session.user or not session.user.is_admin`") from exc
-            # EXPR-5: a condition is a presence test. A name, key or attribute
-            # that does not exist makes it FALSE (never true, see below).
-            # Anything else — a syntax error, a function that does not exist —
-            # propagates as an error: reading those as false is how
-            # `age >= 18 && ok` took the else branch for every input.
-            #
-            #
-            # It used to fall through to a chain that interpolated the variable
-            # VALUES into the text and took the truthiness of the result. For a
-            # condition like `session.user.is_admin` on a logged-out request
-            # that produced the literal string 'session.user.is_admin', which
-            # is non-empty and therefore truthy — so the q:if fired its admin
-            # branch and its q:else never did. A condition failing open is an
-            # authorization bypass by construction. Reported by two audit
-            # dimensions, reproduced directly, and the same fix as HTMLRenderer.
-            #
-            # That fallback chain also fed ExpressionCache's compile()+eval(),
-            # whose regex denylist is bypassable by splitting a dunder across
-            # adjacent string literals — so removing it closes a latent RCE
-            # path as well as the fail-open.
-            report_unresolved(stripped, ExpressionError(
-                f"condition {condition!r} could not be evaluated; treated as false"
-            ))
-            return False
-        except ExpressionError as exc:
-            raise ExpressionError(f"condition {condition!r} could not be evaluated: {exc}") from exc
+        """A condition by the language's rules — see quantum/runtime/conditions.py."""
+        return evaluate_condition(self._expressions, condition, context, guard=guard)
 
     def _apply_databinding(self, text: str, context: Dict[str, Any]) -> Any:
         """Apply variable databinding to text using {variable} syntax.
@@ -839,7 +791,31 @@ class ComponentRuntime:
         finally:
             self.execution_context = previous_context
 
-        return as_return_value(result)
+        return self._check_return_type(func_node, as_return_value(result))
+
+    def _check_return_type(self, func_node: FunctionNode, valor: Any) -> Any:
+        """FN-4: the value a q:function returns matches its returnType.
+
+        returnType= was accepted and never read: returnType="number" returned
+        whatever the body produced.
+        """
+        tipo = (getattr(func_node, 'return_type', None) or 'any').lower()
+        if tipo == 'any':
+            return valor
+        if tipo == 'void':
+            if valor is not None:
+                raise ComponentExecutionError(
+                    f'q:function "{func_node.name}" declares returnType="void" but returned {valor!r}')
+            return valor
+        if valor is None:
+            raise ComponentExecutionError(
+                f'q:function "{func_node.name}" declares returnType="{tipo}" but returned nothing')
+        from types import SimpleNamespace
+        convertido, erro = param_validation.coerce(SimpleNamespace(type=tipo, name=func_node.name), valor)
+        if erro:
+            raise ComponentExecutionError(
+                f'q:function "{func_node.name}" declares returnType="{tipo}" but returned {valor!r}')
+        return convertido
 
     def _validate_function_args(self, func_node: FunctionNode, args: Dict[str, Any], only=None):
         """validate=/range=/enum= rules of the q:param (QuantumValidators)."""

quantum_framework-0.14.0/quantum/runtime/conditions.py

@@ -0,0 +1,54 @@
+"""The one place a `condition` is evaluated (q:if, q:elseif, guards).
+
+ComponentRuntime (statements) and HTMLRenderer (markup) each had their own
+copy of this function. They drifted: IF-2 (`condition="1"` was false) existed
+in one and not the other. Both call this now.
+"""
+
+import re
+from typing import Any, Dict
+
+from quantum.core.expression_diagnostics import report_unresolved
+from quantum.core.expressions import ExpressionError, ExpressionEvaluator, UndefinedError
+
+_BRACES = re.compile(r'\{([^}]+)\}')
+
+
+def evaluate_condition(evaluator: ExpressionEvaluator, condition: str,
+                       variables: Dict[str, Any], guard: bool = False) -> bool:
+    """True or False for a condition, by the rules of SPEC IF-2, EXPR-5, EXPR-8, AUTH-6.
+
+    The condition is evaluated as an expression with the braces stripped:
+    the variable NAMES stay in place for the evaluator to resolve, so no
+    value is ever parsed as syntax. (It used to interpolate the values into
+    the text and eval() the result — code assembled out of data; a record
+    named "'; __import__(...)" became executable. PUBLIC_RELEASE_PLAN P0.1.)
+    """
+    if not condition:
+        return False
+    stripped = _BRACES.sub(lambda m: m.group(1), condition).strip()
+    try:
+        # EXPR-8: a key a scope does not have (session.userId before login)
+        # is None here, so `not session.authenticated` is true for a visitor.
+        return bool(evaluator.evaluate(stripped, variables or {}, absent_scope_key_is_none=True))
+    except UndefinedError as exc:
+        if guard:
+            # AUTH-6: a guard decides whether the page and its actions run.
+            # Reading a failure as false would let everything through, so in
+            # a guard it is an error: the page fails closed.
+            raise ExpressionError(
+                f"guard condition {condition!r} could not be evaluated: {exc}. A guard "
+                f"must decide; test each part first, e.g. "
+                f"`not session.user or not session.user.is_admin`") from exc
+        # EXPR-5: a condition is a presence test — a missing name, key or
+        # attribute makes it FALSE, never true. Before, the literal
+        # placeholder 'session.user.is_admin' came back as a non-empty string,
+        # read as true: the admin branch rendered for a logged-out visitor.
+        report_unresolved(stripped, ExpressionError(
+            f"condition {condition!r} could not be evaluated; treated as false"))
+        return False
+    except ExpressionError as exc:
+        # A syntax error or a function that does not exist is an error:
+        # reading it as false is how `age >= 18 && ok` took the else branch
+        # for every input.
+        raise ExpressionError(f"condition {condition!r} could not be evaluated: {exc}") from exc

