quantum-framework 0.13.0__tar.gz → 0.15.0__tar.gz

{quantum_framework-0.13.0/quantum_framework.egg-info → quantum_framework-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quantum-framework
-Version: 0.13.0
+Version: 0.15.0
 Summary: Full-stack declarative framework for building web, desktop, and mobile applications
 Author-email: Daniel Gregorio <danielgregorio2611@gmail.com>
 License: MIT
@@ -28,6 +28,7 @@ Provides-Extra: dev
 Requires-Dist: pytest>=7.4.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
 Requires-Dist: pytest-mock>=3.11.1; extra == "dev"
+Requires-Dist: pytest-xdist>=3.5; extra == "dev"
 Requires-Dist: black>=23.0.0; extra == "dev"
 Requires-Dist: ruff>=0.1.0; extra == "dev"
 Provides-Extra: db

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "quantum-framework"
-version = "0.13.0"
+version = "0.15.0"
 description = "Full-stack declarative framework for building web, desktop, and mobile applications"
 readme = "README.md"
 license = {text = "MIT"}
@@ -35,6 +35,7 @@ dev = [
     "pytest>=7.4.0",
     "pytest-cov>=4.1.0",
     "pytest-mock>=3.11.1",
+    "pytest-xdist>=3.5",
     "black>=23.0.0",
     "ruff>=0.1.0",
 ]

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/cli/commands/migrate.py

@@ -32,7 +32,7 @@ class Migration:
     @property
     def content(self) -> str:
         if self._content is None:
-            self._content = self.path.read_text()
+            self._content = self.path.read_text(encoding="utf-8")  # DB-8: nunca a codificacao do sistema
         return self._content
 
     @property
@@ -167,6 +167,18 @@ class DatabaseConnection:
             self._conn.close()
 
 
+def _paths_migrations(project_path: Path) -> str:
+    """CFG-3: paths.migrations in quantum.config.yaml (default ./migrations)."""
+    try:
+        import yaml
+        from quantum.core.config_env import expand_env
+        with open(project_path / "quantum.config.yaml", encoding="utf-8") as f:
+            config = expand_env(yaml.safe_load(f) or {})
+        return (config.get("paths") or {}).get("migrations") or "migrations"
+    except (OSError, ValueError, AttributeError):
+        return "migrations"
+
+
 class MigrationRunner:
     """Runs database migrations"""
 
@@ -174,7 +186,7 @@ class MigrationRunner:
 
     def __init__(self, project_path: Path = None, datasource: str = None):
         self.project_path = project_path or Path.cwd()
-        self.migrations_dir = self.project_path / "migrations"
+        self.migrations_dir = self.project_path / _paths_migrations(self.project_path)
         self.db = DatabaseConnection(self.project_path, datasource)
 
     def _ensure_migrations_table(self):
@@ -366,7 +378,7 @@ class MigrationRunner:
                 click.echo(f"Rolling back {version}: {migration_info['name']}...")
 
                 # Execute rollback SQL
-                self.db.execute_script(down_file.read_text())
+                self.db.execute_script(down_file.read_text(encoding="utf-8"))
 
                 # Remove migration record
                 self._remove_migration_record(version)

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/cli/commands/new.py

@@ -443,7 +443,7 @@ def _create_api_template(project_dir: Path, project_name: str) -> None:
 
     # Update config for API
     config_path = project_dir / 'quantum.config.yaml'
-    config = config_path.read_text()
+    config = config_path.read_text(encoding="utf-8")
     config = config.replace('type: api', 'type: microservices')
     config_path.write_text(config)
 

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/cli/deploy.py

@@ -114,7 +114,7 @@ class QuantumDeployer:
         """Load configuration from file."""
         config_file = Path(config_path)
         if config_file.exists():
-            with open(config_file) as f:
+            with open(config_file, encoding='utf-8') as f:
                 return yaml.safe_load(f) or {}
         return {}
 

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/cli/mq.py

@@ -353,7 +353,7 @@ def _handle_mq_publish(broker, args) -> int:
 
     # Get message body
     if args.file:
-        with open(args.file, 'r') as f:
+        with open(args.file, 'r', encoding='utf-8') as f:
             body = f.read()
     elif args.message:
         body = args.message
@@ -388,7 +388,7 @@ def _handle_mq_send(broker, args) -> int:
 