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/runtime/logging_setup.py

@@ -84,14 +84,15 @@ def setup_logging(config: Dict[str, Any]) -> logging.Logger:
     logger.handlers.clear()
 
     datefmt = '%Y-%m-%d %H:%M:%S'
-    plain_fmt = '%(asctime)s %(levelname)-8s %(name)s - %(message)s'
+    # CFG-3: logging.format was documented here and never read.
+    plain_fmt = log_config.get('format') or '%(asctime)s %(levelname)-8s %(name)s - %(message)s'
 
     # Console handler with color support
     if enable_console:
         console_handler = logging.StreamHandler(sys.stderr)
         console_handler.setLevel(level)
         use_color = _supports_color()
-        colored_fmt = '%(asctime)s %(levelname)s %(name)s - %(message)s'
+        colored_fmt = log_config.get('format') or '%(asctime)s %(levelname)s %(name)s - %(message)s'
         formatter = ColoredFormatter(colored_fmt, datefmt=datefmt, use_color=use_color)
         console_handler.setFormatter(formatter)
         logger.addHandler(console_handler)

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/runtime/param_validation.py

@@ -45,6 +45,9 @@ FILE_TYPES = ('file', 'binary', 'upload')
 # receber como veio.
 PASSTHROUGH_TYPES = ('string', 'text', 'array', 'object', 'any', 'json')
 
+# FN-4: what q:function returnType= accepts ('void': returns nothing).
+RETURN_TYPES = frozenset(INT_TYPES + FLOAT_TYPES + PASSTHROUGH_TYPES + ('boolean', 'email', 'url', 'void'))
+
 _EMAIL = re.compile(r'^[^@\s]+@[^@\s]+\.[^@\s]+$')
 _URL = re.compile(r'^https?://', re.IGNORECASE)
 
@@ -128,9 +131,13 @@ def check_rules(param_def, value: Any) -> List[str]:
     errors: List[str] = []
     name = getattr(param_def, 'name', '?')
 
-    # Nada de comprimento, faixa ou padrao faz sentido sobre um arquivo; as
-    # regras de upload sao maxsize/accept, que o q:file aplica.
+    # Nada de comprimento, faixa ou padrao faz sentido sobre um arquivo. O que
+    # vale para um upload e accept= (ACT-11).
     if is_uploaded_file(value):
+        accept = getattr(param_def, 'accept', None)
+        if accept and not accepts_file(value, accept):
+            errors.append(f"Parameter '{name}' accepts {accept}; got "
+                          f"'{getattr(value, 'filename', '')}'")
         return errors
 
     minimo = getattr(param_def, 'min', None)
@@ -184,3 +191,28 @@ def check_rules(param_def, value: Any) -> List[str]:
                 f"Parameter '{name}' must be one of: {', '.join(allowed)}")
 
     return errors
+
+
+def accepts_file(upload, accept: str) -> bool:
+    """ACT-11: does an upload match an HTML-style accept list (".pdf", "image/*")?
+
+    The Content-Type an upload declares comes from the browser, so a MIME
+    pattern is matched against the type the FILE NAME implies as well: an
+    .exe sent as image/png does not pass image/*. An extension pattern is
+    matched against the file name.
+    """
+    import mimetypes
+    nome = (getattr(upload, 'filename', '') or '').lower()
+    pelo_nome = (mimetypes.guess_type(nome)[0] or '').lower()
+    declarado = (getattr(upload, 'content_type', '') or '').split(';')[0].strip().lower()
+    for item in (a.strip().lower() for a in accept.split(',') if a.strip()):
+        if item.startswith('.'):
+            if nome.endswith(item):
+                return True
+        elif item.endswith('/*'):
+            base = item[:-1]
+            if pelo_nome.startswith(base) and (not declarado or declarado.startswith(base)):
+                return True
+        elif pelo_nome == item and (not declarado or declarado == item):
+            return True
+    return False