     # Get message body
     if args.file:
-        with open(args.file, 'r') as f:
+        with open(args.file, 'r', encoding='utf-8') as f:
             body = f.read()
     elif args.message:
         body = args.message

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/cli/runner.py

@@ -285,6 +285,7 @@ Examples:
   quantum start                    # Start web server (magic!)
   quantum run hello.q              # Execute component
   quantum admin                    # Start the Quantum Admin
+  quantum console                  # The application's pages in the terminal
   quantum run game.q --engine godot # Build Godot 4 project
   quantum run backup-job.q         # Execute job
   quantum deploy ./my-app          # Deploy application
@@ -335,6 +336,11 @@ Examples:
     # Stop command
     subparsers.add_parser('stop', help='Stop running web server')
 
+    # Console: the application's pages in the terminal (UI-3)
+    console_parser = subparsers.add_parser('console', help="Open the application's pages in the terminal")
+    console_parser.add_argument('path', nargs='?', default='/', help='Page to open (default: /)')
+    console_parser.add_argument('--config', default='quantum.config.yaml', help='Config file')
+
     # Admin command (the screens need the [admin] extra; checked when run)
     from quantum.cli.admin import create_admin_parser
     create_admin_parser(subparsers)
@@ -401,6 +407,10 @@ Examples:
                 traceback.print_exc()
             sys.exit(1)
 
+    elif args.command == 'console':
+        from quantum.runtime.ui_console import run_console
+        sys.exit(run_console(args.config, args.path))
+
     elif args.command == 'admin':
         from quantum.cli.admin import handle_admin
         sys.exit(handle_admin(args))

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/cli/utils.py

@@ -307,7 +307,7 @@ def get_quantum_version() -> str:
         # Try to read from version file
         version_file = Path(__file__).parent.parent / '__version__.py'
         if version_file.exists():
-            content = version_file.read_text()
+            content = version_file.read_text(encoding="utf-8")
             # Parse version = "x.y.z"
             for line in content.splitlines():
                 if line.startswith('version'):

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/core/features/ui_engine/src/ast_nodes.py

@@ -33,6 +33,11 @@ class UILayoutMixin:
         self.ui_id: Optional[str] = None
         self.ui_class: Optional[str] = None
         self.visible: Optional[str] = None
+        # UI-2: responsive layout, declared (sm < 640 px, md < 768 px, lg < 1024 px)
+        self.stack_below: Optional[str] = None   # hbox side by side, stacked below the breakpoint
+        self.hide_below: Optional[str] = None
+        self.hide_above: Optional[str] = None
+        self.grow: Optional[str] = None          # "true": takes the room left in its row
 
     def _layout_to_dict(self) -> Dict[str, Any]:
         """Return layout attributes as dict (for to_dict)."""
@@ -1852,3 +1857,8 @@ class UIDatePickerNode(QuantumNode, UILayoutMixin):
 
     def validate(self) -> List[str]:
         return self._validate_layout()
+
+
+def is_ui_node(node) -> bool:
+    """A ui:* element (UI-1): markup, drawn by a renderer, never executed."""
+    return type(node).__module__ == __name__

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/core/features/ui_engine/src/parser.py

@@ -41,13 +41,16 @@ class UIParseError(Exception):
 class UIParser:
     """Parser for ui: namespace UI elements."""
 
-    def __init__(self, parent_parser):
+    def __init__(self, parent_parser, page_mode: bool = False):
         """
         Args:
             parent_parser: The main QuantumParser instance, used to parse
                            q: namespace children (q:set, q:function, q:if, etc.)
         """
         self.parent = parent_parser
+        # UI-1: inside a served page, HTML children are content too. In a
+        # <q:application type="ui"> build they were (and stay) ignored.
+        self.page_mode = page_mode
 
     # ------------------------------------------------------------------
     # Dispatch
@@ -130,7 +133,10 @@ class UIParser:
         """Dispatch a ui: element to the correct parse method."""
         method_name = self.UI_TAG_MAP.get(local_name)
         if method_name is None:
-            raise UIParseError(f"Unknown UI tag: ui:{local_name}")
+            import difflib
+            parecidas = difflib.get_close_matches(local_name, self.UI_TAG_MAP, n=1)
+            dica = f"; did you mean <ui:{parecidas[0]}>?" if parecidas else ""
+            raise UIParseError(f"Unknown UI tag: <ui:{local_name}>{dica}")
         method = getattr(self, method_name)
         return method(element)
 
@@ -190,6 +196,14 @@ class UIParser:
         node.ui_id = element.get('id')
         node.ui_class = element.get('class')
         node.visible = element.get('visible')
+        # UI-2: responsive attributes; a breakpoint is sm, md or lg.
+        for attr, campo in (('stack-below', 'stack_below'), ('hide-below', 'hide_below'),
+                            ('hide-above', 'hide_above')):
+            valor = element.get(attr)
+            if valor is not None and valor not in ('sm', 'md', 'lg'):
+                raise UIParseError(f'{attr}="{valor}": use sm (640 px), md (768 px) or lg (1024 px)')
+            setattr(node, campo, valor)
+        node.grow = element.get('grow')
 
     # ------------------------------------------------------------------
     # Animation attributes helper
@@ -233,7 +247,7 @@ class UIParser:
 
         if ns == 'ui':
             return self.parse_ui_element(local, child)
-        elif ns == 'quantum':
+        elif ns == 'quantum' or self.page_mode:
             return self.parent._parse_statement(child)
         return None
 
@@ -319,6 +333,7 @@ class UIParser:
     def _parse_ui_form(self, element: ET.Element) -> UIFormNode:
         node = UIFormNode()
         node.on_submit = element.get('on-submit')
+        node.send = element.get('with')
 
         # Validation attributes
         node.validation_mode = element.get('validation', 'both')
@@ -380,6 +395,7 @@ class UIParser:
         node = UIButtonNode()
         node.content = (element.text or '').strip()
         node.on_click = element.get('on-click')
+        node.send = element.get('with')
         node.variant = element.get('variant')
         node.disabled = self._parse_bool(element.get('disabled'))
         self._apply_layout_attrs(node, element)

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/core/parser.py

@@ -62,6 +62,7 @@ from quantum.core.features.testing_engine.src.ast_nodes import (
     AuthNode as TestingAuthNode,
 )
 from quantum.core.features.ui_engine.src.parser import UIParser, UIParseError
+from quantum.core.features.ui_engine.src.ast_nodes import is_ui_node
 from quantum.core.features.ui_engine.src.ast_nodes import UIWindowNode
 from quantum.core.features.theming.src import UIThemeNode
 from quantum.core.parser_registry import ParserRegistry
@@ -575,10 +576,12 @@ class QuantumParser:
 
         # Parse component-level attributes
         component.port = root.get('port')
-        component.base_path = root.get('basePath')
-        component.health_endpoint = root.get('health')
-        component.metrics_provider = root.get('metrics')
-        component.trace_provider = root.get('trace')
+        # A2: accepted and never read by anything — refused, like FN-2/DB-5.
+        for attr in ('basePath', 'health', 'metrics', 'trace'):
+            if root.get(attr) is not None:
+                raise QuantumParseError(
+                    f'<q:component name="{name}"> {attr}= is not supported: it was accepted '
+                    f'and never did anything.')
 
         # Phase G: Authentication & Security attributes
         require_auth_attr = root.get('require_auth', 'false').lower()
@@ -704,8 +707,8 @@ class QuantumParser:
                 return corpo + list(node.else_body)
             if isinstance(node, LoopNode):
                 return list(node.body)
-            if isinstance(node, (HTMLNode, ComponentCallNode)):
-                return list(node.children or [])
+            if isinstance(node, (HTMLNode, ComponentCallNode)) or is_ui_node(node):
+                return list(getattr(node, 'children', None) or [])
             return []
 
         def renderiza(nodes):
@@ -713,7 +716,7 @@ class QuantumParser:
                 if isinstance(node, TextNode):
                     if node.content.strip():
                         return True
-                elif isinstance(node, (HTMLNode, ComponentCallNode)):
+                elif isinstance(node, (HTMLNode, ComponentCallNode)) or is_ui_node(node):
                     return True
                 elif isinstance(node, (IfNode, LoopNode)) and renderiza(filhos(node)):
                     return True
@@ -750,7 +753,7 @@ class QuantumParser:
 