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/runtime/renderer.py

@@ -27,6 +27,7 @@ from quantum.core.features.conditionals.src.ast_node import IfNode
 from quantum.core.features.loops.src.ast_node import LoopNode
 from quantum.core.features.state_management.src.ast_node import SetNode
 from quantum.runtime.execution_context import ExecutionContext
+from quantum.runtime.conditions import evaluate_condition
 
 logger = logging.getLogger('quantum.renderer')
 
@@ -163,6 +164,15 @@ class HTMLRenderer:
         Returns:
             HTML string
         """
+        ui_tag = getattr(node, 'ui_tag', None)
+        if ui_tag:
+            # UI-0: until 0.15, ui:* is compiled from <q:application type="ui">
+            # (quantum run app.q --target html|textual|desktop). Served inside a
+            # page it came out as <window>/<vbox> tags no browser lays out.
+            raise ValueError(
+                f"<ui:{ui_tag}> cannot be used inside a page yet: ui:* elements are "
+                f"compiled from <q:application type=\"ui\"> with `quantum run app.q "
+                f"--target html`. Using them inside pages arrives in Quantum 0.15.")
 
         # Build opening tag
         tag_parts = [f'<{node.tag}']
@@ -422,44 +432,8 @@ class HTMLRenderer:
         return ''
 
     def _evaluate_condition(self, condition: str) -> bool:
-        """Evaluate a condition expression."""
-        if not condition:
-            return False
-
-        # Evaluate the condition as an expression, without interpolating any
-        # values into it first.
-        #
-        # This used to build a string by substituting databinding results into
-        # the condition and then eval() it. That is not a comparison, it is
-        # code assembly from data: a record whose name is "'; __import__(...)"
-        # became executable code. Stripping the braces instead leaves the
-        # variable NAMES in place and lets the evaluator resolve them, so no
-        # value is ever parsed as syntax. PUBLIC_RELEASE_PLAN.md P0.1.
-        stripped = re.sub(r'\{([^}]+)\}', r'\1', condition).strip()
-        try:
-            return bool(self._expressions.evaluate(
-                stripped, self.context.get_all_variables(), absent_scope_key_is_none=True
-            ))
-        except UndefinedError:
-            # EXPR-5: a missing name, key or attribute makes a condition FALSE,
-            # not true. Other failures raise (see ComponentRuntime).
-            #
-            #
-            # This used to fall through to _apply_databinding, which hands back
-            # the literal placeholder '{session.user.is_admin}' — a non-empty
-            # string, which the truthiness rule below then read as True. So
-            #     <q:if condition="session.user.is_admin">
-            # rendered its admin branch for a logged-out visitor whose session
-            # had no `user`, and every q:else guarding it never fired. A
-            # condition failing open is an authorization bypass by
-            # construction. Reported by two audit dimensions, reproduced
-            # directly. See tests/integration/test_condition_fails_closed.py.
-            report_unresolved(stripped, ExpressionError(
-                f"condition {condition!r} could not be evaluated; treated as false"
-            ))
-            return False
-        except ExpressionError as exc:
-            raise ExpressionError(f"condition {condition!r} could not be evaluated: {exc}") from exc
+        """A condition by the language's rules — see quantum/runtime/conditions.py."""
+        return evaluate_condition(self._expressions, condition, self.context.get_all_variables())
 
     def _render_comment(self, node: CommentNode) -> str:
         """

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/runtime/ui_builder.py

@@ -44,6 +44,13 @@ class UIBuilder:
         Returns:
             Generated source code string.
         """
+        if not isinstance(app, ApplicationNode) or getattr(app, 'app_type', None) != 'ui':
+            # UI-0: it used to fail with "'ComponentNode' object has no
+            # attribute 'app_id'".
+            raise UIBuildError(
+                'a UI build needs <q:application type="ui">; this file is a '
+                f'<q:{"component" if not isinstance(app, ApplicationNode) else "application"}>. '
+                'Wrap the ui:window in <q:application id="MyApp" type="ui">.')
         windows = getattr(app, 'ui_windows', [])
         ui_children = getattr(app, 'ui_children', [])
         title = app.app_id or 'Quantum UI'
@@ -97,13 +104,11 @@ class UIBuilder:
         code = self.build(app, target)
 
         if output_path is None:
-            if target == 'html':
-                ext = '.html'
-            elif target in ('mobile', 'react-native'):
-                ext = '.js'
-            else:
-                ext = '.py'
-            output_path = f"{app.app_id}{ext}"
+            # UI-0: one file per target. textual and desktop both wrote
+            # <id>.py, so building one erased the other.
+            sufixo = {'html': '.html', 'textual': '_console.py', 'desktop': '_desktop.py',
+                      'mobile': '.js', 'react-native': '.js'}.get(target, '.py')
+            output_path = f"{app.app_id}{sufixo}"
 
         path = Path(output_path)
         path.parent.mkdir(parents=True, exist_ok=True)