         def andar(nodes, onde):
             for node in nodes:
-                if not isinstance(node, self._RENDERED):
+                if not isinstance(node, self._RENDERED) and not is_ui_node(node):
                     if onde and onde[0] == 'markup':
                         raise QuantumParseError(
                             f'{tag(node)} inside {onde[1]} in <q:component name="{component.name}"> '
@@ -768,6 +771,9 @@ class QuantumParser:
                     continue
                 if isinstance(node, HTMLNode):
                     andar(filhos(node), onde if onde and onde[0] == 'markup' else ('markup', f'<{node.tag}>'))
+                elif is_ui_node(node):
+                    rotulo = f'<ui:{type(node).__name__[2:-4].lower()}>'
+                    andar(filhos(node), onde if onde and onde[0] == 'markup' else ('markup', rotulo))
                 elif isinstance(node, ComponentCallNode):
                     andar(filhos(node), onde if onde and onde[0] == 'markup'
                           else ('markup', f'the content of <{node.component_name}>'))
@@ -835,6 +841,15 @@ class QuantumParser:
         # === MODULAR PARSER REGISTRY (no fallback) ===
         # PHASE 1 DIAGNOSTIC: Legacy fallback disabled to test modular coverage
         if self._use_modular_parsers and self._parser_registry:
+            # UI-1: a ui:* element inside a page is a UI node, drawn by
+            # UIPageRenderer with the page's runtime doing the logic. First,
+            # before the registry: ui:button would otherwise be the HTML <button>.
+            if self._get_element_ui_namespace(element) == 'ui':
+                try:
+                    return UIParser(self, page_mode=True).parse_ui_element(element_type, element)
+                except UIParseError as exc:
+                    raise QuantumParseError(str(exc)) from exc
+
             # PARSE-1: <q:html>, <q:div> — an HTML element name in the q:
             # namespace. The registry answered for it with the HTML parser, so
             # <q:html value="{post.content}"/> became an empty <html> element
@@ -1235,9 +1250,16 @@ class QuantumParser:
             type=element.get('type', 'string'),
             required=element.get('required', 'false').lower() == 'true',
             default=element.get('default'),
-            validation=element.get('validation'),
             description=element.get('description')
         )
+        if element.get('validation') is not None:
+            # A2: accepted and never read. The rules are validate=, type=,
+            # pattern=, min/max, minlength/maxlength and enum=.
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:param name="{element.get("name", "")}"> validation= is not supported: it was '
+                f'accepted and never did anything. Use type=, pattern=, min/max, '
+                f'minlength/maxlength or enum=.')
 
         # REST-specific
         param.source = element.get('source', 'auto')

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/core/parsers/control_flow/set_parser.py

@@ -53,7 +53,12 @@ class SetParser(BaseTagParser):
         set_node.nullable = self.get_bool_attr(element, 'nullable', True)
         set_node.validate_rule = self.get_attr(element, 'validate')
         set_node.pattern = self.get_attr(element, 'pattern')
-        set_node.mask = self.get_attr(element, 'mask')
+        if element.get('mask') is not None:
+            # A2: accepted and never applied.
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:set name="{set_node.name}"> mask= is not supported: it was accepted and '
+                f'never did anything. To validate a format use pattern=.')
         set_node.range = self.get_attr(element, 'range')
         set_node.enum = self.get_attr(element, 'enum')
         set_node.unique = self.get_attr(element, 'unique')

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/core/parsers/data/invoke_parser.py

@@ -70,7 +70,12 @@ class InvokeParser(BaseTagParser):
 
         # Response handling
         invoke_node.response_format = self.get_attr(element, 'responseFormat', 'auto')
-        invoke_node.transform = self.get_attr(element, 'transform')
+        if element.get('transform') is not None:
+            # A2: accepted and never applied.
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:invoke name="{invoke_node.name}"> transform= is not supported: it was '
+                f'accepted and never did anything. Transform the result with q:set.')
         invoke_node.cache = self.get_bool_attr(element, 'cache', False)
         invoke_node.ttl = self.get_int_attr(element, 'ttl', 0) or None
         invoke_node.result = self.get_attr(element, 'result')

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/core/parsers/functions/function_parser.py

@@ -65,6 +65,13 @@ class FunctionParser(BaseTagParser):
 
         # Core attributes
         func_node.return_type = element.get('returnType', 'any')
+        # FN-4: returnType is checked on every return (see ComponentRuntime).
+        from quantum.runtime.param_validation import RETURN_TYPES
+        if func_node.return_type.lower() not in RETURN_TYPES:
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:function name="{name}"> returnType="{func_node.return_type}" is not a type; '
+                f'use one of: {", ".join(sorted(RETURN_TYPES))}')
         func_node.description = element.get('description')
         func_node.hint = element.get('hint')
 

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/core/parsers/functions/param_parser.py

@@ -29,9 +29,16 @@ class ParamParser(BaseTagParser):
             type=element.get('type', 'string'),
             required=element.get('required', 'false').lower() == 'true',
             default=element.get('default'),
-            validation=element.get('validation'),
             description=element.get('description')
         )
+        if element.get('validation') is not None:
+            # A2: accepted and never read. The rules are validate=, type=,
+            # pattern=, min/max, minlength/maxlength and enum=.
+            from quantum.core.parser import QuantumParseError
+            raise QuantumParseError(
+                f'<q:param name="{element.get("name", "")}"> validation= is not supported: it was '
+                f'accepted and never did anything. Use type=, pattern=, min/max, '
+                f'minlength/maxlength or enum=.')
 
         # REST-specific
         param.source = element.get('source', 'auto')

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/runtime/component.py

@@ -68,6 +68,8 @@ from quantum.runtime.executors.control_flow.loop_executor import (
     as_return_value, produced_return,
 )
 from quantum.runtime.service_container import ServiceContainer
+from quantum.runtime.conditions import evaluate_condition
+from quantum.core.features.ui_engine.src.ast_nodes import is_ui_node
 import re
 import logging
 
@@ -424,7 +426,8 @@ class ComponentRuntime:
             # and served a 500 the moment the legacy if-elif chain that used to
             # swallow it was removed.
             ComponentCallNode,
-        )):
+        )) or is_ui_node(statement):
+            # ui:* inside a page is markup (UI-1): the renderer draws it.
             return None
 
         # <q:return> aninhado dentro de q:if / q:else / q:loop. Nao tem
@@ -462,57 +465,8 @@ class ComponentRuntime:
         return None
     
     def _evaluate_condition(self, condition: str, context: Dict[str, Any], guard: bool = False) -> bool:
-        """Evaluate a condition string using databinding"""
-        if not condition:
-            return False
-
-        # Evaluate the condition as an expression, without interpolating any
-        # values into it first. Stripping the braces leaves the variable NAMES
-        # in place for the evaluator to resolve, so no value is ever parsed as
-        # syntax — unlike the databinding-then-evaluate path below, which
-        # assembles code out of data. Same change as HTMLRenderer.
-        stripped = self._databinding_pattern.sub(lambda m: m.group(1), condition).strip()
-
-        # IF-2: `1` and `{1}` are the number 1, true. There used to be a
-        # regex-quantifier check here that made every such condition false;
-        # a condition is never a regex, and HTMLRenderer never had the check.
-        try:
-            return bool(self._expressions.evaluate(stripped, context or {}, absent_scope_key_is_none=True))
-        except UndefinedError as exc:
-            if guard:
-                # AUTH-6: a guard decides whether the page (and its actions)
-                # may run. Reading a failure as false lets everything through,
-                # so in a guard it is an error: the page fails closed.
-                raise ExpressionError(
-                    f"guard condition {condition!r} could not be evaluated: {exc}. A guard "
-                    f"must decide; test each part first, e.g. "
-                    f"`not session.user or not session.user.is_admin`") from exc
-            # EXPR-5: a condition is a presence test. A name, key or attribute
-            # that does not exist makes it FALSE (never true, see below).
-            # Anything else — a syntax error, a function that does not exist —
-            # propagates as an error: reading those as false is how
-            # `age >= 18 && ok` took the else branch for every input.
-            #
-            #
-            # It used to fall through to a chain that interpolated the variable
-            # VALUES into the text and took the truthiness of the result. For a
-            # condition like `session.user.is_admin` on a logged-out request
-            # that produced the literal string 'session.user.is_admin', which
-            # is non-empty and therefore truthy — so the q:if fired its admin
-            # branch and its q:else never did. A condition failing open is an
-            # authorization bypass by construction. Reported by two audit
-            # dimensions, reproduced directly, and the same fix as HTMLRenderer.
-            #
-            # That fallback chain also fed ExpressionCache's compile()+eval(),
-            # whose regex denylist is bypassable by splitting a dunder across
-            # adjacent string literals — so removing it closes a latent RCE
-            # path as well as the fail-open.
-            report_unresolved(stripped, ExpressionError(
-                f"condition {condition!r} could not be evaluated; treated as false"
-            ))
-            return False
-        except ExpressionError as exc:
-            raise ExpressionError(f"condition {condition!r} could not be evaluated: {exc}") from exc
+        """A condition by the language's rules — see quantum/runtime/conditions.py."""
+        return evaluate_condition(self._expressions, condition, context, guard=guard)
 