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum/runtime/web_server.py

@@ -74,6 +74,9 @@ _KNOWN_KEYS = {
     'security': {'secret_key', 'login_url', 'python_scripting', 'max_content_length',
                  'xss_protection'},
     'performance': {'cache_templates', 'cache_ttl', 'cache_max_size'},
+    'server': {'port', 'host', 'debug', 'reload'},
+    'paths': {'components', 'static', 'logs', 'uploads', 'migrations'},
+    'logging': {'level', 'format', 'console', 'file', 'filename'},
 }
 
 _DATASOURCE_KEYS = {'driver', 'type', 'database', 'host', 'port', 'username', 'user', 'password'}
@@ -220,11 +223,9 @@ class QuantumWebServer:
 
         self.parser = QuantumParser()
         self.template_cache: Dict[str, Any] = {}  # AST cache
-        # The runtime that executes q:action bodies needs the same config as
-        # the page render. Built with no config, it could not see the
-        # datasources declared in quantum.config.yaml: every q:query inside a
-        # q:action failed with "Datasource 'db' is not declared locally" —
-        # a form that writes to the database did not work at all.
+        # Flash helpers only (read/set the flash in the session). q:action
+        # bodies run in a runtime built for each request (ACT-10), never in a
+        # shared one.
         self.action_handler = ActionHandler(ComponentRuntime(config=self.config))
 
         # Phase F: Application scope (global state shared across all users)
@@ -620,9 +621,15 @@ class QuantumWebServer:
                         return self._page_redirect(r, guard_runtime)
                     session['quantum_session'] = guard_runtime.execution_context.session_vars
 
-                    # Handle action
+                    # Handle action — in THIS request's runtime (ACT-10). It
+                    # used to run in one ComponentRuntime shared by every
+                    # request and thread, which never registered the page's
+                    # q:functions: calling one inside an action was a 500.
+                    # guard_runtime has entered this component with this
+                    # request's scopes.
                     try:
-                        redirect_url, status_code = self.action_handler.handle_action(action_node, route_params=path_params)
+                        redirect_url, status_code = ActionHandler(guard_runtime).handle_action(
+                            action_node, route_params=path_params)
                     except PageRedirect as r:
                         # q:redirect reached through a q:function or q:loop in the action
                         return self._page_redirect(r)

{quantum_framework-0.13.0 → quantum_framework-0.14.0/quantum_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quantum-framework
-Version: 0.13.0
+Version: 0.14.0
 Summary: Full-stack declarative framework for building web, desktop, and mobile applications
 Author-email: Daniel Gregorio <danielgregorio2611@gmail.com>
 License: MIT
@@ -28,6 +28,7 @@ Provides-Extra: dev
 Requires-Dist: pytest>=7.4.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
 Requires-Dist: pytest-mock>=3.11.1; extra == "dev"
+Requires-Dist: pytest-xdist>=3.5; extra == "dev"
 Requires-Dist: black>=23.0.0; extra == "dev"
 Requires-Dist: ruff>=0.1.0; extra == "dev"
 Provides-Extra: db

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum_framework.egg-info/SOURCES.txt

@@ -73,7 +73,6 @@ quantum/core/features/logging/src/runtime.py
 quantum/core/features/loops/src/__init__.py
 quantum/core/features/loops/src/ast_node.py
 quantum/core/features/query/src/__init__.py
-quantum/core/features/query/src/database_service.py
 quantum/core/features/query/src/query_validators.py
 quantum/core/features/state_management/src/__init__.py
 quantum/core/features/state_management/src/ast_node.py
@@ -165,6 +164,7 @@ quantum/runtime/auth_service.py
 quantum/runtime/component.py
 quantum/runtime/component_composer.py
 quantum/runtime/component_resolver.py
+quantum/runtime/conditions.py
 quantum/runtime/database_service.py
 quantum/runtime/email_service.py
 quantum/runtime/error_handler.py

{quantum_framework-0.13.0 → quantum_framework-0.14.0}/quantum_framework.egg-info/requires.txt

@@ -19,6 +19,7 @@ pymysql>=1.1.0
 pytest>=7.4.0
 pytest-cov>=4.1.0
 pytest-mock>=3.11.1
+pytest-xdist>=3.5
 black>=23.0.0
 ruff>=0.1.0