     def _apply_databinding(self, text: str, context: Dict[str, Any]) -> Any:
         """Apply variable databinding to text using {variable} syntax.
@@ -839,7 +793,31 @@ class ComponentRuntime:
         finally:
             self.execution_context = previous_context
 
-        return as_return_value(result)
+        return self._check_return_type(func_node, as_return_value(result))
+
+    def _check_return_type(self, func_node: FunctionNode, valor: Any) -> Any:
+        """FN-4: the value a q:function returns matches its returnType.
+
+        returnType= was accepted and never read: returnType="number" returned
+        whatever the body produced.
+        """
+        tipo = (getattr(func_node, 'return_type', None) or 'any').lower()
+        if tipo == 'any':
+            return valor
+        if tipo == 'void':
+            if valor is not None:
+                raise ComponentExecutionError(
+                    f'q:function "{func_node.name}" declares returnType="void" but returned {valor!r}')
+            return valor
+        if valor is None:
+            raise ComponentExecutionError(
+                f'q:function "{func_node.name}" declares returnType="{tipo}" but returned nothing')
+        from types import SimpleNamespace
+        convertido, erro = param_validation.coerce(SimpleNamespace(type=tipo, name=func_node.name), valor)
+        if erro:
+            raise ComponentExecutionError(
+                f'q:function "{func_node.name}" declares returnType="{tipo}" but returned {valor!r}')
+        return convertido
 
     def _validate_function_args(self, func_node: FunctionNode, args: Dict[str, Any], only=None):
         """validate=/range=/enum= rules of the q:param (QuantumValidators)."""

quantum_framework-0.15.0/quantum/runtime/conditions.py

@@ -0,0 +1,54 @@
+"""The one place a `condition` is evaluated (q:if, q:elseif, guards).
+
+ComponentRuntime (statements) and HTMLRenderer (markup) each had their own
+copy of this function. They drifted: IF-2 (`condition="1"` was false) existed
+in one and not the other. Both call this now.
+"""
+
+import re
+from typing import Any, Dict
+
+from quantum.core.expression_diagnostics import report_unresolved
+from quantum.core.expressions import ExpressionError, ExpressionEvaluator, UndefinedError
+
+_BRACES = re.compile(r'\{([^}]+)\}')
+
+
+def evaluate_condition(evaluator: ExpressionEvaluator, condition: str,
+                       variables: Dict[str, Any], guard: bool = False) -> bool:
+    """True or False for a condition, by the rules of SPEC IF-2, EXPR-5, EXPR-8, AUTH-6.
+
+    The condition is evaluated as an expression with the braces stripped:
+    the variable NAMES stay in place for the evaluator to resolve, so no
+    value is ever parsed as syntax. (It used to interpolate the values into
+    the text and eval() the result — code assembled out of data; a record
+    named "'; __import__(...)" became executable. PUBLIC_RELEASE_PLAN P0.1.)
+    """
+    if not condition:
+        return False
+    stripped = _BRACES.sub(lambda m: m.group(1), condition).strip()
+    try:
+        # EXPR-8: a key a scope does not have (session.userId before login)
+        # is None here, so `not session.authenticated` is true for a visitor.
+        return bool(evaluator.evaluate(stripped, variables or {}, absent_scope_key_is_none=True))
+    except UndefinedError as exc:
+        if guard:
+            # AUTH-6: a guard decides whether the page and its actions run.
+            # Reading a failure as false would let everything through, so in
+            # a guard it is an error: the page fails closed.
+            raise ExpressionError(
+                f"guard condition {condition!r} could not be evaluated: {exc}. A guard "
+                f"must decide; test each part first, e.g. "
+                f"`not session.user or not session.user.is_admin`") from exc
+        # EXPR-5: a condition is a presence test — a missing name, key or
+        # attribute makes it FALSE, never true. Before, the literal
+        # placeholder 'session.user.is_admin' came back as a non-empty string,
+        # read as true: the admin branch rendered for a logged-out visitor.
+        report_unresolved(stripped, ExpressionError(
+            f"condition {condition!r} could not be evaluated; treated as false"))
+        return False
+    except ExpressionError as exc:
+        # A syntax error or a function that does not exist is an error:
+        # reading it as false is how `age >= 18 && ok` took the else branch
+        # for every input.
+        raise ExpressionError(f"condition {condition!r} could not be evaluated: {exc}") from exc

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/runtime/executors/control_flow/if_executor.py

@@ -5,6 +5,7 @@ Handles conditional execution with elseif and else blocks.
 """
 
 from typing import Any, List, Dict, Type
+from quantum.core.features.ui_engine.src.ast_nodes import is_ui_node
 from quantum.runtime.executors.base import BaseExecutor, ExecutorError
 from quantum.runtime.executors.control_flow.loop_executor import produced_return
 from quantum.core.features.conditionals.src.ast_node import IfNode
@@ -84,7 +85,7 @@ class IfExecutor(BaseExecutor):
         for statement in statements:
             if isinstance(statement, QuantumReturn):
                 return self.resolve_value(statement.value, context)
-            elif isinstance(statement, _RENDER_ONLY_NODE_TYPES):
+            elif (isinstance(statement, _RENDER_ONLY_NODE_TYPES) or is_ui_node(statement)):
                 continue
             else:
                 # Use registry to execute child statements

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/runtime/executors/control_flow/loop_executor.py

@@ -6,6 +6,7 @@ Handles all loop types: range, array, list, query.
 
 from typing import Any, List, Dict, Type
 import json
+from quantum.core.features.ui_engine.src.ast_nodes import is_ui_node
 from quantum.runtime.executors.base import BaseExecutor, ExecutorError
 from quantum.core.features.loops.src.ast_node import LoopNode
 from quantum.core.features.conditionals.src.ast_node import IfNode
@@ -244,7 +245,7 @@ class LoopExecutor(BaseExecutor):
         """Execute a statement inside a loop body"""
         if isinstance(statement, QuantumReturn):
             return self.resolve_value(statement.value, context)
-        elif isinstance(statement, _RENDER_ONLY_NODE_TYPES):
+        elif (isinstance(statement, _RENDER_ONLY_NODE_TYPES) or is_ui_node(statement)):
             # Text/HTML content is handled by HTMLRenderer._render_loop(),
             # which independently re-iterates and renders the body — it is
             # not meant to be executed here.

{quantum_framework-0.13.0 → quantum_framework-0.15.0}/quantum/runtime/logging_setup.py

@@ -84,14 +84,15 @@ def setup_logging(config: Dict[str, Any]) -> logging.Logger:
     logger.handlers.clear()
 
     datefmt = '%Y-%m-%d %H:%M:%S'
-    plain_fmt = '%(asctime)s %(levelname)-8s %(name)s - %(message)s'
+    # CFG-3: logging.format was documented here and never read.
+    plain_fmt = log_config.get('format') or '%(asctime)s %(levelname)-8s %(name)s - %(message)s'
 
     # Console handler with color support
     if enable_console:
         console_handler = logging.StreamHandler(sys.stderr)
         console_handler.setLevel(level)
         use_color = _supports_color()
-        colored_fmt = '%(asctime)s %(levelname)s %(name)s - %(message)s'
+        colored_fmt = log_config.get('format') or '%(asctime)s %(levelname)s %(name)s - %(message)s'
         formatter = ColoredFormatter(colored_fmt, datefmt=datefmt, use_color=use_color)
         console_handler.setFormatter(formatter)
         logger.addHandler(console_handler)